[UPDATE] Update faker requirement

Updates the requirements on [faker](https://github.com/joke2k/faker) to permit the latest version.
- [Release notes](https://github.com/joke2k/faker/releases)
- [Changelog](https://github.com/joke2k/faker/blob/master/CHANGELOG.md)
- [Commits](https://github.com/joke2k/faker/compare/v40.18.0...v40.20.0)

---
updated-dependencies:
- dependency-name: faker
  dependency-version: 40.20.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

api/admin.py

@@ -17,15 +17,6 @@ class ApiClientAdmin(admin.ModelAdmin):
         "owner__nick_name",
     )
     autocomplete_fields = ("owner", "groups", "client_permissions")
-    readonly_fields = ("hmac_key",)
-    actions = ("reset_hmac_key",)
-
-    @admin.action(permissions=["change"], description=_("Reset HMAC key"))
-    def reset_hmac_key(self, _request: HttpRequest, queryset: QuerySet[ApiClient]):
-        objs = list(queryset)
-        for obj in objs:
-            obj.reset_hmac(commit=False)
-        ApiClient.objects.bulk_update(objs, fields=["hmac_key"])
 
 
 @admin.register(ApiKey)

api/api.py

@@ -1,16 +0,0 @@
-from ninja_extra import ControllerBase, api_controller, route
-
-from api.auth import ApiKeyAuth
-from api.schemas import ApiClientSchema
-
-
-@api_controller("/client")
-class ApiClientController(ControllerBase):
-    @route.get(
-        "/me",
-        auth=[ApiKeyAuth()],
-        response=ApiClientSchema,
-        url_name="api-client-infos",
-    )
-    def get_client_info(self):
-        return self.context.request.auth

api/forms.py

@@ -1,35 +0,0 @@
-from django import forms
-from django.forms import HiddenInput
-from django.utils.translation import gettext_lazy as _
-
-
-class ThirdPartyAuthForm(forms.Form):
-    """Form to complete to authenticate on the sith from a third-party app.
-
-    For the form to be valid, the user approve the EULA (french: CGU)
-    and give its username from the third-party app.
-    """
-
-    cgu_accepted = forms.BooleanField(
-        required=True,
-        label=_("I have read and I accept the terms and conditions of use"),
-        error_messages={
-            "required": _("You must approve the terms and conditions of use.")
-        },
-    )
-    is_username_valid = forms.BooleanField(
-        required=True,
-        error_messages={"required": _("You must confirm that this is your username.")},
-    )
-    client_id = forms.IntegerField(widget=HiddenInput())
-    third_party_app = forms.CharField(widget=HiddenInput())
-    privacy_link = forms.URLField(widget=HiddenInput())
-    username = forms.CharField(widget=HiddenInput())
-    callback_url = forms.URLField(widget=HiddenInput())
-    signature = forms.CharField(widget=HiddenInput())
-
-    def __init__(self, *args, label_suffix: str = "", initial, **kwargs):
-        super().__init__(*args, label_suffix=label_suffix, initial=initial, **kwargs)
-        self.fields["is_username_valid"].label = _(
-            "I confirm that %(username)s is my username on %(app)s"
-        ) % {"username": initial.get("username"), "app": initial.get("third_party_app")}

api/migrations/0002_apiclient_hmac_key.py

@@ -1,19 +0,0 @@
-# Generated by Django 5.2.3 on 2025-10-26 10:15
-
-from django.db import migrations, models
-
-import api.models
-
-
-class Migration(migrations.Migration):
-    dependencies = [("api", "0001_initial")]
-
-    operations = [
-        migrations.AddField(
-            model_name="apiclient",
-            name="hmac_key",
-            field=models.CharField(
-                default=api.models.get_hmac_key, max_length=128, verbose_name="HMAC Key"
-            ),
-        ),
-    ]

api/models.py

@@ -1,20 +1,13 @@
-import secrets
 from typing import Iterable
 
 from django.contrib.auth.models import Permission
 from django.db import models
-from django.db.models import Q
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import pgettext_lazy
 
 from core.models import Group, User
 
 
-def get_hmac_key():
-    return secrets.token_hex(64)
-
-
 class ApiClient(models.Model):
     name = models.CharField(_("name"), max_length=64)
     owner = models.ForeignKey(
@@ -33,10 +26,11 @@ class ApiClient(models.Model):
         help_text=_("Specific permissions for this api client."),
         related_name="clients",
     )
-    hmac_key = models.CharField(_("HMAC Key"), max_length=128, default=get_hmac_key)
     created_at = models.DateTimeField(auto_now_add=True)
     updated_at = models.DateTimeField(auto_now=True)
 
+    _perm_cache: set[str] | None = None
+
     class Meta:
         verbose_name = _("api client")
         verbose_name_plural = _("api clients")
@@ -44,38 +38,33 @@ class ApiClient(models.Model):
     def __str__(self):
         return self.name
 
-    @cached_property
-    def all_permissions(self) -> set[str]:
-        permissions = (
-            Permission.objects.filter(
-                Q(group__group__in=self.groups.all()) | Q(clients=self)
-            )
-            .values_list("content_type__app_label", "codename")
-            .order_by()
-        )
-        return {f"{content_type}.{name}" for content_type, name in permissions}
-
     def has_perm(self, perm: str):
         """Return True if the client has the specified permission."""
-        return perm in self.all_permissions
 
-    def has_perms(self, perm_list: Iterable[str]) -> bool:
-        """Return True if the client has each of the specified permissions."""
+        if self._perm_cache is None:
+            group_permissions = (
+                Permission.objects.filter(group__group__in=self.groups.all())
+                .values_list("content_type__app_label", "codename")
+                .order_by()
+            )
+            client_permissions = self.client_permissions.values_list(
+                "content_type__app_label", "codename"
+            ).order_by()
+            self._perm_cache = {
+                f"{content_type}.{name}"
+                for content_type, name in (*group_permissions, *client_permissions)
+            }
+        return perm in self._perm_cache
+
+    def has_perms(self, perm_list):
+        """
+        Return True if the client has each of the specified permissions. If
+        object is passed, check if the client has all required perms for it.
+        """
         if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
             raise ValueError("perm_list must be an iterable of permissions.")
         return all(self.has_perm(perm) for perm in perm_list)
 
-    def reset_hmac(self, *, commit: bool = True) -> str:
-        """Reset and return the HMAC key for this client.
-
-        Args:
-            commit: if True (the default), persist the new hmac in db.
-        """
-        self.hmac_key = get_hmac_key()
-        if commit:
-            self.save()
-        return self.hmac_key
-
 
 class ApiKey(models.Model):
     PREFIX_LENGTH = 5

api/schemas.py

@@ -1,23 +0,0 @@
-from ninja import ModelSchema, Schema
-from pydantic import Field, HttpUrl
-
-from api.models import ApiClient
-from core.schemas import SimpleUserSchema
-
-
-class ApiClientSchema(ModelSchema):
-    class Meta:
-        model = ApiClient
-        fields = ["id", "name"]
-
-    owner: SimpleUserSchema
-    permissions: list[str] = Field(alias="all_permissions")
-
-
-class ThirdPartyAuthParamsSchema(Schema):
-    client_id: int
-    third_party_app: str
-    privacy_link: HttpUrl
-    username: str
-    callback_url: HttpUrl
-    signature: str

api/templates/api/third_party/auth.jinja

@@ -1,32 +0,0 @@
-{% extends "core/base.jinja" %}
-
-{% block content %}
-  <form method="post">
-    {% csrf_token %}
-    <h3>{% trans %}Confidentiality{% endtrans %}</h3>
-    <p>
-      {% trans trimmed app=third_party_app %}
-        By ticking this box and clicking on the send button, you
-        acknowledge and agree to provide {{ app }} with your
-        first name, last name, nickname and any other information
-        that was the third party app was explicitly authorized to fetch
-        and that it must have acknowledged to you, in a complete and accurate manner.
-      {% endtrans %}
-    </p>
-    <p class="margin-bottom">
-      {% trans trimmed app=third_party_app, privacy_link=third_party_cgu, sith_cgu_link=sith_cgu %}
-        The privacy policies of <a href="{{ privacy_link }}">{{ app }}</a>
-        and of <a href="{{ sith_cgu_link }}">the Students' Association</a>
-        applies as soon as the form is submitted.
-      {% endtrans %}
-    </p>
-    <div class="row">{{ form.cgu_accepted }} {{ form.cgu_accepted.label_tag() }}</div>
-    <br>
-    <h3 class="margin-bottom">{% trans %}Confirmation of identity{% endtrans %}</h3>
-    <div class="row margin-bottom">
-      {{ form.is_username_valid }} {{ form.is_username_valid.label_tag() }}
-    </div>
-    {% for field in form.hidden_fields() %}{{ field }}{% endfor %}
-    <input type="submit" class="btn btn-blue">
-  </form>
-{% endblock %}

api/tests/test_admin.py

@@ -1,24 +0,0 @@
-import pytest
-from django.contrib.admin import AdminSite
-from django.http import HttpRequest
-from model_bakery import baker
-from pytest_django.asserts import assertNumQueries
-
-from api.admin import ApiClientAdmin
-from api.models import ApiClient
-
-
-@pytest.mark.django_db
-def test_reset_hmac_action():
-    client_admin = ApiClientAdmin(ApiClient, AdminSite())
-    api_clients = baker.make(ApiClient, _quantity=4, _bulk_create=True)
-    old_hmac_keys = [c.hmac_key for c in api_clients]
-    with assertNumQueries(2):
-        qs = ApiClient.objects.filter(id__in=[c.id for c in api_clients[2:4]])
-        client_admin.reset_hmac_key(HttpRequest(), qs)
-    for c in api_clients:
-        c.refresh_from_db()
-    assert api_clients[0].hmac_key == old_hmac_keys[0]
-    assert api_clients[1].hmac_key == old_hmac_keys[1]
-    assert api_clients[2].hmac_key != old_hmac_keys[2]
-    assert api_clients[3].hmac_key != old_hmac_keys[3]

api/tests/test_api_client_controller.py

@@ -1,18 +0,0 @@
-import pytest
-from django.test import Client
-from django.urls import reverse
-from model_bakery import baker
-
-from api.hashers import generate_key
-from api.models import ApiClient, ApiKey
-from api.schemas import ApiClientSchema
-
-
-@pytest.mark.django_db
-def test_api_client_controller(client: Client):
-    key, hashed = generate_key()
-    api_client = baker.make(ApiClient)
-    baker.make(ApiKey, client=api_client, hashed_key=hashed)
-    res = client.get(reverse("api:api-client-infos"), headers={"X-APIKey": key})
-    assert res.status_code == 200
-    assert res.json() == ApiClientSchema.from_orm(api_client).model_dump()

api/tests/test_client.py

@@ -1,59 +0,0 @@
-import pytest
-from django.contrib.auth.models import Permission
-from django.test import TestCase
-from model_bakery import baker
-
-from api.models import ApiClient
-from core.models import Group
-
-
-class TestClientPermissions(TestCase):
-    @classmethod
-    def setUpTestData(cls):
-        cls.api_client = baker.make(ApiClient)
-        cls.perms = baker.make(Permission, _quantity=10, _bulk_create=True)
-        cls.api_client.groups.set(
-            [
-                baker.make(Group, permissions=cls.perms[0:3]),
-                baker.make(Group, permissions=cls.perms[3:5]),
-            ]
-        )
-        cls.api_client.client_permissions.set(
-            [cls.perms[3], cls.perms[5], cls.perms[6], cls.perms[7]]
-        )
-
-    def test_all_permissions(self):
-        assert self.api_client.all_permissions == {
-            f"{p.content_type.app_label}.{p.codename}" for p in self.perms[0:8]
-        }
-
-    def test_has_perm(self):
-        assert self.api_client.has_perm(
-            f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}"
-        )
-        assert not self.api_client.has_perm(
-            f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}"
-        )
-
-    def test_has_perms(self):
-        assert self.api_client.has_perms(
-            [
-                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
-                f"{self.perms[2].content_type.app_label}.{self.perms[2].codename}",
-            ]
-        )
-        assert not self.api_client.has_perms(
-            [
-                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
-                f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}",
-            ],
-        )
-
-
-@pytest.mark.django_db
-def test_reset_hmac_key():
-    client = baker.make(ApiClient)
-    original_key = client.hmac_key
-    client.reset_hmac(commit=True)
-    assert len(client.hmac_key) == len(original_key)
-    assert client.hmac_key != original_key

api/tests/test_third_party_auth.py

@@ -1,134 +0,0 @@
-from unittest import mock
-from unittest.mock import Mock
-
-from django.contrib.messages import Message, get_messages
-from django.db.models import Max
-from django.test import TestCase
-from django.urls import reverse
-from model_bakery import baker
-from pytest_django.asserts import assertRedirects
-
-from api.models import ApiClient, get_hmac_key
-from core.baker_recipes import subscriber_user
-from core.schemas import UserProfileSchema
-from core.utils import hmac_hexdigest
-
-
-def mocked_post(*, ok: bool):
-    class MockedResponse(Mock):
-        @property
-        def ok(self):
-            return ok
-
-    def mocked():
-        return MockedResponse()
-
-    return mocked
-
-
-class TestThirdPartyAuth(TestCase):
-    @classmethod
-    def setUpTestData(cls):
-        cls.user = subscriber_user.make()
-        cls.api_client = baker.make(ApiClient)
-
-    def setUp(self):
-        self.query = {
-            "client_id": self.api_client.id,
-            "third_party_app": "app",
-            "privacy_link": "https://foobar.fr/",
-            "username": "bibou",
-            "callback_url": "https://callback.fr/",
-        }
-        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
-        self.callback_data = {
-            "user": UserProfileSchema.from_orm(self.user).model_dump()
-        }
-        self.callback_data["signature"] = hmac_hexdigest(
-            self.api_client.hmac_key, self.callback_data["user"]
-        )
-
-    def test_auth_ok(self):
-        self.client.force_login(self.user)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
-        assert res.status_code == 200
-        with mock.patch("requests.post", new_callable=mocked_post(ok=True)) as mocked:
-            res = self.client.post(
-                reverse("api-link:third-party-auth"),
-                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
-            )
-            mocked.assert_called_once_with(
-                self.query["callback_url"], json=self.callback_data
-            )
-        assertRedirects(
-            res,
-            reverse("api-link:third-party-auth-result", kwargs={"result": "success"}),
-        )
-
-    def test_callback_error(self):
-        """Test that the user see the failure page if the callback request failed."""
-        self.client.force_login(self.user)
-        with mock.patch("requests.post", new_callable=mocked_post(ok=False)) as mocked:
-            res = self.client.post(
-                reverse("api-link:third-party-auth"),
-                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
-            )
-            mocked.assert_called_once_with(
-                self.query["callback_url"], json=self.callback_data
-            )
-        assertRedirects(
-            res,
-            reverse("api-link:third-party-auth-result", kwargs={"result": "failure"}),
-        )
-
-    def test_wrong_signature(self):
-        """Test that a 403 is raised if the signature of the query is wrong."""
-        self.client.force_login(subscriber_user.make())
-        new_key = get_hmac_key()
-        del self.query["signature"]
-        self.query["signature"] = hmac_hexdigest(new_key, self.query)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
-        assert list(get_messages(res.wsgi_request)) == [
-            Message(
-                level=40,
-                message=(
-                    "La signature est incorrecte. "
-                    "Nous ne pouvons pas garantir l'authenticité de la requête."
-                ),
-            )
-        ]
-
-    def test_cgu_not_accepted(self):
-        self.client.force_login(self.user)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
-        assert res.status_code == 200
-        res = self.client.post(reverse("api-link:third-party-auth"), data=self.query)
-        assert res.status_code == 200  # no redirect means invalid form
-        res = self.client.post(
-            reverse("api-link:third-party-auth"),
-            data={"cgu_accepted": False, "is_username_valid": False, **self.query},
-        )
-        assert res.status_code == 200
-
-    def test_invalid_client(self):
-        self.client.force_login(self.user)
-        self.query["client_id"] = ApiClient.objects.aggregate(res=Max("id"))["res"] + 1
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
-        assert list(get_messages(res.wsgi_request)) == [
-            Message(
-                level=40,
-                message="Les données fournies pour l'authentification sont incorrectes.",
-            )
-        ]
-
-    def test_missing_parameter(self):
-        self.client.force_login(self.user)
-        del self.query["username"]
-        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
-        assert list(get_messages(res.wsgi_request)) == [
-            Message(
-                level=40,
-                message="Les données fournies pour l'authentification sont incorrectes.",
-            )
-        ]

api/urls.py

@@ -1,10 +1,6 @@
-from django.urls import path, register_converter
 from ninja.security import SessionAuth
 from ninja_extra import NinjaExtraAPI
 
-from api.views import ThirdPartyAuthResultView, ThirdPartyAuthView
-from core.converters import ResultConverter
-
 api = NinjaExtraAPI(
     title="PICON",
     description="Portail Interactif de Communication avec les Outils Numériques",
@@ -13,14 +9,3 @@ api = NinjaExtraAPI(
     auth=[SessionAuth()],
 )
 api.auto_discover_controllers()
-
-register_converter(ResultConverter, "res")
-
-urlpatterns = [
-    path("auth/", ThirdPartyAuthView.as_view(), name="third-party-auth"),
-    path(
-        "auth/<res:result>/",
-        ThirdPartyAuthResultView.as_view(),
-        name="third-party-auth-result",
-    ),
-]

api/views.py

@@ -1,146 +0,0 @@
-import hmac
-from urllib.parse import unquote
-
-import pydantic
-import requests
-import sentry_sdk
-from django.conf import settings
-from django.contrib import messages
-from django.contrib.auth.mixins import AccessMixin, LoginRequiredMixin
-from django.shortcuts import render
-from django.urls import reverse, reverse_lazy
-from django.utils.translation import gettext as _
-from django.views.generic import FormView, TemplateView
-from ninja_extra.shortcuts import get_object_or_none
-
-from api.forms import ThirdPartyAuthForm
-from api.models import ApiClient
-from api.schemas import ThirdPartyAuthParamsSchema
-from core.models import SithFile
-from core.schemas import UserProfileSchema
-from core.utils import hmac_hexdigest
-
-
-class ThirdPartyAuthView(AccessMixin, FormView):
-    form_class = ThirdPartyAuthForm
-    template_name = "api/third_party/auth.jinja"
-    success_url = reverse_lazy("core:index")
-
-    def parse_params(self) -> ThirdPartyAuthParamsSchema | None:
-        """Parse and check the authentication parameters.
-
-        If parsing fails, messages will be created using the django message
-        infrastructure.
-
-        Returns:
-            The parses parameters, or None if the parsing failed.
-        """
-        # This is here rather than in ThirdPartyAuthForm because
-        # the given parameters and their signature are checked during both
-        # POST (for obvious reasons) and GET (in order not to make
-        # the user fill a form just to get an error he won't understand)
-        params = self.request.GET or self.request.POST
-        params = {key: unquote(val) for key, val in params.items()}
-        try:
-            params = ThirdPartyAuthParamsSchema(**params)
-        except pydantic.ValidationError:
-            messages.error(
-                self.request, _("The data provided for authentication is incorrect")
-            )
-            return None
-        client: ApiClient = get_object_or_none(ApiClient, id=params.client_id)
-        if not client:
-            messages.error(
-                self.request, _("The data provided for authentication is incorrect")
-            )
-            return None
-        if not hmac.compare_digest(
-            hmac_hexdigest(client.hmac_key, params.model_dump(exclude={"signature"})),
-            params.signature,
-        ):
-            messages.error(
-                self.request,
-                _(
-                    "The signature is incorrect. "
-                    "We cannot ensure the provenance of the request."
-                ),
-            )
-            return None
-        return params
-
-    def dispatch(self, request, *args, **kwargs):
-        if not request.user.is_authenticated:
-            return self.handle_no_permission()
-        self.params = self.parse_params()
-        if not self.params:
-            # if parameters parsing failed, shortcut the operation and display
-            # an empty page with just the error messages.
-            return render(request, "core/base.jinja")
-        return super().dispatch(request, *args, **kwargs)
-
-    def get(self, *args, **kwargs):
-        messages.warning(
-            self.request,
-            _(
-                "You are going to link your AE account and your %(app)s account. "
-                "Continue only if this page was opened from %(app)s."
-            )
-            % {"app": self.params.third_party_app},
-        )
-        return super().get(*args, **kwargs)
-
-    def get_initial(self):
-        return self.params.model_dump()
-
-    def form_valid(self, form):
-        client = ApiClient.objects.get(id=form.cleaned_data["client_id"])
-        user = UserProfileSchema.from_orm(self.request.user).model_dump()
-        data = {"user": user, "signature": hmac_hexdigest(client.hmac_key, user)}
-        try:
-            ok = requests.post(form.cleaned_data["callback_url"], json=data).ok
-        except requests.RequestException as e:
-            sentry_sdk.capture_exception(e)
-            ok = False
-        self.success_url = reverse(
-            "api-link:third-party-auth-result",
-            kwargs={"result": "success" if ok else "failure"},
-        )
-        return super().form_valid(form)
-
-    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
-            "third_party_app": self.params.third_party_app,
-            "third_party_cgu": self.params.privacy_link,
-            "sith_cgu": SithFile.objects.get(id=settings.SITH_CGU_FILE_ID),
-        }
-
-
-class ThirdPartyAuthResultView(LoginRequiredMixin, TemplateView):
-    """View that the user will see if its authentication on sith was successful.
-
-    This can show either a success or a failure message :
-    - success : everything is good, the user is successfully authenticated
-      and can close the page
-    - failure : the authentication has been processed on the sith side,
-      but the request to the callback url received an error.
-      In such a case, there is nothing much we can do but to advice
-      the user to contact the developers of the third-party app.
-    """
-
-    template_name = "core/base.jinja"
-    success_message = _(
-        "You have been successfully authenticated. You can now close this page."
-    )
-    error_message = _(
-        "Your authentication on the AE website was successful, "
-        "but an error happened during the interaction "
-        "with the third-party application. "
-        "Please contact the managers of the latter."
-    )
-
-    def get(self, request, *args, **kwargs):
-        if self.kwargs.get("result") == "success":
-            messages.success(request, self.success_message)
-        else:
-            messages.error(request, self.error_message)
-        return super().get(request, *args, **kwargs)

club/forms.py

@@ -392,6 +392,30 @@ class ClubRoleForm(forms.ModelForm):
             self.instance.order = cleaned_data["ORDER"] - 1
         return cleaned_data
 
+    def save(self, commit=True):  # noqa: FBT002
+        instance: ClubRole = super().save(commit=commit)
+        if commit and "is_board" in self.changed_data:
+            # if the role was moved from board to simple member,
+            # remove all users with that role from the club board group.
+            # If the role became a board role, add users with
+            # that role to the club board group.
+            group_id = instance.club.board_group_id
+            if self.cleaned_data["is_board"]:
+                User.groups.through.objects.bulk_create(
+                    [
+                        User.groups.through(user_id=u, group_id=group_id)
+                        for u in Membership.objects.ongoing()
+                        .filter(role=instance)
+                        .values_list("user_id", flat=True)
+                    ],
+                    ignore_conflicts=True,
+                )
+            else:
+                User.groups.through.objects.filter(
+                    user__memberships__role=instance, group_id=group_id
+                ).delete()
+        return instance
+
 
 class ClubRoleCreateForm(forms.ModelForm):
     """Form to create a club role.

club/tests/test_clubrole.py

@@ -4,6 +4,7 @@ import pytest
 from django.contrib.auth.models import Permission
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.timezone import now
 from model_bakery import baker, seq
 from model_bakery.recipe import Recipe
 from pytest_django.asserts import assertRedirects
@@ -239,7 +240,7 @@ class TestClubRoleUpdate(TestCase):
 
     def test_president_moves_itself_out_of_the_presidency(self):
         """Test that if the user moves its own role out of the presidency,
-        then it's redirected to another page and loses access to the update page."""
+        then it loses access to the update page."""
         self.payload["roles-0-is_presidency"] = False
         self.client.force_login(self.user)
         res = self.client.post(self.url, data=self.payload)
@@ -251,3 +252,29 @@ class TestClubRoleUpdate(TestCase):
 
         res = self.client.get(self.url)
         assert res.status_code == 403
+
+    def test_role_stops_being_board(self):
+        """Test that if a role stops being a board role,
+        its users lose the club board group."""
+        self.payload["roles-0-is_board"] = False
+        self.payload["roles-0-is_presidency"] = False
+        self.payload["roles-1-is_board"] = False
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        assert not self.user.groups.contains(self.club.board_group)
+
+    def test_role_becomes_board(self):
+        """Test that if a role becomes a board role,
+        its active users get the club board group"""
+        members = [
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=None),
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=now()),
+        ]
+        self.payload["roles-2-is_board"] = True
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        # the second membership is finished, so its user shouldn't get the role
+        assert members[0].user.groups.contains(self.club.board_group)
+        assert not members[1].user.groups.contains(self.club.board_group)

core/converters.py

@@ -1,16 +1,19 @@
-from django.urls.converters import IntConverter, StringConverter
-
-
-class FourDigitYearConverter(IntConverter):
+class FourDigitYearConverter:
     regex = "[0-9]{4}"
 
+    def to_python(self, value):
+        return int(value)
+
     def to_url(self, value):
         return str(value).zfill(4)
 
 
-class TwoDigitMonthConverter(IntConverter):
+class TwoDigitMonthConverter:
     regex = "[0-9]{2}"
 
+    def to_python(self, value):
+        return int(value)
+
     def to_url(self, value):
         return str(value).zfill(2)
 
@@ -25,9 +28,3 @@ class BooleanStringConverter:
 
     def to_url(self, value):
         return str(value)
-
-
-class ResultConverter(StringConverter):
-    """Converter whose regex match either "success" or "failure"."""
-
-    regex = "(success|failure)"

core/management/commands/populate.py

@@ -28,7 +28,6 @@ from typing import ClassVar, NamedTuple
 from django.conf import settings
 from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
-from django.core.files.base import ContentFile
 from django.core.management import call_command
 from django.core.management.base import BaseCommand
 from django.db import connection
@@ -119,21 +118,15 @@ class Command(BaseCommand):
         )
         self.profiles_root = SithFile.objects.create(name="profiles", owner=root)
         home_root = SithFile.objects.create(name="users", owner=root)
+
+        # Page needed for club creation
+        p = Page(name=settings.SITH_CLUB_ROOT_PAGE)
+        p.save(force_lock=True)
+
         club_root = SithFile.objects.create(name="clubs", owner=root)
         sas = SithFile.objects.create(
             name="SAS", owner=root, id=settings.SITH_SAS_ROOT_DIR_ID
         )
-        SithFile.objects.create(
-            name="CGU",
-            is_folder=False,
-            file=ContentFile(
-                content="Conditions générales d'utilisation", name="cgu.txt"
-            ),
-            owner=root,
-        )
-        # Page needed for club creation
-        p = Page(name=settings.SITH_CLUB_ROOT_PAGE)
-        p.save(force_lock=True)
         clubs = self._create_clubs()
 
         self.reset_index("club")

core/management/commands/populate_more.py

@@ -1,4 +1,3 @@
-import math
 import random
 from datetime import date, timedelta
 from datetime import timezone as tz
@@ -36,17 +35,12 @@ class Command(BaseCommand):
         super().__init__(*args, **kwargs)
         self.faker = Faker("fr_FR")
 
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "-n", "--nb-users", help="Number of users to create", type=int, default=600
-        )
-
     def handle(self, *args, **options):
         if not settings.DEBUG:
             raise Exception("Never call this command in prod. Never.")
 
         self.stdout.write("Creating users...")
-        users = self.create_users(options["nb_users"])
+        users = self.create_users()
         self.create_bans(random.sample(users, k=len(users) // 200))  # 0.5% of users
         subscribers = random.sample(users, k=int(0.8 * len(users)))
         self.stdout.write("Creating subscriptions...")
@@ -86,7 +80,7 @@ class Command(BaseCommand):
         self.stdout.write("Creating products...")
         self.create_products()
         self.stdout.write("Creating sales and refills...")
-        sellers = random.sample(users, len(users) // 10)
+        sellers = random.sample(list(User.objects.all()), 100)
         self.create_sales(sellers)
         self.stdout.write("Creating permanences...")
         self.create_permanences(sellers)
@@ -95,7 +89,7 @@ class Command(BaseCommand):
 
         self.stdout.write("Done")
 
-    def create_users(self, nb_users: int = 600) -> list[User]:
+    def create_users(self) -> list[User]:
         # Create a single password hash for all users to make it faster.
         # It's insecure as hell, but it's ok since it's only for dev purposes.
         password = make_password("plop")
@@ -114,7 +108,7 @@ class Command(BaseCommand):
                 address=self.faker.address(),
                 password=password,
             )
-            for _ in range(nb_users)
+            for _ in range(600)
         ]
         # there may a duplicate or two
         # Not a problem, we will just have 599 users instead of 600
@@ -421,9 +415,8 @@ class Command(BaseCommand):
         Permanency.objects.bulk_create(perms)
 
     def create_forums(self):
-        users = list(User.objects.all())
-        forumers = random.sample(users, math.ceil(len(users) / 10))
-        most_actives = random.sample(forumers, math.ceil(len(forumers) / 6))
+        forumers = random.sample(list(User.objects.all()), 100)
+        most_actives = random.sample(forumers, 10)
         categories = list(Forum.objects.filter(is_category=True))
         new_forums = [
             Forum(name=self.faker.text(20), parent=random.choice(categories))

core/static/core/accordion.scss

@@ -46,6 +46,10 @@ details.accordion>.accordion-content {
   border-bottom-right-radius: 3px;
   border-bottom-left-radius: 3px;
   overflow: hidden;
+
+  @media screen and (max-width: 600px) {
+    padding: .75em 1.5em;
+  }
 }
 
 @mixin animation($selector) {

core/static/core/forms.scss

@@ -141,6 +141,7 @@ form {
   display: block;
   margin: calc(var(--nf-input-size) * 1.5) auto 10px;
   line-height: 1;
+  white-space: nowrap;
 
   .fields-centered {
     padding: 10px 10px 0;

core/tests/test_commands.py

@@ -1,13 +0,0 @@
-import contextlib
-import os
-
-import pytest
-from django.core.management import call_command
-
-
-@pytest.mark.django_db
-def test_populate_more(settings):
-    """Just check that populate more doesn't crash"""
-    settings.DEBUG = True
-    with open(os.devnull, "w") as devnull, contextlib.redirect_stdout(devnull):
-        call_command("populate_more", "--nb-users", "50")

core/utils.py

@@ -12,31 +12,21 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
-from __future__ import annotations
 
-import hmac
 from datetime import date, timedelta
 
 # Image utils
 from io import BytesIO
-from typing import TYPE_CHECKING
-from urllib.parse import urlencode
+from typing import Final
 
 import PIL
 from django.conf import settings
 from django.core.files.base import ContentFile
+from django.core.files.uploadedfile import UploadedFile
+from django.http import HttpRequest
 from django.utils.timezone import localdate
 from PIL.Image import Image, Resampling
 
-if TYPE_CHECKING:
-    from _hashlib import HASH
-    from collections.abc import Buffer, Mapping, Sequence
-    from typing import Any, Callable, Final
-
-    from django.core.files.uploadedfile import UploadedFile
-    from django.http import HttpRequest
-
-
 RED_PIXEL_PNG: Final[bytes] = (
     b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52"
     b"\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90\x77\x53"
@@ -198,30 +188,3 @@ def get_client_ip(request: HttpRequest) -> str | None:
             return ip
 
     return None
-
-
-def hmac_hexdigest(
-    key: str | bytes,
-    data: Mapping[str, Any] | Sequence[tuple[str, Any]],
-    digest: str | Callable[[Buffer], HASH] = "sha512",
-) -> str:
-    """Return the hexdigest of the signature of the given data.
-
-    Args:
-        key: the HMAC key used for the signature
-        data: the data to sign
-        digest: a PEP247 hashing algorithm (by default, sha512)
-
-    Examples:
-        ```python
-        data = {
-            "foo": 5,
-            "bar": "somevalue",
-        }
-        hmac_key = secrets.token_hex(64)
-        signature = hmac_hexdigest(hmac_key, data, "sha256")
-        ```
-    """
-    if isinstance(key, str):
-        key = key.encode()
-    return hmac.digest(key, urlencode(data).encode(), digest).hex()

counter/static/bundled/counter/components/counter-product-select-index.ts

@@ -1,6 +1,6 @@
-import type { RecursivePartial, TomSettings } from "tom-select/dist/types/types";
-import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base.ts";
-import { registerComponent } from "#core:utils/web-components.ts";
+import type { RecursivePartial, TomSettings } from "tom-select/src/types";
+import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base";
+import { registerComponent } from "#core:utils/web-components";
 
 const productParsingRegex = /^(\d+x)?(.*)/i;
 const codeParsingRegex = / \((\w+)\)$/;
@@ -63,13 +63,6 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
         );
       },
     );
-
-    this.widget.hook("after", "onOptionSelect", () => {
-      /* Focus the next element if it's an input */
-      if (this.nextElementSibling.nodeName === "INPUT") {
-        (this.nextElementSibling as HTMLInputElement).focus();
-      }
-    });
   }
   protected tomSelectSettings(): RecursivePartial<TomSettings> {
     /* We disable the dropdown on focus because we're going to always autofocus the widget */
@@ -80,9 +73,7 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
       // We need to manually set weights or it results on an inconsistent
       // behavior between production and development environment
       searchField: [
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "code", weight: 2 },
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "text", weight: 0.5 },
       ],
     };

counter/static/bundled/counter/counter-click-index.ts

@@ -25,6 +25,9 @@ document.addEventListener("alpine:init", () => {
       }
 
       this.codeField = this.$refs.codeField;
+      this.codeField.widget.hook("after", "onOptionSelect", () => {
+        this.handleCode();
+      });
       this.codeField.widget.focus();
 
       // It's quite tricky to manually apply attributes to the management part
@@ -154,6 +157,7 @@ document.addEventListener("alpine:init", () => {
         this.addToBasket(code, quantity);
       }
       this.codeField.widget.clear();
+      this.codeField.widget.setTextboxValue("");
       this.codeField.widget.focus();
     },
   }));

counter/static/counter/css/counter-click.scss

@@ -42,7 +42,28 @@
   min-width: 350px;
 
   ul {
-    list-style-type: none;
+    list-style: none;
+    display: flex;
+    flex-direction: column;
+    gap: .5rem;
+    margin-left: 0;
+
+    .basket-row {
+      display: flex;
+      align-items: center;
+      gap: 1rem;
+
+      .product-name {
+        flex: 1 2 0;
+        min-width: 0;
+        text-wrap: wrap;
+      }
+    }
+  }
+
+  form {
+    margin-top: .5rem;
+    margin-bottom: .5rem;
   }
 }
 

counter/templates/counter/counter_click.jinja

@@ -56,10 +56,15 @@
         <div class="accordion-content">
           {% set counter_click_url = url('counter:click', counter_id=counter.id, user_id=customer.user_id) %}
 
-          <form method="post" action=""
-                class="code_form" @submit.prevent="handleCode">
+          <form method="post" action="" @submit.prevent="handleCode">
 
-            <counter-product-select name="code" x-ref="codeField" autofocus required placeholder="{% trans %}Select a product...{% endtrans %}">
+            <counter-product-select
+              name="code"
+              x-ref="codeField"
+              autofocus
+              required
+              placeholder="{% trans %}Select a product...{% endtrans %}"
+            >
               <option value=""></option>
               <optgroup label="{% trans %}Operations{% endtrans %}">
                 <option value="FIN">{% trans %}Confirm (FIN){% endtrans %}</option>
@@ -68,13 +73,11 @@
               {%- for category, prices in categories.items() -%}
                 <optgroup label="{{ category }}">
                   {%- for price in prices -%}
-                    <option value="{{ price.id }}">{{ price.full_label }}</option>
+                    <option value="{{ price.id }}">{{ price.full_label }} ({{ price.product.code }})</option>
                   {%- endfor -%}
                 </optgroup>
               {%- endfor -%}
             </counter-product-select>
-
-            <input type="submit" value="{% trans %}Go{% endtrans %}"/>
           </form>
 
           {% for error in form.non_form_errors() %}
@@ -102,7 +105,9 @@
               {{ form.management_form }}
             </div>
             <ul>
-              <li x-show="getBasketSize() === 0">{% trans %}This basket is empty{% endtrans %}</li>
+              <li x-show="getBasketSize() === 0">
+                <em>{% trans %}This basket is empty{% endtrans %}</em>
+              </li>
               <template x-for="(item, index) in Object.values(basket)" :key="item.product.price.id">
                 <li>
                   <template x-for="error in item.errors">
@@ -110,19 +115,23 @@
                     </div>
                   </template>
 
-                  <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
-                  <span class="quantity" x-text="item.quantity"></span>
-                  <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                  <div class="basket-row">
+                    <div>
+                      <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
+                      <span class="quantity" x-text="item.quantity"></span>
+                      <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                    </div>
 
-                  <span x-text="item.product.name"></span> :
-                  <span x-text="item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })">€</span>
-                  <span x-show="item.getBonusQuantity() > 0"
-                        x-text="`${item.getBonusQuantity()} x P`"></span>
+                    <span class="product-name" x-text="item.product.name"></span>
+                    <span x-text="`${item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })} €`"></span>
+                    <span x-show="item.getBonusQuantity() > 0"
+                          x-text="`${item.getBonusQuantity()} x P`"></span>
 
-                  <button
-                    class="remove-item"
-                    @click.prevent="removeFromBasket(item.product.price.id)"
-                  ><i class="fa fa-trash-can delete-action"></i></button>
+                    <button
+                      class="remove-item"
+                      @click.prevent="removeFromBasket(item.product.price.id)"
+                    ><i class="fa fa-trash-can delete-action"></i></button>
+                  </div>
 
                   <input
                     type="hidden"

docs/reference/api/schemas.md

@@ -1 +0,0 @@
-::: api.schemas

docs/reference/api/views.md

@@ -1 +0,0 @@
-::: api.views

docs/tutorial/api/account-link.md

@@ -1,372 +0,0 @@
-Le site AE offre des mécanismes permettant aux applications tierces
-de récupérer les informations sur un utilisateur du site AE.
-De cette manière, il devient possible de synchroniser les informations
-qu possède l'application tierce sur l'utilisateur, directement depuis
-le site AE.
-
-## Fonctionnement général
-
-Pour authentifier vos utilisateurs, vous aurez besoin d'un serveur web
-et d'un client d'API (celui auquel est liée votre
-[clef d'API](./connect.md#obtenir-une-clef-dapi)).
-Deux informations vous sont nécessaires, en plus de votre clef d'API :
-
-- l'id du client : vous pouvez l'obtenir soit en le demandant à l'équipe info,
-  soit en appelant la route `GET /api/client/me` avec votre clef d'API
-  renseignée dans le header [X-APIKey](./connect.md#x-apikey)
-- la clef HMAC du client : vous devez la demander à l'équipe info.
-
-Grâce à ces informations, vous allez pouvoir fournir le contexte nécessaire
-au site AE pour qu'il authentifie vos utilisateurs.
-
-En effet, la démarche d'authentification s'effectue presque entièrement
-sur le site : le travail de l'application tierce consiste uniquement
-à fournir à l'utilisateur une url avec les bons paramètres, puis
-à recevoir la réponse du serveur si tout s'est bien passé.
-
-Comme un dessin vaut parfois mieux que mille mots,
-voici les diagrammes décrivant le processus.
-L'un montre l'entièreté de la démarche ;
-l'autre dans un souci de simplicité, ne montre que ce qui est visible
-directement par l'application tierce.
-
-=== "Intégralité du processus"
-
-    ```mermaid
-    sequenceDiagram
-        actor User
-        participant App
-        User->>+App: Authentifie-moi, stp
-        App-->>-User: url de connexion<br/>avec signature
-        User->>+Sith: GET url
-        opt Utilisateur non-connecté
-            Sith->>+User: Formulaire de connexion
-            User-->>-Sith: Connexion
-        end
-        Sith->>Sith: vérification de la signature
-        Sith->>+User: Formulaire<br/>des conditions<br/>d'utilisation
-        User-->>-Sith: Validation
-        Sith->>+App: URL de retour<br/>avec données utilisateur
-        App->>App: Traitement des <br/>données utilisateur
-        App-->>-Sith: 204 OK, No content
-        Sith-->>-User: Message de succès
-        App--)User: Message de succès
-    ```
-
-=== "Point de vue de l'application tierce"
-
-    ```mermaid
-    sequenceDiagram
-        actor User
-        participant App
-        User->>+App: Authentifie-moi, stp
-        App-->>-User: url de connexion<br/>avec signature
-        opt
-            Sith->>+App: URL de retour<br/>avec données utilisateur
-            App->>App: Traitement des <br/>données utilisateur
-            App-->>-Sith: 204 OK, No content
-            App--)User: Message de succès
-        end
-    ```
-
-## Données attendues
-
-### URL de connexion
-
-L'URL de connexion que vous allez fournir à l'utilisateur doit
-être `https://ae.utbm.fr/api-link/auth/`
-et doit contenir les données décrites dans
-[`ThirdPartyAuthParamsSchema`][api.schemas.ThirdPartyAuthParamsSchema] :
-
-- `client_id` (integer) : l'id de votre client, que vous pouvez obtenir
-  de la manière décrite plus haut
-- `third_party_app`(string) : le nom de la plateforme pour laquelle
-  l'authentification va être réalisée (si votre application est un bot
-  discord, mettez la valeur "discord")
-- `privacy_link`(URL) : l'URL vers la page de politique de confidentialité
-  qui s'appliquera dans le cadre de l'application
-  (s'il s'agit d'un bot discord, donnez le lien vers celles de Discord)
-- `username`(string) : le pseudonyme que l'utilisateur possède sur
-  votre application
-- `callback_url`(URL) : l'URL que le site AE appellera si l'authentification
-  réussit
-- `signature`(string) : la signature des données de la requête.
-  Il s'agit d'une signature par clef HMAC dont le fonctionnement 
-  est détaillé plus bas.
-
-Ces données doivent être url-encodées et passées dans les paramètres GET.
-
-!!!warning "URL de retour"
-
-    Les URLs fournies doivent être des URLs HTTP valides.
-    En outre, elles doivent obligatoirement inclure la barre oblique finale.
-
-    === "URL correcte ✔️"
-
-        `https://exemple.ae.utbm.fr/foo/`
-
-    === "URL incorrecte ❌"
-
-        `https://exemple.ae.utbm.fr/foo`
-
-!!!tip
-
-    Inclure l'id de votre utilisateur dans l'URL de retour
-    peut être un bon moyen de l'identifier lors du callback.
-    Par exemple : `GET /callback/{int:user_id}/`.
-
-???Example
-
-    Supposons que votre client d'API soit utilisé dans le cadre d'un bot Discord,
-    avec les données suivantes :
-    
-    - l'id du client est 15
-    - sa clef HMAC est "beb99dd53"
-      (c'est pour l'exemple, une vraie clef sera beaucoup plus longue)
-    - le pseudonyme discord de votre utilisateur est Brian
-    - son id sur discord est 123456789
-    - votre route de callback est `GET /callback/{int:user_id}/`,
-      accessible au domaine `https://bot.ae.utbm.fr`
-    
-    Alors les paramètres de votre URL seront :
-    
-    | Paramètre       | valeur                                                                |
-    |-----------------|-----------------------------------------------------------------------|
-    | client_id       | 15                                                                    |
-    | third_party_app | discord                                                               |
-    | privacy_link    | `https://discord.com/privacy`                                         |
-    | username        | Brian                                                                 |
-    | callback_url    | `https://bot.ae.utbm.fr/callback/123456789/`                          |
-    | signature       | 1a383c51060be64f07772aa42e07<br/>18ae096b8f21f2cdb4061c0834a416d12101 |
-    
-    Et l'url fournie à l'utilisateur sera :
-    
-    `https://ae.utbm.fr/api-link/auth/?client_id=15&third_party_app=discord
-    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy&username=Brian
-    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F
-    &signature=1a383c51060be64f07772aa42e0718ae096b8f21f2cdb4061c0834a416d12101`
-
-### Données de retour
-
-Si l'authentification réussit, le site AE enverra une requête HTTP POST
-à l'URL de retour fournie dans l'URL de connexion.
-
-Le corps de la requête de callback et au format JSON 
-et contient deux paires clef-valeur :
-
-- `user` : les données utilisateur, telles que décrites
-  par [UserProfileSchema][core.schemas.UserProfileSchema]
-- `signature` : la signature des données utilisateur
-
-???Example
-
-    En reprenant les mêmes paramètres que dans l'exemple précédent,
-    le site AE pourra renvoyer à l'application la requête suivante :
-
-    ```http
-    POST https://bot.ae.utbm.fr/callback/123456789/
-    content-type: application/json
-    body: {
-        "user": {
-            "id": 144131,
-            "nick_name": "inzekitchen",
-            "first_name": "Brian",
-            ...
-        },
-        "signature": "f16955bab6b805f6e1abbb98a86dfee53fed0bf812aa6513ca46cfd461b70020"
-    }
-    ```
-
-L'application doit répondre avec un des codes HTTP suivants :
-
-| Code | Raison                                                                         |
-|------|--------------------------------------------------------------------------------|
-| 204  | Tout s'est bien passé                                                          |
-| 403  | Les données de retour ne sont <br>pas signées ou sont mal signées              |
-| 404  | L'URL de retour ne permet pas <br>d'identifier un utilisateur de l'application |
-
-!!!note "Code d'erreur par défaut"
-
-    Si l'appel de la route fait face à plusieurs problèmes en même temps 
-    (par exemple, l'URL ne permet pas de retrouver votre utilisateur, 
-    et en plus les données sont mal signées),
-    le 403 prime et doit être retourné par défaut.
-
-## Signature des données
-
-Les données de l'URL de connexion doivent être signées,
-et la signature de l'URL de retour doit être vérifiée.
-
-Dans le deux cas, la signature est le digest HMAC-SHA512
-des données url-encodées, en utilisant la clef HMAC du client d'API.
-L'ordre dans lequel ces données sont placées dans l'encodage URL
-doit être strictement le même que celui donné plus haut.
-
-???Example "Signature de l'URL de connexion"
-
-    En reprenant le même exemple que les fois précédentes,
-    l'url-encodage des données est :
-
-    `client_id=15&third_party_app=discord
-    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy%2F&username=Brian
-    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F`
-
-    Notez que la signature n'est pas (encore) dedans.
-    Cette dernière peut-être obtenue avec le code suivant :
-
-    === ":simple-python: Python"
-    
-        Dépendances :
-    
-        - `environs` (>=14.1)
-    
-        ```python
-        import hmac
-        from urllib.parse import urlencode
-        
-        from environs import Env
-        
-        env = Env()
-        env.read_env()
-        
-        key = env.str("HMAC_KEY").encode()
-        data = {
-            "client_id": 15,
-            "third_party_app": "discord",
-            "privacy_link": "https://discord.com/privacy/",
-            "username": "Brian",
-            "callback_url": "https://bot.ae.utbm.fr/callback/123456789/",
-        }
-        urlencoded = urlencode(data)
-        data["signature"] = hmac.digest(key, urlencoded.encode(), "sha512").hex()
-        
-        # URL a fournir à l'utilisateur pour son authentification
-        user_url = f"https://ae.ubtm.fr/api-link/auth/?{urlencode(data)}"
-        ```    
-    
-    === ":simple-rust: Rust"
-    
-        Dépendances :
-        
-        - `hmac` (>=0.12.1)
-        - `url` (>=2.5.7, features `serde`)
-        - `serde` (>=1.0.228, features `derive`)
-        - `serde_urlencoded` (>="0.7.1)
-        - `sha2` (>=0.10.9)
-        - `dotenvy` (>= 0.15)
-    
-        ```rust
-        use hmac::{Mac, SimpleHmac};
-        use serde::Serialize;
-        use sha2::Sha512;
-        use url::Url;
-        
-        #[derive(Serialize, Debug)]
-        struct UrlData<'a> {
-            client_id: u32,
-            third_party_app: &'a str,
-            privacy_link: Url,
-            username: &'a str,
-            callback_url: Url,
-        }
-        
-        impl<'a> UrlData<'a> {
-            pub fn signature(&self, key: &[u8]) -> CtOutput<SimpleHmac<Sha512>> {
-                let urlencoded = serde_urlencoded::to_string(self).unwrap();
-                SimpleHmac::<Sha512>::new_from_slice(key)
-                    .unwrap()
-                    .chain_update(urlencoded.as_bytes())
-                    .finalize()
-            }
-        }
-        
-        impl Into<Url> for UrlData<'_> {
-            fn into(self) -> Url {
-                let key = std::env::var("HMAC_KEY").unwrap();
-                let mut url = Url::parse("http://ae.utbm.fr/api-link/auth/").unwrap();
-                url.set_query(Some(
-                    format!(
-                        "{}&signature={:x}",
-                        serde_urlencoded::to_string(&self).unwrap(),
-                        self.signature(key.as_bytes()).into_bytes()
-                    )
-                    .as_str(),
-                ));
-                url
-            }
-        }
-        
-        fn main() {
-            dotenvy::dotenv().expect("Couldn't load env");
-            let data = UrlData {
-                client_id: 1,
-                third_party_app: "discord",
-                privacy_link: "https://discord.com/privacy/".parse().unwrap(),
-                username: "Brian",
-                callback_url: "https://bot.ae.utbm.fr/callback/123456789/"
-                    .parse()
-                    .unwrap(),
-            };
-            let url: Url = data.into();
-            println!("{:?}", url);
-        }
-        ```
-
-???Example "Vérification de la signature de la réponse"
-
-    Les données utilisateur peuvent ressembler à :
-
-    ```json
-    {
-        "user": {
-            "display_name": "Matthieu Vincent",
-            "profile_url": "/user/380/",
-            "profile_pict": "/static/core/img/unknown.jpg",
-            "id": 380,
-            "nick_name": None,
-            "first_name": "Matthieu",
-            "last_name": "Vincent",
-        },
-        "signature": "3802a280fbb01bd9fetc."
-    }
-    ```
-
-    Vous pouvez vérifier la signature ainsi :
-
-    ```python
-        import hmac
-        from urllib.parse import urlencode
-        
-        from environs import Env
-        
-        env = Env()
-        env.read_env()
-        
-        def is_signature_valid(user_data: dict, signature: str) -> bool:
-            key = env.str("HMAC_KEY").encode()
-            urlencoded = urlencode(user_data)
-            return hmac.compare_digest(
-                hmac.digest(key, urlencoded.encode(), "sha512").hex(),
-                signature,
-            )
-        
-        
-        post_data = <récupération des données POST>
-        print(
-            "signature valide :", 
-            is_signature_valid(post_data["user"], post_data["signature"]
-        )
-    ```
-
-!!!Warning
-
-    Vous devez impérativement vérifier la signature 
-    des données de la requête de callback !
-
-    Ne pas vérifier la signature permet à n'importe quel acteur 
-    tierce malveillant de vous appeler sur votre callback. 
-    Ce serait une faille de sécurité majeure de votre côté.
-
-    Si l'équipe informatique se rend compte que vous ne le faites pas,
-    elle se réserve le droit de suspendre votre application,
-    immédiatement et sans préavis.

docs/tutorial/api/connect.md

@@ -112,7 +112,7 @@ cf. [HTTP persistant connection (wikipedia)](https://en.wikipedia.org/wiki/HTTP_
 
 Voici quelques exemples : 
 
-=== ":simple-python: Python (requests)"
+=== "Python (requests)"
 
     Dépendances :
 
@@ -132,7 +132,7 @@ Voici quelques exemples :
         print(response.json())
     ```
 
-=== ":simple-python: Python (aiohttp)"
+=== "Python (aiohttp)"
 
     Dépendances :
 
@@ -158,7 +158,7 @@ Voici quelques exemples :
     asyncio.run(main())
     ```
 
-=== ":simple-javascript: Javascript (axios)"
+=== "Javascript (axios)"
 
     Dépendances :
 
@@ -178,7 +178,7 @@ Voici quelques exemples :
     console.log(await instance.get("club/1").json());
     ```
 
-=== ":simple-rust: Rust (reqwest)"
+=== "Rust (reqwest)"
 
     Dépendances :
     

eboutic/api.py

@@ -1,3 +1,6 @@
+from typing import Any
+
+from ninja import Status
 from ninja_extra import ControllerBase, api_controller, route
 from ninja_extra.exceptions import NotFound
 
@@ -8,13 +11,19 @@ from eboutic.models import Basket
 
 @api_controller("/etransaction", permissions=[CanView])
 class EtransactionInfoController(ControllerBase):
-    @route.get("/data/{basket_id}", url_name="etransaction_data")
+    @route.get(
+        "/data/{basket_id}",
+        url_name="etransaction_data",
+        response={200: dict[str, Any], 410: str},
+    )
     def fetch_etransaction_data(self, basket_id: int):
         """Generate the data to pay an eboutic command with paybox.
 
         The data is generated with the basket that is used by the current session.
         """
         basket: Basket = self.get_object_or_exception(Basket, pk=basket_id)
+        if basket.is_expired:
+            return Status(410, "This basket is expired.")
         try:
             return dict(basket.get_e_transaction_data())
         except BillingInfo.DoesNotExist as e:

eboutic/converters.py

@@ -0,0 +1,37 @@
+#
+# Copyright 2022
+# - Maréchal <thgirod@hotmail.com
+#
+# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
+# http://ae.utbm.fr.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License a published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
+# Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+class PaymentResultConverter:
+    """Converter used for url mapping of the `eboutic.views.payment_result` view.
+
+    It's meant to build an url that can match
+    either `/eboutic/pay/success/` or `/eboutic/pay/failure/`
+    but nothing else.
+    """
+
+    regex = "(success|failure)"
+
+    def to_python(self, value):
+        return str(value)
+
+    def to_url(self, value):
+        return str(value)

eboutic/models.py

@@ -24,6 +24,7 @@ from django.conf import settings
 from django.db import DataError, models
 from django.db.models import F, OuterRef, Subquery, Sum
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 
 from core.models import User
@@ -95,6 +96,10 @@ class Basket(models.Model):
             ]
         )
 
+    @property
+    def is_expired(self) -> bool:
+        return (self.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT) <= now()
+
     def generate_sales(
         self, counter, seller: User, payment_method: Selling.PaymentMethod
     ):
@@ -133,9 +138,20 @@ class Basket(models.Model):
         ]
 
     def get_e_transaction_data(self) -> list[tuple[str, str]]:
+        """Get data for etransaction payment.
+
+        Raises:
+            Customer.DoesNotExist: if the user linked to this basket
+                has no customer account
+            BillingInfo.DoesNotExist: if the user linked to this basket has no
+                billing infos, or incorrect billing infos.
+            ValueError: if this is called on a basket which payment delay is expired.
+        """
         user = self.user
         if not hasattr(user, "customer"):
             raise Customer.DoesNotExist
+        if self.is_expired:
+            raise ValueError("This method cannot be called on an expired basket.")
         customer = user.customer
         if (
             not hasattr(user.customer, "billing_infos")
@@ -155,6 +171,10 @@ class Basket(models.Model):
             ("PBX_IDENTIFIANT", settings.SITH_EBOUTIC_PBX_IDENTIFIANT),
             ("PBX_TOTAL", str(int(self.total * 100))),
             ("PBX_DEVISE", "978"),  # This is Euro
+            (
+                "PBX_DISPLAY",
+                str(int(settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT.total_seconds())),
+            ),
             ("PBX_CMD", str(self.id)),
             ("PBX_PORTEUR", user.email),
             ("PBX_RETOUR", "Amount:M;BasketID:R;Auto:A;Error:E;Sig:K"),
@@ -219,16 +239,14 @@ class Invoice(models.Model):
         if self.validated:
             raise DataError(_("Invoice already validated"))
         customer, _created = Customer.get_or_create(user=self.user)
-        kwargs = {
-            "counter": get_eboutic(),
-            "customer": customer,
-            "date": self.date,
-            "payment_method": Selling.PaymentMethod.CARD,
-        }
+        kwargs = {"counter": get_eboutic(), "customer": customer, "date": self.date}
         for i in self.items.select_related("product"):
             if i.product.product_type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING:
                 Refilling.objects.create(
-                    **kwargs, operator=self.user, amount=i.unit_price * i.quantity
+                    **kwargs,
+                    operator=self.user,
+                    amount=i.unit_price * i.quantity,
+                    payment_method=Refilling.PaymentMethod.CARD,
                 )
             else:
                 Selling.objects.create(
@@ -239,6 +257,7 @@ class Invoice(models.Model):
                     seller=self.user,
                     unit_price=i.unit_price,
                     quantity=i.quantity,
+                    payment_method=Selling.PaymentMethod.CARD,
                 )
         self.validated = True
         self.save()

eboutic/static/bundled/eboutic/checkout-index.ts

@@ -1,21 +1,71 @@
+import { type Notification, NotificationLevel } from "#core:utils/notifications";
 import { etransactioninfoFetchEtransactionData } from "#openapi";
 
+interface Basket {
+  id: number;
+  timeout: Date;
+}
 document.addEventListener("alpine:init", () => {
-  Alpine.data("etransaction", (initialData, basketId: number) => ({
+  Alpine.data("etransaction", (initialData, basket: Basket) => ({
     data: initialData,
     isCbAvailable: Object.keys(initialData).length > 0,
+    isSithAvailable: true,
 
+    init() {
+      const now = new Date();
+      const timeout = basket.timeout.getTime() - now.getTime();
+      if (timeout <= 0) {
+        // basket was already outdated at initial page load
+        this.timeoutBasket();
+      } else {
+        setTimeout(() => this.timeoutBasket(), timeout);
+      }
+    },
+
+    /**
+     * Make this basket into a timeout state.
+     * All submission inputs are disabled, and an error message is displayed.
+     */
+    timeoutBasket() {
+      this.isCbAvailable = false;
+      this.isSithAvailable = false;
+      const message = gettext("Basket expired");
+
+      const existingNotif: Notification | undefined = this.$notifications
+        .getAll()
+        .find(
+          (n: Notification) =>
+            n.tag === NotificationLevel.Error && n.message === message,
+        );
+      if (existingNotif === undefined) {
+        this.$notifications.error(message);
+      }
+    },
+
+    /**
+     * Refresh the data used for etransaction.
+     *
+     * Note: if this is called while the basket is expired, it will be a no-op
+     */
     async fill() {
+      if (new Date() > basket.timeout) {
+        // refresh etransaction data only if the basket is still valid.
+        this.timeoutBasket();
+        return;
+      }
       this.isCbAvailable = false;
       const res = await etransactioninfoFetchEtransactionData({
-        path: {
-          // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          basket_id: basketId,
-        },
+        // biome-ignore lint/style/useNamingConvention: api is in snake_case
+        path: { basket_id: basket.id },
       });
       if (res.response.ok) {
         this.data = res.data;
         this.isCbAvailable = true;
+      } else if (res.response.status === 410) {
+        // The basket is expired, so no payment method should be available at all.
+        // This shouldn't happen, because we don't send the request
+        // when the timeout is passed, but we are better safe than sorry
+        this.timeoutBasket();
       }
     },
   }));

eboutic/templates/eboutic/eboutic_billing_info.jinja

@@ -21,6 +21,7 @@
       hx-swap="outerHTML"
       hx-target="#billing-infos-fragment"
       x-show="collapsed"
+      x-cloak
     >
       {% csrf_token %}
       {{ form.as_p() }}

eboutic/templates/eboutic/eboutic_checkout.jinja

@@ -15,11 +15,10 @@
 {% block content %}
   <h3>{% trans %}Eboutic{% endtrans %}</h3>
 
-  <script type="text/javascript">
-    let billingInfos = {{ billing_infos|safe }};
-  </script>
-
-  <div x-data="etransaction(billingInfos, {{ basket.id }})">
+  <div x-data='etransaction(
+               {{ billing_infos|tojson }},
+               { id: {{ basket.id }}, timeout: new Date('{{ basket.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT }}') }
+                                                                                                                         )'>
     <p>{% trans %}Basket: {% endtrans %}</p>
     <table>
       <thead>
@@ -72,7 +71,11 @@
           x-cloak
           type="submit"
           id="bank-submit-button"
-          :disabled="!isCbAvailable"
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isCbAvailable"
+          {% endif %}
           class="btn btn-blue"
           value="{% trans %}Pay with credit card{% endtrans %}"
         />
@@ -93,7 +96,16 @@
     {% else %}
       <form method="post" action="{{ url('eboutic:pay_with_sith', basket_id=basket.id) }}" name="sith-pay-form">
         {% csrf_token %}
-        <input class="btn btn-blue" type="submit" value="{% trans %}Pay with Sith account{% endtrans %}"/>
+        <input
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isSithAvailable"
+          {% endif %}
+          class="btn btn-blue"
+          type="submit"
+          value="{% trans %}Pay with Sith account{% endtrans %}"
+        />
       </form>
     {% endif %}
   </div>

eboutic/tests/test_payment.py

@@ -3,6 +3,7 @@ import urllib
 from decimal import Decimal
 from typing import TYPE_CHECKING
 
+import freezegun
 from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.hazmat.primitives.hashes import SHA1
@@ -17,7 +18,7 @@ from pytest_django.asserts import assertRedirects
 
 from core.baker_recipes import old_subscriber_user, subscriber_user
 from counter.baker_recipes import price_recipe, product_recipe
-from counter.models import Product, ProductType, Selling
+from counter.models import Product, ProductType, Refilling, Selling
 from counter.tests.test_counter import force_refill_user
 from eboutic.models import Basket, BasketItem
 
@@ -105,7 +106,7 @@ class TestPaymentSith(TestPaymentBase):
             ),
             reverse("eboutic:payment_result", kwargs={"result": "success"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == Decimal(1)
 
@@ -139,10 +140,7 @@ class TestPaymentSith(TestPaymentBase):
         assert len(messages) == 1
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert messages[0].message == "Solde insuffisant"
-
-        assert Basket.objects.contains(self.basket), (
-            "After an unsuccessful request, the basket should be kept"
-        )
+        assert not Basket.objects.filter(id=self.basket.id).exists()
 
     def test_refilling_in_basket(self):
         BasketItem.from_price(self.refilling.prices.first(), 1, self.basket).save()
@@ -157,7 +155,7 @@ class TestPaymentSith(TestPaymentBase):
             response,
             reverse("eboutic:payment_result", kwargs={"result": "failure"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is not None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         messages = list(get_messages(response.wsgi_request))
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert (
@@ -167,6 +165,24 @@ class TestPaymentSith(TestPaymentBase):
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == initial_account_balance
 
+    def test_basket_expired(self):
+        self.client.force_login(self.customer)
+        initial_account_balance = self.customer.customer.amount
+        with freezegun.freeze_time(settings.SITH_EBOUTIC_BASKET_TIMEOUT):
+            response = self.client.post(
+                reverse("eboutic:pay_with_sith", kwargs={"basket_id": self.basket.id})
+            )
+        assertRedirects(
+            response,
+            reverse("eboutic:payment_result", kwargs={"result": "failure"}),
+        )
+        messages = list(get_messages(response.wsgi_request))
+        assert messages[0].level == DEFAULT_LEVELS["ERROR"]
+        assert messages[0].message == "Panier expiré"
+        assert not Basket.objects.filter(id=self.basket.id).exists()
+        self.customer.customer.refresh_from_db()
+        assert self.customer.customer.amount == initial_account_balance
+
 
 class TestPaymentCard(TestPaymentBase):
     def generate_bank_valid_answer(self, basket: Basket):
@@ -236,6 +252,10 @@ class TestPaymentCard(TestPaymentBase):
 
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == price.amount * 2
+        refill = self.customer.customer.refillings.last()
+        assert refill is not None
+        assert refill.amount == price.amount * 2
+        assert refill.payment_method == Refilling.PaymentMethod.CARD
 
     def test_multiple_responses(self):
         bank_response = self.generate_bank_valid_answer(self.basket)

eboutic/urls.py

@@ -24,7 +24,7 @@
 
 from django.urls import path, register_converter
 
-from core.converters import ResultConverter
+from eboutic.converters import PaymentResultConverter
 from eboutic.views import (
     BillingInfoFormFragment,
     EbouticCheckout,
@@ -35,7 +35,7 @@ from eboutic.views import (
     payment_result,
 )
 
-register_converter(ResultConverter, "res")
+register_converter(PaymentResultConverter, "res")
 
 urlpatterns = [
     # Subscription views

eboutic/views.py

@@ -39,6 +39,8 @@ from django.db.utils import cached_property
 from django.http import HttpResponse
 from django.shortcuts import redirect, render
 from django.urls import reverse
+from django.utils.formats import localize
+from django.utils.timezone import localtime
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.http import require_GET
 from django.views.generic import DetailView, FormView, TemplateView, UpdateView, View
@@ -187,9 +189,7 @@ class BillingInfoFormFragment(
 
     def get_initial(self):
         if self.object is None:
-            return {
-                "country": Country(code="FR"),
-            }
+            return {"country": Country(code="FR")}
         return {}
 
     def render_fragment(self, request, **kwargs) -> SafeString:
@@ -255,10 +255,19 @@ class EbouticCheckout(CanViewMixin, UseFragmentsMixin, DetailView):
             kwargs["customer_amount"] = None
         kwargs["billing_infos"] = {}
 
-        with contextlib.suppress(BillingInfo.DoesNotExist):
-            kwargs["billing_infos"] = json.dumps(
-                dict(self.object.get_e_transaction_data())
+        if self.object.is_expired:
+            messages.error(self.request, _("Basket expired"))
+        else:
+            timeout = self.object.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            messages.warning(
+                self.request,
+                _("Basket available until %(until)s")
+                % {"until": localize(localtime(timeout).time())},
             )
+            with contextlib.suppress(BillingInfo.DoesNotExist):
+                kwargs["billing_infos"] = json.dumps(
+                    dict(self.object.get_e_transaction_data())
+                )
         return kwargs
 
 
@@ -268,9 +277,14 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
 
     def post(self, request, *args, **kwargs):
         basket = self.get_object()
+        if basket.is_expired:
+            messages.error(self.request, _("Basket expired"))
+            basket.delete()
+            return redirect("eboutic:payment_result", "failure")
         refilling = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING
         if basket.items.filter(product__product_type_id=refilling).exists():
             messages.error(self.request, _("You can't buy a refilling with sith money"))
+            basket.delete()
             return redirect("eboutic:payment_result", "failure")
 
         eboutic = get_eboutic()
@@ -288,6 +302,7 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
         except DatabaseError as e:
             sentry_sdk.capture_exception(e)
         except ValidationError as e:
+            basket.delete()
             messages.error(self.request, e.message)
         return redirect("eboutic:payment_result", "failure")
 

locale/fr/LC_MESSAGES/django.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-23 15:09+0200\n"
+"POT-Creation-Date: 2026-05-15 11:46+0200\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -35,10 +35,6 @@ msgstr ""
 "True si gardé à jour par le biais d'un fournisseur externe de domains "
 "toxics, False sinon"
 
-#: api/admin.py
-msgid "Reset HMAC key"
-msgstr "Réinitialiser la clef HMAC"
-
 #: api/admin.py
 #, python-format
 msgid ""
@@ -52,23 +48,6 @@ msgstr ""
 msgid "Revoke selected API keys"
 msgstr "Révoquer les clefs d'API sélectionnées"
 
-#: api/forms.py
-msgid "I have read and I accept the terms and conditions of use"
-msgstr "J'ai lu et j'accepte les conditions générales d'utilisation."
-
-#: api/forms.py
-msgid "You must approve the terms and conditions of use."
-msgstr "Vous devez approuver les conditions générales d'utilisation."
-
-#: api/forms.py
-msgid "You must confirm that this is your username."
-msgstr "Vous devez confirmer que c'est bien votre nom d'utilisateur."
-
-#: api/forms.py
-#, python-format
-msgid "I confirm that %(username)s is my username on %(app)s"
-msgstr "Je confirme que %(username)s est mon nom d'utilisateur sur %(app)s"
-
 #: api/models.py club/models.py com/models.py counter/models.py forum/models.py
 msgid "name"
 msgstr "nom"
@@ -89,10 +68,6 @@ msgstr "permissions du client"
 msgid "Specific permissions for this api client."
 msgstr "Permissions spécifiques pour ce client d'API"
 
-#: api/models.py
-msgid "HMAC Key"
-msgstr "Clef HMAC"
-
 #: api/models.py
 msgid "api client"
 msgstr "client d'api"
@@ -122,76 +97,6 @@ msgstr "clef d'api"
 msgid "api keys"
 msgstr "clefs d'api"
 
-#: api/templates/api/third_party/auth.jinja
-msgid "Confidentiality"
-msgstr "Confidentialité"
-
-#: api/templates/api/third_party/auth.jinja
-#, python-format
-msgid ""
-"By ticking this box and clicking on the send button, you acknowledge and "
-"agree to provide %(app)s with your first name, last name, nickname and any "
-"other information that was the third party app was explicitly authorized to "
-"fetch and that it must have acknowledged to you, in a complete and accurate "
-"manner."
-msgstr ""
-"En cochant cette case et en cliquant sur le bouton « Envoyer », vous "
-"reconnaissez et acceptez de fournir à %(app)s votre prénom, nom, pseudonyme "
-"et toute autre information que l'application tierce a été explicitement "
-"autorisée à récupérer et qu'elle doit vous avoir communiqué de manière "
-"complète et exacte."
-
-#: api/templates/api/third_party/auth.jinja
-#, python-format
-msgid ""
-"The privacy policies of <a href=\"%(privacy_link)s\">%(app)s</a> and of <a "
-"href=\"%(sith_cgu_link)s\">the Students' Association</a> applies as soon as "
-"the form is submitted."
-msgstr ""
-"Les politiques de confidentialité de <a href=\"%(privacy_link)s\">%(app)s</"
-"a> et de <a href=\"%(sith_cgu_link)s\">l'Association des Etudiants</a> "
-"s'appliquent dès la soumission du formulaire."
-
-#: api/templates/api/third_party/auth.jinja
-msgid "Confirmation of identity"
-msgstr "Confirmation d'identité"
-
-#: api/views.py
-msgid "The data provided for authentication is incorrect"
-msgstr "Les données fournies pour l'authentification sont incorrectes."
-
-#: api/views.py
-msgid ""
-"The signature is incorrect. We cannot ensure the provenance of the request."
-msgstr ""
-"La signature est incorrecte. Nous ne pouvons pas garantir l'authenticité de "
-"la requête."
-
-#: api/views.py
-#, python-format
-msgid ""
-"You are going to link your AE account and your %(app)s account. Continue "
-"only if this page was opened from %(app)s."
-msgstr ""
-"Vous allez lier votre compte AE et votre compte %(app)s. Poursuivez "
-"uniquement si cette page a été ouverte depuis %(app)s."
-
-#: api/views.py
-msgid "You have been successfully authenticated. You can now close this page."
-msgstr ""
-"Vous avez été authentifié avec succès. Vous pouvez maintenant fermer cette "
-"page."
-
-#: api/views.py
-msgid ""
-"Your authentication on the AE website was successful, but an error happened "
-"during the interaction with the third-party application. Please contact the "
-"managers of the latter."
-msgstr ""
-"Votre authentification sur le site AE a fonctionné, mais une erreur est "
-"arrivée durant l'interaction avec l'application tierce. Veuillez contacter "
-"les responsables de cette dernière."
-
 #: club/forms.py
 msgid "Users to add"
 msgstr "Utilisateurs à ajouter"
@@ -4600,6 +4505,15 @@ msgstr ""
 "souhaitez payer par carte, vous devez rajouter un numéro de téléphone aux "
 "données que vous aviez déjà fourni."
 
+#: eboutic/views.py
+msgid "Basket expired"
+msgstr "Panier expiré"
+
+#: eboutic/views.py
+#, python-format
+msgid "Basket available until %(until)s"
+msgstr "Panier disponible jusqu'à %(until)s"
+
 #: eboutic/views.py
 msgid "You can't buy a refilling with sith money"
 msgstr "Vous ne pouvez pas acheter un rechargement avec de l'argent du sith"

locale/fr/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-04-17 22:42+0200\n"
+"POT-Creation-Date: 2026-05-17 10:03+0200\n"
 "PO-Revision-Date: 2024-09-17 11:54+0200\n"
 "Last-Translator: Sli <antoine@bartuccio.fr>\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -263,6 +263,10 @@ msgstr "Types de produits réordonnés !"
 msgid "Product type reorganisation failed with status code : %d"
 msgstr "La réorganisation des types de produit a échoué avec le code : %d"
 
+#: eboutic/static/bundled/eboutic/checkout-index.ts
+msgid "Basket expired"
+msgstr "Panier expiré"
+
 #: sas/static/bundled/sas/pictures-download-index.ts
 msgid "pictures.%(extension)s"
 msgstr "photos.%(extension)s"

mkdocs.yml

@@ -71,7 +71,6 @@ nav:
     - API:
       - Développement: tutorial/api/dev.md
       - Connexion à l'API: tutorial/api/connect.md
-      - Liaison avec le compte AE: tutorial/api/account-link.md
     - Etransactions: tutorial/etransaction.md
   - How-to:
     - L'ORM de Django: howto/querysets.md
@@ -95,8 +94,6 @@ nav:
       - reference/api/hashers.md
       - reference/api/models.md
       - reference/api/perms.md
-      - reference/api/schemas.md
-      - reference/api/views.md
     - club:
       - reference/club/models.md
       - reference/club/views.md

pyproject.toml

@@ -68,7 +68,7 @@ dev = [
     "pre-commit>=4.6.0,<5.0.0",
     "ruff>=0.15.13,<1.0.0",
     "djhtml>=3.0.11,<4.0.0",
-    "faker>=40.18.0,<41.0.0",
+    "faker>=40.20.0,<41.0.0",
     "rjsmin>=1.2.5,<2.0.0",
 ]
 tests = [

sith/settings.py

@@ -409,8 +409,6 @@ SITH_FORUM_PAGE_LENGTH = 30
 SITH_SAS_ROOT_DIR_ID = env.int("SITH_SAS_ROOT_DIR_ID", default=4)
 SITH_SAS_IMAGES_PER_PAGE = 60
 
-SITH_CGU_FILE_ID = env.int("SITH_CGU_FILE_ID", default=5)
-
 SITH_PROFILE_DEPARTMENTS = [
     ("TC", _("TC")),
     ("IMSI", _("IMSI")),
@@ -573,6 +571,11 @@ SITH_BARMAN_TIMEOUT = 30
 # Minutes to delete the last operations
 SITH_LAST_OPERATIONS_LIMIT = 10
 
+# time before a basket is considered expired
+SITH_EBOUTIC_BASKET_TIMEOUT = timedelta(minutes=10)
+# time that a user can spend on the CB payment page before it to timeout
+SITH_EBOUTIC_ETRANSACTION_TIMEOUT = timedelta(minutes=10)
+
 # ET variables
 SITH_EBOUTIC_CB_ENABLED = env.bool("SITH_EBOUTIC_CB_ENABLED", default=True)
 SITH_EBOUTIC_ET_URL = env.str(

sith/urls.py

@@ -34,7 +34,6 @@ urlpatterns = [
     path("", include(("core.urls", "core"), namespace="core")),
     path("sitemap.xml", cache_page(86400)(sitemap), {"sitemaps": sitemaps}),
     path("api/", api.urls),
-    path("api-link/", include(("api.urls", "api-link"), namespace="api-link")),
     path("rootplace/", include(("rootplace.urls", "rootplace"), namespace="rootplace")),
     path(
         "subscription/",