[UPDATE] Update pytest requirement

Updates the requirements on [pytest](https://github.com/pytest-dev/pytest) to permit the latest version. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/8.4.2...9.0.0) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
2025-11-10 14:03:12 +00:00 · 2025-11-10 08:06:35 +00:00
12 changed files with 248 additions and 240 deletions
--- a/com/views.py
+++ b/com/views.py
@@ -700,7 +700,7 @@ class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
            parsed = urlparse(referer)
            if parsed.netloc == settings.SITH_URL:
                return redirect(parsed.path)
-        return redirect("com:poster_list")
+        return redirect(reverse("com:poster_list"))


 class ScreenListView(PermissionRequiredMixin, ComTabsMixin, ListView):
--- a/core/auth/mixins.py
+++ b/core/auth/mixins.py
@@ -24,6 +24,7 @@
 from __future__ import annotations

 import types
+import warnings
 from typing import TYPE_CHECKING, Any, LiteralString

 from django.contrib.auth.mixins import AccessMixin, PermissionRequiredMixin
@@ -146,6 +147,45 @@ class GenericContentPermissionMixinBuilder(View):
        return super().dispatch(request, *arg, **kwargs)


+class CanCreateMixin(View):
+    """Protect any child view that would create an object.
+
+    Raises:
+        PermissionDenied:
+            If the user has not the necessary permission
+            to create the object of the view.
+    """
+
+    def __init_subclass__(cls, **kwargs):
+        warnings.warn(
+            f"{cls.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init_subclass__(**kwargs)
+
+    def __init__(self, *args, **kwargs):
+        warnings.warn(
+            f"{self.__class__.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(*args, **kwargs)
+
+    def dispatch(self, request, *arg, **kwargs):
+        if not request.user.is_authenticated:
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
+
+    def form_valid(self, form):
+        obj = form.instance
+        if can_edit_prop(obj, self.request.user):
+            return super().form_valid(form)
+        raise PermissionDenied
+
+
 class CanEditPropMixin(GenericContentPermissionMixinBuilder):
    """Ensure the user has owner permissions on the child view object.

--- a/docs/reference/core/auth.md
+++ b/docs/reference/core/auth.md
@@ -17,6 +17,7 @@
            - can_edit_prop
            - can_edit
            - can_view
+            - CanCreateMixin
            - CanEditMixin
            - CanViewMixin
            - CanEditPropMixin
--- a/docs/tutorial/perms.md
+++ b/docs/tutorial/perms.md
@@ -212,7 +212,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
            obj = self.get_object()
            obj.is_moderated = True
            obj.save()
-            return redirect("com:news_list")
+            return redirect(reverse("com:news_list"))
    ```

 === "Function-based view"
@@ -233,7 +233,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
        news = get_object_or_404(News, id=news_id)
        news.is_moderated = True
        news.save()
-        return redirect("com:news_list")
+        return redirect(reverse("com:news_list"))
    ```

 ## Accès à des éléments en particulier
@@ -447,9 +447,10 @@ l'utilisateur recevra une liste vide d'objet.
 Voici un exemple d'utilisation en reprenant l'objet Article crée précédemment :

 ```python
-from django.views.generic import DetailView
+from django.views.generic import CreateView, DetailView
+
+from core.auth.mixins import CanViewMixin, CanCreateMixin

-from core.auth.mixins import CanViewMixin
 from com.models import WeekmailArticle


@@ -458,15 +459,48 @@ from com.models import WeekmailArticle
 # d'une classe de base pour fonctionner correctement.
 class ArticlesDetailView(CanViewMixin, DetailView):
    model = WeekmailArticle
+
+
+# Même chose pour une vue de création de l'objet Article
+class ArticlesCreateView(CanCreateMixin, CreateView):
+    model = WeekmailArticle
 ```

 Les mixins suivants sont implémentés :

+- [CanCreateMixin][core.auth.mixins.CanCreateMixin] : l'utilisateur peut-il créer l'objet ?
+  Ce mixin existe, mais est déprécié et ne doit plus être utilisé !
 - [CanEditPropMixin][core.auth.mixins.CanEditPropMixin] : l'utilisateur peut-il éditer les propriétés de l'objet ?
 - [CanEditMixin][core.auth.mixins.CanEditMixin] : L'utilisateur peut-il éditer l'objet ?
 - [CanViewMixin][core.auth.mixins.CanViewMixin] : L'utilisateur peut-il voir l'objet ?
 - [FormerSubscriberMixin][core.auth.mixins.FormerSubscriberMixin] : L'utilisateur a-t-il déjà été cotisant ?

+!!!danger "CanCreateMixin"
+
+    L'usage de `CanCreateMixin` est dangereux et ne doit en aucun cas être
+    étendu.
+    La façon dont ce mixin marche est qu'il valide le formulaire
+    de création et crée l'objet sans le persister en base de données, puis
+    vérifie les droits sur cet objet non-persisté.
+    Le danger de ce système vient de multiples raisons :
+
+    - Les vérifications se faisant sur un objet non persisté,
+      l'utilisation de mécanismes nécessitant une persistance préalable
+      peut mener à des comportements indésirés, voire à des erreurs.
+    - Les développeurs de django ayant tendance à restreindre progressivement
+      les actions qui peuvent être faites sur des objets non-persistés,
+      les mises-à-jour de django deviennent plus compliquées.
+    - La vérification des droits ne se fait que dans les requêtes POST,
+      à la toute fin de la requête.
+      Tout ce qui arrive avant n'est absolument pas protégé.
+      Toute opération (même les suppressions et les créations) qui ont
+      lieu avant la persistance de l'objet seront appliquées,
+      même sans permission.
+    - Si un développeur du site fait l'erreur de surcharger
+      la méthode `form_valid` (ce qui est plutôt courant,
+      lorsqu'on veut accomplir certaines actions 
+      quand un formulaire est valide), on peut se retrouver
+      dans une situation où l'objet est persisté sans aucune protection.

 !!!danger "Performance"

--- a/forum/views.py
+++ b/forum/views.py
@@ -27,14 +27,14 @@ from functools import partial

 from django import forms
 from django.conf import settings
-from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.core.exceptions import PermissionDenied
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
 from django.db import IntegrityError
 from django.shortcuts import get_object_or_404
 from django.urls import reverse_lazy
 from django.utils import html, timezone
 from django.utils.decorators import method_decorator
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, RedirectView
 from django.views.generic.detail import SingleObjectMixin
@@ -44,6 +44,7 @@ from honeypot.decorators import check_honeypot

 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.auth.mixins import (
+    CanCreateMixin,
    CanEditMixin,
    CanEditPropMixin,
    CanViewMixin,
@@ -179,19 +180,11 @@ class ForumForm(forms.ModelForm):
    )


-class ForumCreateView(UserPassesTestMixin, CreateView):
+class ForumCreateView(CanCreateMixin, CreateView):
    model = Forum
    form_class = ForumForm
    template_name = "core/create.jinja"

-    def test_func(self):
-        if self.request.user.has_perm("forum.add_forum"):
-            return True
-        parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
-        if parent is not None:
-            return self.request.user.is_owner(parent)
-        return False
-
    def get_initial(self):
        init = super().get_initial()
        parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
@@ -265,19 +258,18 @@ class TopicForm(forms.ModelForm):
@method_decorator(
    partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumTopicCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumTopicCreateView(CanCreateMixin, CreateView):
    model = ForumMessage
    form_class = TopicForm
    template_name = "forum/reply.jinja"

-    @cached_property
-    def forum(self):
-        return get_object_or_404(Forum, id=self.kwargs["forum_id"], is_category=False)
-
-    def test_func(self):
-        return self.request.user.has_perm("forum.add_forumtopic") or (
-            self.request.user.can_view(self.forum)
+    def dispatch(self, request, *args, **kwargs):
+        self.forum = get_object_or_404(
+            Forum, id=self.kwargs["forum_id"], is_category=False
        )
+        if not request.user.can_view(self.forum):
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)

    def form_valid(self, form):
        topic = ForumTopic(
@@ -412,7 +404,7 @@ class ForumMessageUndeleteView(SingleObjectMixin, RedirectView):
@method_decorator(
    partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumMessageCreateView(CanCreateMixin, CreateView):
    model = ForumMessage
    form_class = forms.modelform_factory(
        model=ForumMessage,
@@ -421,14 +413,11 @@ class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView
    )
    template_name = "forum/reply.jinja"

-    @cached_property
-    def topic(self):
-        return get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
-
-    def test_func(self):
-        return self.request.user.has_perm(
-            "forum.add_forummessage"
-        ) or self.request.user.can_view(self.topic)
+    def dispatch(self, request, *args, **kwargs):
+        self.topic = get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
+        if not request.user.can_view(self.topic):
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)

    def get_initial(self):
        init = super().get_initial()
--- a/galaxy/static/bundled/galaxy/galaxy-index.js
+++ b/galaxy/static/bundled/galaxy/galaxy-index.js
@@ -0,0 +1,138 @@
+import { default as ForceGraph3D } from "3d-force-graph";
+import { forceX, forceY, forceZ } from "d3-force-3d";
+// biome-ignore lint/style/noNamespaceImport: This is how it should be imported
+import * as Three from "three";
+import SpriteText from "three-spritetext";
+
+/**
+ * @typedef GalaxyConfig
+ * @property {number} nodeId id of the current user node
+ * @property {string} dataUrl url to fetch the galaxy data from
+ **/
+
+/**
+ * Load the galaxy of an user
+ * @param {GalaxyConfig} config
+ **/
+window.loadGalaxy = (config) => {
+  window.getNodeFromId = (id) => {
+    return Graph.graphData().nodes.find((n) => n.id === id);
+  };
+
+  window.getLinksFromNodeId = (id) => {
+    return Graph.graphData().links.filter(
+      (l) => l.source.id === id || l.target.id === id,
+    );
+  };
+
+  window.focusNode = (node) => {
+    highlightNodes.clear();
+    highlightLinks.clear();
+
+    hoverNode = node || null;
+    if (node) {
+      // collect neighbors and links for highlighting
+      for (const link of window.getLinksFromNodeId(node.id)) {
+        highlightLinks.add(link);
+        highlightNodes.add(link.source);
+        highlightNodes.add(link.target);
+      }
+    }
+
+    // refresh node and link display
+    Graph.nodeThreeObject(Graph.nodeThreeObject())
+      .linkWidth(Graph.linkWidth())
+      .linkDirectionalParticles(Graph.linkDirectionalParticles());
+
+    // Aim at node from outside it
+    const distance = 42;
+    const distRatio = 1 + distance / Math.hypot(node.x, node.y, node.z);
+
+    const newPos =
+      node.x || node.y || node.z
+        ? { x: node.x * distRatio, y: node.y * distRatio, z: node.z * distRatio }
+        : { x: 0, y: 0, z: distance }; // special case if node is in (0,0,0)
+
+    Graph.cameraPosition(
+      newPos, // new position
+      node, // lookAt ({ x, y, z })
+      3000, // ms transition duration
+    );
+  };
+
+  const highlightNodes = new Set();
+  const highlightLinks = new Set();
+  let hoverNode = null;
+
+  const grpahDiv = document.getElementById("3d-graph");
+  const Graph = ForceGraph3D();
+  Graph(grpahDiv);
+  Graph.jsonUrl(config.dataUrl)
+    .width(
+      grpahDiv.parentElement.clientWidth > 1200
+        ? 1200
+        : grpahDiv.parentElement.clientWidth,
+    ) // Not perfect at all. JS-fu master from the future, please fix this :-)
+    .height(1000)
+    .enableNodeDrag(false) // allow easier navigation
+    .onNodeClick((node) => {
+      const camera = Graph.cameraPosition();
+      const distance = Math.sqrt(
+        (node.x - camera.x) ** 2 + (node.y - camera.y) ** 2 + (node.z - camera.z) ** 2,
+      );
+      if (distance < 120 || highlightNodes.has(node)) {
+        window.focusNode(node);
+      }
+    })
+    .linkWidth((link) => (highlightLinks.has(link) ? 0.4 : 0.0))
+    .linkColor((link) =>
+      highlightLinks.has(link) ? "rgba(255,160,0,1)" : "rgba(128,255,255,0.6)",
+    )
+    .linkVisibility((link) => highlightLinks.has(link))
+    .nodeVisibility((node) => highlightNodes.has(node) || node.mass > 4)
+    // .linkDirectionalParticles(link => highlightLinks.has(link) ? 3 : 1) // kinda buggy for now, and slows this a bit, but would be great to help visualize lanes
+    .linkDirectionalParticleWidth(0.2)
+    .linkDirectionalParticleSpeed(-0.006)
+    .nodeThreeObject((node) => {
+      const sprite = new SpriteText(node.name);
+      sprite.material.depthWrite = false; // make sprite background transparent
+      sprite.color = highlightNodes.has(node)
+        ? node === hoverNode
+          ? "rgba(200,0,0,1)"
+          : "rgba(255,160,0,0.8)"
+        : "rgba(0,255,255,0.2)";
+      sprite.textHeight = 2;
+      sprite.center = new Three.Vector2(1.2, 0.5);
+      return sprite;
+    })
+    .onEngineStop(() => {
+      window.focusNode(window.getNodeFromId(config.nodeId));
+      Graph.onEngineStop(() => {
+        /* nope */
+      }); // don't call ourselves in a loop while moving the focus
+    });
+
+  // Set distance between stars
+  Graph.d3Force("link").distance((link) => link.value);
+
+  // Set high masses nearer the center of the galaxy
+  // TODO: quick and dirty strength computation, this will need tuning.
+  Graph.d3Force(
+    "positionX",
+    forceX().strength((node) => {
+      return 1 - 1 / node.mass;
+    }),
+  );
+  Graph.d3Force(
+    "positionY",
+    forceY().strength((node) => {
+      return 1 - 1 / node.mass;
+    }),
+  );
+  Graph.d3Force(
+    "positionZ",
+    forceZ().strength((node) => {
+      return 1 - 1 / node.mass;
+    }),
+  );
+};
--- a/galaxy/static/bundled/galaxy/galaxy-index.ts
+++ b/galaxy/static/bundled/galaxy/galaxy-index.ts
@@ -1,137 +0,0 @@
-import { exportToHtml } from "#core:utils/globals";
-
-import cytoscape from "cytoscape";
-import d3Force, { type D3ForceLayoutOptions } from "cytoscape-d3-force";
-
-cytoscape.use(d3Force);
-
-interface GalaxyConfig {
-  nodeId: number;
-  dataUrl: string;
-}
-
-async function getGraphData(dataUrl: string) {
-  const response = await fetch(dataUrl);
-  if (!response.ok) {
-    return [];
-  }
-
-  const content = await response.json();
-  const nodes = content.nodes.map((node, i) => {
-    return {
-      group: "nodes",
-      data: {
-        id: node.id,
-        name: node.name,
-        mass: node.mass,
-      },
-    };
-  });
-
-  const edges = content.links.map((link) => {
-    return {
-      group: "edges",
-      data: {
-        id: `edge_${link.source}_${link.value}`,
-        source: link.source,
-        target: link.target,
-        value: link.value,
-      },
-    };
-  });
-
-  return { nodes: nodes, edges: edges };
-}
-
-exportToHtml("loadGalaxy", async (config: GalaxyConfig) => {
-  const graphDiv = document.getElementById("3d-graph");
-  const elements = await getGraphData(config.dataUrl);
-  const cy = cytoscape({
-    container: graphDiv,
-    elements: elements,
-    style: [
-      {
-        selector: "node",
-        style: {
-          label: "data(name)",
-          "background-color": "red",
-        },
-      },
-      {
-        selector: ".focused",
-        style: {
-          "border-width": "5px",
-          "border-style": "solid",
-          "border-color": "black",
-          "target-arrow-color": "black",
-          "line-color": "black",
-        },
-      },
-      {
-        selector: "edge",
-        style: {
-          width: 0.1,
-        },
-      },
-      {
-        selector: ".direct",
-        style: {
-          width: "5px",
-          "line-color": "red",
-        },
-      },
-    ],
-    layout: {
-      name: "d3-force",
-      animate: true,
-      fit: false,
-      ungrabifyWhileSimulating: true,
-      fixedAfterDragging: true,
-
-      linkId: (node) => {
-        return node.id;
-      },
-
-      linkDistance: (link) => {
-        return elements.nodes.length * 10;
-      },
-
-      linkStrength: (link) => {
-        return 1 / Math.max(1, link?.value);
-      },
-
-      linkIterations: 10,
-
-      manyBodyStrength: (node) => {
-        return node?.mass;
-      },
-
-      // manyBodyDistanceMin: 500,
-      collideRadius: () => {
-        return 50;
-      },
-
-      ready: (e) => {
-        // Center on current user node at the start of the simulation
-        // Color all direct paths from that citizen to it's neighbor
-        const citizen = e.cy.nodes(`#${config.nodeId}`)[0];
-        citizen.addClass("focused");
-        citizen.connectedEdges().addClass("direct");
-        e.cy.center(citizen);
-      },
-
-      tick: () => {
-        // Center on current user node during simulation
-        const citizen = cy.nodes(`#${config.nodeId}`)[0];
-        cy.center(citizen);
-      },
-
-      stop: (e) => {
-        // Disable user grabbing of nodes
-        // This has to be disabled after the simulation is done
-        // Otherwise the simulation can't move nodes
-        e.cy.autolock(true);
-      },
-    } as D3ForceLayoutOptions,
-  });
-});
--- a/galaxy/templates/galaxy/user.jinja
+++ b/galaxy/templates/galaxy/user.jinja
@@ -5,14 +5,14 @@
 {% endblock %}

 {% block additional_js %}
-  <script type="module" src="{{ static('bundled/galaxy/galaxy-index.ts') }}"></script>
+  <script type="module" src="{{ static('bundled/galaxy/galaxy-index.js') }}"></script>
 {% endblock %}


 {% block content %}
  {% if object.current_star %}
    <div style="display: flex; flex-wrap: wrap;">
-      <div style="width: 100%; height: 70vh; display: block" id="3d-graph"></div>
+      <div id="3d-graph"></div>

      <div style="margin: 1em;">
        <p><a onclick="window.focusNode(window.getNodeFromId({{ object.id }}))">Reset on {{ object.get_display_name() }}</a></p>
--- a/package-lock.json
+++ b/package-lock.json
@@ -25,7 +25,6 @@
        "country-flag-emoji-polyfill": "^0.1.8",
        "cytoscape": "^3.33.1",
        "cytoscape-cxtmenu": "^3.5.0",
-        "cytoscape-d3-force": "^1.1.4",
        "cytoscape-klay": "^3.1.4",
        "d3-force-3d": "^3.0.6",
        "easymde": "^2.20.0",
@@ -47,7 +46,6 @@
        "@rollup/plugin-inject": "^5.0.5",
        "@types/alpinejs": "^3.13.11",
        "@types/cytoscape-cxtmenu": "^3.4.5",
-        "@types/cytoscape-d3-force": "^1.0.0",
        "@types/cytoscape-klay": "^3.1.5",
        "@types/js-cookie": "^3.0.6",
        "typescript": "^5.9.3",
@@ -2892,16 +2890,6 @@
        "cytoscape": "^3.31"
      }
    },
-    "node_modules/@types/cytoscape-d3-force": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@types/cytoscape-d3-force/-/cytoscape-d3-force-1.0.0.tgz",
-      "integrity": "sha512-1eRd9xr/DvJ4MIA5lCEG8DMX2Ha87qAbpP7irpuKZun0ZCBQPpoOBo9mPl0WrkJbXH+hHwG8s3E2CpUz3HxLrw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/cytoscape": "^3.0.9"
-      }
-    },
    "node_modules/@types/cytoscape-klay": {
      "version": "3.1.5",
      "resolved": "https://registry.npmjs.org/@types/cytoscape-klay/-/cytoscape-klay-3.1.5.tgz",
@@ -3571,18 +3559,6 @@
        "cytoscape": "^3.2.0"
      }
    },
-    "node_modules/cytoscape-d3-force": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/cytoscape-d3-force/-/cytoscape-d3-force-1.1.4.tgz",
-      "integrity": "sha512-8NjI/yEoB3YqVsdf7ud7Oh8Kyi+C9Lhh1fICmtemIo6EC1ZUtm8KcPNLkQySYO8nRS2mQKj5eVdCr7W0L8ONoQ==",
-      "license": "MIT",
-      "dependencies": {
-        "d3-force": "^2.0.1"
-      },
-      "peerDependencies": {
-        "cytoscape": "^3.2.0"
-      }
-    },
    "node_modules/cytoscape-klay": {
      "version": "3.1.4",
      "resolved": "https://registry.npmjs.org/cytoscape-klay/-/cytoscape-klay-3.1.4.tgz",
@@ -3631,17 +3607,6 @@
        "node": ">=12"
      }
    },
-    "node_modules/d3-force": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-2.1.1.tgz",
-      "integrity": "sha512-nAuHEzBqMvpFVMf9OX75d00OxvOXdxY+xECIXjW6Gv8BRrXu6gAWbv/9XKrvfJ5i5DCokDW7RYE50LRoK092ew==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "d3-dispatch": "1 - 2",
-        "d3-quadtree": "1 - 2",
-        "d3-timer": "1 - 2"
-      }
-    },
    "node_modules/d3-force-3d": {
      "version": "3.0.6",
      "resolved": "https://registry.npmjs.org/d3-force-3d/-/d3-force-3d-3.0.6.tgz",
@@ -3658,24 +3623,6 @@
        "node": ">=12"
      }
    },
-    "node_modules/d3-force/node_modules/d3-dispatch": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-2.0.0.tgz",
-      "integrity": "sha512-S/m2VsXI7gAti2pBoLClFFTMOO1HTtT0j99AuXLoGFKO6deHDdnv6ZGTxSTTUTgO1zVcv82fCOtDjYK4EECmWA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/d3-force/node_modules/d3-quadtree": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-2.0.0.tgz",
-      "integrity": "sha512-b0Ed2t1UUalJpc3qXzKi+cPGxeXRr4KU9YSlocN74aTzp6R/Ud43t79yLLqxHRWZfsvWXmbDWPpoENK1K539xw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/d3-force/node_modules/d3-timer": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-2.0.0.tgz",
-      "integrity": "sha512-TO4VLh0/420Y/9dO3+f9abDEFYeCUr2WZRlxJvbp4HPTQcSylXNiL6yZa9FIUvV1yRiFufl1bszTCLDqv9PWNA==",
-      "license": "BSD-3-Clause"
-    },
    "node_modules/d3-format": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.0.tgz",
--- a/package.json
+++ b/package.json
@@ -31,7 +31,6 @@
    "@rollup/plugin-inject": "^5.0.5",
    "@types/alpinejs": "^3.13.11",
    "@types/cytoscape-cxtmenu": "^3.4.5",
-    "@types/cytoscape-d3-force": "^1.0.0",
    "@types/cytoscape-klay": "^3.1.5",
    "@types/js-cookie": "^3.0.6",
    "typescript": "^5.9.3",
@@ -56,7 +55,6 @@
    "country-flag-emoji-polyfill": "^0.1.8",
    "cytoscape": "^3.33.1",
    "cytoscape-cxtmenu": "^3.5.0",
-    "cytoscape-d3-force": "^1.1.4",
    "cytoscape-klay": "^3.1.4",
    "d3-force-3d": "^3.0.6",
    "easymde": "^2.20.0",
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -73,7 +73,7 @@ dev = [
 ]
 tests = [
    "freezegun>=1.5.5,<2.0.0",
-    "pytest>=8.4.2,<9.0.0",
+    "pytest>=8.4.2,<10.0.0",
    "pytest-cov>=7.0.0,<8.0.0",
    "pytest-django<5.0.0,>=4.10.0",
    "model-bakery<2.0.0,>=1.20.4",
--- a/trombi/views.py
+++ b/trombi/views.py
@@ -27,7 +27,7 @@ from datetime import date
 from django import forms
 from django.conf import settings
 from django.contrib import messages
-from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import PermissionDenied
 from django.db import IntegrityError
@@ -35,13 +35,17 @@ from django.forms.models import modelform_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse, reverse_lazy
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, RedirectView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView

 from club.models import Club
-from core.auth.mixins import CanEditMixin, CanEditPropMixin, CanViewMixin
+from core.auth.mixins import (
+    CanCreateMixin,
+    CanEditMixin,
+    CanEditPropMixin,
+    CanViewMixin,
+)
 from core.models import User
 from core.views.forms import SelectDate
 from core.views.mixins import TabedViewMixin
@@ -113,25 +117,19 @@ class TrombiForm(forms.ModelForm):
        widgets = {"subscription_deadline": SelectDate, "comments_deadline": SelectDate}


-class TrombiCreateView(UserPassesTestMixin, CreateView):
+class TrombiCreateView(CanCreateMixin, CreateView):
    """Create a trombi for a club."""

    model = Trombi
    form_class = TrombiForm
    template_name = "core/create.jinja"

-    @cached_property
-    def club(self):
-        return get_object_or_404(Club, id=self.kwargs["club_id"])
-
-    def test_func(self):
-        return self.request.user.can_edit(self.club)
-
    def post(self, request, *args, **kwargs):
        """Affect club."""
        form = self.get_form()
        if form.is_valid():
-            form.instance.club = self.club
+            club = get_object_or_404(Club, id=self.kwargs["club_id"])
+            form.instance.club = club
            ret = self.form_valid(form)
            return ret
        else: