klmp200/Sith
1
0
Fork 0
mirror of https://github.com/ae-utbm/sith.git synced 2025-07-12 21:09:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: klmp200:dependabot/pip/taiste/redis-hiredis--gte-5.3.0-and-lt-7.0.0
Branches Tags
klmp200:master klmp200:gh-pages klmp200:taiste klmp200:promo_add_tool klmp200:room-reservation klmp200:refactor-election klmp200:edt klmp200:ia-explanation klmp200:galaxy klmp200:invoice_calls_validation klmp200:dependabot/pip/taiste/redis-hiredis--gte-5.3.0-and-lt-7.0.0 klmp200:photos klmp200:dependabot/npm_and_yarn/vite-6.2.6 klmp200:openapi klmp200:ts-album-fix klmp200:docker klmp200:windows-update klmp200:trombi klmp200:counter-activity-stats klmp200:fix/license klmp200:features/migrate-from-xapian-to-elasticsearch klmp200:feature/improved-header-buttons klmp200:feature/easy_switch_weekmail_banner
..
compare: klmp200:photos
Branches Tags
klmp200:gh-pages klmp200:taiste klmp200:promo_add_tool klmp200:master klmp200:room-reservation klmp200:refactor-election klmp200:edt klmp200:ia-explanation klmp200:galaxy klmp200:invoice_calls_validation klmp200:dependabot/pip/taiste/redis-hiredis--gte-5.3.0-and-lt-7.0.0 klmp200:photos klmp200:dependabot/npm_and_yarn/vite-6.2.6 klmp200:openapi klmp200:ts-album-fix klmp200:docker klmp200:windows-update klmp200:trombi klmp200:counter-activity-stats klmp200:fix/license klmp200:features/migrate-from-xapian-to-elasticsearch klmp200:feature/improved-header-buttons klmp200:feature/easy_switch_weekmail_banner

4 Commits
dependabot ... photos

Author SHA1 Message Date
imperosol
5788c1a8b3 WIP 2025-06-12 15:04:38 +02:00
imperosol
ca31584ce1 get_list_exact_or_404 util function 2025-06-12 15:04:38 +02:00
imperosol
30a8a9dc7c fix some tests 2025-06-12 15:04:38 +02:00
imperosol
2e2676fd1f Migrate albums and pictures to their own tables 2025-06-12 15:04:38 +02:00
106 changed files with 3963 additions and 3174 deletions
Expand all files Collapse all files

2
.pre-commit-config.yaml
View File

@ -1,7 +1,7 @@
repos:
- repo: https://github.com/astral-sh/ruff-pre-commit
# Ruff version.
rev: v0.11.13
rev: v0.11.11
hooks:
- id: ruff-check # just check the code, and print the errors
- id: ruff-check # actually fix the fixable errors, but print nothing

0
api/__init__.py
View File

55
api/admin.py
View File

@ -1,55 +0,0 @@
from django.contrib import admin, messages
from django.db.models import QuerySet
from django.http import HttpRequest
from django.utils.translation import gettext_lazy as _
from api.hashers import generate_key
from api.models import ApiClient, ApiKey
@admin.register(ApiClient)
class ApiClientAdmin(admin.ModelAdmin):
list_display = ("name", "owner", "created_at", "updated_at")
search_fields = (
"name",
"owner__first_name",
"owner__last_name",
"owner__nick_name",
)
autocomplete_fields = ("owner", "groups", "client_permissions")
@admin.register(ApiKey)
class ApiKeyAdmin(admin.ModelAdmin):
list_display = ("name", "client", "created_at", "revoked")
list_filter = ("revoked",)
date_hierarchy = "created_at"
readonly_fields = ("prefix", "hashed_key")
actions = ("revoke_keys",)
def save_model(self, request: HttpRequest, obj: ApiKey, form, change):
if not change:
key, hashed = generate_key()
obj.prefix = key[: ApiKey.PREFIX_LENGTH]
obj.hashed_key = hashed
self.message_user(
request,
_(
"The API key for %(name)s is: %(key)s. "
"Please store it somewhere safe: "
"you will not be able to see it again."
)
% {"name": obj.name, "key": key},
level=messages.WARNING,
)
return super().save_model(request, obj, form, change)
def get_readonly_fields(self, request, obj: ApiKey | None = None):
if obj is None or obj.revoked:
return ["revoked", *self.readonly_fields]
return self.readonly_fields
@admin.action(description=_("Revoke selected API keys"))
def revoke_keys(self, _request: HttpRequest, queryset: QuerySet[ApiKey]):
queryset.update(revoked=True)

6
api/apps.py
View File

@ -1,6 +0,0 @@
from django.apps import AppConfig
class ApiConfig(AppConfig):
default_auto_field = "django.db.models.BigAutoField"
name = "api"

20
api/auth.py
View File

@ -1,20 +0,0 @@
from django.http import HttpRequest
from ninja.security import APIKeyHeader
from api.hashers import get_hasher
from api.models import ApiClient, ApiKey
class ApiKeyAuth(APIKeyHeader):
param_name = "X-APIKey"
def authenticate(self, request: HttpRequest, key: str | None) -> ApiClient | None:
if not key or len(key) != ApiKey.KEY_LENGTH:
return None
hasher = get_hasher()
hashed_key = hasher.encode(key)
try:
key_obj = ApiKey.objects.get(revoked=False, hashed_key=hashed_key)
except ApiKey.DoesNotExist:
return None
return key_obj.client

43
api/hashers.py
View File

@ -1,43 +0,0 @@
import functools
import hashlib
import secrets
from django.contrib.auth.hashers import BasePasswordHasher
from django.utils.crypto import constant_time_compare
class Sha512ApiKeyHasher(BasePasswordHasher):
"""
An API key hasher using the sha256 algorithm.
This hasher shouldn't be used in Django's `PASSWORD_HASHERS` setting.
It is insecure for use in hashing passwords, but is safe for hashing
high entropy, randomly generated API keys.
"""
algorithm = "sha512"
def salt(self) -> str:
# No need for a salt on a high entropy key.
return ""
def encode(self, password: str, salt: str = "") -> str:
hashed = hashlib.sha512(password.encode()).hexdigest()
return f"{self.algorithm}$${hashed}"
def verify(self, password: str, encoded: str) -> bool:
encoded_2 = self.encode(password, "")
return constant_time_compare(encoded, encoded_2)
@functools.cache
def get_hasher():
return Sha512ApiKeyHasher()
def generate_key() -> tuple[str, str]:
"""Generate a [key, hash] couple."""
# this will result in key with a length of 72
key = str(secrets.token_urlsafe(54))
hasher = get_hasher()
return key, hasher.encode(key)

113
api/migrations/0001_initial.py
View File

@ -1,113 +0,0 @@
# Generated by Django 5.2 on 2025-06-01 08:53
import django.db.models.deletion
from django.conf import settings
from django.db import migrations, models
class Migration(migrations.Migration):
initial = True
dependencies = [
("auth", "0012_alter_user_first_name_max_length"),
("core", "0046_permissionrights"),
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
]
operations = [
migrations.CreateModel(
name="ApiClient",
fields=[
(
"id",
models.BigAutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
("name", models.CharField(max_length=64, verbose_name="name")),
("created_at", models.DateTimeField(auto_now_add=True)),
("updated_at", models.DateTimeField(auto_now=True)),
(
"client_permissions",
models.ManyToManyField(
blank=True,
help_text="Specific permissions for this api client.",
related_name="clients",
to="auth.permission",
verbose_name="client permissions",
),
),
(
"groups",
models.ManyToManyField(
blank=True,
related_name="api_clients",
to="core.group",
verbose_name="groups",
),
),
(
"owner",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="api_clients",
to=settings.AUTH_USER_MODEL,
verbose_name="owner",
),
),
],
options={
"verbose_name": "api client",
"verbose_name_plural": "api clients",
},
),
migrations.CreateModel(
name="ApiKey",
fields=[
(
"id",
models.BigAutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
("name", models.CharField(blank=True, default="", verbose_name="name")),
(
"prefix",
models.CharField(
editable=False, max_length=5, verbose_name="prefix"
),
),
(
"hashed_key",
models.CharField(
db_index=True,
editable=False,
max_length=136,
verbose_name="hashed key",
),
),
("revoked", models.BooleanField(default=False, verbose_name="revoked")),
("created_at", models.DateTimeField(auto_now_add=True)),
(
"client",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="api_keys",
to="api.apiclient",
verbose_name="api client",
),
),
],
options={
"verbose_name": "api key",
"verbose_name_plural": "api keys",
"permissions": [("revoke_apikey", "Revoke API keys")],
},
),
]

0
api/migrations/__init__.py
View File

94
api/models.py
View File

@ -1,94 +0,0 @@
from typing import Iterable
from django.contrib.auth.models import Permission
from django.db import models
from django.utils.translation import gettext_lazy as _
from django.utils.translation import pgettext_lazy
from core.models import Group, User
class ApiClient(models.Model):
name = models.CharField(_("name"), max_length=64)
owner = models.ForeignKey(
User,
verbose_name=_("owner"),
related_name="api_clients",
on_delete=models.CASCADE,
)
groups = models.ManyToManyField(
Group, verbose_name=_("groups"), related_name="api_clients", blank=True
)
client_permissions = models.ManyToManyField(
Permission,
verbose_name=_("client permissions"),
blank=True,
help_text=_("Specific permissions for this api client."),
related_name="clients",
)
created_at = models.DateTimeField(auto_now_add=True)
updated_at = models.DateTimeField(auto_now=True)
_perm_cache: set[str] | None = None
class Meta:
verbose_name = _("api client")
verbose_name_plural = _("api clients")
def __str__(self):
return self.name
def has_perm(self, perm: str):
"""Return True if the client has the specified permission."""
if self._perm_cache is None:
group_permissions = (
Permission.objects.filter(group__group__in=self.groups.all())
.values_list("content_type__app_label", "codename")
.order_by()
)
client_permissions = self.client_permissions.values_list(
"content_type__app_label", "codename"
).order_by()
self._perm_cache = {
f"{content_type}.{name}"
for content_type, name in (*group_permissions, *client_permissions)
}
return perm in self._perm_cache
def has_perms(self, perm_list):
"""
Return True if the client has each of the specified permissions. If
object is passed, check if the client has all required perms for it.
"""
if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
raise ValueError("perm_list must be an iterable of permissions.")
return all(self.has_perm(perm) for perm in perm_list)
class ApiKey(models.Model):
PREFIX_LENGTH = 5
KEY_LENGTH = 72
HASHED_KEY_LENGTH = 136
name = models.CharField(_("name"), blank=True, default="")
prefix = models.CharField(_("prefix"), max_length=PREFIX_LENGTH, editable=False)
hashed_key = models.CharField(
_("hashed key"), max_length=HASHED_KEY_LENGTH, db_index=True, editable=False
)
client = models.ForeignKey(
ApiClient,
verbose_name=_("api client"),
related_name="api_keys",
on_delete=models.CASCADE,
)
revoked = models.BooleanField(pgettext_lazy("api key", "revoked"), default=False)
created_at = models.DateTimeField(auto_now_add=True)
class Meta:
verbose_name = _("api key")
verbose_name_plural = _("api keys")
permissions = [("revoke_apikey", "Revoke API keys")]
def __str__(self):
return f"{self.name} ({self.prefix}***)"

0
api/tests/__init__.py
View File

29
api/tests/test_api_key.py
View File

@ -1,29 +0,0 @@
import pytest
from django.test import RequestFactory
from model_bakery import baker
from api.auth import ApiKeyAuth
from api.hashers import generate_key
from api.models import ApiClient, ApiKey
@pytest.mark.django_db
def test_api_key_auth():
key, hashed = generate_key()
client = baker.make(ApiClient)
baker.make(ApiKey, client=client, hashed_key=hashed)
auth = ApiKeyAuth()
assert auth.authenticate(RequestFactory().get(""), key) == client
@pytest.mark.django_db
@pytest.mark.parametrize(
("key", "hashed"), [(generate_key()[0], generate_key()[1]), (generate_key()[0], "")]
)
def test_api_key_auth_invalid(key, hashed):
client = baker.make(ApiClient)
baker.make(ApiKey, client=client, hashed_key=hashed)
auth = ApiKeyAuth()
assert auth.authenticate(RequestFactory().get(""), key) is None

10
api/urls.py
View File

@ -1,10 +0,0 @@
from ninja_extra import NinjaExtraAPI
api = NinjaExtraAPI(
title="PICON",
description="Portail Interaction de Communication avec les Services Étudiants",
version="0.2.0",
urls_namespace="api",
csrf=True,
)
api.auto_discover_controllers()

22
club/api.py
View File

@ -1,38 +1,22 @@
from typing import Annotated
from annotated_types import MinLen
from ninja.security import SessionAuth
from ninja_extra import ControllerBase, api_controller, paginate, route
from ninja_extra.pagination import PageNumberPaginationExtra
from ninja_extra.schemas import PaginatedResponseSchema
from api.auth import ApiKeyAuth
from api.permissions import CanAccessLookup, HasPerm
from club.models import Club
from club.schemas import ClubSchema, SimpleClubSchema
from club.schemas import ClubSchema
from core.auth.api_permissions import CanAccessLookup
@api_controller("/club")
class ClubController(ControllerBase):
@route.get(
"/search",
response=PaginatedResponseSchema[SimpleClubSchema],
auth=[SessionAuth(), ApiKeyAuth()],
response=PaginatedResponseSchema[ClubSchema],
permissions=[CanAccessLookup],
url_name="search_club",
)
@paginate(PageNumberPaginationExtra, page_size=50)
def search_club(self, search: Annotated[str, MinLen(1)]):
return Club.objects.filter(name__icontains=search).values()
@route.get(
"/{int:club_id}",
response=ClubSchema,
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[HasPerm("club.view_club")],
url_name="fetch_club",
)
def fetch_club(self, club_id: int):
return self.get_object_or_exception(
Club.objects.prefetch_related("members", "members__user"), id=club_id
)

17
club/forms.py
View File

@ -163,16 +163,15 @@ class SellingsForm(forms.Form):
def __init__(self, club, *args, **kwargs):
super().__init__(*args, **kwargs)
# postgres struggles really hard with a single query having three WHERE conditions,
# but deals perfectly fine with UNION of multiple queryset with their own WHERE clause,
# so we do this to get the ids, which we use to build another queryset that can be used by django.
club_sales_subquery = Selling.objects.filter(counter=OuterRef("pk"), club=club)
ids = (
Counter.objects.filter(Q(club=club) | Q(products__club=club))
.union(Counter.objects.filter(Exists(club_sales_subquery)))
.values_list("id", flat=True)
counters_qs = (
Counter.objects.filter(
Q(club=club)
| Q(products__club=club)
| Exists(Selling.objects.filter(counter=OuterRef("pk"), club=club))
)
.distinct()
.order_by(Lower("name"))
)
counters_qs = Counter.objects.filter(id__in=ids).order_by(Lower("name"))
self.fields["counters"] = forms.ModelMultipleChoiceField(
counters_qs, label=_("Counter"), required=False
)

21
club/schemas.py
View File

@ -1,10 +1,9 @@
from ninja import ModelSchema
from club.models import Club, Membership
from core.schemas import SimpleUserSchema
from club.models import Club
class SimpleClubSchema(ModelSchema):
class ClubSchema(ModelSchema):
class Meta:
model = Club
fields = ["id", "name"]
@ -22,19 +21,3 @@ class ClubProfileSchema(ModelSchema):
@staticmethod
def resolve_url(obj: Club) -> str:
return obj.get_absolute_url()
class ClubMemberSchema(ModelSchema):
class Meta:
model = Membership
fields = ["start_date", "end_date", "role", "description"]
user: SimpleUserSchema
class ClubSchema(ModelSchema):
class Meta:
model = Club
fields = ["id", "name", "logo", "is_active", "short_description", "address"]
members: list[ClubMemberSchema]

21
club/tests/test_club_controller.py
View File

@ -1,21 +0,0 @@
import pytest
from django.test import Client
from django.urls import reverse
from model_bakery import baker
from pytest_django.asserts import assertNumQueries
from club.models import Club, Membership
from core.baker_recipes import subscriber_user
@pytest.mark.django_db
def test_fetch_club(client: Client):
club = baker.make(Club)
baker.make(Membership, club=club, _quantity=10, _bulk_create=True)
user = subscriber_user.make()
client.force_login(user)
with assertNumQueries(7):
# - 4 queries for authentication
# - 3 queries for the actual data
res = client.get(reverse("api:fetch_club", kwargs={"club_id": club.id}))
assert res.status_code == 200

6
club/widgets/ajax_select.py
View File

@ -1,7 +1,7 @@
from pydantic import TypeAdapter
from club.models import Club
from club.schemas import SimpleClubSchema
from club.schemas import ClubSchema
from core.views.widgets.ajax_select import (
AutoCompleteSelect,
AutoCompleteSelectMultiple,
@ -13,7 +13,7 @@ _js = ["bundled/club/components/ajax-select-index.ts"]
class AutoCompleteSelectClub(AutoCompleteSelect):
component_name = "club-ajax-select"
model = Club
adapter = TypeAdapter(list[SimpleClubSchema])
adapter = TypeAdapter(list[ClubSchema])
js = _js
@ -21,6 +21,6 @@ class AutoCompleteSelectClub(AutoCompleteSelect):
class AutoCompleteSelectMultipleClub(AutoCompleteSelectMultiple):
component_name = "club-ajax-select"
model = Club
adapter = TypeAdapter(list[SimpleClubSchema])
adapter = TypeAdapter(list[ClubSchema])
js = _js

2
com/api.py
View File

@ -8,10 +8,10 @@ from ninja_extra.pagination import PageNumberPaginationExtra
from ninja_extra.permissions import IsAuthenticated
from ninja_extra.schemas import PaginatedResponseSchema
from api.permissions import HasPerm
from com.ics_calendar import IcsCalendar
from com.models import News, NewsDate
from com.schemas import NewsDateFilterSchema, NewsDateSchema
from core.auth.api_permissions import HasPerm
from core.views.files import send_raw_file

2
com/models.py
View File

@ -194,7 +194,7 @@ class NewsDateQuerySet(models.QuerySet):
class NewsDate(models.Model):
"""A date associated with news.
A [News][com.models.News] can have multiple dates, for example if it is a recurring event.
A [News][] can have multiple dates, for example if it is a recurring event.
"""
news = models.ForeignKey(

113
com/static/bundled/com/components/ics-calendar-index.ts
View File

@ -7,7 +7,6 @@ import frLocale from "@fullcalendar/core/locales/fr";
import dayGridPlugin from "@fullcalendar/daygrid";
import iCalendarPlugin from "@fullcalendar/icalendar";
import listPlugin from "@fullcalendar/list";
import { type HTMLTemplateResult, html, render } from "lit-html";
import {
calendarCalendarInternal,
calendarCalendarUnpublished,
@ -177,25 +176,29 @@ export class IcsCalendar extends inheritHtmlElement("div") {
oldPopup.remove();
}
const makePopupInfo = (info: HTMLTemplateResult, iconClass: string) => {
return html`
<div class="event-details-row">
<i class="event-detail-row-icon fa-xl ${iconClass}"></i>
${info}
</div>
`;
const makePopupInfo = (info: HTMLElement, iconClass: string) => {
const row = document.createElement("div");
const icon = document.createElement("i");
row.setAttribute("class", "event-details-row");
icon.setAttribute("class", `event-detail-row-icon fa-xl ${iconClass}`);
row.appendChild(icon);
row.appendChild(info);
return row;
};
const makePopupTitle = (event: EventImpl) => {
const row = html`
<div>
<h4 class="event-details-row-content">
${event.title}
</h4>
<span class="event-details-row-content">
${this.formatDate(event.start)} - ${this.formatDate(event.end)}
</span>
</div>
const row = document.createElement("div");
row.innerHTML = `
<h4 class="event-details-row-content">
${event.title}
</h4>
<span class="event-details-row-content">
${this.formatDate(event.start)} - ${this.formatDate(event.end)}
</span>
`;
return makePopupInfo(
row,
@ -207,11 +210,9 @@ export class IcsCalendar extends inheritHtmlElement("div") {
if (event.extendedProps.location === null) {
return null;
}
const info = html`
<div>
${event.extendedProps.location}
</div>
`;
const info = document.createElement("div");
info.innerText = event.extendedProps.location;
return makePopupInfo(info, "fa-solid fa-location-dot");
};
@ -219,7 +220,10 @@ export class IcsCalendar extends inheritHtmlElement("div") {
if (event.url === "") {
return null;
}
const url = html`<a href="${event.url}">${gettext("More info")}</a>`;
const url = document.createElement("a");
url.href = event.url;
url.textContent = gettext("More info");
return makePopupInfo(url, "fa-solid fa-link");
};
@ -228,59 +232,64 @@ export class IcsCalendar extends inheritHtmlElement("div") {
return null;
}
const newsId = this.getNewsId(event);
const buttons = [] as HTMLTemplateResult[];
const div = document.createElement("div");
if (this.canModerate) {
if (event.source.internalEventSource.ui.classNames.includes("unpublished")) {
const button = html`
<button class="btn btn-green" @click="${() => this.publishNews(newsId)}">
<i class="fa fa-check"></i>${gettext("Publish")}
</button>
`;
buttons.push(button);
const button = document.createElement("button");
button.innerHTML = `<i class="fa fa-check"></i>${gettext("Publish")}`;
button.setAttribute("class", "btn btn-green");
button.onclick = () => {
this.publishNews(newsId);
};
div.appendChild(button);
} else {
const button = html`
<button class="btn btn-orange" @click="${() => this.unpublishNews(newsId)}">
<i class="fa fa-times"></i>${gettext("Unpublish")}
</button>
`;
buttons.push(button);
const button = document.createElement("button");
button.innerHTML = `<i class="fa fa-times"></i>${gettext("Unpublish")}`;
button.setAttribute("class", "btn btn-orange");
button.onclick = () => {
this.unpublishNews(newsId);
};
div.appendChild(button);
}
}
if (this.canDelete) {
const button = html`
<button class="btn btn-red" @click="${() => this.deleteNews(newsId)}">
<i class="fa fa-trash-can"></i>${gettext("Delete")}
</button>
`;
buttons.push(button);
const button = document.createElement("button");
button.innerHTML = `<i class="fa fa-trash-can"></i>${gettext("Delete")}`;
button.setAttribute("class", "btn btn-red");
button.onclick = () => {
this.deleteNews(newsId);
};
div.appendChild(button);
}
return makePopupInfo(html`<div>${buttons}</div>`, "fa-solid fa-toolbox");
return makePopupInfo(div, "fa-solid fa-toolbox");
};
// Create new popup
const infos = [] as HTMLTemplateResult[];
infos.push(makePopupTitle(event.event));
const popup = document.createElement("div");
const popupContainer = document.createElement("div");
popup.setAttribute("id", "event-details");
popupContainer.setAttribute("class", "event-details-container");
popupContainer.appendChild(makePopupTitle(event.event));
const location = makePopupLocation(event.event);
if (location !== null) {
infos.push(location);
popupContainer.appendChild(location);
}
const url = makePopupUrl(event.event);
if (url !== null) {
infos.push(url);
popupContainer.appendChild(url);
}
const tools = makePopupTools(event.event);
if (tools !== null) {
infos.push(tools);
popupContainer.appendChild(tools);
}
const popup = document.createElement("div");
popup.setAttribute("id", "event-details");
render(html`<div class="event-details-container">${infos}</div>`, popup);
popup.appendChild(popupContainer);
// We can't just add the element relative to the one we want to appear under
// Otherwise, it either gets clipped by the boundaries of the calendar or resize cells

0
com/static/bundled/com/moderation-alert-index.ts → com/static/bundled/com/components/moderation-alert-index.ts
View File

6
com/static/bundled/com/upcoming-news-loader-index.ts → com/static/bundled/com/components/upcoming-news-loader-index.ts
View File

@ -8,17 +8,13 @@ interface ParsedNewsDateSchema extends Omit<NewsDateSchema, "start_date" | "end_
}
document.addEventListener("alpine:init", () => {
Alpine.data("upcomingNewsLoader", (startDate: Date, locale: string) => ({
Alpine.data("upcomingNewsLoader", (startDate: Date) => ({
startDate: startDate,
currentPage: 1,
pageSize: 6,
hasNext: true,
loading: false,
newsDates: [] as NewsDateSchema[],
dateFormat: new Intl.DateTimeFormat(locale, {
dateStyle: "medium",
timeStyle: "short",
}),
async loadMore() {
this.loading = true;

2
com/templates/com/news_detail.jinja
View File

@ -18,7 +18,7 @@
{% endblock %}
{% block additional_js %}
<script type="module" src={{ static("bundled/com/moderation-alert-index.ts") }}></script>
<script type="module" src={{ static("bundled/com/components/moderation-alert-index.ts") }}></script>
{% endblock %}
{% block content %}

14
com/templates/com/news_list.jinja
View File

@ -15,8 +15,8 @@
{% block additional_js %}
<script type="module" src={{ static("bundled/com/components/ics-calendar-index.ts") }}></script>
<script type="module" src={{ static("bundled/com/moderation-alert-index.ts") }}></script>
<script type="module" src={{ static("bundled/com/upcoming-news-loader-index.ts") }}></script>
<script type="module" src={{ static("bundled/com/components/moderation-alert-index.ts") }}></script>
<script type="module" src={{ static("bundled/com/components/upcoming-news-loader-index.ts") }}></script>
{% endblock %}
{% block content %}
@ -84,11 +84,11 @@
<a href="{{ date.news.club.get_absolute_url() }}">{{ date.news.club }}</a>
<div class="news_date">
<time datetime="{{ date.start_date.isoformat(timespec="seconds") }}">
{{ date.start_date|localtime|date(DATETIME_FORMAT) }},
{{ date.start_date|localtime|date(DATETIME_FORMAT) }}
{{ date.start_date|localtime|time(DATETIME_FORMAT) }}
</time> -
<time datetime="{{ date.end_date.isoformat(timespec="seconds") }}">
{{ date.end_date|localtime|date(DATETIME_FORMAT) }},
{{ date.end_date|localtime|date(DATETIME_FORMAT) }}
{{ date.end_date|localtime|time(DATETIME_FORMAT) }}
</time>
</div>
@ -103,7 +103,7 @@
</div>
</div>
{% endfor %}
<div x-data="upcomingNewsLoader(new Date('{{ last_day + timedelta(days=1) }}'), '{{ get_language() }}')">
<div x-data="upcomingNewsLoader(new Date('{{ last_day + timedelta(days=1) }}'))">
<template x-for="newsList in Object.values(groupedDates())">
<div class="news_events_group">
<div class="news_events_group_date">
@ -139,11 +139,11 @@
<div class="news_date">
<time
:datetime="newsDate.start_date.toISOString()"
x-text="dateFormat.format(newsDate.start_date)"
x-text="`${newsDate.start_date.getHours()}:${newsDate.start_date.getMinutes()}`"
></time> -
<time
:datetime="newsDate.end_date.toISOString()"
x-text="dateFormat.format(newsDate.end_date)"
x-text="`${newsDate.end_date.getHours()}:${newsDate.end_date.getMinutes()}`"
></time>
</div>
</div>

4
core/admin.py
View File

@ -88,9 +88,9 @@ class PageAdmin(admin.ModelAdmin):
@admin.register(SithFile)
class SithFileAdmin(admin.ModelAdmin):
list_display = ("name", "owner", "size", "date", "is_in_sas")
list_display = ("name", "owner", "size", "date")
autocomplete_fields = ("parent", "owner", "moderator")
search_fields = ("name", "parent__name")
search_fields = ("name",)
@admin.register(OperationLog)

8
core/api.py
View File

@ -5,15 +5,13 @@ from django.conf import settings
from django.db.models import F
from django.http import HttpResponse
from ninja import File, Query
from ninja.security import SessionAuth
from ninja_extra import ControllerBase, api_controller, paginate, route
from ninja_extra.exceptions import PermissionDenied
from ninja_extra.pagination import PageNumberPaginationExtra
from ninja_extra.schemas import PaginatedResponseSchema
from api.auth import ApiKeyAuth
from api.permissions import CanAccessLookup, CanView, HasPerm
from club.models import Mailing
from core.auth.api_permissions import CanAccessLookup, CanView, HasPerm
from core.models import Group, QuickUploadImage, SithFile, User
from core.schemas import (
FamilyGodfatherSchema,
@ -92,12 +90,11 @@ class SithFileController(ControllerBase):
@route.get(
"/search",
response=PaginatedResponseSchema[SithFileSchema],
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[CanAccessLookup],
)
@paginate(PageNumberPaginationExtra, page_size=50)
def search_files(self, search: Annotated[str, annotated_types.MinLen(1)]):
return SithFile.objects.filter(is_in_sas=False).filter(name__icontains=search)
return SithFile.objects.filter(name__icontains=search)
@api_controller("/group")
@ -105,7 +102,6 @@ class GroupController(ControllerBase):
@route.get(
"/search",
response=PaginatedResponseSchema[GroupSchema],
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[CanAccessLookup],
)
@paginate(PageNumberPaginationExtra, page_size=50)

42
api/permissions.py → core/auth/api_permissions.py
View File

@ -39,7 +39,7 @@ Example:
import operator
from functools import reduce
from typing import Any, Callable
from typing import Any
from django.contrib.auth.models import Permission
from django.http import HttpRequest
@ -67,26 +67,21 @@ class HasPerm(BasePermission):
Example:
```python
@api_controller("/foo")
class FooController(ControllerBase):
# this route will require both permissions
@route.put("/foo", permissions=[HasPerm(["foo.change_foo", "foo.add_foo"])]
def foo(self): ...
# this route will require both permissions
@route.put("/foo", permissions=[HasPerm(["foo.change_foo", "foo.add_foo"])]
def foo(self): ...
# This route will require at least one of the perm,
# but it's not mandatory to have all of them
@route.put(
"/bar",
permissions=[HasPerm(["foo.change_bar", "foo.add_bar"], op=operator.or_)],
)
def bar(self): ...
```
# This route will require at least one of the perm,
# but it's not mandatory to have all of them
@route.put(
"/bar",
permissions=[HasPerm(["foo.change_bar", "foo.add_bar"], op=operator.or_)],
)
def bar(self): ...
"""
def __init__(
self,
perms: str | Permission | list[str | Permission],
op: Callable[[bool, bool], bool] = operator.and_,
self, perms: str | Permission | list[str | Permission], op=operator.and_
):
"""
Args:
@ -101,16 +96,7 @@ class HasPerm(BasePermission):
self._perms = perms
def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
# if the request has the `auth` property,
# it means that the user has been explicitly authenticated
# using a django-ninja authentication backend
# (whether it is SessionAuth or ApiKeyAuth).
# If not, this authentication has not been done, but the user may
# still be implicitly authenticated through AuthenticationMiddleware
user = request.auth if hasattr(request, "auth") else request.user
# `user` may either be a `core.User` or an `api.ApiClient` ;
# they are not the same model, but they both implement the `has_perm` method
return reduce(self._operator, (user.has_perm(p) for p in self._perms))
return reduce(self._operator, (request.user.has_perm(p) for p in self._perms))
class IsRoot(BasePermission):
@ -194,4 +180,4 @@ class IsLoggedInCounter(BasePermission):
return Counter.objects.filter(token=token).exists()
CanAccessLookup = IsLoggedInCounter | HasPerm("core.access_lookup")
CanAccessLookup = IsOldSubscriber | IsRoot | IsLoggedInCounter

25
core/management/commands/populate.py
View File

@ -109,7 +109,6 @@ class Command(BaseCommand):
p.save(force_lock=True)
club_root = SithFile.objects.create(name="clubs", owner=root)
sas = SithFile.objects.create(name="SAS", owner=root)
main_club = Club.objects.create(
id=1, name="AE", address="6 Boulevard Anatole France, 90000 Belfort"
)
@ -692,33 +691,21 @@ class Command(BaseCommand):
# SAS
for f in self.SAS_FIXTURE_PATH.glob("*"):
if f.is_dir():
album = Album(
parent=sas,
name=f.name,
owner=root,
is_folder=True,
is_in_sas=True,
is_moderated=True,
)
album.clean()
album.save()
album = Album.objects.create(name=f.name, is_moderated=True)
for p in f.iterdir():
file = resize_image(Image.open(p), 1000, "WEBP")
pict = Picture(
parent=album,
name=p.name,
file=file,
original=file,
owner=root,
is_folder=False,
is_in_sas=True,
is_moderated=True,
mime_type="image/webp",
size=file.size,
)
pict.file.name = p.name
pict.full_clean()
pict.original.name = pict.name
pict.generate_thumbnails()
pict.full_clean()
pict.save()
album.generate_thumbnail()
img_skia = Picture.objects.get(name="skia.jpg")
img_sli = Picture.objects.get(name="sli.jpg")
@ -805,8 +792,6 @@ class Command(BaseCommand):
"add_peoplepicturerelation",
"add_page",
"add_quickuploadimage",
"view_club",
"access_lookup",
]
)
)

28
core/migrations/0046_permissionrights.py
View File

@ -1,28 +0,0 @@
# Generated by Django 5.2 on 2025-05-20 17:50
from django.db import migrations, models
class Migration(migrations.Migration):
dependencies = [("core", "0045_quickuploadimage")]
operations = [
migrations.CreateModel(
name="GlobalPermissionRights",
fields=[
(
"id",
models.AutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
],
options={
"permissions": [("access_lookup", "Can access any lookup in the sith")],
"managed": False,
"default_permissions": [],
},
),
]

27
core/migrations/0046_remove_sithfiles.py Normal file
View File

@ -0,0 +1,27 @@
# Generated by Django 4.2.17 on 2025-01-26 15:01
from typing import TYPE_CHECKING
from django.db import migrations
from django.db.migrations.state import StateApps
if TYPE_CHECKING:
import core.models
def remove_sas_sithfiles(apps: StateApps, schema_editor):
SithFile: type[core.models.SithFile] = apps.get_model("core", "SithFile")
SithFile.objects.filter(is_in_sas=True).delete()
class Migration(migrations.Migration):
dependencies = [
("core", "0045_quickuploadimage"),
("sas", "0006_alter_peoplepicturerelation_picture_and_more"),
]
operations = [
migrations.RunPython(
remove_sas_sithfiles, reverse_code=migrations.RunPython.noop, elidable=True
)
]

9
core/migrations/0047_remove_sithfile_is_in_sas.py Normal file
View File

@ -0,0 +1,9 @@
# Generated by Django 4.2.17 on 2025-02-14 11:58
from django.db import migrations
class Migration(migrations.Migration):
dependencies = [("core", "0046_remove_sithfiles")]
operations = [migrations.RemoveField(model_name="sithfile", name="is_in_sas")]

48
core/models.py
View File

@ -754,23 +754,6 @@ class UserBan(models.Model):
return f"Ban of user {self.user.id}"
class GlobalPermissionRights(models.Model):
"""Little hack to have permissions not linked to a specific db table."""
class Meta:
# No database table creation or deletion
# operations will be performed for this model.
managed = False
# disable "add", "change", "delete" and "view" default permissions
default_permissions = []
permissions = [("access_lookup", "Can access any lookup in the sith")]
def __str__(self):
return self.__class__.__name__
class Preferences(models.Model):
user = models.OneToOneField(
User, related_name="_preferences", on_delete=models.CASCADE
@ -863,9 +846,6 @@ class SithFile(models.Model):
on_delete=models.CASCADE,
)
asked_for_removal = models.BooleanField(_("asked for removal"), default=False)
is_in_sas = models.BooleanField(
_("is in the SAS"), default=False, db_index=True
) # Allows to query this flag, updated at each call to save()
class Meta:
verbose_name = _("file")
@ -874,22 +854,10 @@ class SithFile(models.Model):
return self.get_parent_path() + "/" + self.name
def save(self, *args, **kwargs):
sas = SithFile.objects.filter(id=settings.SITH_SAS_ROOT_DIR_ID).first()
self.is_in_sas = sas in self.get_parent_list() or self == sas
adding = self._state.adding
super().save(*args, **kwargs)
if adding:
self.copy_rights()
if self.is_in_sas:
for user in User.objects.filter(
groups__id__in=[settings.SITH_GROUP_SAS_ADMIN_ID]
):
Notification(
user=user,
url=reverse("sas:moderation"),
type="SAS_MODERATION",
param="1",
).save()
def is_owned_by(self, user: User) -> bool:
if user.is_anonymous:
@ -902,8 +870,6 @@ class SithFile(models.Model):
return user.is_board_member
if user.is_com_admin:
return True
if self.is_in_sas and user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
return True
return user.id == self.owner_id
def can_be_viewed_by(self, user: User) -> bool:
@ -930,8 +896,6 @@ class SithFile(models.Model):
super().clean()
if "/" in self.name:
raise ValidationError(_("Character '/' not authorized in name"))
if self == self.parent:
raise ValidationError(_("Loop in folder tree"), code="loop")
if self == self.parent or (
self.parent is not None and self in self.get_parent_list()
):
@ -1069,18 +1033,6 @@ class SithFile(models.Model):
def is_file(self):
return not self.is_folder
@cached_property
def as_picture(self):
from sas.models import Picture
return Picture.objects.filter(id=self.id).first()
@cached_property
def as_album(self):
from sas.models import Album
return Album.objects.filter(id=self.id).first()
def get_parent_list(self):
parents = []
current = self.parent

120
core/static/bundled/core/components/tabs-index.ts
View File

@ -1,120 +0,0 @@
import { registerComponent } from "#core:utils/web-components";
import { html, render } from "lit-html";
import { unsafeHTML } from "lit-html/directives/unsafe-html.js";
@registerComponent("ui-tab")
export class Tab extends HTMLElement {
static observedAttributes = ["title", "active"];
private description = "";
private inner = "";
private active = false;
attributeChangedCallback(name: string, _oldValue?: string, newValue?: string) {
const activeOld = this.active;
this.active = this.hasAttribute("active");
if (this.active !== activeOld && this.active) {
this.dispatchEvent(
new CustomEvent("ui-tab-activated", { detail: this, bubbles: true }),
);
}
if (name === "title") {
this.description = newValue;
}
this.dispatchEvent(new CustomEvent("ui-tab-updated", { bubbles: true }));
}
getButtonTemplate() {
return html`
<button
role="tab"
?aria-selected=${this.active}
class="tab-header clickable ${this.active ? "active" : ""}"
@click="${() => this.setActive(true)}"
>
${this.description}
</button>
`;
}
getContentTemplate() {
return html`
<section
class="tab-section"
?hidden=${!this.active}
>
${unsafeHTML(this.getContentHtml())}
</section>
`;
}
setActive(value: boolean) {
if (value) {
this.setAttribute("active", "");
} else {
this.removeAttribute("active");
}
}
connectedCallback() {
this.inner = this.innerHTML;
this.innerHTML = "";
}
getContentHtml() {
const content = this.getElementsByClassName("tab-section")[0];
if (content !== undefined) {
return content.innerHTML;
}
return this.inner;
}
setContentHtml(value: string) {
const content = this.getElementsByClassName("tab-section")[0];
if (content !== undefined) {
content.innerHTML = value;
}
this.inner = value;
}
}
@registerComponent("ui-tab-group")
export class TabGroup extends HTMLElement {
private node: HTMLDivElement;
connectedCallback() {
this.node = document.createElement("div");
this.node.classList.add("tabs", "shadow");
this.appendChild(this.node);
this.addEventListener("ui-tab-activated", (event: CustomEvent) => {
const target = event.detail as Tab;
for (const tab of this.getElementsByTagName("ui-tab") as HTMLCollectionOf<Tab>) {
if (tab !== target) {
tab.setActive(false);
}
}
});
this.addEventListener("ui-tab-updated", () => {
this.render();
});
this.render();
}
render() {
const tabs = Array.prototype.slice.call(
this.getElementsByTagName("ui-tab"),
) as Tab[];
render(
html`
<div class="tab-headers">
${tabs.map((tab) => tab.getButtonTemplate())}
</div>
<div class="tab-content">
${tabs.map((tab) => tab.getContentTemplate())}
</div>
`,
this.node,
);
}
}

2
core/static/bundled/jquery-ui-index.js vendored Normal file
View File

@ -0,0 +1,2 @@
// This is only used to import jquery-ui css files
import "jquery-ui/themes/base/all.css";

53
core/static/core/components/tabs.scss
View File

@ -1,53 +0,0 @@
@import "core/static/core/colors";
ui-tab-group {
*[hidden] {
display: none;
}
.tabs {
border-radius: 5px;
.tab-headers {
display: flex;
flex-flow: row wrap;
background-color: $primary-neutral-light-color;
padding: 3px 12px 12px;
column-gap: 20px;
border-top-left-radius: 5px;
border-top-right-radius: 5px;
.tab-header {
border: none;
padding-right: 0;
padding-left: 0;
font-size: 120%;
background-color: unset;
position: relative;
&:after {
content: '';
position: absolute;
bottom: 0;
left: 0;
width: 100%;
border-bottom: 4px solid darken($primary-neutral-light-color, 10%);
border-radius: 2px;
transition: all 0.2s ease-in-out;
}
&:hover:after {
border-bottom-color: darken($primary-neutral-light-color, 20%);
}
&.active:after {
border-bottom-color: $primary-dark-color;
}
}
}
section {
padding: 20px;
}
}
}

38
core/static/core/js/script.js
View File

@ -1,4 +1,42 @@
$(() => {
// const buttons = $('.choose_file_button')
const popups = $(".choose_file_widget");
popups.dialog({
autoOpen: false,
modal: true,
width: "90%",
create: (event) => {
const target = $(event.target);
target.parent().css({
position: "fixed",
top: "5%",
bottom: "5%",
});
target.css("height", "300px");
},
buttons: [
{
text: "Choose",
click: function () {
$(`input[name=${$(this).attr("name")}]`).attr(
"value",
$("#file_id").attr("value"),
);
$(this).dialog("close");
},
disabled: true,
},
],
});
$(".choose_file_button")
.button()
.on("click", function () {
const popup = popups.filter(`[name=${$(this).attr("name")}]`);
popup.html(
'<iframe src="/file/popup" width="100%" height="95%"></iframe><div id="file_id" value="null" />',
);
popup.dialog({ title: $(this).text() }).dialog("open");
});
$("#quick_notif li").click(function () {
$(this).hide();
});

71
core/static/core/style.scss
View File

@ -111,6 +111,12 @@ body {
/*--------------------------------HEADER-------------------------------*/
#popupheader {
width: 88%;
margin: 0 auto;
padding: 0.3em 1%;
}
#info_boxes {
display: flex;
flex-wrap: wrap;
@ -346,6 +352,52 @@ body {
text-align: center;
}
.tabs {
border-radius: 5px;
.tab-headers {
display: flex;
flex-flow: row wrap;
background-color: $primary-neutral-light-color;
padding: 3px 12px 12px;
column-gap: 20px;
border-top-left-radius: 5px;
border-top-right-radius: 5px;
.tab-header {
border: none;
padding-right: 0;
padding-left: 0;
font-size: 120%;
background-color: unset;
position: relative;
&:after {
content: '';
position: absolute;
bottom: 0;
left: 0;
width: 100%;
border-bottom: 4px solid darken($primary-neutral-light-color, 10%);
border-radius: 2px;
transition: all 0.2s ease-in-out;
}
&:hover:after {
border-bottom-color: darken($primary-neutral-light-color, 20%);
}
&.active:after {
border-bottom-color: $primary-dark-color;
}
}
}
section {
padding: 20px;
}
}
.tool_bar {
overflow: auto;
padding: 4px;
@ -796,6 +848,25 @@ footer {
}
/*--------------------------------JQuery-------------------------------*/
.ui-state-active,
.ui-widget-content .ui-state-active,
.ui-widget-header .ui-state-active,
a.ui-button:active,
.ui-button:active,
.ui-button.ui-state-active:hover {
background: $primary-color;
border-color: $primary-color;
}
.ui-corner-all,
.ui-corner-bottom,
.ui-corner-right,
.ui-corner-top,
.ui-corner-left {
border-radius: 0;
}
#club_detail {
.club_logo {
float: right;

98
core/templates/core/base.jinja
View File

@ -14,6 +14,10 @@
<link rel="stylesheet" href="{{ static('core/pagination.scss') }}">
<link rel="stylesheet" href="{{ static('core/accordion.scss') }}">
{% block jquery_css %}
{# Thile file is quite heavy (around 250kb), so declaring it in a block allows easy removal #}
<link rel="stylesheet" href="{{ static('bundled/jquery-ui-index.css') }}">
{% endblock %}
<link rel="preload" as="style" href="{{ static('bundled/fontawesome-index.css') }}" onload="this.onload=null;this.rel='stylesheet'">
<noscript><link rel="stylesheet" href="{{ static('bundled/fontawesome-index.css') }}"></noscript>
@ -26,8 +30,11 @@
<!-- Jquery declared here to be accessible in every django widgets -->
<script src="{{ static('bundled/vendored/jquery.min.js') }}"></script>
<script src="{{ static('bundled/vendored/jquery-ui.min.js') }}"></script>
<script src="{{ static('core/js/script.js') }}"></script>
{% block additional_css %}{% endblock %}
{% block additional_js %}{% endblock %}
{% endblock %}
@ -40,28 +47,35 @@
{% csrf_token %}
{% block header %}
{% include "core/base/header.jinja" %}
{% if not popup %}
{% include "core/base/header.jinja" %}
{% block info_boxes %}
<div id="info_boxes">
{% set sith = get_sith() %}
{% if sith.alert_msg %}
<div id="alert_box">
{{ sith.alert_msg|markdown }}
</div>
{% endif %}
{% if sith.info_msg %}
<div id="info_box">
{{ sith.info_msg|markdown }}
</div>
{% endif %}
</div>
{% endblock %}
{% block info_boxes %}
<div id="info_boxes">
{% set sith = get_sith() %}
{% if sith.alert_msg %}
<div id="alert_box">
{{ sith.alert_msg|markdown }}
</div>
{% endif %}
{% if sith.info_msg %}
<div id="info_box">
{{ sith.info_msg|markdown }}
</div>
{% endif %}
</div>
{% endblock %}
{% else %}
<div id="popupheader">{{ user.get_display_name() }}</div>
{% endif %}
{% endblock %}
{% block nav %}
{% include "core/base/navbar.jinja" %}
{% if not popup %}
{% include "core/base/navbar.jinja" %}
{% endif %}
{% endblock %}
<div id="page">
@ -88,50 +102,42 @@
</div>
</div>
<footer>
{% block footer %}
<div>
<a href="{{ url('core:page', 'contacts') }}">{% trans %}Contacts{% endtrans %}</a>
<a href="{{ url('core:page', 'legals') }}">{% trans %}Legal notices{% endtrans %}</a>
<a href="{{ url('core:page', 'copyright_agent') }}">{% trans %}Intellectual property{% endtrans %}</a>
<a href="{{ url('core:page', 'docs') }}">{% trans %}Help & Documentation{% endtrans %}</a>
<a href="{{ url('core:page', 'rd') }}">{% trans %}R&D{% endtrans %}</a>
</div>
<a rel="nofollow" href="https://github.com/ae-utbm/sith" target="#">
<i class="fa-brands fa-github"></i>
{% trans %}Site created by the IT Department of the AE{% endtrans %}
</a>
{% endblock %}
<br>
</footer>
{% if not popup %}
<footer>
{% block footer %}
<div>
<a href="{{ url('core:page', 'contacts') }}">{% trans %}Contacts{% endtrans %}</a>
<a href="{{ url('core:page', 'legals') }}">{% trans %}Legal notices{% endtrans %}</a>
<a href="{{ url('core:page', 'copyright_agent') }}">{% trans %}Intellectual property{% endtrans %}</a>
<a href="{{ url('core:page', 'docs') }}">{% trans %}Help & Documentation{% endtrans %}</a>
<a href="{{ url('core:page', 'rd') }}">{% trans %}R&D{% endtrans %}</a>
</div>
<a rel="nofollow" href="https://github.com/ae-utbm/sith" target="#">
<i class="fa-brands fa-github"></i>
{% trans %}Site created by the IT Department of the AE{% endtrans %}
</a>
{% endblock %}
<br>
</footer>
{% endif %}
{% block script %}
<script>
const menuItems = document.querySelectorAll(".navbar details[name='navbar'].menu");
const isDesktop = () => {
const isMobile = () => {
return window.innerWidth >= 500;
}
for (const item of menuItems){
item.addEventListener("mouseover", () => {
if (isDesktop()){
if (isMobile()){
item.setAttribute("open", "");
}
})
item.addEventListener("mouseout", () => {
if (isDesktop()){
if (isMobile()){
item.removeAttribute("open");
}
})
item.addEventListener("click", (event) => {
// Ignore keyboard clicks
if (event.detail === 0){
return;
}
if (isDesktop()){
event.preventDefault();
}
})
}
function showMenu() {

12
core/templates/core/file.jinja
View File

@ -19,9 +19,9 @@
{% macro print_file_name(file) %}
{% if file %}
{{ print_file_name(file.parent) }} >
<a href="{{ url('core:file_detail', file_id=file.id) }}">{{ file.get_display_name() }}</a>
<a href="{{ url('core:file_detail', file_id=file.id, popup=popup) }}">{{ file.get_display_name() }}</a>
{% else %}
<a href="{{ url('core:file_list') }}">{% trans %}Files{% endtrans %}</a>
<a href="{{ url('core:file_list', popup) }}">{% trans %}Files{% endtrans %}</a>
{% endif %}
{% endmacro %}
@ -33,16 +33,16 @@
<div>
{% set home = user.home %}
{% if home %}
<a href="{{ url('core:file_detail', home.id) }}">{% trans %}My files{% endtrans %}</a>
<a href="{{ url('core:file_detail', home.id, popup) }}">{% trans %}My files{% endtrans %}</a>
{% endif %}
</div>
{% if file %}
<a href="{{ url('core:file_detail', file.id) }}">{% trans %}View{% endtrans %}</a>
<a href="{{ url('core:file_detail', file.id, popup) }}">{% trans %}View{% endtrans %}</a>
{% if can_edit(file, user) %}
<a href="{{ url('core:file_edit', file_id=file.id) }}">{% trans %}Edit{% endtrans %}</a>
<a href="{{ url('core:file_edit', file_id=file.id, popup=popup) }}">{% trans %}Edit{% endtrans %}</a>
{% endif %}
{% if can_edit_prop(file, user) %}
<a href="{{ url('core:file_prop', file_id=file.id) }}">{% trans %}Prop{% endtrans %}</a>
<a href="{{ url('core:file_prop', file_id=file.id, popup=popup) }}">{% trans %}Prop{% endtrans %}</a>
{% endif %}
{% endif %}
</div>

17
core/templates/core/file_detail.jinja
View File

@ -45,7 +45,7 @@
{% else %}
<i class="fa fa-file" aria-hidden="true"></i>
{% endif %}
<a href="{{ url('core:file_detail', file_id=f.id) }}">{{ f.get_display_name() }}</a></li>
<a href="{{ url('core:file_detail', file_id=f.id, popup=popup) }}">{{ f.get_display_name() }}</a></li>
{% endfor %}
</ul>
</form>
@ -59,9 +59,22 @@
<p><a href="{{ url('core:download', file_id=file.id) }}">{% trans %}Download{% endtrans %}</a></p>
{% endif %}
{% if not file.home_of and not file.home_of_club and file.parent %}
<p><a href="{{ url('core:file_delete', file_id=file.id) }}">{% trans %}Delete{% endtrans %}</a></p>
<p><a href="{{ url('core:file_delete', file_id=file.id, popup=popup) }}">{% trans %}Delete{% endtrans %}</a></p>
{% endif %}
{% if user.is_com_admin %}
<p><a href="{{ url('core:file_moderate', file_id=file.id) }}">{% trans %}Moderate{% endtrans %}</a></p>
{% endif %}
{% endblock %}
{% block script %}
{{ super() }}
<script>
{% if popup and file.is_file %}
parent.$("#file_id").replaceWith('<div id="file_id" value="{{ file.id }}">{{ file.name }}</div>');
parent.$(".ui-dialog-buttonpane button").button("option", "disabled", false);
{% endif %}
</script>
{% endblock %}

2
core/templates/core/file_list.jinja
View File

@ -12,7 +12,7 @@
{% else %}
<i class="fa fa-file" aria-hidden="true"></i>
{% endif %}
<a href="{{ url('core:file_detail', file_id=f.id) }}">{{ f.name }}</a></li>
<a href="{{ url('core:file_detail', file_id=f.id, popup=popup) }}">{{ f.name }}</a></li>
{% endfor %}
</ul>
{% else %}

62
core/templates/core/macros.jinja
View File

@ -245,3 +245,65 @@
<button type="button" onclick="checkbox_{{form_id}}(true);">{% trans %}Select All{% endtrans %}</button>
<button type="button" onclick="checkbox_{{form_id}}(false);">{% trans %}Unselect All{% endtrans %}</button>
{% endmacro %}
{% macro tabs(tab_list, attrs = "") %}
{# Tab component
Parameters:
tab_list: list[tuple[str, str]] The list of tabs to display.
Each element of the list is a tuple which first element
is the title of the tab and the second element its content
attrs: str Additional attributes to put on the enclosing div
Example:
A basic usage would be as follow :
{{ tabs([("title 1", "content 1"), ("title 2", "content 2")]) }}
If you want to display more complex logic, you can define macros
and use those macros in parameters :
{{ tabs([("title", my_macro())]) }}
It's also possible to get and set the currently selected tab using Alpine.
Here, the title of the currently selected tab will be displayed.
Moreover, on page load, the tab will be opened on "tab 2".
<div x-data="{current_tab: 'tab 2'}">
<p x-text="current_tab"></p>
{{ tabs([("tab 1", "Hello"), ("tab 2", "World")], "x-model=current_tab") }}
</div>
If you want to have translated tab titles, you can enclose the macro call
in a with block :
{% with title=_("title"), content=_("Content") %}
{{ tabs([(tab1, content)]) }}
{% endwith %}
#}
<div
class="tabs shadow"
x-data="{selected: '{{ tab_list[0][0] }}'}"
x-modelable="selected"
{{ attrs }}
>
<div class="tab-headers">
{% for title, _ in tab_list %}
<button
class="tab-header clickable"
:class="{active: selected === '{{ title }}'}"
@click="selected = '{{ title }}'"
>
{{ title }}
</button>
{% endfor %}
</div>
<div class="tab-content">
{% for title, content in tab_list %}
<section x-show="selected === '{{ title }}'">
{{ content }}
</section>
{% endfor %}
</div>
</div>
{% endmacro %}

2
core/templates/core/user_edit.jinja
View File

@ -74,7 +74,7 @@
{%- if this_picture -%}
{% set default_picture = this_picture.get_download_url()|tojson %}
{% set delete_url = (
url('core:file_delete', file_id=this_picture.id)
url('core:file_delete', file_id=this_picture.id, popup='')
+ "?next=" + url('core:user_edit', user_id=profile.id)
)|tojson %}
{%- else -%}

54
core/tests/test_files.py
View File

@ -5,6 +5,7 @@ from typing import Callable
from uuid import uuid4
import pytest
from django.conf import settings
from django.core.cache import cache
from django.core.files.uploadedfile import SimpleUploadedFile, UploadedFile
from django.test import Client, TestCase
@ -17,8 +18,8 @@ from pytest_django.asserts import assertNumQueries
from core.baker_recipes import board_user, old_subscriber_user, subscriber_user
from core.models import Group, QuickUploadImage, SithFile, User
from core.utils import RED_PIXEL_PNG
from sas.baker_recipes import picture_recipe
from sas.models import Picture
from sith import settings
@pytest.mark.django_db
@ -30,24 +31,19 @@ class TestImageAccess:
lambda: baker.make(
User, groups=[Group.objects.get(pk=settings.SITH_GROUP_SAS_ADMIN_ID)]
),
lambda: baker.make(
User, groups=[Group.objects.get(pk=settings.SITH_GROUP_COM_ADMIN_ID)]
),
],
)
def test_sas_image_access(self, user_factory: Callable[[], User]):
"""Test that only authorized users can access the sas image."""
user = user_factory()
picture: SithFile = baker.make(
Picture, parent=SithFile.objects.get(pk=settings.SITH_SAS_ROOT_DIR_ID)
)
assert picture.is_owned_by(user)
picture = picture_recipe.make()
assert user.can_edit(picture)
def test_sas_image_access_owner(self):
"""Test that the owner of the image can access it."""
user = baker.make(User)
picture: Picture = baker.make(Picture, owner=user)
assert picture.is_owned_by(user)
picture = picture_recipe.make(owner=user)
assert user.can_edit(picture)
@pytest.mark.parametrize(
"user_factory",
@ -63,7 +59,41 @@ class TestImageAccess:
user = user_factory()
owner = baker.make(User)
picture: Picture = baker.make(Picture, owner=owner)
assert not picture.is_owned_by(user)
assert not user.can_edit(picture)
@pytest.mark.django_db
class TestUserPicture:
def test_anonymous_user_unauthorized(self, client):
"""An anonymous user shouldn't have access to an user's photo page."""
response = client.get(
reverse(
"core:user_pictures",
kwargs={"user_id": User.objects.get(username="sli").pk},
)
)
assert response.status_code == 403
@pytest.mark.parametrize(
("username", "status"),
[
("guy", 403),
("root", 200),
("skia", 200),
("sli", 200),
],
)
def test_page_is_working(self, client, username, status):
"""Only user that subscribed (or admins) should be able to see the page."""
# Test for simple user
client.force_login(User.objects.get(username=username))
response = client.get(
reverse(
"core:user_pictures",
kwargs={"user_id": User.objects.get(username="sli").pk},
)
)
assert response.status_code == status
# TODO: many tests on the pages:
@ -146,7 +176,7 @@ class TestUserProfilePicture:
return client.post(
reverse(
"core:file_delete",
kwargs={"file_id": user.profile_pict.pk},
kwargs={"file_id": user.profile_pict.pk, "popup": ""},
query={"next": user.get_absolute_url()},
),
)

2
core/tests/test_user.py
View File

@ -22,6 +22,7 @@ from core.models import Group, User
from core.views import UserTabsMixin
from counter.models import Counter, Refilling, Selling
from eboutic.models import Invoice, InvoiceItem
from sas.models import Picture
class TestSearchUsers(TestCase):
@ -29,6 +30,7 @@ class TestSearchUsers(TestCase):
def setUpTestData(cls):
# News.author has on_delete=PROTECT, so news must be deleted beforehand
News.objects.all().delete()
Picture.objects.all().delete() # same for pictures
User.objects.all().delete()
user_recipe = Recipe(
User,

10
core/urls.py
View File

@ -193,24 +193,24 @@ urlpatterns = [
name="user_gift_delete",
),
# File views
re_path(r"^file/$", FileListView.as_view(), name="file_list"),
re_path(r"^file/(?P<popup>popup)?$", FileListView.as_view(), name="file_list"),
re_path(
r"^file/(?P<file_id>[0-9]+)/$",
r"^file/(?P<file_id>[0-9]+)/(?P<popup>popup)?$",
FileView.as_view(),
name="file_detail",
),
re_path(
r"^file/(?P<file_id>[0-9]+)/edit/$",
r"^file/(?P<file_id>[0-9]+)/edit/(?P<popup>popup)?$",
FileEditView.as_view(),
name="file_edit",
),
re_path(
r"^file/(?P<file_id>[0-9]+)/prop/$",
r"^file/(?P<file_id>[0-9]+)/prop/(?P<popup>popup)?$",
FileEditPropView.as_view(),
name="file_prop",
),
re_path(
r"^file/(?P<file_id>[0-9]+)/delete/$",
r"^file/(?P<file_id>[0-9]+)/delete/(?P<popup>popup)?$",
FileDeleteView.as_view(),
name="file_delete",
),

79
core/utils.py
View File

@ -12,18 +12,23 @@
# OR WITHIN THE LOCAL FILE "LICENSE"
#
#
from dataclasses import dataclass
from datetime import date, timedelta
# Image utils
from io import BytesIO
from typing import Final
from typing import Any, Final, Unpack
import PIL
from django.conf import settings
from django.core.files.base import ContentFile
from django.core.files.uploadedfile import UploadedFile
from django.http import HttpRequest
from django.db import models
from django.forms import BaseForm
from django.http import Http404, HttpRequest
from django.shortcuts import get_list_or_404
from django.template.loader import render_to_string
from django.utils.safestring import SafeString
from django.utils.timezone import localdate
from PIL import ExifTags
from PIL.Image import Image, Resampling
@ -42,6 +47,21 @@ to generate a dummy image that is considered valid nonetheless
"""
@dataclass
class FormFragmentTemplateData[T: BaseForm]:
"""Dataclass used to pre-render form fragments"""
form: T
template: str
context: dict[str, Any]
def render(self, request: HttpRequest) -> SafeString:
# Request is needed for csrf_tokens
return render_to_string(
self.template, context={"form": self.form, **self.context}, request=request
)
def get_start_of_semester(today: date | None = None) -> date:
"""Return the date of the start of the semester of the given date.
If no date is given, return the start date of the current semester.
@ -195,3 +215,56 @@ def get_client_ip(request: HttpRequest) -> str | None:
return ip
return None
Filterable = models.Model | models.QuerySet | models.Manager
ListFilter = dict[str, list | tuple | set]
def get_list_exact_or_404(klass: Filterable, **kwargs: Unpack[ListFilter]) -> list:
"""Use filter() to return a list of objects from a list of unique keys (like ids)
or raises Http404 if the list has not the same length as the given one.
Work like `get_object_or_404()` but for lists of objects, with some caveats :
- The filter must be a list, a tuple or a set.
- There can't be more than exactly one filter.
- There must be no duplicate in the filter.
- The filter should consist in unique keys (like ids), or it could fail randomly.
klass may be a Model, Manager, or QuerySet object. All other passed
arguments and keyword arguments are used in the filter() query.
Raises:
Http404: If the list is empty or doesn't have as many elements as the keys list.
ValueError: If the first argument is not a Model, Manager, or QuerySet object.
ValueError: If more than one filter is passed.
TypeError: If the given filter is not a list, a tuple or a set.
Examples:
Get all the products with ids 1, 2, 3: ::
products = get_list_exact_or_404(Product, id__in=[1, 2, 3])
Don't work with duplicate ids: ::
products = get_list_exact_or_404(Product, id__in=[1, 2, 3, 3])
# Raises Http404: "The list of keys must contain no duplicates."
"""
if len(kwargs) > 1:
raise ValueError("get_list_exact_or_404() only accepts one filter.")
key, list_filter = next(iter(kwargs.items()))
if not isinstance(list_filter, (list, tuple, set)):
raise TypeError(
f"The given filter must be a list, a tuple or a set, not {type(list_filter)}"
)
if len(list_filter) != len(set(list_filter)):
raise ValueError("The list of keys must contain no duplicates.")
kwargs = {key: list_filter}
obj_list = get_list_or_404(klass, **kwargs)
if len(obj_list) != len(list_filter):
raise Http404(
"The given list of keys doesn't match the number of objects found."
f"Expected {len(list_filter)} items, got {len(obj_list)}."
)
return obj_list

2
core/views/__init__.py
View File

@ -37,6 +37,8 @@ from core.views.forms import LoginForm
def forbidden(request, exception):
context = {"next": request.path, "form": LoginForm()}
if popup := request.resolver_match.kwargs.get("popup"):
context["popup"] = popup
return HttpResponseForbidden(render(request, "core/403.jinja", context=context))

38
core/views/files.py
View File

@ -198,6 +198,9 @@ class FileListView(ListView):
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["popup"] = ""
if self.kwargs.get("popup") is not None:
kwargs["popup"] = "popup"
return kwargs
@ -214,7 +217,20 @@ class FileEditView(CanEditMixin, UpdateView):
return modelform_factory(SithFile, fields=fields)
def get_success_url(self):
return reverse("core:file_detail", kwargs={"file_id": self.object.id})
if self.kwargs.get("popup") is not None:
return reverse(
"core:file_detail", kwargs={"file_id": self.object.id, "popup": "popup"}
)
return reverse(
"core:file_detail", kwargs={"file_id": self.object.id, "popup": ""}
)
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["popup"] = ""
if self.kwargs.get("popup") is not None:
kwargs["popup"] = "popup"
return kwargs
class FileEditPropForm(forms.ModelForm):
@ -252,9 +268,16 @@ class FileEditPropView(CanEditPropMixin, UpdateView):
def get_success_url(self):
return reverse(
"core:file_detail",
kwargs={"file_id": self.object.id},
kwargs={"file_id": self.object.id, "popup": self.kwargs.get("popup", "")},
)
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["popup"] = ""
if self.kwargs.get("popup") is not None:
kwargs["popup"] = "popup"
return kwargs
class FileView(CanViewMixin, DetailView, FormMixin):
"""Handle the upload of new files into a folder."""
@ -330,12 +353,15 @@ class FileView(CanViewMixin, DetailView, FormMixin):
def get_success_url(self):
return reverse(
"core:file_detail",
kwargs={"file_id": self.object.id},
kwargs={"file_id": self.object.id, "popup": self.kwargs.get("popup", "")},
)
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["popup"] = ""
kwargs["form"] = self.form
if self.kwargs.get("popup") is not None:
kwargs["popup"] = "popup"
kwargs["clipboard"] = SithFile.objects.filter(
id__in=self.request.session["clipboard"]
)
@ -354,17 +380,19 @@ class FileDeleteView(AllowFragment, CanEditPropMixin, DeleteView):
return self.request.GET["next"]
if self.object.parent is None:
return reverse(
"core:file_list",
"core:file_list", kwargs={"popup": self.kwargs.get("popup", "")}
)
return reverse(
"core:file_detail",
kwargs={
"file_id": self.object.parent.id,
"popup": self.kwargs.get("popup", ""),
},
)
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["popup"] = "" if self.kwargs.get("popup") is None else "popup"
kwargs["next"] = self.request.GET.get("next", None)
kwargs["previous"] = self.request.GET.get("previous", None)
kwargs["current"] = self.request.path
@ -374,7 +402,7 @@ class FileDeleteView(AllowFragment, CanEditPropMixin, DeleteView):
class FileModerationView(AllowFragment, ListView):
model = SithFile
template_name = "core/file_moderation.jinja"
queryset = SithFile.objects.filter(is_moderated=False, is_in_sas=False)
queryset = SithFile.objects.filter(is_moderated=False)
ordering = "id"
paginate_by = 100

24
core/views/forms.py
View File

@ -86,6 +86,30 @@ class NFCTextInput(TextInput):
return context
class SelectFile(TextInput):
def render(self, name, value, attrs=None, renderer=None):
if attrs:
attrs["class"] = "select_file"
else:
attrs = {"class": "select_file"}
output = (
'%(content)s<div name="%(name)s" class="choose_file_widget" title="%(title)s"></div>'
% {
"content": super().render(name, value, attrs, renderer),
"title": _("Choose file"),
"name": name,
}
)
output += (
'<span name="'
+ name
+ '" class="choose_file_button">'
+ gettext("Choose file")
+ "</span>"
)
return output
class SelectUser(TextInput):
def render(self, name, value, attrs=None, renderer=None):
if attrs:

6
counter/api.py
View File

@ -16,13 +16,11 @@ from django.conf import settings
from django.db.models import F
from django.shortcuts import get_object_or_404
from ninja import Query
from ninja.security import SessionAuth
from ninja_extra import ControllerBase, api_controller, paginate, route
from ninja_extra.pagination import PageNumberPaginationExtra
from ninja_extra.schemas import PaginatedResponseSchema
from api.auth import ApiKeyAuth
from api.permissions import CanAccessLookup, CanView, IsInGroup, IsRoot
from core.auth.api_permissions import CanAccessLookup, CanView, IsInGroup, IsRoot
from counter.models import Counter, Product, ProductType
from counter.schemas import (
CounterFilterSchema,
@ -64,7 +62,6 @@ class CounterController(ControllerBase):
@route.get(
"/search",
response=PaginatedResponseSchema[SimplifiedCounterSchema],
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[CanAccessLookup],
)
@paginate(PageNumberPaginationExtra, page_size=50)
@ -77,7 +74,6 @@ class ProductController(ControllerBase):
@route.get(
"/search",
response=PaginatedResponseSchema[SimpleProductSchema],
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[CanAccessLookup],
)
@paginate(PageNumberPaginationExtra, page_size=50)

2
counter/models.py
View File

@ -61,7 +61,7 @@ class CustomerQuerySet(models.QuerySet):
Returns:
The number of updated rows.
Warning:
Warnings:
The execution time of this query grows really quickly.
When updating 500 customers, it may take around a second.
If you try to update all customers at once, the execution time

4
counter/schemas.py
View File

@ -5,7 +5,7 @@ from django.urls import reverse
from ninja import Field, FilterSchema, ModelSchema, Schema
from pydantic import model_validator
from club.schemas import SimpleClubSchema
from club.schemas import ClubSchema
from core.schemas import GroupSchema, SimpleUserSchema
from counter.models import Counter, Product, ProductType
@ -82,7 +82,7 @@ class ProductSchema(ModelSchema):
]
buying_groups: list[GroupSchema]
club: SimpleClubSchema
club: ClubSchema
product_type: SimpleProductTypeSchema | None
url: str

5
counter/static/bundled/counter/counter-click-index.ts
View File

@ -137,3 +137,8 @@ document.addEventListener("alpine:init", () => {
},
}));
});
$(() => {
// biome-ignore lint/suspicious/noExplicitAny: dealing with legacy jquery
($("#products") as any).tabs();
});

55
counter/templates/counter/counter_click.jinja
View File

@ -9,14 +9,12 @@
<link rel="stylesheet" type="text/css" href="{{ static('counter/css/counter-click.scss') }}" defer></link>
<link rel="stylesheet" type="text/css" href="{{ static('bundled/core/components/ajax-select-index.css') }}" defer></link>
<link rel="stylesheet" type="text/css" href="{{ static('core/components/ajax-select.scss') }}" defer></link>
<link rel="stylesheet" type="text/css" href="{{ static('core/components/tabs.scss') }}" defer></link>
<link rel="stylesheet" href="{{ static("core/components/card.scss") }}">
{% endblock %}
{% block additional_js %}
<script type="module" src="{{ static('bundled/counter/counter-click-index.ts') }}"></script>
<script type="module" src="{{ static('bundled/counter/components/counter-product-select-index.ts') }}"></script>
<script type="module" src="{{ static('bundled/core/components/tabs-index.ts') }}"></script>
{% endblock %}
{% block info_boxes %}
@ -207,32 +205,35 @@
{% trans %}No products available on this counter for this user{% endtrans %}
</div>
{% else %}
<ui-tab-group>
<ul>
{% for category in categories.keys() -%}
<ui-tab title="{{ category }}" {% if loop.index == 1 -%}active{%- endif -%}>
<h5 class="margin-bottom">{{ category }}</h5>
<div class="row gap-2x">
{% for product in categories[category] -%}
<button class="card shadow" @click="addToBasketWithMessage('{{ product.id }}', 1)">
<img
class="card-image"
alt="image de {{ product.name }}"
{% if product.icon %}
src="{{ product.icon.url }}"
{% else %}
src="{{ static('core/img/na.gif') }}"
{% endif %}
/>
<span class="card-content">
<strong class="card-title">{{ product.name }}</strong>
<p>{{ product.price }} €<br>{{ product.code }}</p>
</span>
</button>
{%- endfor %}
</div>
</ui-tab>
{% endfor %}
</ui-tab-group>
<li><a href="#cat_{{ category|slugify }}">{{ category }}</a></li>
{%- endfor %}
</ul>
{% for category in categories.keys() -%}
<div id="cat_{{ category|slugify }}">
<h5 class="margin-bottom">{{ category }}</h5>
<div class="row gap-2x">
{% for product in categories[category] -%}
<button class="card shadow" @click="addToBasketWithMessage('{{ product.id }}', 1)">
<img
class="card-image"
alt="image de {{ product.name }}"
{% if product.icon %}
src="{{ product.icon.url }}"
{% else %}
src="{{ static('core/img/na.gif') }}"
{% endif %}
/>
<span class="card-content">
<strong class="card-title">{{ product.name }}</strong>
<p>{{ product.price }} €<br>{{ product.code }}</p>
</span>
</button>
{%- endfor %}
</div>
</div>
{%- endfor %}
{% endif %}
</div>
</div>

4
counter/templates/counter/stats.jinja
View File

@ -5,6 +5,10 @@
{% trans counter_name=counter %}{{ counter_name }} stats{% endtrans %}
{% endblock %}
{% block jquery_css %}
{# Remove jquery_css #}
{% endblock %}
{% block content %}
<h3>{% trans counter_name=counter %}{{ counter_name }} stats{% endtrans %}</h3>
<h4>

BIN
docs/img/api_key_authorize_1.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 33 KiB

BIN
docs/img/api_key_authorize_2.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 49 KiB

6
docs/reference/api/auth.md
View File

@ -1,6 +0,0 @@
::: api.auth
handler: python
options:
heading_level: 3
members:
- ApiKeyAuth

8
docs/reference/api/hashers.md
View File

@ -1,8 +0,0 @@
::: api.hashers
handler: python
options:
heading_level: 3
members:
- Sha256ApiKeyHasher
- get_hasher
- generate_key

7
docs/reference/api/models.md
View File

@ -1,7 +0,0 @@
::: api.auth
handler: python
options:
heading_level: 3
members:
- ApiKey
- ApiClient

4
docs/reference/api/perms.md
View File

@ -1,4 +0,0 @@
::: api.permissions
handler: python
options:
heading_level: 3

9
docs/reference/core/auth.md
View File

@ -20,6 +20,13 @@
- CanCreateMixin
- CanEditMixin
- CanViewMixin
- CanEditPropMixin
- FormerSubscriberMixin
- PermissionOrAuthorRequiredMixin
## API Permissions
::: core.auth.api_permissions
handler: python
options:
heading_level: 3

215
docs/tutorial/api/connect.md
View File

@ -1,215 +0,0 @@
La connexion à l'API du site AE peut se faire par deux moyens :
- par le cookie de session du site ; si vous accédez à l'API depuis le sith
en étant connecté, cette méthode fonctionne par défaut
- par clef d'API ; si vous accédez à l'API depuis une application externe,
vous devez passer par cette méthode.
Comme la méthode par cookie de session ne devrait pas être utilisée
en dehors du cadre interne au site et qu'elle marche par défaut
dans le cadre de ce dernier, nous ne décrirons pas outre mesure la manière
de l'utiliser.
## Obtenir une clef d'API
Il n'y a, à l'heure actuelle, pas d'interface accessible sur le site
pour obtenir une clef d'API.
Si vous désirez en obtenir une, demandez directement au respo info.
!!!danger
Votre clef d'API doit rester secrète.
Ne la transmettez à personne, ne l'inscrivez pas en dur dans votre code.
Si votre clef a fuité, ou que vous soupçonnez qu'elle ait pu fuiter,
informez-en immédiatement l'équipe informatique !
## L'interface Swagger
Avant de commencer à utiliser l'API du site, vous pouvez explorer
les différentes routes qu'elle met à disposition,
avec les schémas de données attendus en requête et en réponse.
Pour cela, vous pouvez vous rendre sur
[https://ae.utbm.fr/api/docs](https://ae.utbm.fr/api/docs).
Toutes les routes, à de rares exceptions près, y sont recensées.
Vous pouvez les utiliser dans les limites
de ce à quoi vos permissions vous donnent droit
et de la méthode d'authentification.
Vous pouvez vous connecter directement sur l'interface Swagger,
en cliquant sur ce bouton, en haut à droite :
![Swagger auth (1)](../../img/api_key_authorize_1.png)
/// caption
Bouton d'autorisation sur Swagger
///
Puis rentrez votre clef d'API dans le champ prévu à cet effet,
et cliquez sur authorize :
![Swagger auth (2)](../../img/api_key_authorize_2.png)
/// caption
Saisie de la clef d'API
///
Les routes accessibles avec une clef d'API seront alors marquées par
une icône de cadenas fermé, sur la droite.
!!!warning "Authentification et permissions"
L'icône de cadenas signifie que la route accepte l'authentification
basée sur les clefs d'API, mais pas forcément que vous avez les
permissions nécessaires.
Si une route vous renvoie une erreur 403,
référez-en à l'équipe info, pour qu'elle puisse vous donner
les permissions nécessaires.
## Utiliser la clef d'API
### `X-APIKey`
Maintenant que vous avez la clef d'API,
il faut l'utiliser pour authentifier votre application
lorsqu'elle effectue des requêtes au site.
Pour cela, vous devez le fournir dans vos requêtes
à travers le header `X-APIKey`.
Par exemple :
```shell
curl "https://ae.utbm.fr/api/club/1" \
-H "X-APIKey: <votre clef d'API>"
```
Comme votre clef d'API doit rester absolument secrète,
vous ne devez en aucun cas la mettre dans votre code.
À la place, vous pouvez créer un fichier (par exemple, un `.env`)
qui contiendra votre clef et qui sera gitignoré.
```dotenv title=".env"
API_KEY="<votre clef d'API>"
```
Vous fournirez alors la clef d'API en la chargeant depuis votre environnement.
Notez que c'est une bonne pratique à double-titre,
puisque vous pouvez ainsi aisément changer votre clef d'API.
### Connexion persistante
La plupart des librairies permettant d'effectuer des requêtes
HTTP incluent une prise en charge des sessions persistantes.
Nous vous recommandons fortement d'utiliser ces fonctionnalités,
puisqu'elles permettent de rendre votre code plus simple
(vous n'aurez à renseigner votre clef d'API qu'une seule fois)
et plus efficace (réutiliser la même connexion plutôt que d'en créer
une nouvelle à chaque requête peut résulter en un gain de performance significatif ;
cf. [HTTP persistant connection (wikipedia)](https://en.wikipedia.org/wiki/HTTP_persistent_connection))
Voici quelques exemples :
=== "Python (requests)"
Dépendances :
- `requests` (>=2.32)
- `environs` (>=14.1)
```python
import requests
from environs import Env
env = Env()
env.read_env()
with requests.Session() as session:
session.headers["X-APIKey"] = env.str("API_KEY")
response = session.get("https://ae.utbm.fr/api/club/1")
print(response.json())
```
=== "Python (aiohttp)"
Dépendances :
- `aiohttp` (>=3.11)
- `environs` (>=14.1)
```python
import aiohttp
import asyncio
from environs import Env
env = Env()
env.read_env()
async def main():
async with aiohttp.ClientSession(
base_url="https://ae.utbm.fr/api/",
headers={"X-APIKey": env.str("API_KEY")}
) as session:
async with session.get("club/1") as res:
print(await res.json())
asyncio.run(main())
```
=== "Javascript (axios)"
Dépendances :
- `axios` (>=1.9)
- `dotenv` (>=16.5)
```javascript
import { axios } from "axios";
import { config } from "dotenv";
config();
const instance = axios.create({
baseUrl: "https://ae.utbm.fr/api/",
headers: { "X-APIKey": process.env.API_KEY }
});
console.log(await instance.get("club/1").json());
```
=== "Rust (reqwest)"
Dépendances :
- `reqwest` (>= 0.12, features `json` et `gzip`)
- `tokio` (>= 1.44, feature `derive`)
- `dotenvy` (>= 0.15)
```rust
use reqwest::Client;
use reqwest::header::{HeaderMap, HeaderValue};
use dotenvy::EnvLoader;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let env = EnvLoader::new().load()?;
let mut headers = HeaderMap::new();
let mut api_key = HeaderValue::from_str(env.var("API_KEY")?.as_str());
api_key.set_sensitive(true);
headers.insert("X-APIKey", api_key);
let client = Client::builder()
.default_headers(headers)
.gzip(true)
.build()?;
let resp = client
.get("https://ae.utbm.fr/api/club/1")
.send()
.await?
.json()
.await?;
println!("{resp:#?}");
Ok(())
}
```

175
docs/tutorial/api/dev.md
View File

@ -1,175 +0,0 @@
Pour l'API, nous utilisons `django-ninja` et sa surcouche `django-ninja-extra`.
Ce sont des librairies relativement simples et qui présentent
l'immense avantage d'offrir des mécanismes de validation et de sérialisation
de données à la fois simples et expressifs.
## Dossiers et fichiers
L'API possède une application (`api`)
à la racine du projet, contenant des utilitaires
et de la configuration partagée par toutes les autres applications.
C'est la pièce centrale de notre API, mais ce n'est pas là que
vous trouverez les routes de l'API.
Les routes en elles-mêmes sont contenues dans les autres applications,
de manière thématiques :
les routes liées aux clubs sont dans `club`, les routes liées
aux photos dans `sas` et ainsi de suite.
Les fichiers liés à l'API dans chaque application sont
`schemas.py` et `api.py`.
`schemas.py` contient les schémas de validation de données
et `api.py` contient les contrôleurs de l'API.
## Schéma de données
Le cœur de django-ninja étant sa validation de données grâce à Pydantic,
le développement de l'API commence par l'écriture de ses schémas de données.
Pour en comprendre le fonctionnement, veuillez consulter
[la doc de django-ninja](https://django-ninja.dev/guides/response/).
Il est également important de consulter
[la doc de pydantic](https://docs.pydantic.dev/latest/).
Notre surcouche par-dessus les schémas de django-ninja est relativement mince.
Elle ne comprend que [UploadedImage][core.schemas.UploadedImage], qui hérite de
[`UploadedFile`](https://django-ninja.dev/guides/input/file-params/?h=upl)
pour le restreindre uniquement aux images.
## Authentification et permissions
### Authentification
Notre API offre deux moyens d'authentification :
- par cookie de session (la méthode par défaut de django)
- par clef d'API
La plus grande partie des routes de l'API utilisent la méthode par cookie de session.
Pour placer une route d'API derrière l'une de ces méthodes (ou bien les deux),
utilisez l'attribut `auth` et les classes `SessionAuth` et
[`ApiKeyAuth`][api.auth.ApiKeyAuth].
!!!example
```python
@api_controller("/foo")
class FooController(ControllerBase):
# Cette route sera accessible uniquement avec l'authentification
# par cookie de session
@route.get("", auth=[SessionAuth()])
def fetch_foo(self, club_id: int): ...
# Et celle-ci sera accessible peut importe la méthode d'authentification
@route.get("/bar", auth=[SessionAuth(), ApiKeyAuth()])
def fetch_bar(self, club_id: int): ...
```
### Permissions
Si l'utilisateur est connecté, ça ne veut pas dire pour autant qu'il a accès à tout.
Une fois qu'il est authentifié, il faut donc vérifier ses permissions.
Pour cela, nous utilisons une surcouche
par-dessus `django-ninja`, le système de permissions de django
et notre propre système.
Cette dernière est documentée [ici](../perms.md).
### Limites des clefs d'API
#### Incompatibilité avec certaines permissions
Le système des clefs d'API est apparu très tard dans l'histoire du site
(en P25, 10 ans après le début du développement).
Il s'agit ni plus ni moins qu'un système d'authentification parallèle fait maison,
devant interagir avec un système de permissions ayant connu lui-même
une histoire assez chaotique.
Assez logiquement, on ne peut pas tout faire :
il n'est pas possible que toutes les routes acceptent
l'authentification par clef d'API.
Cette impossibilité provient majoritairement d'une incompatibilité
entre cette méthode d'authentification et le système de permissions
(qui n'a pas été prévu pour l'implémentation d'un client d'API).
Les principaux points de friction sont :
- `CanView` et `CanEdit`, qui se basent `User.can_view` et `User.can_edit`,
qui peuvent eux-mêmes se baser sur les méthodes `can_be_viewed_by`
et `can_be_edited_by` des différents modèles.
Or, ces dernières testent spécifiquement la relation entre l'objet et un `User`.
Ce comportement est possiblement changeable, mais au prix d'un certain travail
et au risque de transformer encore plus notre système de permissions
en usine à gaz.
- `IsSubscriber` et `OldSubscriber`, qui vérifient qu'un utilisateur est ou
a été cotisant.
Or, une clef d'API est liée à un client d'API, pas à un utilisateur.
Par définition, un client d'API ne peut pas être cotisant.
- `IsLoggedInCounter`, qui utilise encore un autre système
d'authentification maison et qui n'est pas fait pour être utilisé en dehors du site.
#### Incompatibilité avec les tokens csrf
Le [CSRF (*cross-site request forgery*)](https://fr.wikipedia.org/wiki/Cross-site_request_forgery)
est un des multiples facteurs d'attaque sur le web.
Heureusement, Django vient encore une fois à notre aide,
avec des mécanismes intégrés pour s'en protéger.
Ceux-ci incluent notamment un système de
[token CSRF](https://docs.djangoproject.com/fr/stable/ref/csrf/)
à fournir dans les requêtes POST/PUT/PATCH.
Ceux-ci sont bien adaptés au cycle requêtes/réponses
typique de l'expérience utilisateur sur un navigateur,
où les requêtes POST sont toujours effectuées après une requête
GET au cours de laquelle on a pu récupérer un token csrf.
Cependant, le flux des requêtes sur une API est bien différent ;
de ce fait, il est à attendre que les requêtes POST envoyées à l'API
par un client externe n'aient pas de token CSRF et se retrouvent
donc bloquées.
Pour ces raisons, l'accès aux requêtes POST/PUT/PATCH de l'API
par un client externe ne marche pas.
## Créer un client et une clef d'API
Le site n'a actuellement pas d'interface permettant à ses utilisateurs
de créer une application et des clefs d'API.
C'est volontaire : tant que le système ne sera pas suffisamment mature,
toute attribution de clef d'API doit passer par le pôle info.
Cette opération se fait au travers de l'interface admin.
Pour commencer, créez un client d'API, en renseignant son nom,
son propriétaire (l'utilisateur qui vous a demandé de le créer)
et les groupes qui lui sont attribués.
Ces groupes sont les mêmes que ceux qui sont attribués aux utilisateurs,
ce qui permet de réutiliser une partie du système d'authentification.
!!!warning
N'attribuez pas les groupes "anciens cotisants" et "cotisants"
aux clients d'API.
Un client d'API géré comme un cotisant, ça n'a aucun sens.
Evitez également de donner à des clients d'API des droits
autres que ceux de lecture sur le site.
Et surtout, n'attribuez jamais le group Root à un client d'API.
Une fois le client d'API créé, créez-lui une clef d'API.
Renseignez uniquement son nom et le client d'API auquel elle est lié.
La valeur de cette clef d'API est automatiquement générée
et affichée en haut de la page une fois la création complétée.
Notez bien la valeur de la clef d'API et transmettez-la à la personne
qui en a besoin.
Dites-lui bien de garder cette clef en lieu sûr !
Si la clef est perdue, il n'y a pas moyen de la récupérer,
vous devrez en recréer une.

32
docs/tutorial/groups.md
View File

@ -263,3 +263,35 @@ avec un unique champ permettant de sélectionner des groupes.
Par défaut, seuls les utilisateurs avec la permission
`auth.change_permission` auront accès à ce formulaire
(donc, normalement, uniquement les utilisateurs Root).
```mermaid
sequenceDiagram
participant A as Utilisateur
participant B as ReverseProxy
participant C as MarkdownImage
participant D as Model
A->>B: GET /page/foo
B->>C: GET /page/foo
C-->>B: La page, avec les urls
B-->>A: La page, avec les urls
alt image publique
A->>B: GET markdown/public/2025/img.webp
B-->>A: img.webp
end
alt image privée
A->>B: GET markdown_image/{id}
B->>C: GET markdown_image/{id}
C->>D: user.can_view(image)
alt l'utilisateur a le droit de voir l'image
D-->>C: True
C-->>B: 200 (avec le X-Accel-Redirect)
B-->>A: img.webp
end
alt l'utilisateur n'a pas le droit de l'image
D-->>C: False
C-->>B: 403
B-->>A: 403
end
end
```

2
docs/tutorial/perms.md
View File

@ -606,4 +606,4 @@ vous ne devriez pas être perdu, étant donné
que le système de permissions de l'API utilise
des noms assez similaires : `IsInGroup`, `IsRoot`, `IsSubscriber`...
Vous pouvez trouver des exemples d'utilisation de ce système
dans [cette partie](../reference/api/perms.md).
dans [cette partie](../reference/core/api_permissions.md).

130
docs/tutorial/structure.md
View File

@ -24,66 +24,62 @@ sith/
├── .github/
│ ├── actions/ (1)
│ └── workflows/ (2)
├── api/ (3)
├── club/ (3)
│ └── ...
├── antispam/ (4)
├── com/ (4)
│ └── ...
├── club/ (5)
├── core/ (5)
│ └── ...
├── com/ (6)
├── counter/ (6)
│ └── ...
├── core/ (7)
├── docs/ (7)
│ └── ...
├── counter/ (8)
├── eboutic/ (8)
│ └── ...
├── docs/ (9)
├── election/ (9)
│ └── ...
├── eboutic/ (10)
├── forum/ (10)
│ └── ...
├── election/ (11)
├── galaxy/ (11)
│ └── ...
├── forum/ (12)
├── locale/ (12)
│ └── ...
├── galaxy/ (13)
├── matmat/ (13)
│ └── ...
├── locale/ (14)
├── pedagogy/ (14)
│ └── ...
├── matmat/ (15)
├── rootplace/ (15)
│ └── ...
├── pedagogy/ (16)
├── sas/ (16)
│ └── ...
├── rootplace/ (17)
├── sith/ (17)
│ └── ...
├── sas/ (18)
├── subscription/ (18)
│ └── ...
├── sith/ (19)
├── trombi/ (19)
│ └── ...
├── subscription/ (20)
├── antispam/ (20)
│ └── ...
├── trombi/ (21)
├── staticfiles/ (21)
│ └── ...
├── antispam/ (22)
│ └── ...
├── staticfiles/ (23)
│ └── ...
├── processes/ (24)
├── processes/ (22)
│ └── ...
│
├── .coveragerc (25)
├── .envrc (26)
├── .coveragerc (23)
├── .envrc (24)
├── .gitattributes
├── .gitignore
├── .mailmap
├── .env (27)
├── .env.example (28)
├── manage.py (29)
├── mkdocs.yml (30)
├── .env (25)
├── .env.example (26)
├── manage.py (27)
├── mkdocs.yml (28)
├── uv.lock
├── pyproject.toml (31)
├── .venv/ (32)
├── .python-version (33)
├── Procfile.static (34)
├── Procfile.service (35)
├── pyproject.toml (29)
├── .venv/ (30)
├── .python-version (31)
├── Procfile.static (32)
├── Procfile.service (33)
└── README.md
```
</div>
@ -96,55 +92,53 @@ sith/
des workflows Github.
Par exemple, le workflow `docs.yml` compile
et publie la documentation à chaque push sur la branche `master`.
3. Application avec la configuration de l'API
4. Application contenant des utilitaires pour bloquer le spam et les bots
5. Application de gestion des clubs et de leurs membres.
6. Application contenant les fonctionnalités
3. Application de gestion des clubs et de leurs membres.
4. Application contenant les fonctionnalités
destinées aux responsables communication de l'AE.
7. Application contenant la modélisation centrale du site.
5. Application contenant la modélisation centrale du site.
On en reparle plus loin sur cette page.
8. Application de gestion des comptoirs, des permanences
6. Application de gestion des comptoirs, des permanences
sur ces comptoirs et des transactions qui y sont effectuées.
9. Dossier contenant la documentation.
10. Application de gestion de la boutique en ligne.
11. Application de gestion des élections.
12. Application de gestion du forum
13. Application de gestion de la galaxie ; la galaxie
7. Dossier contenant la documentation.
8. Application de gestion de la boutique en ligne.
9. Application de gestion des élections.
10. Application de gestion du forum
11. Application de gestion de la galaxie ; la galaxie
est un graphe des niveaux de proximité entre les différents
étudiants.
14. Dossier contenant les fichiers de traduction.
15. Fonctionnalités de recherche d'utilisateurs.
16. Le guide des UEs du site, sur lequel les utilisateurs
12. Dossier contenant les fichiers de traduction.
13. Fonctionnalités de recherche d'utilisateurs.
14. Le guide des UEs du site, sur lequel les utilisateurs
peuvent également laisser leurs avis.
17. Fonctionnalités utiles aux utilisateurs root.
18. Le SAS, où l'on trouve toutes les photos de l'AE.
19. Application principale du projet, contenant sa configuration.
20. Gestion des cotisations des utilisateurs du site.
21. Outil pour faciliter la fabrication des trombinoscopes de promo.
22. Fonctionnalités pour gérer le spam.
23. Gestion des statics du site. Override le système de statics de Django.
15. Fonctionnalités utiles aux utilisateurs root.
16. Le SAS, où l'on trouve toutes les photos de l'AE.
17. Application principale du projet, contenant sa configuration.
18. Gestion des cotisations des utilisateurs du site.
19. Outil pour faciliter la fabrication des trombinoscopes de promo.
20. Fonctionnalités pour gérer le spam.
21. Gestion des statics du site. Override le système de statics de Django.
Ajoute l'intégration du scss et du bundler js
de manière transparente pour l'utilisateur.
24. Module de gestion des services externes.
22. Module de gestion des services externes.
Offre une API simple pour utiliser les fichiers `Procfile.*`.
25. Fichier de configuration de coverage.
26. Fichier de configuration de direnv.
27. Contient les variables d'environnement, qui sont susceptibles
23. Fichier de configuration de coverage.
24. Fichier de configuration de direnv.
25. Contient les variables d'environnement, qui sont susceptibles
de varier d'une machine à l'autre.
28. Contient des valeurs par défaut pour le `.env`
26. Contient des valeurs par défaut pour le `.env`
pouvant convenir à un environnment de développement local
29. Fichier généré automatiquement par Django. C'est lui
27. Fichier généré automatiquement par Django. C'est lui
qui permet d'appeler des commandes de gestion du projet
avec la syntaxe `python ./manage.py <nom de la commande>`
30. Le fichier de configuration de la documentation,
28. Le fichier de configuration de la documentation,
avec ses plugins et sa table des matières.
31. Le fichier où sont déclarés les dépendances et la configuration
29. Le fichier où sont déclarés les dépendances et la configuration
de certaines d'entre elles.
32. Dossier d'environnement virtuel généré par uv
33. Fichier qui contrôle quelle version de python utiliser pour le projet
34. Fichier qui contrôle les commandes à lancer pour gérer la compilation
30. Dossier d'environnement virtuel généré par uv
31. Fichier qui contrôle quelle version de python utiliser pour le projet
32. Fichier qui contrôle les commandes à lancer pour gérer la compilation
automatique des static et autres services nécessaires à la command runserver.
35. Fichier qui contrôle les services tiers nécessaires au fonctionnement
33. Fichier qui contrôle les services tiers nécessaires au fonctionnement
du Sith tel que redis.
## L'application principale

2
eboutic/api.py
View File

@ -1,7 +1,7 @@
from ninja_extra import ControllerBase, api_controller, route
from ninja_extra.exceptions import NotFound
from api.permissions import CanView
from core.auth.api_permissions import CanView
from counter.models import BillingInfo
from eboutic.models import Basket

4
eboutic/templates/eboutic/eboutic_checkout.jinja
View File

@ -4,6 +4,10 @@
{% trans %}Basket state{% endtrans %}
{% endblock %}
{% block jquery_css %}
{# Remove jquery css #}
{% endblock %}
{% block additional_js %}
<script type="module" src="{{ static('bundled/eboutic/checkout-index.ts') }}"></script>
{% endblock %}

4
eboutic/templates/eboutic/eboutic_main.jinja
View File

@ -4,6 +4,10 @@
{% trans %}Eboutic{% endtrans %}
{% endblock %}
{% block jquery_css %}
{# Remove jquery css #}
{% endblock %}
{% block additional_js %}
{# This script contains the code to perform requests to manipulate the
user basket without having to reload the page #}

4
election/static/election/css/election.scss
View File

@ -93,14 +93,13 @@ $min_col_width: 100px;
align-items: center;
justify-content: space-between;
margin: 0;
gap: 20px;
row-gap: 10px;
padding: $padding;
width: 100%;
>.role_text {
display: flex;
width: 100%;
flex-direction: column;
>h4 {
@ -108,6 +107,7 @@ $min_col_width: 100px;
}
.role_description {
flex-grow: 1;
margin-top: .5em;
text-wrap: auto;
text-align: left;

16
galaxy/management/commands/generate_galaxy_test_data.py
View File

@ -25,13 +25,12 @@ import warnings
from datetime import timedelta
from typing import Final, Optional
from django.conf import settings
from django.core.files.base import ContentFile
from django.core.management.base import BaseCommand
from django.utils import timezone
from club.models import Club, Membership
from core.models import Group, Page, SithFile, User
from core.models import Group, Page, User
from core.utils import RED_PIXEL_PNG
from sas.models import Album, PeoplePictureRelation, Picture
from subscription.models import Subscription
@ -91,13 +90,8 @@ class Command(BaseCommand):
self.NB_CLUBS = options["club_count"]
root = User.objects.filter(username="root").first()
sas = SithFile.objects.get(id=settings.SITH_SAS_ROOT_DIR_ID)
self.galaxy_album = Album.objects.create(
name="galaxy-register-file",
owner=root,
is_moderated=True,
is_in_sas=True,
parent=sas,
name="galaxy-register-file", owner=root, is_moderated=True
)
self.make_clubs()
@ -285,14 +279,10 @@ class Command(BaseCommand):
owner=u,
name=f"galaxy-picture {u} {i // self.NB_USERS}",
is_moderated=True,
is_folder=False,
parent=self.galaxy_album,
is_in_sas=True,
file=ContentFile(RED_PIXEL_PNG),
original=ContentFile(RED_PIXEL_PNG),
compressed=ContentFile(RED_PIXEL_PNG),
thumbnail=ContentFile(RED_PIXEL_PNG),
mime_type="image/png",
size=len(RED_PIXEL_PNG),
)
)
self.picts[i].file.name = self.picts[i].name

880
locale/fr/LC_MESSAGES/django.po
View File

@ -6,7 +6,7 @@
msgid ""
msgstr ""
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2025-06-16 14:54+0200\n"
"POT-Creation-Date: 2025-06-04 09:58+0200\n"
"PO-Revision-Date: 2016-07-18\n"
"Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
"Language-Team: AE info <ae.info@utbm.fr>\n"
@ -16,6 +16,767 @@ msgstr ""
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=2; plural=(n > 1);\n"
#: accounting/models.py club/models.py com/models.py counter/models.py
#: forum/models.py launderette/models.py sas/models.py
msgid "name"
msgstr "nom"
#: accounting/models.py
msgid "street"
msgstr "rue"
#: accounting/models.py
msgid "city"
msgstr "ville"
#: accounting/models.py
msgid "postcode"
msgstr "code postal"
#: accounting/models.py
msgid "country"
msgstr "pays"
#: accounting/models.py core/models.py
msgid "phone"
msgstr "téléphone"
#: accounting/models.py
msgid "email"
msgstr "email"
#: accounting/models.py
msgid "website"
msgstr "site internet"
#: accounting/models.py
msgid "company"
msgstr "entreprise"
#: accounting/models.py
msgid "iban"
msgstr "IBAN"
#: accounting/models.py
msgid "account number"
msgstr "numéro de compte"
#: accounting/models.py club/models.py com/models.py counter/models.py
#: trombi/models.py
msgid "club"
msgstr "club"
#: accounting/models.py
msgid "Bank account"
msgstr "Compte en banque"
#: accounting/models.py
msgid "bank account"
msgstr "compte en banque"
#: accounting/models.py
msgid "Club account"
msgstr "Compte club"
#: accounting/models.py
#, python-format
msgid "%(club_account)s on %(bank_account)s"
msgstr "%(club_account)s sur %(bank_account)s"
#: accounting/models.py club/models.py counter/models.py election/models.py
#: launderette/models.py
msgid "start date"
msgstr "date de début"
#: accounting/models.py club/models.py counter/models.py election/models.py
msgid "end date"
msgstr "date de fin"
#: accounting/models.py
msgid "is closed"
msgstr "est fermé"
#: accounting/models.py
msgid "club account"
msgstr "compte club"
#: accounting/models.py counter/models.py
msgid "amount"
msgstr "montant"
#: accounting/models.py
msgid "effective_amount"
msgstr "montant effectif"
#: accounting/models.py
msgid "General journal"
msgstr "Classeur"
#: accounting/models.py
msgid "number"
msgstr "numéro"
#: accounting/models.py
msgid "journal"
msgstr "classeur"
#: accounting/models.py core/models.py counter/models.py eboutic/models.py
#: forum/models.py
msgid "date"
msgstr "date"
#: accounting/models.py counter/models.py pedagogy/models.py
msgid "comment"
msgstr "commentaire"
#: accounting/models.py counter/models.py subscription/models.py
msgid "payment method"
msgstr "méthode de paiement"
#: accounting/models.py
msgid "cheque number"
msgstr "numéro de chèque"
#: accounting/models.py eboutic/models.py
msgid "invoice"
msgstr "facture"
#: accounting/models.py
msgid "is done"
msgstr "est fait"
#: accounting/models.py
msgid "simple type"
msgstr "type simplifié"
#: accounting/models.py
msgid "accounting type"
msgstr "type comptable"
#: accounting/models.py core/models.py counter/models.py
msgid "label"
msgstr "étiquette"
#: accounting/models.py
msgid "target type"
msgstr "type de cible"
#: accounting/models.py club/models.py club/templates/club/club_members.jinja
#: club/templates/club/club_old_members.jinja club/templates/club/mailing.jinja
#: counter/templates/counter/cash_summary_list.jinja
#: counter/templates/counter/stats.jinja
#: launderette/templates/launderette/launderette_admin.jinja
msgid "User"
msgstr "Utilisateur"
#: accounting/models.py club/models.py club/templates/club/club_detail.jinja
#: com/templates/com/mailing_admin.jinja
#: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
#: core/templates/core/user_clubs.jinja
#: counter/templates/counter/invoices_call.jinja
#: trombi/templates/trombi/edit_profile.jinja
#: trombi/templates/trombi/export.jinja
#: trombi/templates/trombi/user_profile.jinja
msgid "Club"
msgstr "Club"
#: accounting/models.py core/views/user.py
msgid "Account"
msgstr "Compte"
#: accounting/models.py
msgid "Company"
msgstr "Entreprise"
#: accounting/models.py core/models.py sith/settings.py
msgid "Other"
msgstr "Autre"
#: accounting/models.py
msgid "target id"
msgstr "id de la cible"
#: accounting/models.py
msgid "target label"
msgstr "nom de la cible"
#: accounting/models.py
msgid "linked operation"
msgstr "opération liée"
#: accounting/models.py
msgid "The date must be set."
msgstr "La date doit être indiquée."
#: accounting/models.py
#, python-format
msgid ""
"The date can not be before the start date of the journal, which is\n"
"%(start_date)s."
msgstr ""
"La date ne peut pas être avant la date de début du journal, qui est\n"
"%(start_date)s."
#: accounting/models.py
msgid "Target does not exists"
msgstr "La cible n'existe pas."
#: accounting/models.py
msgid "Please add a target label if you set no existing target"
msgstr ""
"Merci d'ajouter un nom de cible si vous ne spécifiez pas de cible existante"
#: accounting/models.py
msgid ""
"You need to provide ether a simplified accounting type or a standard "
"accounting type"
msgstr ""
"Vous devez fournir soit un type comptable simplifié ou un type comptable "
"standard"
#: accounting/models.py counter/models.py pedagogy/models.py
msgid "code"
msgstr "code"
#: accounting/models.py
msgid "An accounting type code contains only numbers"
msgstr "Un code comptable ne contient que des numéros"
#: accounting/models.py
msgid "movement type"
msgstr "type de mouvement"
#: accounting/models.py
#: accounting/templates/accounting/journal_statement_nature.jinja
#: accounting/templates/accounting/journal_statement_person.jinja
#: accounting/views.py
msgid "Credit"
msgstr "Crédit"
#: accounting/models.py
#: accounting/templates/accounting/journal_statement_nature.jinja
#: accounting/templates/accounting/journal_statement_person.jinja
#: accounting/views.py
msgid "Debit"
msgstr "Débit"
#: accounting/models.py
msgid "Neutral"
msgstr "Neutre"
#: accounting/models.py
msgid "simplified accounting types"
msgstr "type simplifié"
#: accounting/models.py
msgid "simplified type"
msgstr "type simplifié"
#: accounting/templates/accounting/accountingtype_list.jinja
msgid "Accounting type list"
msgstr "Liste des types comptable"
#: accounting/templates/accounting/accountingtype_list.jinja
#: accounting/templates/accounting/bank_account_details.jinja
#: accounting/templates/accounting/bank_account_list.jinja
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/label_list.jinja
#: accounting/templates/accounting/operation_edit.jinja
#: accounting/templates/accounting/simplifiedaccountingtype_list.jinja
#: core/templates/core/user_tools.jinja
msgid "Accounting"
msgstr "Comptabilité"
#: accounting/templates/accounting/accountingtype_list.jinja
msgid "Accounting types"
msgstr "Type comptable"
#: accounting/templates/accounting/accountingtype_list.jinja
msgid "New accounting type"
msgstr "Nouveau type comptable"
#: accounting/templates/accounting/accountingtype_list.jinja
#: accounting/templates/accounting/simplifiedaccountingtype_list.jinja
msgid "There is no types in this website."
msgstr "Il n'y a pas de types comptable dans ce site web."
#: accounting/templates/accounting/bank_account_details.jinja
#: core/templates/core/user_tools.jinja
msgid "Bank account: "
msgstr "Compte en banque : "
#: accounting/templates/accounting/bank_account_details.jinja
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/label_list.jinja
#: club/templates/club/club_sellings.jinja club/templates/club/mailing.jinja
#: com/templates/com/macros.jinja com/templates/com/mailing_admin.jinja
#: com/templates/com/news_admin_list.jinja com/templates/com/poster_edit.jinja
#: com/templates/com/screen_edit.jinja com/templates/com/weekmail.jinja
#: core/templates/core/file_detail.jinja
#: core/templates/core/file_moderation.jinja
#: core/templates/core/group_detail.jinja core/templates/core/group_list.jinja
#: core/templates/core/macros.jinja core/templates/core/page_prop.jinja
#: core/templates/core/user_account_detail.jinja
#: core/templates/core/user_clubs.jinja core/templates/core/user_edit.jinja
#: counter/templates/counter/fragments/create_student_card.jinja
#: counter/templates/counter/last_ops.jinja
#: election/templates/election/election_detail.jinja
#: forum/templates/forum/macros.jinja
#: launderette/templates/launderette/launderette_admin.jinja
#: launderette/views.py pedagogy/templates/pedagogy/guide.jinja
#: pedagogy/templates/pedagogy/uv_detail.jinja sas/templates/sas/album.jinja
#: sas/templates/sas/moderation.jinja sas/templates/sas/picture.jinja
#: trombi/templates/trombi/detail.jinja
#: trombi/templates/trombi/edit_profile.jinja
msgid "Delete"
msgstr "Supprimer"
#: accounting/templates/accounting/bank_account_details.jinja club/views.py
#: core/views/user.py sas/templates/sas/picture.jinja
msgid "Infos"
msgstr "Infos"
#: accounting/templates/accounting/bank_account_details.jinja
msgid "IBAN: "
msgstr "IBAN : "
#: accounting/templates/accounting/bank_account_details.jinja
msgid "Number: "
msgstr "Numéro : "
#: accounting/templates/accounting/bank_account_details.jinja
msgid "New club account"
msgstr "Nouveau compte club"
#: accounting/templates/accounting/bank_account_details.jinja
#: accounting/templates/accounting/bank_account_list.jinja
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja club/views.py
#: com/templates/com/news_admin_list.jinja com/templates/com/poster_list.jinja
#: com/templates/com/screen_list.jinja com/templates/com/weekmail.jinja
#: core/templates/core/file.jinja core/templates/core/group_list.jinja
#: core/templates/core/page.jinja core/templates/core/user_tools.jinja
#: core/views/user.py counter/templates/counter/cash_summary_list.jinja
#: counter/templates/counter/counter_list.jinja
#: election/templates/election/election_detail.jinja
#: forum/templates/forum/macros.jinja
#: launderette/templates/launderette/launderette_list.jinja
#: pedagogy/templates/pedagogy/guide.jinja
#: pedagogy/templates/pedagogy/uv_detail.jinja sas/templates/sas/album.jinja
#: trombi/templates/trombi/detail.jinja
#: trombi/templates/trombi/edit_profile.jinja
msgid "Edit"
msgstr "Éditer"
#: accounting/templates/accounting/bank_account_list.jinja
msgid "Bank account list"
msgstr "Liste des comptes en banque"
#: accounting/templates/accounting/bank_account_list.jinja
msgid "Manage simplified types"
msgstr "Gérer les types simplifiés"
#: accounting/templates/accounting/bank_account_list.jinja
msgid "Manage accounting types"
msgstr "Gérer les types comptable"
#: accounting/templates/accounting/bank_account_list.jinja
msgid "New bank account"
msgstr "Nouveau compte en banque"
#: accounting/templates/accounting/bank_account_list.jinja
msgid "There is no accounts in this website."
msgstr "Il n'y a pas de comptes dans ce site web."
#: accounting/templates/accounting/club_account_details.jinja
msgid "Club account:"
msgstr "Compte club : "
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/label_list.jinja
msgid "New label"
msgstr "Nouvelle étiquette"
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/label_list.jinja
msgid "Label list"
msgstr "Liste des étiquettes"
#: accounting/templates/accounting/club_account_details.jinja
msgid "New journal"
msgstr "Nouveau classeur"
#: accounting/templates/accounting/club_account_details.jinja
msgid "You can not create new journal while you still have one opened"
msgstr "Vous ne pouvez pas créer de journal tant qu'il y en a un d'ouvert"
#: accounting/templates/accounting/club_account_details.jinja
#: launderette/templates/launderette/launderette_admin.jinja
msgid "Name"
msgstr "Nom"
#: accounting/templates/accounting/club_account_details.jinja
#: com/templates/com/news_admin_list.jinja
msgid "Start"
msgstr "Début"
#: accounting/templates/accounting/club_account_details.jinja
#: com/templates/com/news_admin_list.jinja
msgid "End"
msgstr "Fin"
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
#: core/templates/core/user_account_detail.jinja
#: counter/templates/counter/last_ops.jinja
#: counter/templates/counter/refilling_list.jinja
msgid "Amount"
msgstr "Montant"
#: accounting/templates/accounting/club_account_details.jinja
msgid "Effective amount"
msgstr "Montant effectif"
#: accounting/templates/accounting/club_account_details.jinja sith/settings.py
msgid "Closed"
msgstr "Fermé"
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
#: com/templates/com/mailing_admin.jinja
#: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
#: counter/templates/counter/refilling_list.jinja
msgid "Actions"
msgstr "Actions"
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
msgid "Yes"
msgstr "Oui"
#: accounting/templates/accounting/club_account_details.jinja
#: accounting/templates/accounting/journal_details.jinja
msgid "No"
msgstr "Non"
#: accounting/templates/accounting/club_account_details.jinja
#: com/templates/com/news_admin_list.jinja core/templates/core/file.jinja
#: core/templates/core/page.jinja
msgid "View"
msgstr "Voir"
#: accounting/templates/accounting/co_list.jinja
#: accounting/templates/accounting/journal_details.jinja
#: core/templates/core/user_tools.jinja
msgid "Company list"
msgstr "Liste des entreprises"
#: accounting/templates/accounting/co_list.jinja
msgid "Create new company"
msgstr "Nouvelle entreprise"
#: accounting/templates/accounting/co_list.jinja
msgid "Companies"
msgstr "Entreprises"
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/journal_statement_accounting.jinja
#: accounting/templates/accounting/journal_statement_nature.jinja
#: accounting/templates/accounting/journal_statement_person.jinja
msgid "General journal:"
msgstr "Classeur : "
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/journal_statement_accounting.jinja
#: core/templates/core/user_account.jinja
#: core/templates/core/user_account_detail.jinja
#: counter/templates/counter/counter_click.jinja
msgid "Amount: "
msgstr "Montant : "
#: accounting/templates/accounting/journal_details.jinja
#: accounting/templates/accounting/journal_statement_accounting.jinja
msgid "Effective amount: "
msgstr "Montant effectif: "
#: accounting/templates/accounting/journal_details.jinja
msgid "Journal is closed, you can not create operation"
msgstr "Le classeur est fermé, vous ne pouvez pas créer d'opération"
#: accounting/templates/accounting/journal_details.jinja
msgid "New operation"
msgstr "Nouvelle opération"
#: accounting/templates/accounting/journal_details.jinja
msgid "Nb"
msgstr "No"
#: accounting/templates/accounting/journal_details.jinja
#: club/templates/club/club_sellings.jinja
#: core/templates/core/user_account_detail.jinja
#: counter/templates/counter/cash_summary_list.jinja
#: counter/templates/counter/last_ops.jinja
#: counter/templates/counter/refilling_list.jinja
#: rootplace/templates/rootplace/logs.jinja sas/forms.py
#: trombi/templates/trombi/user_profile.jinja
msgid "Date"
msgstr "Date"
#: accounting/templates/accounting/journal_details.jinja
#: club/templates/club/club_sellings.jinja
#: core/templates/core/user_account_detail.jinja
#: counter/templates/counter/last_ops.jinja
#: rootplace/templates/rootplace/logs.jinja
msgid "Label"
msgstr "Étiquette"
#: accounting/templates/accounting/journal_details.jinja
msgid "Payment mode"
msgstr "Méthode de paiement"
#: accounting/templates/accounting/journal_details.jinja
msgid "Target"
msgstr "Cible"
#: accounting/templates/accounting/journal_details.jinja
msgid "Code"
msgstr "Code"
#: accounting/templates/accounting/journal_details.jinja
msgid "Nature"
msgstr "Nature"
#: accounting/templates/accounting/journal_details.jinja
msgid "Done"
msgstr "Effectuées"
#: accounting/templates/accounting/journal_details.jinja
#: counter/templates/counter/cash_summary_list.jinja counter/views/cash.py
#: pedagogy/templates/pedagogy/moderation.jinja
#: pedagogy/templates/pedagogy/uv_detail.jinja
#: trombi/templates/trombi/comment.jinja
#: trombi/templates/trombi/user_tools.jinja
msgid "Comment"
msgstr "Commentaire"
#: accounting/templates/accounting/journal_details.jinja
msgid "File"
msgstr "Fichier"
#: accounting/templates/accounting/journal_details.jinja
msgid "PDF"
msgstr "PDF"
#: accounting/templates/accounting/journal_details.jinja
msgid ""
"Warning: this operation has no linked operation because the targeted club "
"account has no opened journal."
msgstr ""
"Attention: cette opération n'a pas d'opération liée parce qu'il n'y a pas de "
"classeur ouvert dans le compte club cible"
#: accounting/templates/accounting/journal_details.jinja
#, python-format
msgid ""
"Open a journal in <a href=\"%(url)s\">this club account</a>, then save this "
"operation again to make the linked operation."
msgstr ""
"Ouvrez un classeur dans <a href=\"%(url)s\">ce compte club</a>, puis sauver "
"cette opération à nouveau pour créer l'opération liée."
#: accounting/templates/accounting/journal_details.jinja
msgid "Generate"
msgstr "Générer"
#: accounting/templates/accounting/journal_statement_accounting.jinja
msgid "Accounting statement: "
msgstr "Bilan comptable : "
#: accounting/templates/accounting/journal_statement_accounting.jinja
#: rootplace/templates/rootplace/logs.jinja
msgid "Operation type"
msgstr "Type d'opération"
#: accounting/templates/accounting/journal_statement_accounting.jinja
#: accounting/templates/accounting/journal_statement_nature.jinja
#: accounting/templates/accounting/journal_statement_person.jinja
#: counter/templates/counter/invoices_call.jinja
msgid "Sum"
msgstr "Somme"
#: accounting/templates/accounting/journal_statement_nature.jinja
msgid "Nature of operation"
msgstr "Nature de l'opération"
#: accounting/templates/accounting/journal_statement_nature.jinja
#: club/templates/club/club_sellings.jinja
#: counter/templates/counter/counter_main.jinja
msgid "Total: "
msgstr "Total : "
#: accounting/templates/accounting/journal_statement_nature.jinja
msgid "Statement by nature: "
msgstr "Bilan par nature : "
#: accounting/templates/accounting/journal_statement_person.jinja
msgid "Statement by person: "
msgstr "Bilan par personne : "
#: accounting/templates/accounting/journal_statement_person.jinja
msgid "Target of the operation"
msgstr "Cible de l'opération"
#: accounting/templates/accounting/label_list.jinja
msgid "Back to club account"
msgstr "Retour au compte club"
#: accounting/templates/accounting/label_list.jinja
msgid "There is no label in this club account."
msgstr "Il n'y a pas d'étiquette dans ce compte club."
#: accounting/templates/accounting/operation_edit.jinja
msgid "Edit operation"
msgstr "Éditer l'opération"
#: accounting/templates/accounting/operation_edit.jinja
msgid ""
"Warning: if you select <em>Account</em>, the opposite operation will be "
"created in the target account. If you don't want that, select <em>Club</em> "
"instead of <em>Account</em>."
msgstr ""
"Attention : si vous sélectionnez <em>Compte</em>, l'opération inverse sera "
"créée dans le compte cible. Si vous ne le voulez pas, sélectionnez <em>Club</"
"em> à la place de <em>Compte</em>."
#: accounting/templates/accounting/operation_edit.jinja
msgid "Linked operation:"
msgstr "Opération liée : "
#: accounting/templates/accounting/operation_edit.jinja
#: com/templates/com/news_edit.jinja com/templates/com/poster_edit.jinja
#: com/templates/com/screen_edit.jinja com/templates/com/weekmail.jinja
#: core/templates/core/create.jinja core/templates/core/edit.jinja
#: core/templates/core/file_edit.jinja core/templates/core/macros_pages.jinja
#: core/templates/core/page_prop.jinja
#: core/templates/core/user_godfathers.jinja
#: core/templates/core/user_godfathers_tree.jinja
#: core/templates/core/user_preferences.jinja
#: counter/templates/counter/cash_register_summary.jinja
#: forum/templates/forum/reply.jinja
#: subscription/templates/subscription/fragments/creation_form.jinja
#: trombi/templates/trombi/comment.jinja
#: trombi/templates/trombi/edit_profile.jinja
#: trombi/templates/trombi/user_tools.jinja
msgid "Save"
msgstr "Sauver"
#: accounting/templates/accounting/refound_account.jinja accounting/views.py
msgid "Refound account"
msgstr "Remboursement de compte"
#: accounting/templates/accounting/refound_account.jinja
msgid "Refound"
msgstr "Rembourser"
#: accounting/templates/accounting/simplifiedaccountingtype_list.jinja
msgid "Simplified type list"
msgstr "Liste des types simplifiés"
#: accounting/templates/accounting/simplifiedaccountingtype_list.jinja
msgid "Simplified types"
msgstr "Types simplifiés"
#: accounting/templates/accounting/simplifiedaccountingtype_list.jinja
msgid "New simplified type"
msgstr "Nouveau type simplifié"
#: accounting/views.py
msgid "Journal"
msgstr "Classeur"
#: accounting/views.py
msgid "Statement by nature"
msgstr "Bilan par nature"
#: accounting/views.py
msgid "Statement by person"
msgstr "Bilan par personne"
#: accounting/views.py
msgid "Accounting statement"
msgstr "Bilan comptable"
#: accounting/views.py
msgid "Link this operation to the target account"
msgstr "Lier cette opération au compte cible"
#: accounting/views.py
msgid "The target must be set."
msgstr "La cible doit être indiquée."
#: accounting/views.py
msgid "The amount must be set."
msgstr "Le montant doit être indiqué."
#: accounting/views.py
msgid "Operation"
msgstr "Opération"
#: accounting/views.py
msgid "Financial proof: "
msgstr "Justificatif de libellé : "
#: accounting/views.py
#, python-format
msgid "Club: %(club_name)s"
msgstr "Club : %(club_name)s"
#: accounting/views.py
#, python-format
msgid "Label: %(op_label)s"
msgstr "Libellé : %(op_label)s"
#: accounting/views.py
#, python-format
msgid "Date: %(date)s"
msgstr "Date : %(date)s"
#: accounting/views.py
#, python-format
msgid "Amount: %(amount).2f €"
msgstr "Montant : %(amount).2f €"
#: accounting/views.py
msgid "Debtor"
msgstr "Débiteur"
#: accounting/views.py
msgid "Creditor"
msgstr "Créditeur"
#: accounting/views.py
msgid "Comment:"
msgstr "Commentaire :"
#: accounting/views.py
msgid "Signature:"
msgstr "Signature :"
#: accounting/views.py
msgid "General statement"
msgstr "Bilan général"
#: accounting/views.py
msgid "No label operations"
msgstr "Opérations sans étiquette"
#: accounting/views.py
msgid "Refound this account"
msgstr "Rembourser ce compte"
#: antispam/forms.py
msgid "Email domain is not allowed."
msgstr "Le domaine de l'addresse e-mail n'est pas autorisé."
@ -35,68 +796,6 @@ msgstr ""
"True si gardé à jour par le biais d'un fournisseur externe de domains "
"toxics, False sinon"
#: api/admin.py
#, python-format
msgid ""
"The API key for %(name)s is: %(key)s. Please store it somewhere safe: you "
"will not be able to see it again."
msgstr ""
"La clef d'API pour %(name)s est : %(key)s. Gardez-là dans un emplacement "
"sûr : vous ne pourrez pas la revoir à nouveau."
#: api/admin.py
msgid "Revoke selected API keys"
msgstr "Révoquer les clefs d'API sélectionnées"
#: api/models.py club/models.py com/models.py counter/models.py forum/models.py
msgid "name"
msgstr "nom"
#: api/models.py core/models.py
msgid "owner"
msgstr "propriétaire"
#: api/models.py core/models.py
msgid "groups"
msgstr "groupes"
#: api/models.py
msgid "client permissions"
msgstr "permissions du client"
#: api/models.py
msgid "Specific permissions for this api client."
msgstr "Permissions spécifiques pour ce client d'API"
#: api/models.py
msgid "api client"
msgstr "client d'api"
#: api/models.py
msgid "api clients"
msgstr "clients d'api"
#: api/models.py
msgid "prefix"
msgstr "préfixe"
#: api/models.py
msgid "hashed key"
msgstr "hash de la clef"
#: api/models.py
msgctxt "api key"
msgid "revoked"
msgstr "révoquée"
#: api/models.py
msgid "api key"
msgstr "clef d'api"
#: api/models.py
msgid "api keys"
msgstr "clefs d'api"
#: club/forms.py
msgid "Users to add"
msgstr "Utilisateurs à ajouter"
@ -181,6 +880,10 @@ msgstr "Vous devez choisir un rôle"
msgid "You do not have the permission to do that"
msgstr "Vous n'avez pas la permission de faire cela"
#: club/models.py com/models.py counter/models.py forum/models.py
msgid "name"
msgstr "nom"
#: club/models.py
msgid "slug name"
msgstr "nom slug"
@ -267,7 +970,7 @@ msgid "Enter a valid address. Only the root of the address is needed."
msgstr ""
"Entrez une adresse valide. Seule la racine de l'adresse est nécessaire."
#: club/models.py com/models.py core/models.py
#: club/models.py com/models.py core/models.py sas/models.py
msgid "is moderated"
msgstr "est modéré"
@ -727,7 +1430,8 @@ msgstr "message d'info"
msgid "weekmail destinations"
msgstr "destinataires du weekmail"
#: com/models.py election/models.py forum/models.py pedagogy/models.py
#: com/models.py core/templates/core/macros.jinja election/models.py
#: forum/models.py pedagogy/models.py
msgid "title"
msgstr "titre"
@ -1152,7 +1856,7 @@ msgstr "Nouvel article"
msgid "Articles in no weekmail yet"
msgstr "Articles dans aucun weekmail"
#: com/templates/com/weekmail.jinja
#: com/templates/com/weekmail.jinja core/templates/core/macros.jinja
msgid "Content"
msgstr "Contenu"
@ -1314,6 +2018,10 @@ msgstr "surnom"
msgid "last update"
msgstr "dernière mise à jour"
#: core/models.py
msgid "groups"
msgstr "groupes"
#: core/models.py
msgid ""
"The groups this user belongs to. A user will get all permissions granted to "
@ -1534,11 +2242,11 @@ msgstr "avoir une notification pour chaque click"
msgid "get a notification for every refilling"
msgstr "avoir une notification pour chaque rechargement"
#: core/models.py sas/forms.py
#: core/models.py sas/models.py
msgid "file name"
msgstr "nom du fichier"
#: core/models.py
#: core/models.py sas/models.py
msgid "parent"
msgstr "parent"
@ -1546,10 +2254,14 @@ msgstr "parent"
msgid "compressed file"
msgstr "version allégée"
#: core/models.py
#: core/models.py sas/models.py
msgid "thumbnail"
msgstr "miniature"
#: core/models.py sas/models.py
msgid "owner"
msgstr "propriétaire"
#: core/models.py
msgid "edit group"
msgstr "groupe d'édition"
@ -1578,10 +2290,6 @@ msgstr "date"
msgid "asked for removal"
msgstr "retrait demandé"
#: core/models.py
msgid "is in the SAS"
msgstr "est dans le SAS"
#: core/models.py
msgid "Character '/' not authorized in name"
msgstr "Le caractère '/' n'est pas autorisé dans les noms de fichier"
@ -2774,6 +3482,10 @@ msgstr "Erreur d'envoi du fichier %(file_name)s : %(msg)s"
msgid "Apply rights recursively"
msgstr "Appliquer les droits récursivement"
#: core/views/forms.py
msgid "Choose file"
msgstr "Choisir un fichier"
#: core/views/forms.py
msgid "Choose user"
msgstr "Choisir un utilisateur"
@ -3171,7 +3883,7 @@ msgstr "élément de relevé de caisse"
msgid "banner"
msgstr "bannière"
#: counter/models.py
#: counter/models.py sas/models.py
msgid "event date"
msgstr "date de l'événement"
@ -3936,11 +4648,11 @@ msgstr "début des candidatures"
msgid "end candidature"
msgstr "fin des candidatures"
#: election/models.py
#: election/models.py sas/models.py
msgid "edit groups"
msgstr "groupe d'édition"
#: election/models.py
#: election/models.py sas/models.py
msgid "view groups"
msgstr "groupe de vue"
@ -4655,6 +5367,22 @@ msgstr "Envoyer les images"
msgid "You already requested moderation for this picture."
msgstr "Vous avez déjà déposé une demande de retrait pour cette photo."
#: sas/models.py
msgid "The date on which the photos in this album were taken"
msgstr "La date à laquelle les photos de cet album ont été prises"
#: sas/models.py
msgid "album"
msgstr "album"
#: sas/models.py
msgid "original image"
msgstr "image originale"
#: sas/models.py
msgid "compressed image"
msgstr "version compressée"
#: sas/models.py
msgid "picture"
msgstr "photo"

12
locale/fr/LC_MESSAGES/djangojs.po
View File

@ -7,7 +7,7 @@
msgid ""
msgstr ""
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2025-05-18 12:17+0200\n"
"POT-Creation-Date: 2025-04-13 00:18+0200\n"
"PO-Revision-Date: 2024-09-17 11:54+0200\n"
"Last-Translator: Sli <antoine@bartuccio.fr>\n"
"Language-Team: AE info <ae.info@utbm.fr>\n"
@ -37,15 +37,15 @@ msgstr "Supprimer"
msgid "Copy calendar link"
msgstr "Copier le lien du calendrier"
#: com/static/bundled/com/components/ics-calendar-index.ts
msgid "Link copied"
msgstr "Lien copié"
#: com/static/bundled/com/components/ics-calendar-index.ts
msgid "How to use calendar link"
msgstr "Comment utiliser le lien du calendrier"
#: com/static/bundled/com/moderation-alert-index.ts
#: com/static/bundled/com/components/ics-calendar-index.ts
msgid "Link copied"
msgstr "Lien copié"
#: com/static/bundled/com/components/moderation-alert-index.ts
#, javascript-format
msgid ""
"This event will take place every week for %s weeks. If you publish or delete "

10
mkdocs.yml
View File

@ -45,6 +45,7 @@ plugins:
members: true
members_order: source
show_source: true
show_inherited_members: true
merge_init_into_class: true
show_root_toc_entry: false
- include-markdown:
@ -66,9 +67,6 @@ nav:
- Gestion des permissions: tutorial/perms.md
- Gestion des groupes: tutorial/groups.md
- Les fragments: tutorial/fragments.md
- API:
- Développement: tutorial/api/dev.md
- Connexion à l'API: tutorial/api/connect.md
- Etransactions: tutorial/etransaction.md
- How-to:
- L'ORM de Django: howto/querysets.md
@ -86,11 +84,6 @@ nav:
- antispam:
- reference/antispam/models.md
- reference/antispam/forms.md
- api:
- reference/api/auth.md
- reference/api/hashers.md
- reference/api/models.md
- reference/api/perms.md
- club:
- reference/club/models.md
- reference/club/views.md
@ -160,7 +153,6 @@ markdown_extensions:
- pymdownx.details
- pymdownx.inlinehilite
- pymdownx.keys
- pymdownx.blocks.caption
- pymdownx.superfences:
custom_fences:
- name: mermaid

2481
package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

11
package.json
View File

@ -27,13 +27,13 @@
"@babel/core": "^7.25.2",
"@babel/preset-env": "^7.25.4",
"@biomejs/biome": "1.9.4",
"@hey-api/openapi-ts": "^0.73.0",
"@hey-api/openapi-ts": "^0.64.0",
"@rollup/plugin-inject": "^5.0.5",
"@types/alpinejs": "^3.13.10",
"@types/jquery": "^3.5.31",
"vite": "^6.2.5",
"vite-bundle-visualizer": "^1.2.1",
"vite-plugin-static-copy": "^3.0.2"
"vite-plugin-static-copy": "^2.1.0"
},
"dependencies": {
"@alpinejs/sort": "^3.14.7",
@ -44,7 +44,8 @@
"@fullcalendar/daygrid": "^6.1.15",
"@fullcalendar/icalendar": "^6.1.15",
"@fullcalendar/list": "^6.1.15",
"@sentry/browser": "^9.29.0",
"@hey-api/client-fetch": "^0.8.2",
"@sentry/browser": "^8.34.0",
"@zip.js/zip.js": "^2.7.52",
"3d-force-graph": "^1.73.4",
"alpinejs": "^3.14.7",
@ -58,10 +59,10 @@
"glob": "^11.0.0",
"htmx.org": "^2.0.3",
"jquery": "^3.7.1",
"jquery-ui": "^1.14.0",
"js-cookie": "^3.0.5",
"lit-html": "^3.3.0",
"native-file-system-adapter": "^3.0.1",
"three": "^0.177.0",
"three": "^0.172.0",
"three-spritetext": "^1.9.0",
"tom-select": "^2.3.1"
}

6
pedagogy/api.py
View File

@ -3,13 +3,11 @@ from typing import Annotated
from annotated_types import Ge
from ninja import Query
from ninja.security import SessionAuth
from ninja_extra import ControllerBase, api_controller, paginate, route
from ninja_extra.exceptions import NotFound
from ninja_extra.pagination import PageNumberPaginationExtra, PaginatedResponseSchema
from api.auth import ApiKeyAuth
from api.permissions import HasPerm
from core.auth.api_permissions import HasPerm
from pedagogy.models import UV
from pedagogy.schemas import SimpleUvSchema, UvFilterSchema, UvSchema
from pedagogy.utbm_api import UtbmApiClient
@ -19,7 +17,6 @@ from pedagogy.utbm_api import UtbmApiClient
class UvController(ControllerBase):
@route.get(
"/{code}",
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[
# this route will almost always be called in the context
# of a UV creation/edition
@ -45,7 +42,6 @@ class UvController(ControllerBase):
"",
response=PaginatedResponseSchema[SimpleUvSchema],
url_name="fetch_uvs",
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[HasPerm("pedagogy.view_uv")],
)
@paginate(PageNumberPaginationExtra, page_size=100)

2
pedagogy/tests/test_api.py
View File

@ -68,7 +68,7 @@ class TestUVSearch(TestCase):
def test_permissions(self):
# Test with anonymous user
response = self.client.get(self.url)
assert response.status_code == 401
assert response.status_code == 403
# Test with not subscribed user
self.client.force_login(baker.make(User))

11
pyproject.toml
View File

@ -41,10 +41,10 @@ dependencies = [
"dict2xml<2.0.0,>=1.7.6",
"Sphinx<6,>=5",
"tomli<3.0.0,>=2.2.1",
"django-honeypot>=1.3.0,<2",
"django-honeypot",
"pydantic-extra-types<3.0.0,>=2.10.3",
"ical>=10.0.3,<11",
"redis[hiredis]>=5.3.0,<7.0.0",
"ical<10.0.0,>=9.1.0",
"redis[hiredis]<6.0.0,>=5.3.0",
"environs[django]<15.0.0,>=14.1.1",
"requests>=2.32.3",
"honcho>=2.0.0",
@ -66,7 +66,7 @@ dev = [
"django-debug-toolbar>=5.2.0,<6.0.0",
"ipython<10.0.0,>=9.0.2",
"pre-commit<5.0.0,>=4.1.0",
"ruff>=0.11.13,<1.0.0",
"ruff>=0.11.11,<1.0.0",
"djhtml<4.0.0,>=3.0.7",
"faker<38.0.0,>=37.0.0",
"rjsmin<2.0.0,>=1.2.4",
@ -91,6 +91,9 @@ docs = [
[tool.uv]
default-groups = ["dev", "tests", "docs"]
[tool.uv.sources]
django-honeypot = { git = "https://github.com/jamesturk/django-honeypot.git", rev = "3986228" }
[tool.xapian]
version = "1.4.25"

8
sas/admin.py
View File

@ -20,9 +20,9 @@ from sas.models import Album, PeoplePictureRelation, Picture, PictureModerationR
@admin.register(Picture)
class PictureAdmin(admin.ModelAdmin):
list_display = ("name", "parent", "date", "size", "is_moderated")
list_display = ("name", "parent", "is_moderated")
search_fields = ("name",)
autocomplete_fields = ("owner", "parent", "edit_groups", "view_groups", "moderator")
autocomplete_fields = ("owner", "parent", "moderator")
@admin.register(PeoplePictureRelation)
@ -33,9 +33,9 @@ class PeoplePictureRelationAdmin(admin.ModelAdmin):
@admin.register(Album)
class AlbumAdmin(admin.ModelAdmin):
list_display = ("name", "parent", "date", "owner", "is_moderated")
list_display = ("name", "parent")
search_fields = ("name",)
autocomplete_fields = ("owner", "parent", "edit_groups", "view_groups")
autocomplete_fields = ("parent", "edit_groups", "view_groups")
@admin.register(PictureModerationRequest)

69
sas/api.py
View File

@ -3,9 +3,10 @@ from typing import Any, Literal
from django.conf import settings
from django.core.exceptions import ValidationError
from django.db.models import F
from django.shortcuts import get_list_or_404
from django.urls import reverse
from ninja import Body, File, Query
from ninja.security import SessionAuth
from ninja import Body, Query, UploadedFile
from ninja.errors import HttpError
from ninja_extra import ControllerBase, api_controller, paginate, route
from ninja_extra.exceptions import NotFound, PermissionDenied
from ninja_extra.pagination import PageNumberPaginationExtra
@ -13,16 +14,16 @@ from ninja_extra.permissions import IsAuthenticated
from ninja_extra.schemas import PaginatedResponseSchema
from pydantic import NonNegativeInt
from api.auth import ApiKeyAuth
from api.permissions import (
from core.auth.api_permissions import (
CanAccessLookup,
CanEdit,
CanView,
HasPerm,
IsInGroup,
IsRoot,
)
from core.models import Notification, User
from core.schemas import UploadedImage
from core.utils import get_list_exact_or_404
from sas.models import Album, PeoplePictureRelation, Picture
from sas.schemas import (
AlbumAutocompleteSchema,
@ -30,6 +31,7 @@ from sas.schemas import (
AlbumSchema,
IdentifiedUserSchema,
ModerationRequestSchema,
MoveAlbumSchema,
PictureFilterSchema,
PictureSchema,
)
@ -55,7 +57,6 @@ class AlbumController(ControllerBase):
@route.get(
"/autocomplete-search",
response=PaginatedResponseSchema[AlbumAutocompleteSchema],
auth=[SessionAuth(), ApiKeyAuth()],
permissions=[CanAccessLookup],
)
@paginate(PageNumberPaginationExtra, page_size=50)
@ -72,6 +73,48 @@ class AlbumController(ControllerBase):
Album.objects.viewable_by(self.context.request.user).order_by("-date")
)
@route.patch("/parent", permissions=[IsAuthenticated])
def change_album_parent(self, payload: list[MoveAlbumSchema]):
"""Change parents of albums
Note:
For this operation to work, the user must be authorized
to edit both the moved albums and their new parent.
"""
user: User = self.context.request.user
albums: list[Album] = get_list_exact_or_404(
Album, pk__in={a.id for a in payload}
)
if not user.has_perm("sas.change_album"):
unauthorized = [a.id for a in albums if not user.can_edit(a)]
raise PermissionDenied(
f"You can't move the following albums : {unauthorized}"
)
parents: list[Album] = get_list_exact_or_404(
Album, pk__in={a.new_parent_id for a in payload}
)
if not user.has_perm("sas.change_album"):
unauthorized = [a.id for a in parents if not user.can_edit(a)]
raise PermissionDenied(
f"You can't move to the following albums : {unauthorized}"
)
id_to_new_parent = {i.id: i.new_parent_id for i in payload}
for album in albums:
album.parent_id = id_to_new_parent[album.id]
# known caveat : moving an album won't move it's thumbnail.
# E.g. if the album foo/bar is moved to foo/baz,
# the thumbnail will still be foo/bar/thumb.webp
# This has no impact for the end user
# and doing otherwise would be hard for us to implement,
# because we would then have to manage rollbacks on fail.
Album.objects.bulk_update(albums, fields=["parent_id"])
@route.delete("", permissions=[HasPerm("sas.delete_album")])
def delete_album(self, album_ids: list[int]):
# known caveat : deleting an album doesn't delete the pictures on the disk.
# It's a db only operation.
albums: list[Album] = get_list_or_404(Album, pk__in=album_ids)
@api_controller("/sas/picture")
class PicturesController(ControllerBase):
@ -104,7 +147,7 @@ class PicturesController(ControllerBase):
return (
filters.filter(Picture.objects.viewable_by(user))
.distinct()
.order_by("-parent__date", "date")
.order_by("-parent__event_date", "created_at")
.select_related("owner")
.annotate(album=F("parent__name"))
)
@ -119,27 +162,25 @@ class PicturesController(ControllerBase):
},
url_name="upload_picture",
)
def upload_picture(self, album_id: Body[int], picture: File[UploadedImage]):
def upload_picture(self, album_id: Body[int], picture: UploadedFile):
album = self.get_object_or_exception(Album, pk=album_id)
user = self.context.request.user
self_moderate = user.has_perm("sas.moderate_sasfile")
new = Picture(
parent=album,
name=picture.name,
file=picture,
original=picture,
owner=user,
is_moderated=self_moderate,
is_folder=False,
mime_type=picture.content_type,
)
if self_moderate:
new.moderator = user
new.generate_thumbnails()
try:
new.generate_thumbnails()
new.full_clean()
new.save()
except ValidationError as e:
return self.create_response({"detail": dict(e)}, status_code=409)
raise HttpError(status_code=409, message=str(e)) from e
new.save()
@route.get(
"/{picture_id}/identified",

35
sas/baker_recipes.py
View File

@ -1,18 +1,35 @@
from django.core.files.uploadedfile import SimpleUploadedFile
from model_bakery import seq
from model_bakery.recipe import Recipe
from sas.models import Picture
from core.utils import RED_PIXEL_PNG
from sas.models import Album, Picture
album_recipe = Recipe(
Album,
name=seq("Album "),
thumbnail=SimpleUploadedFile(
name="thumb.webp", content=b"", content_type="image/webp"
),
)
picture_recipe = Recipe(
Picture,
is_in_sas=True,
is_folder=False,
is_moderated=True,
name=seq("Picture "),
original=SimpleUploadedFile(
# compressed and thumbnail are generated on save (except if bulk creating).
# For this step no to fail, original must be a valid image.
name="img.png",
content=RED_PIXEL_PNG,
content_type="image/png",
),
compressed=SimpleUploadedFile(
name="img.webp", content=b"", content_type="image/webp"
),
thumbnail=SimpleUploadedFile(
name="img.webp", content=b"", content_type="image/webp"
),
)
"""A SAS Picture fixture.
Warnings:
If you don't `bulk_create` this, you need
to explicitly set the parent album, or it won't work
"""
"""A SAS Picture fixture."""

3
sas/forms.py
View File

@ -48,13 +48,12 @@ class PictureEditForm(forms.ModelForm):
class AlbumEditForm(forms.ModelForm):
class Meta:
model = Album
fields = ["name", "date", "file", "parent", "edit_groups"]
fields = ["name", "date", "thumbnail", "parent", "edit_groups"]
widgets = {
"parent": AutoCompleteSelectAlbum,
"edit_groups": AutoCompleteSelectMultipleGroup,
}
name = forms.CharField(max_length=Album.NAME_MAX_LENGTH, label=_("file name"))
date = forms.DateField(label=_("Date"), widget=SelectDate, required=True)
recursive = forms.BooleanField(label=_("Apply rights recursively"), required=False)

357
sas/migrations/0005_move_the_whole_sas.py Normal file
View File

@ -0,0 +1,357 @@
# Generated by Django 4.2.17 on 2025-01-22 21:53
import collections
import itertools
import logging
from typing import TYPE_CHECKING
import django.db.models.deletion
from django.conf import settings
from django.db import migrations, models
from django.db.migrations.state import StateApps
import sas.models
if TYPE_CHECKING:
import core.models
# NB : tous les commentaires sont écrits en français,
# parce qu'on est sur des opérations qui sont complexes,
# et qui sont surtout DANGEREUSES.
# Ici, la clarté des explications prime sur toute autre considération.
def copy_albums_and_pictures(apps: StateApps, schema_editor):
SithFile: type[core.models.SithFile] = apps.get_model("core", "SithFile")
Album: type[sas.models.Album] = apps.get_model("sas", "Album")
Picture: type[sas.models.Picture] = apps.get_model("sas", "Picture")
logger = logging.getLogger("django")
# Il y a environ 1800 albums, 257k photos et 488k identifications
# d'utilisateurs dans la db de prod.
# En supposant qu'une insertion prenne 10ms (ce qui est très optimiste),
# migrer tous les enregistrements de la db prendrait plus de 2h.
# C'est trop long.
# Mais d'un autre côté, j'ai pas assez confiance dans les capacités de nos
# machines pour charger presque un million d'objets en mémoire.
# Pour faire un compromis, les albums sont migrés individuellement un à un,
# mais tous les objets liés à ces albums
# (photos, groupes de vue, groupe d'édition, identification d'utilisateurs)
# sont migrés en tas.
#
# Ordre des opérations :
# 1. On migre les albums 1 à 1 (il y en a 1800, donc c'est relativement court)
# 2. On migre les photos par paquet de 2500 (soit ~une centaine d'opérations)
# 3. On migre tous les groupes de vue et tous les groupes d'édition des albums
#
# Au total, la migration devrait demander aux alentours de 2000 insertions,
# ce qui est un compromis acceptable entre une migration
# pas trop longue et une RAM pas trop surchargée.
#
# Pour ce qui est de la répartition des tables, quatre nouvelles tables
# sont créées : sas_album, sas_picture,
# sas_pictureviewgroups et sas_picture_editgroups.
# Tous les albums et toutes les photos qui sont dans core_sithfile
# vont être copiés dans ces tables.
# Comme les albums sont migrés un à un, ils recevront une nouvelle
# clef primaire.
# Pour les photos, en revanche, c'est beaucoup plus sûr de leur donner
# le même id que celui qu'il y avait dans core_sithfile.
#
# Les identifications des photos ne sont pas migrées pour l'instant.
# Ce qu'on va faire, c'est qu'on va changer la contrainte de clef étrangère
# sur la colonne des photos pour pointer vers sas_picture
# au lieu de core_sithfile.
# Cependant, pour que ça marche,
# il faut qu'au moment où ce changement est effectué,
# toutes les clefs primaires référencées existent à la fois dans
# les deux tables, sinon les contraintes d'intégrité ne sont pas respectées.
# La migration de ce fichier va donc s'occuper de créer les nouvelles tables
# et d'y copier les données nécessaires.
# Puis une deuxième migration s'occupera de changer les contraintes.
# Et enfin une troisième migration supprimera les anciennes données.
#
# Pavé César
albums = SithFile.objects.filter(is_in_sas=True, is_folder=True).prefetch_related(
"view_groups", "edit_groups"
)
old_albums = collections.deque(
albums.filter(parent_id=settings.SITH_SAS_ROOT_DIR_ID)
)
# Changement de représentation en DB.
# Dans l'ancien système, un fichier était dans le SAS si
# un fichier spécial (le SAS_ROOT) était parmi ses ancêtres.
# Comme maintenant les fichiers du SAS sont dans des tables à part,
# il ne peut plus y avoir de confusion.
# Les photos ont donc obligatoirement un parent (qui est un album)
# et les albums peuvent avoir un parent null.
# Un album sans parent est considéré comme se trouvant à la racine
# de l'arborescence.
# En quelque sorte, None est le nouveau SITH_SAS_ROOT_DIR_ID
album_id_old_to_new = {settings.SITH_SAS_ROOT_DIR_ID: None}
logger.info(f"migrating {albums.count()} albums")
while len(old_albums) > 0:
# Comme les albums référencent leur parent, les albums doivent être migrés
# par ordre croissant de profondeur dans l'arborescence.
# Chaque album est donc pris par la gauche de la file
# et ses enfants ajoutés sur la droite.
old_album = old_albums.popleft()
old_albums.extend(list(albums.filter(parent=old_album)))
new_album = Album.objects.create(
parent_id=album_id_old_to_new[old_album.parent_id],
event_date=old_album.date.date(),
name=old_album.name,
thumbnail=(old_album.file or None),
is_moderated=old_album.is_moderated,
)
# on garde un dictionnaire qui associe les id des albums dans l'ancienne table
# à leur id dans la nouvelle table, pour pouvoir recréer
# les liens de parenté entre albums
album_id_old_to_new[old_album.id] = new_album.id
pictures = SithFile.objects.filter(is_in_sas=True, is_folder=False)
nb_pictures = pictures.count()
logger.info(f"migrating {nb_pictures} pictures")
for i, pictures_batch in enumerate(itertools.batched(pictures, 2500), start=1):
Picture.objects.bulk_create(
[
Picture(
id=p.id,
name=p.name,
parent_id=album_id_old_to_new[p.parent_id],
thumbnail=p.thumbnail,
compressed=p.compressed,
original=p.file,
owner_id=p.owner_id,
created_at=p.date,
is_moderated=p.is_moderated,
asked_for_removal=p.asked_for_removal,
moderator_id=p.moderator_id,
)
for p in pictures_batch
]
)
logger.info(f"Migrated {min(i * 2500, nb_pictures)} / {nb_pictures} pictures")
logger.info("Migrating album groups")
albums = SithFile.objects.filter(is_in_sas=True, is_folder=True).exclude(
id=settings.SITH_SAS_ROOT_DIR_ID
)
Album.edit_groups.through.objects.bulk_create(
[
Album.view_groups.through(
album=album_id_old_to_new[g.sithfile_id], group_id=g.group_id
)
for g in SithFile.view_groups.through.objects.filter(sithfile__in=albums)
]
)
Album.edit_groups.through.objects.bulk_create(
[
Album.view_groups.through(
album=album_id_old_to_new[g.sithfile_id], group_id=g.group_id
)
for g in SithFile.view_groups.through.objects.filter(sithfile__in=albums)
]
)
class Migration(migrations.Migration):
dependencies = [
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
("core", "0044_alter_userban_options"),
("sas", "0004_picturemoderationrequest_and_more"),
]
operations = [
# les relations et les demandes de modération étaient liées à SithFile,
# via le model proxy Picture.
# Pour que la migration marche malgré la disparition du modèle Proxy,
# on change la relation pour qu'elle pointe directement vers SithFile
migrations.AlterField(
model_name="peoplepicturerelation",
name="picture",
field=models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="people",
to="core.sithfile",
verbose_name="picture",
),
),
migrations.AlterField(
model_name="picturemoderationrequest",
name="picture",
field=models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="moderation_requests",
to="core.sithfile",
verbose_name="Picture",
),
),
migrations.DeleteModel(name="Album"),
migrations.DeleteModel(name="Picture"),
migrations.DeleteModel(name="SasFile"),
migrations.CreateModel(
name="Album",
fields=[
(
"id",
models.AutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
(
"thumbnail",
models.FileField(
max_length=256,
upload_to=sas.models.get_thumbnail_directory,
verbose_name="thumbnail",
),
),
("name", models.CharField(max_length=100, verbose_name="name")),
(
"event_date",
models.DateField(
default=django.utils.timezone.localdate,
help_text="The date on which the photos in this album were taken",
verbose_name="event date",
),
),
(
"is_moderated",
models.BooleanField(default=False, verbose_name="is moderated"),
),
(
"edit_groups",
models.ManyToManyField(
related_name="editable_albums",
to="core.group",
verbose_name="edit groups",
),
),
(
"parent",
models.ForeignKey(
blank=True,
null=True,
on_delete=django.db.models.deletion.CASCADE,
related_name="children",
to="sas.album",
verbose_name="parent",
),
),
(
"view_groups",
models.ManyToManyField(
related_name="viewable_albums",
to="core.group",
verbose_name="view groups",
),
),
],
options={"verbose_name": "album"},
),
migrations.CreateModel(
name="Picture",
fields=[
(
"id",
models.AutoField(
auto_created=True,
primary_key=True,
serialize=False,
verbose_name="ID",
),
),
(
"thumbnail",
models.FileField(
unique=True,
upload_to=sas.models.get_thumbnail_directory,
verbose_name="thumbnail",
max_length=256,
),
),
("name", models.CharField(max_length=256, verbose_name="file name")),
(
"original",
models.FileField(
unique=True,
upload_to=sas.models.get_directory,
verbose_name="original image",
max_length=256,
),
),
(
"compressed",
models.FileField(
unique=True,
upload_to=sas.models.get_compressed_directory,
verbose_name="compressed image",
max_length=256,
),
),
("created_at", models.DateTimeField(default=django.utils.timezone.now)),
(
"is_moderated",
models.BooleanField(default=False, verbose_name="is moderated"),
),
(
"asked_for_removal",
models.BooleanField(
default=False, verbose_name="asked for removal"
),
),
(
"moderator",
models.ForeignKey(
blank=True,
null=True,
on_delete=django.db.models.deletion.SET_NULL,
related_name="moderated_pictures",
to=settings.AUTH_USER_MODEL,
),
),
(
"owner",
models.ForeignKey(
on_delete=django.db.models.deletion.PROTECT,
related_name="owned_pictures",
to=settings.AUTH_USER_MODEL,
verbose_name="owner",
),
),
(
"parent",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="pictures",
to="sas.album",
verbose_name="album",
),
),
],
options={"abstract": False, "verbose_name": "picture"},
),
migrations.AddConstraint(
model_name="picture",
constraint=models.UniqueConstraint(
fields=("name", "parent"), name="sas_picture_unique_per_album"
),
),
migrations.AddConstraint(
model_name="album",
constraint=models.UniqueConstraint(
fields=("name", "parent"), name="unique_album_name_if_same_parent"
),
),
migrations.RunPython(
copy_albums_and_pictures,
reverse_code=migrations.RunPython.noop,
elidable=True,
),
]

31
sas/migrations/0006_alter_peoplepicturerelation_picture_and_more.py Normal file
View File

@ -0,0 +1,31 @@
# Generated by Django 4.2.17 on 2025-01-25 23:50
import django.db.models.deletion
from django.db import migrations, models
class Migration(migrations.Migration):
dependencies = [("sas", "0005_move_the_whole_sas")]
operations = [
migrations.AlterField(
model_name="peoplepicturerelation",
name="picture",
field=models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="people",
to="sas.picture",
verbose_name="picture",
),
),
migrations.AlterField(
model_name="picturemoderationrequest",
name="picture",
field=models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="moderation_requests",
to="sas.picture",
verbose_name="Picture",
),
),
]

405
sas/models.py
View File

@ -18,30 +18,53 @@ from __future__ import annotations
import contextlib
from io import BytesIO
from pathlib import Path
from typing import ClassVar, Self
from typing import TYPE_CHECKING, ClassVar, Self
from django.conf import settings
from django.core.cache import cache
from django.core.exceptions import ValidationError
from django.core.files.base import ContentFile
from django.db import models
from django.db.models import Exists, OuterRef, Q
from django.db.models.deletion import Collector
from django.urls import reverse
from django.utils import timezone
from django.utils.functional import cached_property
from django.utils.translation import gettext_lazy as _
from PIL import Image
from core.models import SithFile, User
from core.models import Group, Notification, User
from core.utils import exif_auto_rotate, resize_image
if TYPE_CHECKING:
from django.db.models.fields.files import FieldFile
class SasFile(SithFile):
"""Proxy model for any file in the SAS.
def get_directory(instance: SasFile, filename: str):
return f"./{instance.parent_path}/{filename}"
def get_compressed_directory(instance: SasFile, filename: str):
return f"./.compressed/{instance.parent_path}/{filename}"
def get_thumbnail_directory(instance: SasFile, filename: str):
if isinstance(instance, Album):
_, extension = filename.rsplit(".", 1)
filename = f"{instance.name}/thumb.{extension}"
return f"./.thumbnails/{instance.parent_path}/{filename}"
class SasFile(models.Model):
"""Abstract model for SAS files
May be used to have logic that should be shared by both
[Picture][sas.models.Picture] and [Album][sas.models.Album].
"""
class Meta:
proxy = True
abstract = True
permissions = [("moderate_sasfile", "Can moderate SAS albums and SAS pictures")]
def can_be_viewed_by(self, user):
if user.is_anonymous:
@ -59,8 +82,171 @@ class SasFile(SithFile):
cache.set(cache_key, viewable, timeout=10)
return self.id in viewable
def can_be_edited_by(self, user):
return user.is_root or user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID)
def can_be_edited_by(self, user: User):
return user.has_perm(f"sas.change_{self._meta.model_name}")
@cached_property
def parent_path(self) -> str:
"""The parent location in the SAS album tree (e.g. `SAS/foo/bar`)."""
return "/".join(["SAS", *[p.name for p in self.parent_list]])
@cached_property
def parent_list(self) -> list[Album]:
"""The ancestors of this SAS object.
The result is ordered from the direct parent to the farthest one.
"""
parents = []
current = self.parent
while current is not None:
parents.append(current)
current = current.parent
return parents
class AlbumQuerySet(models.QuerySet):
def viewable_by(self, user: User) -> Self:
"""Filter the albums that this user can view.
Warning:
Calling this queryset method may add several additional requests.
"""
if user.is_root or user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
return self.all()
if user.was_subscribed:
return self.filter(is_moderated=True)
# known bug : if all children of an album are also albums
# then this album is excluded, even if one of the sub-albums should be visible.
# The fs-like navigation is likely to be half-broken for non-subscribers,
# but that's ok, since non-subscribers are expected to see only the albums
# containing pictures on which they have been identified (hence, very few).
# Most, if not all, of their albums will be displayed on the
# `latest albums` section of the SAS.
# Moreover, they will still see all of their picture in their profile.
return self.filter(
Exists(Picture.objects.filter(parent_id=OuterRef("pk")).viewable_by(user))
)
class Album(SasFile):
NAME_MAX_LENGTH: ClassVar[int] = 50
name = models.CharField(_("name"), max_length=100)
parent = models.ForeignKey(
"self",
related_name="children",
verbose_name=_("parent"),
null=True,
blank=True,
on_delete=models.CASCADE,
)
thumbnail = models.FileField(
upload_to=get_thumbnail_directory,
verbose_name=_("thumbnail"),
max_length=256,
blank=True,
)
view_groups = models.ManyToManyField(
Group, related_name="viewable_albums", verbose_name=_("view groups"), blank=True
)
edit_groups = models.ManyToManyField(
Group, related_name="editable_albums", verbose_name=_("edit groups"), blank=True
)
event_date = models.DateField(
_("event date"),
help_text=_("The date on which the photos in this album were taken"),
default=timezone.localdate,
blank=True,
)
is_moderated = models.BooleanField(_("is moderated"), default=False)
objects = AlbumQuerySet.as_manager()
class Meta:
verbose_name = _("album")
constraints = [
models.UniqueConstraint(
fields=["name", "parent"],
name="unique_album_name_if_same_parent",
# TODO : add `nulls_distinct=True` after upgrading to django>=5.0
)
]
def __str__(self):
return f"Album {self.name}"
def save(self, *args, **kwargs):
super().save(*args, **kwargs)
for user in User.objects.filter(
groups__id__in=[settings.SITH_GROUP_SAS_ADMIN_ID]
):
Notification(
user=user,
url=reverse("sas:moderation"),
type="SAS_MODERATION",
param="1",
).save()
def get_absolute_url(self):
return reverse("sas:album", kwargs={"album_id": self.id})
def clean(self):
super().clean()
if "/" in self.name:
raise ValidationError(_("Character '/' not authorized in name"))
if self.parent_id is not None and (
self.id == self.parent_id or self in self.parent_list
):
raise ValidationError(_("Loop in album tree"), code="loop")
if self.thumbnail:
try:
Image.open(BytesIO(self.thumbnail.read()))
except Image.UnidentifiedImageError as e:
raise ValidationError(_("This is not a valid album thumbnail")) from e
def delete(self, *args, **kwargs):
"""Delete the album, all of its children and all linked disk files"""
collector = Collector(using="default")
collector.collect([self])
albums: set[Album] = collector.data[Album]
pictures: set[Picture] = collector.data[Picture]
files: list[FieldFile] = [
*[a.thumbnail for a in albums],
*[p.thumbnail for p in pictures],
*[p.compressed for p in pictures],
*[p.original for p in pictures],
]
# `bool(f)` checks that the file actually exists on the disk
files = [f for f in files if bool(f)]
folders = {Path(f.path).parent for f in files}
res = super().delete(*args, **kwargs)
# once the model instances have been deleted,
# delete the actual files.
for file in files:
# save=False ensures that django doesn't recreate the db record,
# which would make the whole deletion pointless
# cf. https://docs.djangoproject.com/en/stable/ref/models/fields/#django.db.models.fields.files.FieldFile.delete
file.delete(save=False)
for folder in folders:
# now that the files are deleted, remove the empty folders
if folder.is_dir() and next(folder.iterdir(), None) is None:
folder.rmdir()
return res
def get_download_url(self):
return reverse("sas:album_preview", kwargs={"album_id": self.id})
def generate_thumbnail(self):
p = (
self.pictures.exclude(thumbnail="").order_by("?").first()
or self.children.exclude(thumbnail="").order_by("?").first()
)
if p:
# The file is loaded into memory to duplicate it.
# It may not be the most efficient way, but thumbnails are
# usually quite small, so it's still ok
self.thumbnail = ContentFile(p.thumbnail.read(), name="thumb.webp")
self.save()
class PictureQuerySet(models.QuerySet):
@ -77,23 +263,65 @@ class PictureQuerySet(models.QuerySet):
return self.filter(people__user_id=user.id, is_moderated=True)
class SASPictureManager(models.Manager):
def get_queryset(self):
return super().get_queryset().filter(is_in_sas=True, is_folder=False)
class Picture(SasFile):
name = models.CharField(_("file name"), max_length=256)
parent = models.ForeignKey(
Album,
related_name="pictures",
verbose_name=_("album"),
on_delete=models.CASCADE,
)
thumbnail = models.FileField(
upload_to=get_thumbnail_directory,
verbose_name=_("thumbnail"),
max_length=256,
unique=True,
)
original = models.FileField(
upload_to=get_directory,
verbose_name=_("original image"),
max_length=256,
unique=True,
)
compressed = models.FileField(
upload_to=get_compressed_directory,
verbose_name=_("compressed image"),
max_length=256,
unique=True,
)
created_at = models.DateTimeField(default=timezone.now)
owner = models.ForeignKey(
User,
related_name="owned_pictures",
verbose_name=_("owner"),
on_delete=models.PROTECT,
)
is_moderated = models.BooleanField(_("is moderated"), default=False)
asked_for_removal = models.BooleanField(_("asked for removal"), default=False)
moderator = models.ForeignKey(
User,
related_name="moderated_pictures",
null=True,
blank=True,
on_delete=models.SET_NULL,
)
objects = PictureQuerySet.as_manager()
class Meta:
proxy = True
verbose_name = _("picture")
constraints = [
models.UniqueConstraint(
fields=["name", "parent"], name="sas_picture_unique_per_album"
)
]
objects = SASPictureManager.from_queryset(PictureQuerySet)()
def __str__(self):
return self.name
@property
def is_vertical(self):
with open(settings.MEDIA_ROOT / self.file.name, "rb") as f:
im = Image.open(BytesIO(f.read()))
(w, h) = im.size
return (w / h) < 1
def get_absolute_url(self):
return reverse("sas:picture", kwargs={"picture_id": self.id})
def get_download_url(self):
return reverse("sas:download", kwargs={"picture_id": self.id})
@ -104,41 +332,34 @@ class Picture(SasFile):
def get_download_thumb_url(self):
return reverse("sas:download_thumb", kwargs={"picture_id": self.id})
def get_absolute_url(self):
return reverse("sas:picture", kwargs={"picture_id": self.id})
@property
def is_vertical(self):
# original, compressed and thumbnail image have all three the same ratio,
# so the smallest one is used to tell if the image is vertical
im = Image.open(BytesIO(self.thumbnail.read()))
(w, h) = im.size
return w < h
def generate_thumbnails(self, *, overwrite=False):
im = Image.open(BytesIO(self.file.read()))
def generate_thumbnails(self):
im = Image.open(self.original)
with contextlib.suppress(Exception):
im = exif_auto_rotate(im)
# convert the compressed image and the thumbnail into webp
# The original image keeps its original type, because it's not
# meant to be shown on the website, but rather to keep the real image
# for less frequent cases (like downloading the pictures of an user)
extension = self.mime_type.split("/")[-1]
# the HD version of the image doesn't need to be optimized, because :
# - it isn't frequently queried
# - optimizing large images takes a lot time, which greatly hinders the UX
# - optimizing large images takes a lot of time, which greatly hinders the UX
# - photographers usually already optimize their images
file = resize_image(im, max(im.size), extension, optimize=False)
thumb = resize_image(im, 200, "webp")
compressed = resize_image(im, 1200, "webp")
if overwrite:
self.file.delete()
self.thumbnail.delete()
self.compressed.delete()
new_extension_name = str(Path(self.name).with_suffix(".webp"))
self.file = file
self.file.name = self.name
new_extension_name = str(Path(self.original.name).with_suffix(".webp"))
self.thumbnail = thumb
self.thumbnail.name = new_extension_name
self.compressed = compressed
self.compressed.name = new_extension_name
def rotate(self, degree):
for attr in ["file", "compressed", "thumbnail"]:
name = self.__getattribute__(attr).name
with open(settings.MEDIA_ROOT / name, "r+b") as file:
for field in self.original, self.compressed, self.thumbnail:
with open(field.file, "r+b") as file:
if file:
im = Image.open(BytesIO(file.read()))
file.seek(0)
@ -151,110 +372,6 @@ class Picture(SasFile):
progressive=True,
)
def get_next(self):
if self.is_moderated:
pictures_qs = self.parent.children.filter(
is_moderated=True,
asked_for_removal=False,
is_folder=False,
id__gt=self.id,
)
else:
pictures_qs = Picture.objects.filter(id__gt=self.id, is_moderated=False)
return pictures_qs.order_by("id").first()
def get_previous(self):
if self.is_moderated:
pictures_qs = self.parent.children.filter(
is_moderated=True,
asked_for_removal=False,
is_folder=False,
id__lt=self.id,
)
else:
pictures_qs = Picture.objects.filter(id__lt=self.id, is_moderated=False)
return pictures_qs.order_by("-id").first()
class AlbumQuerySet(models.QuerySet):
def viewable_by(self, user: User) -> Self:
"""Filter the albums that this user can view.
Warning:
Calling this queryset method may add several additional requests.
"""
if user.is_root or user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
return self.all()
if user.was_subscribed:
return self.filter(Q(is_moderated=True) | Q(owner=user))
# known bug : if all children of an album are also albums
# then this album is excluded, even if one of the sub-albums should be visible.
# The fs-like navigation is likely to be half-broken for non-subscribers,
# but that's ok, since non-subscribers are expected to see only the albums
# containing pictures on which they have been identified (hence, very few).
# Most, if not all, of their albums will be displayed on the
# `latest albums` section of the SAS.
# Moreover, they will still see all of their picture in their profile.
return self.filter(
Exists(Picture.objects.filter(parent_id=OuterRef("pk")).viewable_by(user))
)
class SASAlbumManager(models.Manager):
def get_queryset(self):
return super().get_queryset().filter(is_in_sas=True, is_folder=True)
class Album(SasFile):
NAME_MAX_LENGTH: ClassVar[int] = 50
"""Maximum length of an album's name.
[SithFile][core.models.SithFile] have a maximum length
of 256 characters.
However, this limit is too high for albums.
Names longer than 50 characters are harder to read
and harder to display on the SAS page.
It is to be noted, though, that this does not
add or modify any db behaviour.
It's just a constant to be used in views and forms.
"""
class Meta:
proxy = True
objects = SASAlbumManager.from_queryset(AlbumQuerySet)()
@property
def children_pictures(self):
return Picture.objects.filter(parent=self)
@property
def children_albums(self):
return Album.objects.filter(parent=self)
def get_absolute_url(self):
if self.id == settings.SITH_SAS_ROOT_DIR_ID:
return reverse("sas:main")
return reverse("sas:album", kwargs={"album_id": self.id})
def get_download_url(self):
return reverse("sas:album_preview", kwargs={"album_id": self.id})
def generate_thumbnail(self):
p = (
self.children_pictures.order_by("?").first()
or self.children_albums.exclude(file=None)
.exclude(file="")
.order_by("?")
.first()
)
if p and p.file:
image = resize_image(Image.open(BytesIO(p.file.read())), 200, "webp")
self.file = image
self.file.name = f"{self.name}/thumb.webp"
self.save()
def sas_notification_callback(notif):
count = Picture.objects.filter(is_moderated=False).count()

9
sas/schemas.py
View File

@ -50,7 +50,12 @@ class AlbumAutocompleteSchema(ModelSchema):
@staticmethod
def resolve_path(obj: Album) -> str:
return str(Path(obj.get_parent_path()) / obj.name)
return str(Path(obj.parent_path) / obj.name)
class MoveAlbumSchema(Schema):
id: int
new_parent_id: int
class PictureFilterSchema(FilterSchema):
@ -63,7 +68,7 @@ class PictureFilterSchema(FilterSchema):
class PictureSchema(ModelSchema):
class Meta:
model = Picture
fields = ["id", "name", "date", "size", "is_moderated", "asked_for_removal"]
fields = ["id", "name", "created_at", "is_moderated", "asked_for_removal"]
owner: UserProfileSchema
sas_url: str

105
sas/static/bundled/sas/album-index.ts
View File

@ -126,3 +126,108 @@ document.addEventListener("alpine:init", () => {
},
}));
});
// Todo: migrate to alpine.js if we have some time
// $("form#upload_form").submit(function (event) {
// const formData = new FormData($(this)[0]);
//
// if (!formData.get("album_name") && !formData.get("images").name) return false;
//
// if (!formData.get("images").name) {
// return true;
// }
//
// event.preventDefault();
//
// let errorList = this.querySelector("#upload_form ul.errorlist.nonfield");
// if (errorList === null) {
// errorList = document.createElement("ul");
// errorList.classList.add("errorlist", "nonfield");
// this.insertBefore(errorList, this.firstElementChild);
// }
//
// while (errorList.childElementCount > 0)
// errorList.removeChild(errorList.firstElementChild);
//
// let progress = this.querySelector("progress");
// if (progress === null) {
// progress = document.createElement("progress");
// progress.value = 0;
// const p = document.createElement("p");
// p.appendChild(progress);
// this.insertBefore(p, this.lastElementChild);
// }
//
// let dataHolder;
//
// if (formData.get("album_name")) {
// dataHolder = new FormData();
// dataHolder.set("csrfmiddlewaretoken", "{{ csrf_token }}");
// dataHolder.set("album_name", formData.get("album_name"));
// $.ajax({
// method: "POST",
// url: "{{ url('sas:album_upload', album_id=object.id) }}",
// data: dataHolder,
// processData: false,
// contentType: false,
// success: onSuccess,
// });
// }
//
// const images = formData.getAll("images");
// const imagesCount = images.length;
// let completeCount = 0;
//
// const poolSize = 1;
// const imagePool = [];
//
// while (images.length > 0 && imagePool.length < poolSize) {
// const image = images.shift();
// imagePool.push(image);
// sendImage(image);
// }
//
// function sendImage(image) {
// dataHolder = new FormData();
// dataHolder.set("csrfmiddlewaretoken", "{{ csrf_token }}");
// dataHolder.set("images", image);
//
// $.ajax({
// method: "POST",
// url: "{{ url('sas:album_upload', album_id=object.id) }}",
// data: dataHolder,
// processData: false,
// contentType: false,
// })
// .fail(onSuccess.bind(undefined, image))
// .done(onSuccess.bind(undefined, image))
// .always(next.bind(undefined, image));
// }
//
// function next(image, _, __) {
// const index = imagePool.indexOf(image);
// const nextImage = images.shift();
//
// if (index !== -1) {
// imagePool.splice(index, 1);
// }
//
// if (nextImage) {
// imagePool.push(nextImage);
// sendImage(nextImage);
// }
// }
//
// function onSuccess(image, data, _, __) {
// let errors = [];
//
// if ($(data.responseText).find(".errorlist.nonfield")[0])
// errors = Array.from($(data.responseText).find(".errorlist.nonfield")[0].children);
//
// while (errors.length > 0) errorList.appendChild(errors.shift());
//
// progress.value = ++completeCount / imagesCount;
// if (progress.value === 1 && errorList.children.length === 0)
// document.location.reload();
// }
// });

4
sas/static/bundled/sas/pictures-download-index.ts
View File

@ -30,10 +30,10 @@ document.addEventListener("alpine:init", () => {
await Promise.all(
this.pictures.map((p: PictureSchema) => {
const imgName = `${p.album}/IMG_${p.date.replace(/[:\-]/g, "_")}${p.name.slice(p.name.lastIndexOf("."))}`;
const imgName = `${p.album}/IMG_${p.created_at.replace(/[:\-]/g, "_")}${p.name.slice(p.name.lastIndexOf("."))}`;
return zipWriter.add(imgName, new HttpReader(p.full_size_url), {
level: 9,
lastModDate: new Date(p.date),
lastModDate: new Date(p.created_at),
onstart: incrementProgressBar,
});
}),

3
sas/static/bundled/sas/viewer-index.ts
View File

@ -141,7 +141,8 @@ exportToHtml("loadViewer", (config: ViewerConfig) => {
// biome-ignore lint/style/useNamingConvention: api is in snake_case
full_size_url: "",
owner: "",
date: new Date(),
// biome-ignore lint/style/useNamingConvention: api is in snake_case
created_at: new Date(),
identifications: [],
},
/**

38
sas/templates/sas/album.jinja
View File

@ -20,7 +20,7 @@
{% block content %}
<code>
<a href="{{ url('sas:main') }}">SAS</a> / {{ print_path(album.parent) }} {{ album.get_display_name() }}
<a href="{{ url('sas:main') }}">SAS</a> / {{ print_path(album.parent) }} {{ album.name }}
</code>
{% set is_sas_admin = user.can_edit(album) %}
@ -30,7 +30,7 @@
<form action="" method="post" enctype="multipart/form-data">
{% csrf_token %}
<div class="album-navbar">
<h3>{{ album.get_display_name() }}</h3>
<h3>{{ album.name }}</h3>
<div class="toolbar">
<a href="{{ url('sas:album_edit', album_id=album.id) }}">{% trans %}Edit{% endtrans %}</a>
@ -40,17 +40,17 @@
</div>
</div>
{% if clipboard %}
<div class="clipboard">
{% trans %}Clipboard: {% endtrans %}
<ul>
{% for f in clipboard %}
<li>{{ f.get_full_path() }}</li>
{% endfor %}
</ul>
<input name="clear" type="submit" value="{% trans %}Clear clipboard{% endtrans %}">
</div>
{% endif %}
{# {% if clipboard %}#}
{# <div class="clipboard">#}
{# {% trans %}Clipboard: {% endtrans %}#}
{# <ul>#}
{# {% for f in clipboard["albums"] %}#}
{# <li>{{ f.get_full_path() }}</li>#}
{# {% endfor %}#}
{# </ul>#}
{# <input name="clear" type="submit" value="{% trans %}Clear clipboard{% endtrans %}">#}
{# </div>#}
{# {% endif %}#}
{% endif %}
{% if show_albums %}
@ -73,8 +73,8 @@
<div class="text">{% trans %}To be moderated{% endtrans %}</div>
</template>
</div>
{% if is_sas_admin %}
<input type="checkbox" name="file_list" :value="album.id">
{% if edit_mode %}
<input type="checkbox" name="album_list" :value="album.id">
{% endif %}
</a>
</template>
@ -100,7 +100,7 @@
</template>
</div>
{% if is_sas_admin %}
<input type="checkbox" name="file_list" :value="picture.id">
<input type="checkbox" name="picture_list" :value="picture.id">
{% endif %}
</a>
</template>
@ -120,9 +120,9 @@
{% csrf_token %}
<div class="inputs">
<p>
<label for="{{ upload_form.images.id_for_label }}">{{ upload_form.images.label }} :</label>
{{ upload_form.images|add_attr("x-ref=pictures") }}
<span class="helptext">{{ upload_form.images.help_text }}</span>
<label for="{{ form.images.id_for_label }}">{{ form.images.label }} :</label>
{{ form.images|add_attr("x-ref=pictures") }}
<span class="helptext">{{ form.images.help_text }}</span>
</p>
<input type="submit" value="{% trans %}Upload{% endtrans %}" />
<progress x-ref="progress" x-show="sending"></progress>

14
sas/templates/sas/macros.jinja
View File

@ -1,19 +1,13 @@
{% macro display_album(a, edit_mode) %}
<a href="{{ url('sas:album', album_id=a.id) }}">
{% if a.file %}
{% if a.thumbnail %}
{% set img = a.get_download_url() %}
{% set src = a.name %}
{% elif a.children.filter(is_folder=False, is_moderated=True).exists() %}
{% set picture = a.children.filter(is_folder=False).first().as_picture %}
{% set img = picture.get_download_thumb_url() %}
{% set src = picture.name %}
{% else %}
{% set img = static('core/img/sas.jpg') %}
{% set src = "sas.jpg" %}
{% endif %}
<div
class="album{% if not a.is_moderated %} not_moderated{% endif %}"
>
<div class="album{% if not a.is_moderated %} not_moderated{% endif %}">
<img src="{{ img }}" alt="{{ src }}" loading="lazy" />
{% if not a.is_moderated %}
<div class="overlay">&nbsp;</div>
@ -31,7 +25,7 @@
{% macro print_path(file) %}
{% if file and file.parent %}
{{ print_path(file.parent) }}
<a href="{{ url('sas:album', album_id=file.id) }}">{{ file.get_display_name() }}</a> /
<a href="{{ url("sas:album", album_id=file.id) }}">{{ file.name }}</a> /
{% endif %}
{% endmacro %}
@ -39,7 +33,7 @@
record of albums with alpine
This needs to be used inside an alpine environment.
Downloaded pictures will be `pictures` from the
Downloaded pictures will be `pictures` from the
parent data store.
Note:

8
sas/templates/sas/picture.jinja
View File

@ -1,9 +1,9 @@
{% extends "core/base.jinja" %}
{%- block additional_css -%}
<link defer rel="stylesheet" href="{{ static('bundled/core/components/ajax-select-index.css') }}">
<link defer rel="stylesheet" href="{{ static('core/components/ajax-select.scss') }}">
<link defer rel="stylesheet" href="{{ static('sas/css/picture.scss') }}">
<link rel="stylesheet" href="{{ static('bundled/core/components/ajax-select-index.css') }}">
<link rel="stylesheet" href="{{ static('core/components/ajax-select.scss') }}">
<link rel="stylesheet" href="{{ static('sas/css/picture.scss') }}">
{%- endblock -%}
{%- block additional_js -%}
@ -104,7 +104,7 @@
<span
x-text="Intl.DateTimeFormat(
'{{ LANGUAGE_CODE }}', {dateStyle: 'long'}
).format(new Date(currentPicture.date))"
).format(new Date(currentPicture.created_at))"
>
</span>
</div>

14
sas/tests/test_api.py
View File

@ -27,8 +27,8 @@ class TestSas(TestCase):
cls.user_b, cls.user_c = subscriber_user.make(_quantity=2)
picture = picture_recipe.extend(owner=owner)
cls.album_a = baker.make(Album, is_in_sas=True, parent=sas)
cls.album_b = baker.make(Album, is_in_sas=True, parent=sas)
cls.album_a = baker.make(Album)
cls.album_b = baker.make(Album)
relation_recipe = Recipe(PeoplePictureRelation)
relations = []
for album in cls.album_a, cls.album_b:
@ -61,7 +61,7 @@ class TestPictureSearch(TestSas):
self.client.force_login(self.user_b)
res = self.client.get(self.url + f"?album_id={self.album_a.id}")
assert res.status_code == 200
expected = list(self.album_a.children_pictures.values_list("id", flat=True))
expected = list(self.album_a.pictures.values_list("id", flat=True))
assert [i["id"] for i in res.json()["results"]] == expected
def test_filter_by_user(self):
@ -70,7 +70,7 @@ class TestPictureSearch(TestSas):
assert res.status_code == 200
expected = list(
self.user_a.pictures.order_by(
"-picture__parent__date", "picture__date"
"-picture__parent__event_date", "picture__created_at"
).values_list("picture_id", flat=True)
)
assert [i["id"] for i in res.json()["results"]] == expected
@ -84,7 +84,7 @@ class TestPictureSearch(TestSas):
assert res.status_code == 200
expected = list(
self.user_a.pictures.union(self.user_b.pictures.all())
.order_by("-picture__parent__date", "picture__date")
.order_by("-picture__parent__event_date", "picture__created_at")
.values_list("picture_id", flat=True)
)
assert [i["id"] for i in res.json()["results"]] == expected
@ -97,7 +97,7 @@ class TestPictureSearch(TestSas):
assert res.status_code == 200
expected = list(
self.user_a.pictures.order_by(
"-picture__parent__date", "picture__date"
"-picture__parent__event_date", "picture__created_at"
).values_list("picture_id", flat=True)
)
assert [i["id"] for i in res.json()["results"]] == expected
@ -123,7 +123,7 @@ class TestPictureSearch(TestSas):
assert res.status_code == 200
expected = list(
self.user_b.pictures.intersection(self.user_a.pictures.all())
.order_by("-picture__parent__date", "picture__date")
.order_by("-picture__parent__event_date", "picture__created_at")
.values_list("picture_id", flat=True)
)
assert [i["id"] for i in res.json()["results"]] == expected

23
sas/tests/test_model.py
View File

@ -3,8 +3,8 @@ from model_bakery import baker
from core.baker_recipes import old_subscriber_user, subscriber_user
from core.models import User
from sas.baker_recipes import picture_recipe
from sas.models import Picture
from sas.baker_recipes import album_recipe, picture_recipe
from sas.models import Album, Picture
class TestPictureQuerySet(TestCase):
@ -44,3 +44,22 @@ class TestPictureQuerySet(TestCase):
user.pictures.create(picture=self.pictures[1]) # moderated
pictures = list(Picture.objects.viewable_by(user))
assert pictures == [self.pictures[1]]
class TestDeleteAlbum(TestCase):
def setUp(cls):
cls.album: Album = album_recipe.make()
cls.album_pictures = picture_recipe.make(parent=cls.album, _quantity=5)
cls.sub_album = album_recipe.make(parent=cls.album)
cls.sub_album_pictures = picture_recipe.make(parent=cls.sub_album, _quantity=5)
def test_delete(self):
album_ids = [self.album.id, self.sub_album.id]
picture_ids = [
*[p.id for p in self.album_pictures],
*[p.id for p in self.sub_album_pictures],
]
self.album.delete()
# assert not p.exists()
assert not Album.objects.filter(id__in=album_ids).exists()
assert not Picture.objects.filter(id__in=picture_ids).exists()

4
sas/tests/test_views.py
View File

@ -136,9 +136,7 @@ class TestAlbumUpload:
class TestSasModeration(TestCase):
@classmethod
def setUpTestData(cls):
album = baker.make(
Album, parent_id=settings.SITH_SAS_ROOT_DIR_ID, is_moderated=True
)
album = baker.make(Album)
cls.pictures = picture_recipe.make(
parent=album, _quantity=10, _bulk_create=True
)

87
sas/views.py
View File

@ -12,6 +12,7 @@
# OR WITHIN THE LOCAL FILE "LICENSE"
#
#
from pathlib import Path
from typing import Any
from django.conf import settings
@ -21,12 +22,12 @@ from django.shortcuts import get_object_or_404
from django.urls import reverse
from django.utils.safestring import SafeString
from django.views.generic import CreateView, DetailView, TemplateView
from django.views.generic.edit import FormView, UpdateView
from django.views.generic.edit import FormMixin, FormView, UpdateView
from core.auth.mixins import CanEditMixin, CanViewMixin
from core.models import SithFile, User
from core.views import UseFragmentsMixin
from core.views.files import FileView, send_file
from core.views import FileView, UseFragmentsMixin
from core.views.files import send_raw_file
from core.views.mixins import FragmentMixin, FragmentRenderer
from core.views.user import UserTabsMixin
from sas.forms import (
@ -62,6 +63,7 @@ class AlbumCreateFragment(FragmentMixin, CreateView):
class SASMainView(UseFragmentsMixin, TemplateView):
form_class = AlbumCreateForm
template_name = "sas/main.jinja"
def get_fragments(self) -> dict[str, FragmentRenderer]:
@ -78,12 +80,26 @@ class SASMainView(UseFragmentsMixin, TemplateView):
root_user = User.objects.get(pk=settings.SITH_ROOT_USER_ID)
return {"album_create_fragment": {"owner": root_user}}
def dispatch(self, request, *args, **kwargs):
if request.method == "POST" and not self.request.user.has_perm("sas.add_album"):
raise PermissionDenied
return super().dispatch(request, *args, **kwargs)
def get_form(self, form_class=None):
if not self.request.user.has_perm("sas.add_album"):
return None
return super().get_form(form_class)
def get_form_kwargs(self):
return super().get_form_kwargs() | {
"owner": User.objects.get(pk=settings.SITH_ROOT_USER_ID),
"parent": None,
}
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
albums_qs = Album.objects.viewable_by(self.request.user)
kwargs["categories"] = list(
albums_qs.filter(parent_id=settings.SITH_SAS_ROOT_DIR_ID).order_by("id")
)
kwargs["categories"] = list(albums_qs.filter(parent=None).order_by("id"))
kwargs["latest"] = list(albums_qs.order_by("-id")[:5])
return kwargs
@ -93,6 +109,9 @@ class PictureView(CanViewMixin, DetailView):
pk_url_kwarg = "picture_id"
template_name = "sas/picture.jinja"
def get_queryset(self):
return super().get_queryset().select_related("parent")
def get(self, request, *args, **kwargs):
self.object = self.get_object()
if "rotate_right" in request.GET:
@ -102,31 +121,42 @@ class PictureView(CanViewMixin, DetailView):
return super().get(request, *args, **kwargs)
def get_context_data(self, **kwargs):
return super().get_context_data(**kwargs) | {
"album": Album.objects.get(children=self.object)
}
return super().get_context_data(**kwargs) | {"album": self.object.parent}
def send_album(request, album_id):
return send_file(request, album_id, Album)
album = get_object_or_404(Album, id=album_id)
if not album.can_be_viewed_by(request.user):
raise PermissionDenied
return send_raw_file(Path(album.thumbnail.path))
def send_pict(request, picture_id):
return send_file(request, picture_id, Picture)
picture = get_object_or_404(Picture, id=picture_id)
if not picture.can_be_viewed_by(request.user):
raise PermissionDenied
return send_raw_file(Path(picture.original.path))
def send_compressed(request, picture_id):
return send_file(request, picture_id, Picture, "compressed")
picture = get_object_or_404(Picture, id=picture_id)
if not picture.can_be_viewed_by(request.user):
raise PermissionDenied
return send_raw_file(Path(picture.compressed.path))
def send_thumb(request, picture_id):
return send_file(request, picture_id, Picture, "thumbnail")
picture = get_object_or_404(Picture, id=picture_id)
if not picture.can_be_viewed_by(request.user):
raise PermissionDenied
return send_raw_file(Path(picture.thumbnail.path))
class AlbumView(CanViewMixin, UseFragmentsMixin, DetailView):
class AlbumView(CanViewMixin, UseFragmentsMixin, FormMixin, DetailView):
model = Album
pk_url_kwarg = "album_id"
template_name = "sas/album.jinja"
form_class = PictureUploadForm
def get_fragments(self) -> dict[str, FragmentRenderer]:
return {
@ -141,27 +171,32 @@ class AlbumView(CanViewMixin, UseFragmentsMixin, DetailView):
except ValueError as e:
raise Http404 from e
if "clipboard" not in request.session:
request.session["clipboard"] = []
request.session["clipboard"] = {"albums": [], "pictures": []}
return super().dispatch(request, *args, **kwargs)
def get_form(self, *args, **kwargs):
if not self.request.user.can_edit(self.object):
return None
return super().get_form(*args, **kwargs)
def post(self, request, *args, **kwargs):
self.object = self.get_object()
if not self.object.file:
self.object.generate_thumbnail()
if request.user.can_edit(self.object): # Handle the copy-paste functions
FileView.handle_clipboard(request, self.object)
return HttpResponseRedirect(self.request.path)
form = self.get_form()
if not form:
# the form is reserved for users that can edit this album.
# If there is no form, it means the user has no right to do a POST
raise PermissionDenied
FileView.handle_clipboard(self.request, self.object)
if not form.is_valid():
return self.form_invalid(form)
return self.form_valid(form)
def get_fragment_data(self) -> dict[str, dict[str, Any]]:
return {"album_create_fragment": {"owner": self.request.user}}
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
if ids := self.request.session.get("clipboard", None):
kwargs["clipboard"] = SithFile.objects.filter(id__in=ids)
kwargs["upload_form"] = PictureUploadForm()
# if True, the albums will be fetched with a request to the API
# if False, the section won't be displayed at all
kwargs["clipboard"] = {}
kwargs["show_albums"] = (
Album.objects.viewable_by(self.request.user)
.filter(parent_id=self.object.id)
@ -207,7 +242,7 @@ class ModerationView(TemplateView):
def get_context_data(self, **kwargs):
kwargs = super().get_context_data(**kwargs)
kwargs["albums_to_moderate"] = Album.objects.filter(
is_moderated=False, is_in_sas=True, is_folder=True
is_moderated=False
).order_by("id")
pictures = Picture.objects.filter(is_moderated=False).select_related("parent")
kwargs["pictures"] = pictures

1
sith/settings.py
View File

@ -124,7 +124,6 @@ INSTALLED_APPS = (
"pedagogy",
"galaxy",
"antispam",
"api",
)
MIDDLEWARE = (

Some files were not shown because too many files have changed in this diff Show More