exclude hidden users from ajax search

api/auth.py

@@ -6,8 +6,6 @@ from api.models import ApiClient, ApiKey
 
 
 class ApiKeyAuth(APIKeyHeader):
-    """Authentication through client api keys."""
-
     param_name = "X-APIKey"
 
     def authenticate(self, request: HttpRequest, key: str | None) -> ApiClient | None:

api/tests/test_mixed_auth.py

@@ -1,48 +0,0 @@
-import pytest
-from django.test import Client
-from django.urls import path
-from model_bakery import baker
-from ninja import NinjaAPI
-from ninja.security import SessionAuth
-
-from api.auth import ApiKeyAuth
-from api.hashers import generate_key
-from api.models import ApiClient, ApiKey
-
-api = NinjaAPI()
-
-
-@api.post("", auth=[ApiKeyAuth(), SessionAuth()])
-def post_method(*args, **kwargs) -> None:
-    """Dummy POST route authenticated by either api key or session cookie."""
-    pass
-
-
-urlpatterns = [path("", api.urls)]
-
-
-@pytest.mark.django_db
-@pytest.mark.urls(__name__)
-@pytest.mark.parametrize("user_logged_in", [False, True])
-def test_csrf_token(user_logged_in):
-    """Test that CSRF check happens only when no api key is used."""
-    client = Client(enforce_csrf_checks=True)
-    key, hashed = generate_key()
-    api_client = baker.make(ApiClient)
-    baker.make(ApiKey, client=api_client, hashed_key=hashed)
-    if user_logged_in:
-        client.force_login(api_client.owner)
-
-    response = client.post("")
-    assert response.status_code == 403
-    assert response.json()["detail"] == "CSRF check Failed"
-
-    # if using a valid API key, CSRF check should not occur
-    response = client.post("", headers={"X-APIKey": key})
-    assert response.status_code == 200
-
-    # if using a wrong API key, ApiKeyAuth should fail,
-    # leading to a fallback into SessionAuth and a CSRF check
-    response = client.post("", headers={"X-APIKey": generate_key()[0]})
-    assert response.status_code == 403
-    assert response.json()["detail"] == "CSRF check Failed"

api/urls.py

@@ -1,4 +1,3 @@
-from ninja.security import SessionAuth
 from ninja_extra import NinjaExtraAPI
 
 api = NinjaExtraAPI(
@@ -6,6 +5,6 @@ api = NinjaExtraAPI(
     description="Portail Interactif de Communication avec les Outils Numériques",
     version="0.2.0",
     urls_namespace="api",
-    auth=[SessionAuth()],
+    csrf=True,
 )
 api.auto_discover_controllers()

club/api.py

@@ -16,7 +16,7 @@ class ClubController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimpleClubSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
         url_name="search_club",
     )
@@ -27,7 +27,7 @@ class ClubController(ControllerBase):
     @route.get(
         "/{int:club_id}",
         response=ClubSchema,
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[HasPerm("club.view_club")],
         url_name="fetch_club",
     )

club/templates/club/club_detail.jinja

@@ -9,18 +9,6 @@
   {{ club.short_description }}
 {%- endblock %}
 
-{% block metatags %}
-  <meta property="og:url" content="{{ request.build_absolute_uri(club.get_absolute_url()) }}" />
-  <meta property="og:type" content="website" />
-  <meta property="og:title" content="{{ club.name }}" />
-  <meta property="og:description" content="{{ club.short_description }}" />
-  {% if club.logo %}
-    <meta property="og:image" content="{{ request.build_absolute_uri(club.logo.url) }}" />
-  {% else %}
-    <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-  {% endif %}
-{% endblock %}
-
 {% block content %}
   <div id="club_detail">
     {% if club.logo %}
@@ -29,7 +17,7 @@
     {% if page_revision %}
       {{ page_revision|markdown }}
     {% else %}
-      <h3>{{ club.name }}</h3>
+      <h3>{% trans %}Club{% endtrans %}</h3>
     {% endif %}
   </div>
 {% endblock %}

com/api.py

@@ -5,6 +5,7 @@ from django.utils.cache import add_never_cache_headers
 from ninja import Query
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.pagination import PageNumberPaginationExtra
+from ninja_extra.permissions import IsAuthenticated
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.permissions import HasPerm
@@ -16,13 +17,17 @@ from core.views.files import send_raw_file
 
 @api_controller("/calendar")
 class CalendarController(ControllerBase):
-    @route.get("/internal.ics", auth=None, url_name="calendar_internal")
+    @route.get("/internal.ics", url_name="calendar_internal")
     def calendar_internal(self):
         response = send_raw_file(IcsCalendar.get_internal())
         add_never_cache_headers(response)
         return response
 
-    @route.get("/unpublished.ics", url_name="calendar_unpublished")
+    @route.get(
+        "/unpublished.ics",
+        permissions=[IsAuthenticated],
+        url_name="calendar_unpublished",
+    )
     def calendar_unpublished(self):
         response = HttpResponse(
             IcsCalendar.get_unpublished(self.context.request.user),
@@ -69,7 +74,6 @@ class NewsController(ControllerBase):
 
     @route.get(
         "/date",
-        auth=None,
         url_name="fetch_news_dates",
         response=PaginatedResponseSchema[NewsDateSchema],
     )

com/templates/com/news_detail.jinja

@@ -1,20 +1,15 @@
 {% extends "core/base.jinja" %}
-{% from 'core/macros.jinja' import user_profile_link, link_news_logo %}
+{% from 'core/macros.jinja' import user_profile_link, facebook_share, tweet, link_news_logo, gen_news_metatags %}
 {% from "com/macros.jinja" import news_moderation_alert %}
 
 {% block title %}
-  {% trans %}News{% endtrans %} - {{ object.title }}
+  {% trans %}News{% endtrans %} -
+  {{ object.title }}
 {% endblock %}
 
-{% block description %}{{ news.summary }}{% endblock %}
+{% block head %}
-
+  {{ super() }}
-{% block metatags %}
+  {{ gen_news_metatags(news) }}
-  <meta property="og:url" content="{{ news.get_full_url() }}" />
-  <meta property="og:type" content="article" />
-  <meta property="article:section" content="{% trans %}News{% endtrans %}" />
-  <meta property="og:title" content="{{ news.title }}" />
-  <meta property="og:description" content="{{ news.summary }}" />
-  <meta property="og:image" content="{{ request.build_absolute_uri(link_news_logo(news)) }}" />
 {% endblock %}
 
 
@@ -49,14 +44,8 @@
         <div><em>{{ news.summary|markdown }}</em></div>
         <br/>
         <div>{{ news.content|markdown }}</div>
-        <a
+        {{ facebook_share(news) }}
-          rel="nofollow"
+        {{ tweet(news) }}
-          target="#"
-          class="share_button facebook"
-          href="https://www.facebook.com/sharer/sharer.php?u={{ news.get_full_url() }}"
-        >
-          {% trans %}Share on Facebook{% endtrans %}
-        </a>
         <div class="news_meta">
           <p>{% trans %}Author: {% endtrans %}{{ user_profile_link(news.author) }}</p>
           {% if news.moderator %}

com/views.py

@@ -240,10 +240,11 @@ class NewsListView(TemplateView):
         if not self.request.user.has_perm("core.view_user"):
             return []
         return itertools.groupby(
-            User.objects.filter(
+            User.objects.viewable_by(self.request.user)
+            .filter(
                 date_of_birth__month=localdate().month,
                 date_of_birth__day=localdate().day,
-                is_subscriber_viewable=True,
+                is_viewable=True,
             )
             .filter(role__in=["STUDENT", "FORMER STUDENT"])
             .order_by("-date_of_birth"),
@@ -700,7 +701,7 @@ class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
             parsed = urlparse(referer)
             if parsed.netloc == settings.SITH_URL:
                 return redirect(parsed.path)
-        return redirect("com:poster_list")
+        return redirect(reverse("com:poster_list"))
 
 
 class ScreenListView(PermissionRequiredMixin, ComTabsMixin, ListView):

core/admin.py

@@ -74,9 +74,19 @@ class UserBanAdmin(admin.ModelAdmin):
     autocomplete_fields = ("user", "ban_group")
 
 
+class GroupInline(admin.TabularInline):
+    model = Group.permissions.through
+    readonly_fields = ("group",)
+    extra = 0
+
+    def has_add_permission(self, request, obj):
+        return False
+
+
 @admin.register(Permission)
 class PermissionAdmin(admin.ModelAdmin):
     search_fields = ("codename",)
+    inlines = (GroupInline,)
 
 
 @admin.register(Page)

core/api.py

@@ -74,7 +74,7 @@ class MailingListController(ControllerBase):
 class UserController(ControllerBase):
     @route.get("", response=list[UserProfileSchema], permissions=[CanAccessLookup])
     def fetch_profiles(self, pks: Query[set[int]]):
-        return User.objects.filter(pk__in=pks)
+        return User.objects.viewable_by(self.context.request.user).filter(pk__in=pks)
 
     @route.get("/{int:user_id}", response=UserSchema, permissions=[CanView])
     def fetch_user(self, user_id: int):
@@ -90,7 +90,9 @@ class UserController(ControllerBase):
     @paginate(PageNumberPaginationExtra, page_size=20)
     def search_users(self, filters: Query[UserFilterSchema]):
         return filters.filter(
-            User.objects.order_by(F("last_login").desc(nulls_last=True))
+            User.objects.viewable_by(self.context.request.user).order_by(
+                F("last_login").desc(nulls_last=True)
+            )
         )
 
 
@@ -99,7 +101,7 @@ class SithFileController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SithFileSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -112,7 +114,7 @@ class GroupController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[GroupSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)

core/auth/mixins.py

@@ -24,6 +24,7 @@
 from __future__ import annotations
 
 import types
+import warnings
 from typing import TYPE_CHECKING, Any, LiteralString
 
 from django.contrib.auth.mixins import AccessMixin, PermissionRequiredMixin
@@ -146,6 +147,45 @@ class GenericContentPermissionMixinBuilder(View):
         return super().dispatch(request, *arg, **kwargs)
 
 
+class CanCreateMixin(View):
+    """Protect any child view that would create an object.
+
+    Raises:
+        PermissionDenied:
+            If the user has not the necessary permission
+            to create the object of the view.
+    """
+
+    def __init_subclass__(cls, **kwargs):
+        warnings.warn(
+            f"{cls.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init_subclass__(**kwargs)
+
+    def __init__(self, *args, **kwargs):
+        warnings.warn(
+            f"{self.__class__.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(*args, **kwargs)
+
+    def dispatch(self, request, *arg, **kwargs):
+        if not request.user.is_authenticated:
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
+
+    def form_valid(self, form):
+        obj = form.instance
+        if can_edit_prop(obj, self.request.user):
+            return super().form_valid(form)
+        raise PermissionDenied
+
+
 class CanEditPropMixin(GenericContentPermissionMixinBuilder):
     """Ensure the user has owner permissions on the child view object.
 

core/management/commands/check_fs.py

@@ -0,0 +1,40 @@
+#
+# Copyright 2018
+# - Skia <skia@libskia.so>
+#
+# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
+# http://ae.utbm.fr.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License a published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
+# Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+#
+
+from django.core.management.base import BaseCommand
+
+from core.models import SithFile
+
+
+class Command(BaseCommand):
+    help = "Recursively check the file system with respect to the DB"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "ids", metavar="ID", type=int, nargs="+", help="The file IDs to process"
+        )
+
+    def handle(self, *args, **options):
+        files = SithFile.objects.filter(id__in=options["ids"]).all()
+        for f in files:
+            f._check_fs()

core/management/commands/populate.py

@@ -150,7 +150,8 @@ class Command(BaseCommand):
 
         Weekmail().save()
 
-        # Here we add a lot of test datas, that are not necessary for the Sith, but that provide a basic development environment
+        # Here we add a lot of test datas, that are not necessary for the Sith,
+        # but that provide a basic development environment
         self.now = timezone.now().replace(hour=12, second=0)
 
         skia = User.objects.create_user(

core/management/commands/repair_fs.py

@@ -0,0 +1,41 @@
+#
+# Copyright 2018
+# - Skia <skia@libskia.so>
+#
+# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
+# http://ae.utbm.fr.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License a published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
+# Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+#
+
+
+from django.core.management.base import BaseCommand
+
+from core.models import SithFile
+
+
+class Command(BaseCommand):
+    help = "Recursively repair the file system with respect to the DB"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "ids", metavar="ID", type=int, nargs="+", help="The file IDs to process"
+        )
+
+    def handle(self, *args, **options):
+        files = SithFile.objects.filter(id__in=options["ids"]).all()
+        for f in files:
+            f._repair_fs()

core/migrations/0048_alter_user_options.py

@@ -0,0 +1,33 @@
+# Generated by Django 5.2.8 on 2025-11-09 15:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [("core", "0047_alter_notification_date_alter_notification_type")]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="user",
+            options={
+                "permissions": [("view_hidden_user", "Can view hidden users")],
+                "verbose_name": "user",
+                "verbose_name_plural": "users",
+            },
+        ),
+        migrations.RenameField(
+            model_name="user", old_name="is_subscriber_viewable", new_name="is_viewable"
+        ),
+        migrations.AlterField(
+            model_name="user",
+            name="is_viewable",
+            field=models.BooleanField(
+                default=True,
+                verbose_name="Profile visible by subscribers",
+                help_text=(
+                    "If you disable this option, only admin users "
+                    "will be able to see your profile."
+                ),
+            ),
+        ),
+    ]

core/models.py

@@ -23,12 +23,14 @@
 #
 from __future__ import annotations
 
+import logging
+import os
 import string
 import unicodedata
 from datetime import timedelta
 from io import BytesIO
 from pathlib import Path
-from typing import TYPE_CHECKING, Self
+from typing import TYPE_CHECKING, Optional, Self
 from uuid import uuid4
 
 from django.conf import settings
@@ -95,6 +97,48 @@ def validate_promo(value: int) -> None:
         )
 
 
+def get_group(*, pk: int | None = None, name: str | None = None) -> Group | None:
+    """Search for a group by its primary key or its name.
+    Either one of the two must be set.
+
+    The result is cached for the default duration (should be 5 minutes).
+
+    Args:
+        pk: The primary key of the group
+        name: The name of the group
+
+    Returns:
+        The group if it exists, else None
+
+    Raises:
+        ValueError: If no group matches the criteria
+    """
+    if pk is None and name is None:
+        raise ValueError("Either pk or name must be set")
+
+    # replace space characters to hide warnings with memcached backend
+    pk_or_name: str | int = pk if pk is not None else name.replace(" ", "_")
+    group = cache.get(f"sith_group_{pk_or_name}")
+
+    if group == "not_found":
+        # Using None as a cache value is a little bit tricky,
+        # so we use a special string to represent None
+        return None
+    elif group is not None:
+        return group
+    # if this point is reached, the group is not in cache
+    if pk is not None:
+        group = Group.objects.filter(pk=pk).first()
+    else:
+        group = Group.objects.filter(name=name).first()
+    if group is not None:
+        name = group.name.replace(" ", "_")
+        cache.set_many({f"sith_group_{group.id}": group, f"sith_group_{name}": group})
+    else:
+        cache.set(f"sith_group_{pk_or_name}", "not_found")
+    return group
+
+
 class BanGroup(AuthGroup):
     """An anti-group, that removes permissions instead of giving them.
 
@@ -136,6 +180,15 @@ class UserQuerySet(models.QuerySet):
             Q(Exists(subscriptions)) | Q(Exists(refills)) | Q(Exists(purchases))
         )
 
+    def viewable_by(self, user: User) -> Self:
+        if user.has_perm("core.view_hidden_user"):
+            return self
+        if user.has_perm("core.view_user"):
+            return self.filter(is_viewable=True)
+        if user.is_anonymous:
+            return self.none()
+        return self.filter(id=user.id)
+
 
 class CustomUserManager(UserManager.from_queryset(UserQuerySet)):
     # see https://docs.djangoproject.com/fr/stable/topics/migrations/#model-managers
@@ -271,13 +324,24 @@ class User(AbstractUser):
     parent_address = models.CharField(
         _("parent address"), max_length=128, blank=True, default=""
     )
-    is_subscriber_viewable = models.BooleanField(
+    is_viewable = models.BooleanField(
-        _("is subscriber viewable"), default=True
+        _("Profile visible by subscribers"),
+        help_text=_(
+            "If you disable this option, only admin users "
+            "will be able to see your profile."
+        ),
+        default=True,
     )
     godfathers = models.ManyToManyField("User", related_name="godchildren", blank=True)
 
     objects = CustomUserManager()
 
+    class Meta(AbstractUser.Meta):
+        abstract = False
+        permissions = [
+            ("view_hidden_user", "Can view hidden users"),
+        ]
+
     def __str__(self):
         return self.get_display_name()
 
@@ -338,18 +402,19 @@ class User(AbstractUser):
         Returns:
              True if the user is the group, else False
         """
-        if not pk and not name:
+        if pk is not None:
+            group: Optional[Group] = get_group(pk=pk)
+        elif name is not None:
+            group: Optional[Group] = get_group(name=name)
+        else:
             raise ValueError("You must either provide the id or the name of the group")
-        group_id: int | None = (
+        if group is None:
-            pk or Group.objects.filter(name=name).values_list("id", flat=True).first()
-        )
-        if group_id is None:
             return False
-        if group_id == settings.SITH_GROUP_SUBSCRIBERS_ID:
+        if group.id == settings.SITH_GROUP_SUBSCRIBERS_ID:
             return self.is_subscribed
-        if group_id == settings.SITH_GROUP_ROOT_ID:
+        if group.id == settings.SITH_GROUP_ROOT_ID:
             return self.is_root
-        return any(g.id == group_id for g in self.cached_groups)
+        return group in self.cached_groups
 
     @cached_property
     def cached_groups(self) -> list[Group]:
@@ -409,6 +474,14 @@ class User(AbstractUser):
         else:
             raise ValidationError(_("A user with that username already exists"))
 
+    def get_profile(self):
+        return {
+            "last_name": self.last_name,
+            "first_name": self.first_name,
+            "nick_name": self.nick_name,
+            "date_of_birth": self.date_of_birth,
+        }
+
     def get_short_name(self):
         """Returns the short name for the user."""
         if self.nick_name:
@@ -551,8 +624,12 @@ class User(AbstractUser):
     def can_be_edited_by(self, user):
         return user.is_root or user.is_board_member
 
-    def can_be_viewed_by(self, user):
+    def can_be_viewed_by(self, user: User) -> bool:
-        return (user.was_subscribed and self.is_subscriber_viewable) or user.is_root
+        return (
+            user.id == self.id
+            or user.has_perm("core.view_hidden_user")
+            or (user.has_perm("core.view_user") and self.is_viewable)
+        )
 
     def get_mini_item(self):
         return """
@@ -636,8 +713,8 @@ class AnonymousUser(AuthAnonymousUser):
         if pk is not None:
             return pk == allowed_id
         elif name is not None:
-            group = Group.objects.get(id=allowed_id)
+            group = get_group(name=name)
-            return group.name == name
+            return group is not None and group.id == allowed_id
         else:
             raise ValueError("You must either provide the id or the name of the group")
 
@@ -963,6 +1040,63 @@ class SithFile(models.Model):
         self.clean()
         self.save()
 
+    def _repair_fs(self):
+        """Rebuilds recursively the filesystem as it should be regarding the DB tree."""
+        if self.is_folder:
+            for c in self.children.all():
+                c._repair_fs()
+            return
+        elif not self._check_path_consistence():
+            # First get future parent path and the old file name
+            # Prepend "." so that we match all relative handling of Django's
+            # file storage
+            parent_path = "." + self.parent.get_full_path()
+            parent_full_path = settings.MEDIA_ROOT + parent_path
+            os.makedirs(parent_full_path, exist_ok=True)
+            old_path = self.file.name  # Should be relative: "./users/skia/bleh.jpg"
+            new_path = "." + self.get_full_path()
+            try:
+                # Make this atomic, so that a FS problem rolls back the DB change
+                with transaction.atomic():
+                    # Set the new filesystem path
+                    self.file.name = new_path
+                    self.save()
+                    # Really move at the FS level
+                    if os.path.exists(parent_full_path):
+                        os.rename(
+                            settings.MEDIA_ROOT + old_path,
+                            settings.MEDIA_ROOT + new_path,
+                        )
+                        # Empty directories may remain, but that's not really a
+                        # problem, and that can be solved with a simple shell
+                        # command: `find . -type d -empty -delete`
+            except Exception as e:
+                logging.error(e)
+
+    def _check_path_consistence(self):
+        file_path = str(self.file)
+        file_full_path = settings.MEDIA_ROOT + file_path
+        db_path = ".%s" % self.get_full_path()
+        if not os.path.exists(file_full_path):
+            print("%s: WARNING: real file does not exists!" % self.id)  # noqa T201
+            print("file path: %s" % file_path, end="")  # noqa T201
+            print("  db path: %s" % db_path)  # noqa T201
+            return False
+        if file_path != db_path:
+            print("%s: " % self.id, end="")  # noqa T201
+            print("file path: %s" % file_path, end="")  # noqa T201
+            print("  db path: %s" % db_path)  # noqa T201
+            return False
+        return True
+
+    def _check_fs(self):
+        if self.is_folder:
+            for c in self.children.all():
+                c._check_fs()
+            return
+        else:
+            self._check_path_consistence()
+
     @property
     def is_file(self):
         return not self.is_folder

core/static/core/footer.scss

@@ -65,7 +65,7 @@ footer.bottom-links {
       flex-wrap: wrap;
       align-items: center;
       background-color: $primary-neutral-dark-color;
-      box-shadow: black 0 8px 15px;
+      box-shadow: $shadow-color 0 0 15px;
 
       a {
         color: $white-color;

core/static/core/header.scss

@@ -11,8 +11,7 @@ $hovered-red-text-color: #ff4d4d;
 .header {
   box-sizing: border-box;
   background-color: $deepblue;
-  box-shadow: black 0 1px 3px 0,
+  box-shadow: 3px 3px 3px 0 #dfdfdf;
-              black 0 4px 8px 3px;
   border-radius: 0;
   width: 100%;
   display: flex;
@@ -100,7 +99,7 @@ $hovered-red-text-color: #ff4d4d;
         border-radius: 0;
         margin: 0;
         box-sizing: border-box;
-        background-color: transparent;
+        background-color: $deepblue;
         width: 45px;
         height: 25px;
         padding: 0;
@@ -332,7 +331,7 @@ $hovered-red-text-color: #ff4d4d;
           padding: 10px;
           z-index: 100;
           border-radius: 10px;
-          @include shadow;
+          box-shadow: 3px 3px 3px 0 #767676;
 
           >ul {
             list-style-type: none;

core/static/core/style.scss

@@ -271,9 +271,8 @@ body {
 
   /*--------------------------------CONTENT------------------------------*/
   #content {
-    padding: 1.5em 2%;
+    padding: 1em 1%;
-    border-radius: 5px;
+    box-shadow: $shadow-color 0 5px 10px;
-    box-shadow: black 0 8px 15px;
     background: $white-color;
     overflow: auto;
   }

core/static/user/user_edit.scss

@@ -7,10 +7,13 @@
 .profile {
   &-visible {
     display: flex;
-    justify-content: center;
+    flex-direction: column;
     align-items: center;
     gap: 5px;
     padding-top: 10px;
+    input[type="checkbox"]+label {
+      max-width: unset;
+    }
   }
 
   &-pictures {
@@ -116,23 +119,19 @@
     display: flex;
     flex-direction: row;
     flex-wrap: wrap;
-    gap: 10px;
+    gap: var(--nf-input-size) 10px;
     justify-content: center;
   }
 
   &-field {
     display: flex;
-    flex-direction: row;
-    align-items: center;
     flex-wrap: wrap;
     justify-content: center;
-    gap: 10px;
     width: 100%;
     max-width: 330px;
     min-width: 300px;
 
     @media (max-width: 750px) {
-      gap: 4px;
       max-width: 100%;
     }
 
@@ -145,22 +144,6 @@
       }
     }
 
-    &-label {
-      text-align: left !important;
-    }
-
-    &-content {
-      > * {
-        box-sizing: border-box;
-        text-align: left !important;
-        margin: 0;
-
-        > * {
-          text-align: left !important;
-        }
-      }
-    }
-
     textarea {
       height: 7rem;
     }

core/templates/core/base.jinja

@@ -4,22 +4,12 @@
     {% block head %}
       <title>{% block title %}Association des Étudiants de l'UTBM{% endblock %}</title>
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <meta
+      <meta name="description" content="{% block description -%}
-        name="description"
-        content="{% block description -%}
                                           {% trans trimmed %}
                                             AE UTBM is a voluntary organisation run by UTBM students.
                                             It organises student life at UTBM and manages its student facilities.
                                           {% endtrans %}
-                 {%- endblock %}"
+                                        {%- endblock %}">
-      >
-      <meta property="og:site_name" content="Association des Étudiants de l'UTBM" />
-      {% block metatags %}
-        <meta property="og:url" content="{{ request.build_absolute_uri() }}" />
-        <meta property="og:type" content="website" />
-        <meta property="og:title" content="Association des Étudiants de l'UTBM" />
-        <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-      {% endblock %}
       <link rel="shortcut icon" href="{{ static('core/img/favicon.ico') }}">
       <link rel="stylesheet" href="{{ static('core/base.css') }}">
       <link rel="stylesheet" href="{{ static('core/style.scss') }}">
@@ -44,18 +34,6 @@
 
       {% block additional_css %}{% endblock %}
       {% block additional_js %}{% endblock %}
-      <style>
-        {# background image must be declared here, because the static names are
-           changed during the static collection step,
-           which means we must gather them with the `static` template function #}
-        .header {
-          background-image: url("{{ static("core/img/gala25_background.webp") }}");
-          background-position-y: 80%;  {# There are more stars in this part of the picture #}
-        }
-        body {
-          background-image: url("{{ static("core/img/gala25_background.webp") }}");
-        }
-      </style>
     {% endblock %}
   </head>
 

core/templates/core/base/header.jinja

@@ -1,6 +1,6 @@
 <header class="header">
   <div class="header-logo">
-    <a class="header-logo-picture" href="{{ url('core:index') }}" style="background-image: url('{{ static("core/img/gala25_logo.webp") }}')">
+    <a class="header-logo-picture" href="{{ url('core:index') }}" style="background-image: url('{{ static('core/img/logo_no_text.png') }}')">
       &nbsp;
     </a>
     <a class="header-logo-text" href="{{ url('core:index') }}">

core/templates/core/edit.jinja

@@ -21,6 +21,20 @@
   {% else %}
     <h2>{% trans %}Save{% endtrans %}</h2>
   {% endif %}
+  {% if messages %}
+    <div x-data="{show_alert: true}" class="alert alert-green" x-show="show_alert" x-transition>
+      <span class="alert-main">
+        {% for message in messages %}
+          {% if message.level_tag == "success" %}
+            {{ message }}
+          {% endif %}
+        {% endfor %}
+      </span>
+      <span class="clickable" @click="show_alert = false">
+        <i class="fa fa-close"></i>
+      </span>
+    </div>
+  {% endif %}
   <form action="" method="post" enctype="multipart/form-data">
     {% csrf_token %}
     {{ form.as_p() }}

core/templates/core/macros.jinja

@@ -13,11 +13,30 @@
 {%- endmacro %}
 
 {% macro link_news_logo(news) -%}
-  {%- if news.club.logo -%}
+  {% if news.club.logo -%}
     {{ news.club.logo.url }}
-  {%- else -%}
+  {% else -%}
     {{ static("com/img/news.png") }}
-  {%- endif -%}
+  {% endif %}
+{%- endmacro %}
+
+{% macro gen_news_metatags(news) -%}
+  <meta name="twitter:card" content="summary" />
+  <meta name="twitter:site" content="{{ settings.SITH_TWITTER }}" />
+  <meta name="twitter:creator" content= "{{ settings.SITH_TWITTER }}" />
+  <meta property="og:url"                content="{{ news.get_full_url() }}" />
+  <meta property="og:type"               content="article" />
+  <meta property="og:title"              content="{{ news.title }}" />
+  <meta property="og:description"        content="{{ news.summary }}" />
+  <meta property="og:image"              content="{{ "https://%s%s" % (settings.SITH_URL, link_news_logo(news)) }}" />
+{%- endmacro %}
+
+{% macro facebook_share(news) -%}
+  <a rel="nofollow" target="#" class="share_button facebook" href="https://www.facebook.com/sharer/sharer.php?u={{ news.get_full_url() }}">{% trans %}Share on Facebook{% endtrans %}</a>
+{%- endmacro %}
+
+{% macro tweet(news) -%}
+  <a rel="nofollow" target="#" class="share_button twitter" href="https://twitter.com/intent/tweet?text={{ news.get_full_url() }}">{% trans %}Tweet{% endtrans %}</a>
 {%- endmacro %}
 
 {% macro user_mini_profile(user) %}

core/templates/core/page.jinja

@@ -12,18 +12,6 @@
   {% endif %}
 {% endblock %}
 
-{% block metatags %}
-  {% if page %}
-    <meta property="og:url" content="{{ request.build_absolute_uri(page.get_absolute_url()) }}" />
-    <meta property="og:type" content="article" />
-    <meta property="article:section" content="{% trans %}Page{% endtrans %}" />
-    <meta property="og:title" content="{{ page.get_display_name() }}" />
-    <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-  {% else %}
-    {{ super() }}
-  {% endif %}
-{% endblock %}
-
 {%- macro print_page_name(page) -%}
   {%- if page -%}
     {{ print_page_name(page.parent) }} >

core/templates/core/user_edit.jinja

@@ -116,12 +116,12 @@
     {# All fields #}
     <div class="profile-fields">
       {%- for field in form -%}
-        {%- if field.name in ["quote","profile_pict","avatar_pict","scrub_pict","is_subscriber_viewable","forum_signature"] -%}
+        {%- if field.name in ["quote","profile_pict","avatar_pict","scrub_pict","is_viewable","forum_signature"] -%}
           {%- continue -%}
         {%- endif -%}
 
         <div class="profile-field">
-          <div class="profile-field-label">{{ field.label }}</div>
+          {{ field.label_tag() }}
           <div class="profile-field-content">
             {{ field }}
             {%- if field.errors -%}
@@ -136,7 +136,7 @@
     <div class="profile-fields">
       {%- for field in [form.quote, form.forum_signature] -%}
         <div class="profile-field">
-          <div class="profile-field-label">{{ field.label }}</div>
+          {{ field.label_tag() }}
           <div class="profile-field-content">
             {{ field }}
             {%- if field.errors -%}
@@ -149,8 +149,13 @@
 
     {# Checkboxes #}
     <div class="profile-visible">
-      {{ form.is_subscriber_viewable }}
+      <div class="row">
-      {{ form.is_subscriber_viewable.label }}
+        {{ form.is_viewable }}
+        {{ form.is_viewable.label_tag() }}
+      </div>
+      <span class="helptext">
+        {{ form.is_viewable.help_text }}
+      </span>
     </div>
     <div class="final-actions">
 

core/tests/test_core.py

@@ -421,16 +421,18 @@ class TestUserIsInGroup(TestCase):
 
         # clear the cached property `User.cached_groups`
         self.public_user.__dict__.pop("cached_groups", None)
+        cache.clear()
         # Test when the user is in the group
-        with self.assertNumQueries(1):
+        with self.assertNumQueries(2):
             self.public_user.is_in_group(pk=group_in.id)
         with self.assertNumQueries(0):
             self.public_user.is_in_group(pk=group_in.id)
 
         group_not_in = baker.make(Group)
         self.public_user.__dict__.pop("cached_groups", None)
+        cache.clear()
         # Test when the user is not in the group
-        with self.assertNumQueries(1):
+        with self.assertNumQueries(2):
             self.public_user.is_in_group(pk=group_not_in.id)
         with self.assertNumQueries(0):
             self.public_user.is_in_group(pk=group_not_in.id)

core/tests/test_family.py

@@ -46,7 +46,7 @@ class TestFetchFamilyApi(TestCase):
         response = self.client.get(
             reverse("api:family_graph", args=[self.main_user.id])
         )
-        assert response.status_code == 401
+        assert response.status_code == 403
 
         self.client.force_login(baker.make(User))  # unsubscribed user
         response = self.client.get(
@@ -55,7 +55,7 @@ class TestFetchFamilyApi(TestCase):
         assert response.status_code == 403
 
     def test_fetch_family_hidden_user(self):
-        self.main_user.is_subscriber_viewable = False
+        self.main_user.is_viewable = False
         self.main_user.save()
         for user_to_login, error_code in [
             (self.main_user, 200),

core/tests/test_files.py

@@ -269,7 +269,7 @@ def test_apply_rights_recursively():
             SimpleUploadedFile(
                 "test.jpg", content=RED_PIXEL_PNG, content_type="image/jpg"
             ),
-            401,
+            403,
         ),
         (
             lambda: baker.make(User),

core/tests/test_user.py

@@ -3,6 +3,7 @@ from datetime import timedelta
 import pytest
 from django.conf import settings
 from django.contrib import auth
+from django.contrib.auth.models import Permission
 from django.core.management import call_command
 from django.test import Client, RequestFactory, TestCase
 from django.urls import reverse
@@ -18,7 +19,7 @@ from core.baker_recipes import (
     subscriber_user,
     very_old_subscriber_user,
 )
-from core.models import Group, User
+from core.models import AnonymousUser, Group, User
 from core.views import UserTabsMixin
 from counter.baker_recipes import sale_recipe
 from counter.models import Counter, Customer, Refilling, Selling
@@ -368,3 +369,38 @@ class TestRedirectMe:
 def test_promo_has_logo(promo):
     user = baker.make(User, promo=promo)
     assert user.promo_has_logo()
+
+
+@pytest.mark.django_db
+class TestUserQuerySetViewableBy:
+    @pytest.fixture
+    def users(self) -> list[User]:
+        return [
+            baker.make(User),
+            subscriber_user.make(),
+            subscriber_user.make(is_viewable=False),
+        ]
+
+    def test_admin_user(self, users: list[User]):
+        user = baker.make(
+            User,
+            user_permissions=[Permission.objects.get(codename="view_hidden_user")],
+        )
+        viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user)
+        assert set(viewable) == set(users)
+
+    @pytest.mark.parametrize(
+        "user_factory", [old_subscriber_user.make, subscriber_user.make]
+    )
+    def test_subscriber(self, users: list[User], user_factory):
+        user = user_factory()
+        viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user)
+        assert set(viewable) == {users[0], users[1]}
+
+    @pytest.mark.parametrize(
+        "user_factory", [lambda: baker.make(User), lambda: AnonymousUser()]
+    )
+    def test_not_subscriber(self, users: list[User], user_factory):
+        user = user_factory()
+        viewable = User.objects.filter(id__in=[u.id for u in users]).viewable_by(user)
+        assert not viewable.exists()

core/views/forms.py

@@ -202,7 +202,7 @@ class UserProfileForm(forms.ModelForm):
             "school",
             "promo",
             "forum_signature",
-            "is_subscriber_viewable",
+            "is_viewable",
         ]
         widgets = {
             "date_of_birth": SelectDate,
@@ -211,8 +211,8 @@ class UserProfileForm(forms.ModelForm):
             "quote": forms.Textarea,
         }
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, label_suffix: str = "", **kwargs):
-        super().__init__(*args, **kwargs)
+        super().__init__(*args, label_suffix=label_suffix, **kwargs)
 
         # Image fields are injected here to override the file field provided by the model
         # This would be better if we could have a SithImage sort of model input instead of a generic SithFile

core/views/user.py

@@ -103,9 +103,7 @@ def password_root_change(request, user_id):
     """Allows a root user to change someone's password."""
     if not request.user.is_root:
         raise PermissionDenied
-    user = User.objects.filter(id=user_id).first()
+    user = get_object_or_404(User, id=user_id)
-    if not user:
-        raise Http404("User not found")
     if request.method == "POST":
         form = views.SetPasswordForm(user=user, data=request.POST)
         if form.is_valid():

counter/api.py

@@ -64,7 +64,7 @@ class CounterController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimplifiedCounterSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -77,7 +77,7 @@ class ProductController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimpleProductSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -117,7 +117,7 @@ class ProductTypeController(ControllerBase):
     def fetch_all(self):
         return ProductType.objects.order_by("order")
 
-    @route.patch("/{type_id}/move", url_name="reorder_product_type")
+    @route.patch("/{type_id}/move")
     def reorder(self, type_id: int, other_id: Query[ReorderProductTypeSchema]):
         """Change the order of a product type.
 

counter/tests/test_product_type.py

@@ -3,9 +3,11 @@ from django.conf import settings
 from django.test import Client
 from django.urls import reverse
 from model_bakery import baker, seq
+from ninja_extra.testing import TestClient
 
 from core.baker_recipes import board_user, subscriber_user
 from core.models import Group, User
+from counter.api import ProductTypeController
 from counter.models import ProductType
 
 
@@ -17,43 +19,24 @@ def product_types(db) -> list[ProductType]:
     return baker.make(ProductType, _quantity=5, order=seq(0))
 
 
-@pytest.fixture()
-def counter_admin_client(db, client: Client) -> Client:
-    client.force_login(
-        baker.make(
-            User, groups=[Group.objects.get(id=settings.SITH_GROUP_COUNTER_ADMIN_ID)]
-        )
-    )
-    return client
-
-
 @pytest.mark.django_db
-def test_fetch_product_types(
+def test_fetch_product_types(product_types: list[ProductType]):
-    counter_admin_client: Client, product_types: list[ProductType]
-):
     """Test that the API returns the right products in the right order"""
-    response = counter_admin_client.get(reverse("api:fetch_product_types"))
+    client = TestClient(ProductTypeController)
+    response = client.get("")
     assert response.status_code == 200
     assert [i["id"] for i in response.json()] == [t.id for t in product_types]
 
 
 @pytest.mark.django_db
-def test_move_below_product_type(
+def test_move_below_product_type(product_types: list[ProductType]):
-    counter_admin_client: Client, product_types: list[ProductType]
-):
     """Test that moving a product below another works"""
-    response = counter_admin_client.patch(
+    client = TestClient(ProductTypeController)
-        reverse(
+    response = client.patch(
-            "api:reorder_product_type",
+        f"/{product_types[-1].id}/move", query={"below": product_types[0].id}
-            kwargs={"type_id": product_types[-1].id},
-            query={"below": product_types[0].id},
-        ),
     )
     assert response.status_code == 200
-    new_order = [
+    new_order = [i["id"] for i in client.get("").json()]
-        i["id"]
-        for i in counter_admin_client.get(reverse("api:fetch_product_types")).json()
-    ]
     assert new_order == [
         product_types[0].id,
         product_types[-1].id,
@@ -62,22 +45,14 @@ def test_move_below_product_type(
 
 
 @pytest.mark.django_db
-def test_move_above_product_type(
+def test_move_above_product_type(product_types: list[ProductType]):
-    counter_admin_client: Client, product_types: list[ProductType]
-):
     """Test that moving a product above another works"""
-    response = counter_admin_client.patch(
+    client = TestClient(ProductTypeController)
-        reverse(
+    response = client.patch(
-            "api:reorder_product_type",
+        f"/{product_types[1].id}/move", query={"above": product_types[0].id}
-            kwargs={"type_id": product_types[1].id},
-            query={"above": product_types[0].id},
-        ),
     )
     assert response.status_code == 200
-    new_order = [
+    new_order = [i["id"] for i in client.get("").json()]
-        i["id"]
-        for i in counter_admin_client.get(reverse("api:fetch_product_types")).json()
-    ]
     assert new_order == [
         product_types[1].id,
         product_types[0].id,

docs/explanation/technos.md

@@ -182,19 +182,29 @@ ainsi même que de l'héritage de templates.
     si on souhaite faire des modifications côté client, 
     il faut utiliser du Javascript, rien ne change à ce niveau-là.
 
-### Typescript
+### jQuery
 
-[Site officiel](https://www.typescriptlang.org/)
+[Site officiel](https://jquery.com/)
 
-Pour rendre le site interactif, nous n'utilisons 
+jQuery est une bibliothèque JavaScript 
-pas directement Javascript, mais Typescript.
+libre et multiplateforme créée pour faciliter
-Il s'agit d'un langage construit par-dessus Javascript,
+l'écriture de scripts côté client 
-en ajoutant un typage statique et des éléments de sucre syntaxique.
+dans le code HTML des pages web. 
-Grâce au système de type, le code est plus lisible,
+La première version est lancée en janvier 2006 par John Resig.
-à la fois par les humains et par l'IDE, et plus fiable.
 
-Il faut parfois se battre un peu contre le système de types de Typescript,
+C'est une vieille technologie et certains
-mais globalement Typescript est une alternative largement préférable à Javascript.
+feront remarquer à juste titre que le Javascript 
+moderne permet d'utiliser assez simplement 
+la majorité de ce que fournit jQuery 
+sans rien avoir à installer. 
+Cependant, de nombreuses dépendances du projet
+utilisent encore jQuery qui est toujours 
+très implanté aujourd'hui. 
+Le sucre syntaxique qu'offre cette librairie 
+reste très agréable à utiliser et économise
+parfois beaucoup de temps. 
+Ça fonctionne et ça fonctionne très bien.
+C'est maintenu et pratique.
 
 
 ### AlpineJS
@@ -260,6 +270,17 @@ sur tous les navigateurs contrairement
 à un simple icône unicode qui s'affiche 
 lui différemment selon la plate-forme.
 
+!!!note
+
+    C'est une dépendance capricieuse qui évolue très vite 
+    et qu'il faut très souvent mettre à jour.
+
+!!!warning
+
+    Il a été décidé de **ne pas utiliser**
+    de CDN puisque le site ralentissait régulièrement.
+    Il est préférable de fournir cette dépendance avec le site.
+
 ## Workflow
 
 ### Git

docs/howto/querysets.md

@@ -1,4 +1,4 @@
-L'ORM de Django est puissant, très puissant, non pas parce qu'il
+L'ORM de Django est puissant, très puissant, non par parce qu'il
 est performant (après tout, ce n'est qu'une interface, le gros du boulot,
 c'est la db qui le fait), mais parce qu'il permet d'écrire
 de manière relativement simple un grand panel de requêtes.

docs/howto/statics.md

@@ -51,7 +51,7 @@ Pour accéder au fichier, il faut utiliser `static` comme pour le reste mais en
 	Le bundler ne génère que des modules javascript.
 	Ajouter `type="module"` n'est pas optionnel !
 
-### Les imports au sein des fichiers javascript bundlés
+### Les imports au sein des fichiers des fichiers javascript bundlés
 
 Pour importer au sein d'un fichier js bundlé, il faut préfixer ses imports de `#app:`.
 

docs/howto/subscriptions.md

@@ -36,4 +36,11 @@ SITH_SUBSCRIPTIONS = {
 }
 ```
 
-Après ça, n'oubliez pas de gérer les traductions (cf. [ici](./translation.md))
+Une fois ceci fait, il faut créer une nouvelle migration :
+
+```bash
+python ./manage.py makemigrations subscription
+python ./manage.py migrate
+```
+
+N'oubliez pas non plus les traductions (cf. [ici](./translation.md))

docs/reference/core/auth.md

@@ -17,6 +17,7 @@
             - can_edit_prop
             - can_edit
             - can_view
+            - CanCreateMixin
             - CanEditMixin
             - CanViewMixin
             - CanEditPropMixin

docs/tutorial/api/dev.md

@@ -1,3 +1,4 @@
+
 Pour l'API, nous utilisons `django-ninja` et sa surcouche `django-ninja-extra`.
 Ce sont des librairies relativement simples et qui présentent
 l'immense avantage d'offrir des mécanismes de validation et de sérialisation
@@ -48,9 +49,8 @@ Notre API offre deux moyens d'authentification :
 - par clef d'API
 
 La plus grande partie des routes de l'API utilisent la méthode par cookie de session.
-Cette dernière est donc activée par défaut.
 
-Pour changer la méthode d'authentification,
+Pour placer une route d'API derrière l'une de ces méthodes (ou bien les deux),
 utilisez l'attribut `auth` et les classes `SessionAuth` et 
 [`ApiKeyAuth`][api.auth.ApiKeyAuth].
 
@@ -60,17 +60,13 @@ utilisez l'attribut `auth` et les classes `SessionAuth` et
     @api_controller("/foo")
     class FooController(ControllerBase):
         # Cette route sera accessible uniquement avec l'authentification
-        # par clef d'API
+        # par cookie de session
-        @route.get("", auth=[ApiKeyAuth()])
+        @route.get("", auth=[SessionAuth()])
         def fetch_foo(self, club_id: int): ...
 
-        # Celle-ci sera accessible avec les deux méthodes d'authentification
+        # Et celle-ci sera accessible peut importe la méthode d'authentification
-        @route.get("/bar", auth=[ApiKeyAuth(), SessionAuth()])
+        @route.get("/bar", auth=[SessionAuth(), ApiKeyAuth()])
         def fetch_bar(self, club_id: int): ...
-
-        # Et celle-ci sera accessible aussi aux utilisateurs non-connectés
-        @route.get("/public", auth=None)
-        def fetch_public(self, club_id: int): ...
     ```
 
 ### Permissions
@@ -83,7 +79,9 @@ par-dessus `django-ninja`, le système de permissions de django
 et notre propre système.
 Cette dernière est documentée [ici](../perms.md).
 
-### Incompatibilité avec certaines permissions
+### Limites des clefs d'API
+
+#### Incompatibilité avec certaines permissions
 
 Le système des clefs d'API est apparu très tard dans l'histoire du site
 (en P25, 10 ans après le début du développement).
@@ -114,33 +112,10 @@ Les principaux points de friction sont :
 - `IsLoggedInCounter`, qui utilise encore un autre système 
   d'authentification maison et qui n'est pas fait pour être utilisé en dehors du site.
 
-### CSRF
+#### Incompatibilité avec les tokens csrf
 
-!!!info "A propos du csrf"
+Le [CSRF (*cross-site request forgery*)](https://fr.wikipedia.org/wiki/Cross-site_request_forgery)
-
+est un des multiples facteurs d'attaque sur le web.
-    Le [CSRF (*cross-site request forgery*)](https://fr.wikipedia.org/wiki/Cross-site_request_forgery)
-    est un vecteur d'attaque sur le web consistant
-    à soumettre des données au serveur à l'insu
-    de l'utilisateur, en profitant de sa session.
-
-    C'est une attaque qui peut se produire lorsque l'utilisateur
-    est authentifié par cookie de session.
-    En effet, les cookies sont joints automatiquement à
-    toutes les requêtes ;
-    en l'absence de protection contre le CSRF, 
-    un attaquant parvenant à insérer un formulaire 
-    dans la page de l'utilisateur serait en mesure
-    de faire presque n'importe quoi en son nom,
-    et ce sans même que l'utilisateur ni les administrateurs
-    ne s'en rendent compte avant qu'il ne soit largement trop tard !
-
-    Sur le CSRF et les moyens de s'en prémunir, voir :
-
-    - [https://owasp.org/www-community/attacks/csrf]()
-    - [https://security.stackexchange.com/questions/166724/should-i-use-csrf-protection-on-rest-api-endpoints]()
-    - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html]()
-    
-Le CSRF, c'est dangereux.
 Heureusement, Django vient encore une fois à notre aide,
 avec des mécanismes intégrés pour s'en protéger.
 Ceux-ci incluent notamment un système de 
@@ -148,39 +123,16 @@ Ceux-ci incluent notamment un système de
 à fournir dans les requêtes POST/PUT/PATCH.
 
 Ceux-ci sont bien adaptés au cycle requêtes/réponses
-typiques de l'expérience utilisateur sur un navigateur, 
+typique de l'expérience utilisateur sur un navigateur, 
 où les requêtes POST sont toujours effectuées après une requête
 GET au cours de laquelle on a pu récupérer un token csrf.
-Cependant, ils sont également gênants et moins utiles
+Cependant, le flux des requêtes sur une API est bien différent ;
-dans le cadre d'une API REST, étant donné
+de ce fait, il est à attendre que les requêtes POST envoyées à l'API
-que l'authentification cesse d'être implicite :
+par un client externe n'aient pas de token CSRF et se retrouvent 
-la clef d'API doit être explicitement jointe aux headers,
+donc bloquées.
-pour chaque requête.
 
-Pour ces raisons, la vérification CSRF ne prend place
+Pour ces raisons, l'accès aux requêtes POST/PUT/PATCH de l'API
-que pour la vérification de l'authentification
+par un client externe ne marche pas.
-par cookie de session.
-
-!!!warning "L'ordre est important"
-
-    Si vous écrivez le code suivant, l'authentification par clef d'API
-    ne marchera plus :
-    
-    ```python
-    @api_controller("/foo")
-    class FooController(ControllerBase):
-        @route.post("/bar", auth=[SessionAuth(), ApiKeyAuth()])
-        def post_bar(self, club_id: int): ...
-    ```
-    
-    En effet, la vérification du cookie de session intègrera
-    toujours la vérification CSRF.
-    Or, un échec de cette dernière est traduit par django en un code HTTP 403
-    au lieu d'un HTTP 401.
-    L'authentification se retrouve alors court-circuitée,
-    faisant que la vérification de la clef d'API ne sera jamais appelée.
-    
-    `SessionAuth` doit donc être déclaré **après** `ApiKeyAuth`.
 
 ## Créer un client et une clef d'API
 
@@ -219,3 +171,5 @@ qui en a besoin.
 Dites-lui bien de garder cette clef en lieu sûr !
 Si la clef est perdue, il n'y a pas moyen de la récupérer,
 vous devrez en recréer une.
+
+

docs/tutorial/devtools.md

@@ -157,18 +157,16 @@ que sont VsCode et Sublime Text.
     Si vous avez réussi à terminer l'installation, vous n'avez donc pas de configuration
     supplémentaire à effectuer.
 
-Pour utiliser Biome, placez-vous à la racine du projet et lancez la commande suivante:
+Pour utiliser Biome, placez-vous à la racine du projet et lancer la commande suivante:
 
 ```bash
     npx @biomejs/biome check # Pour checker le code avec le linter et le formater
-    npx @biomejs/biome check --write # Pour appliquer les changements
+    npx @biomejs/biome check --write # Pour appliquer les changemnts
 ```
 
 Biome va alors faire son travail sur l'ensemble du projet puis vous dire
 si des documents ont été reformatés (si vous avez fait `npx @biomejs/biome format --write`)
-ou bien s'il y a des erreurs à réparer 
+ou bien s'il y a des erreurs à réparer (si vous avez faire `npx @biomejs/biome lint`) ou les deux (si vous avez fait `npx @biomejs/biome check --write`).
-(si vous avez fait `npx @biomejs/biome lint`)
-ou les deux (si vous avez fait `npx @biomejs/biome check --write`).
 
 Appeler Biome en ligne de commandes avant de pousser votre code sur Github
 est une technique qui marche très bien.

docs/tutorial/fragments.md

@@ -30,7 +30,7 @@ opérations, telles que la validation de formulaire.
 En effet, valider un formulaire demande beaucoup
 de travail de nettoyage des données et d'affichage
 des messages d'erreur appropriés.
-Or, tout ce travail existe déjà dans Django.
+Or, tout ce travail existe déjà dans django.
 
 On veut donc, dans ces cas-là, ne pas demander
 toute une page HTML au serveur, mais uniquement
@@ -84,7 +84,7 @@ Grâce à ça, on peut écrire des vues qui
 fonctionnent dans les deux contextes.
 
 Par exemple, supposons que nous avons
-une `UpdateView` très simple, contenant
+une `EditView` très simple, contenant
 uniquement un formulaire.
 On peut écrire la vue et le template de la manière
 suivante :
@@ -94,10 +94,8 @@ suivante :
     ```python
     from django.views.generic import UpdateView
 
-    from core.views import AllowFragment
 
-
+    class FooUpdateView(UpdateView):
-    class FooUpdateView(AllowFragment, UpdateView):
         model = Foo
         fields = ["foo", "bar"]
         pk_url_kwarg = "foo_id"
@@ -134,7 +132,7 @@ Dans ces situations, pouvoir décomposer une vue
 en plusieurs vues de fragment permet de ne plus 
 raisonner en termes de condition, mais en termes
 de composition : on n'a pas un seul template
-qui peut changer selon les situations, on a plusieurs
+qui peut changer les situations, on a plusieurs
 templates que l'on injecte dans un template principal.
 
 Supposons, par exemple, que nous n'avons plus un,
@@ -240,10 +238,10 @@ qui se comportera alors comme une vue normale.
 
 #### La méthode `as_fragment`
 
-Il est à noter que l'instanciation d'un fragment
+Il est à noter que l'instantiation d'un fragment
 se fait en deux étapes :
 
-- on commence par instancier la vue en tant que renderer.
+- on commence par instantier la vue en tant que renderer.
 - on appelle le renderer en lui-même
 
 Ce qui donne la syntaxe `Fragment.as_fragment()()`.

docs/tutorial/install.md

@@ -76,7 +76,7 @@ cd /mnt/<la_lettre_du_disque>/vos/fichiers/comme/dhab
         ```bash
         sudo pacman -Syu  # on s'assure que les dépôts et le système sont à jour
 
-        sudo pacman -S uv gcc git gettext pkgconf npm valkey
+        sudo pacman -S uv gcc git gettext pkgconf npm redis
         ```
 
 === "macOS"

docs/tutorial/perms.md

@@ -212,7 +212,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
             obj = self.get_object()
             obj.is_moderated = True
             obj.save()
-            return redirect("com:news_list")
+            return redirect(reverse("com:news_list"))
     ```
 
 === "Function-based view"
@@ -233,7 +233,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
         news = get_object_or_404(News, id=news_id)
         news.is_moderated = True
         news.save()
-        return redirect("com:news_list")
+        return redirect(reverse("com:news_list"))
     ```
 
 ## Accès à des éléments en particulier
@@ -447,9 +447,10 @@ l'utilisateur recevra une liste vide d'objet.
 Voici un exemple d'utilisation en reprenant l'objet Article crée précédemment :
 
 ```python
-from django.views.generic import DetailView
+from django.views.generic import CreateView, DetailView
+
+from core.auth.mixins import CanViewMixin, CanCreateMixin
 
-from core.auth.mixins import CanViewMixin
 from com.models import WeekmailArticle
 
 
@@ -458,15 +459,48 @@ from com.models import WeekmailArticle
 # d'une classe de base pour fonctionner correctement.
 class ArticlesDetailView(CanViewMixin, DetailView):
     model = WeekmailArticle
+
+
+# Même chose pour une vue de création de l'objet Article
+class ArticlesCreateView(CanCreateMixin, CreateView):
+    model = WeekmailArticle
 ```
 
 Les mixins suivants sont implémentés :
 
+- [CanCreateMixin][core.auth.mixins.CanCreateMixin] : l'utilisateur peut-il créer l'objet ?
+  Ce mixin existe, mais est déprécié et ne doit plus être utilisé !
 - [CanEditPropMixin][core.auth.mixins.CanEditPropMixin] : l'utilisateur peut-il éditer les propriétés de l'objet ?
 - [CanEditMixin][core.auth.mixins.CanEditMixin] : L'utilisateur peut-il éditer l'objet ?
 - [CanViewMixin][core.auth.mixins.CanViewMixin] : L'utilisateur peut-il voir l'objet ?
 - [FormerSubscriberMixin][core.auth.mixins.FormerSubscriberMixin] : L'utilisateur a-t-il déjà été cotisant ?
 
+!!!danger "CanCreateMixin"
+
+    L'usage de `CanCreateMixin` est dangereux et ne doit en aucun cas être
+    étendu.
+    La façon dont ce mixin marche est qu'il valide le formulaire
+    de création et crée l'objet sans le persister en base de données, puis
+    vérifie les droits sur cet objet non-persisté.
+    Le danger de ce système vient de multiples raisons :
+
+    - Les vérifications se faisant sur un objet non persisté,
+      l'utilisation de mécanismes nécessitant une persistance préalable
+      peut mener à des comportements indésirés, voire à des erreurs.
+    - Les développeurs de django ayant tendance à restreindre progressivement
+      les actions qui peuvent être faites sur des objets non-persistés,
+      les mises-à-jour de django deviennent plus compliquées.
+    - La vérification des droits ne se fait que dans les requêtes POST,
+      à la toute fin de la requête.
+      Tout ce qui arrive avant n'est absolument pas protégé.
+      Toute opération (même les suppressions et les créations) qui ont
+      lieu avant la persistance de l'objet seront appliquées,
+      même sans permission.
+    - Si un développeur du site fait l'erreur de surcharger
+      la méthode `form_valid` (ce qui est plutôt courant,
+      lorsqu'on veut accomplir certaines actions 
+      quand un formulaire est valide), on peut se retrouver
+      dans une situation où l'objet est persisté sans aucune protection.
 
 !!!danger "Performance"
 

election/templates/election/election_detail.jinja

@@ -141,7 +141,7 @@
                           <label for="{{ input_id }}">
                         {%- endif %}
                         <figure>
-                          {%- if user.is_subscriber_viewable %}
+                          {%- if user.is_viewable %}
                             {% if candidature.user.profile_pict %}
                               <img class="candidate__picture" src="{{ candidature.user.profile_pict.get_download_url() }}" alt="{% trans %}Profile{% endtrans %}">
                             {% else %}

forum/views.py

@@ -27,14 +27,14 @@ from functools import partial
 
 from django import forms
 from django.conf import settings
-from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.core.exceptions import PermissionDenied
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
 from django.db import IntegrityError
 from django.shortcuts import get_object_or_404
 from django.urls import reverse_lazy
 from django.utils import html, timezone
 from django.utils.decorators import method_decorator
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, RedirectView
 from django.views.generic.detail import SingleObjectMixin
@@ -44,6 +44,7 @@ from honeypot.decorators import check_honeypot
 
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.auth.mixins import (
+    CanCreateMixin,
     CanEditMixin,
     CanEditPropMixin,
     CanViewMixin,
@@ -179,19 +180,11 @@ class ForumForm(forms.ModelForm):
     )
 
 
-class ForumCreateView(UserPassesTestMixin, CreateView):
+class ForumCreateView(CanCreateMixin, CreateView):
     model = Forum
     form_class = ForumForm
     template_name = "core/create.jinja"
 
-    def test_func(self):
-        if self.request.user.has_perm("forum.add_forum"):
-            return True
-        parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
-        if parent is not None:
-            return self.request.user.is_owner(parent)
-        return False
-
     def get_initial(self):
         init = super().get_initial()
         parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
@@ -265,19 +258,18 @@ class TopicForm(forms.ModelForm):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumTopicCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumTopicCreateView(CanCreateMixin, CreateView):
     model = ForumMessage
     form_class = TopicForm
     template_name = "forum/reply.jinja"
 
-    @cached_property
+    def dispatch(self, request, *args, **kwargs):
-    def forum(self):
+        self.forum = get_object_or_404(
-        return get_object_or_404(Forum, id=self.kwargs["forum_id"], is_category=False)
+            Forum, id=self.kwargs["forum_id"], is_category=False
-
-    def test_func(self):
-        return self.request.user.has_perm("forum.add_forumtopic") or (
-            self.request.user.can_view(self.forum)
         )
+        if not request.user.can_view(self.forum):
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
 
     def form_valid(self, form):
         topic = ForumTopic(
@@ -412,7 +404,7 @@ class ForumMessageUndeleteView(SingleObjectMixin, RedirectView):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumMessageCreateView(CanCreateMixin, CreateView):
     model = ForumMessage
     form_class = forms.modelform_factory(
         model=ForumMessage,
@@ -421,14 +413,11 @@ class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView
     )
     template_name = "forum/reply.jinja"
 
-    @cached_property
+    def dispatch(self, request, *args, **kwargs):
-    def topic(self):
+        self.topic = get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
-        return get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
+        if not request.user.can_view(self.topic):
-
+            raise PermissionDenied
-    def test_func(self):
+        return super().dispatch(request, *args, **kwargs)
-        return self.request.user.has_perm(
-            "forum.add_forummessage"
-        ) or self.request.user.can_view(self.topic)
 
     def get_initial(self):
         init = super().get_initial()

galaxy/models.py

@@ -199,7 +199,7 @@ class Galaxy(models.Model):
         cls, picture_count_threshold: int = DEFAULT_PICTURE_COUNT_THRESHOLD
     ) -> QuerySet[User]:
         return (
-            User.objects.filter(is_subscriber_viewable=True)
+            User.objects.filter(is_viewable=True)
             .exclude(subscriptions=None)
             .annotate(
                 pictures_count=Count("pictures"),

locale/fr/LC_MESSAGES/django.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-07 14:50+0100\n"
+"POT-Creation-Date: 2025-11-09 18:03+0100\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -1532,8 +1532,15 @@ msgid "parent address"
 msgstr "adresse des parents"
 
 #: core/models.py
-msgid "is subscriber viewable"
+msgid "Profile visible by subscribers"
-msgstr "profil visible par les cotisants"
+msgstr "Profil visible par les cotisants"
+
+#: core/models.py
+msgid ""
+"If you disable this option, only admin users will be able to see your "
+"profile."
+msgstr ""
+"Si vous désactivez cette option, seuls les admins pourront voir votre profil."
 
 #: core/models.py
 msgid "A user with that username already exists"
@@ -5112,14 +5119,6 @@ msgstr "Membre de Sbarro ou de l'ESTA"
 msgid "One semester Welcome Week"
 msgstr "Un semestre Welcome Week"
 
-#: sith/settings.py
-msgid "One month for free"
-msgstr "Un mois gratuit"
-
-#: sith/settings.py
-msgid "Two months for free"
-msgstr "Deux mois gratuits"
-
 #: sith/settings.py
 msgid "Eurok's volunteer"
 msgstr "Bénévole Eurockéennes"
@@ -5133,7 +5132,9 @@ msgid "One day"
 msgstr "Un jour"
 
 #: sith/settings.py
-msgid "GA staff member (2 weeks)"
+#, fuzzy
+#| msgid "GA staff member (2 weeks)"
+msgid "GA staff member"
 msgstr "Membre staff GA (2 semaines)"
 
 #: sith/settings.py
@@ -5677,3 +5678,12 @@ msgstr "Vous ne pouvez plus écrire de commentaires, la date est passée."
 #, python-format
 msgid "Maximum characters: %(max_length)s"
 msgstr "Nombre de caractères max: %(max_length)s"
+
+#~ msgid "is viewable"
+#~ msgstr "profil visible"
+
+#~ msgid "One month for free"
+#~ msgstr "Un mois gratuit"
+
+#~ msgid "Two months for free"
+#~ msgstr "Deux mois gratuits"

matmat/views.py

@@ -105,7 +105,7 @@ class SearchFormListView(FormerSubscriberMixin, SingleObjectMixin, ListView):
         self.can_see_hidden = True
         if not (request.user.is_board_member or request.user.is_root):
             self.can_see_hidden = False
-            self.init_query = self.init_query.exclude(is_subscriber_viewable=False)
+            self.init_query = self.init_query.filter(is_viewable=True)
 
         return super().dispatch(request, *args, **kwargs)
 
@@ -130,7 +130,7 @@ class SearchFormListView(FormerSubscriberMixin, SingleObjectMixin, ListView):
                 else:
                     q = []
                 if not self.can_see_hidden and len(q) > 0:
-                    q = [user for user in q if user.is_subscriber_viewable]
+                    q = [user for user in q if user.is_viewable]
             else:
                 search_dict = {}
                 for key, value in self.valid_form.items():

pedagogy/api.py

@@ -19,7 +19,7 @@ from pedagogy.utbm_api import UtbmApiClient
 class UvController(ControllerBase):
     @route.get(
         "/{code}",
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[
             # this route will almost always be called in the context
             # of a UV creation/edition
@@ -45,7 +45,7 @@ class UvController(ControllerBase):
         "",
         response=PaginatedResponseSchema[SimpleUvSchema],
         url_name="fetch_uvs",
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[HasPerm("pedagogy.view_uv")],
     )
     @paginate(PageNumberPaginationExtra, page_size=100)

sas/api.py

@@ -8,6 +8,7 @@ from ninja.security import SessionAuth
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.exceptions import NotFound, PermissionDenied
 from ninja_extra.pagination import PageNumberPaginationExtra
+from ninja_extra.permissions import IsAuthenticated
 from ninja_extra.schemas import PaginatedResponseSchema
 from pydantic import NonNegativeInt
 
@@ -40,6 +41,7 @@ class AlbumController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[AlbumSchema],
+        permissions=[IsAuthenticated],
         url_name="search-album",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -52,7 +54,7 @@ class AlbumController(ControllerBase):
     @route.get(
         "/autocomplete-search",
         response=PaginatedResponseSchema[AlbumAutocompleteSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -72,7 +74,12 @@ class AlbumController(ControllerBase):
 
 @api_controller("/sas/picture")
 class PicturesController(ControllerBase):
-    @route.get("", response=PaginatedResponseSchema[PictureSchema], url_name="pictures")
+    @route.get(
+        "",
+        response=PaginatedResponseSchema[PictureSchema],
+        permissions=[IsAuthenticated],
+        url_name="pictures",
+    )
     @paginate(PageNumberPaginationExtra, page_size=100)
     def fetch_pictures(self, filters: Query[PictureFilterSchema]):
         """Find pictures viewable by the user corresponding to the given filters.
@@ -134,15 +141,18 @@ class PicturesController(ControllerBase):
 
     @route.get(
         "/{picture_id}/identified",
-        permissions=[CanView],
+        permissions=[IsAuthenticated, CanView],
         response=list[IdentifiedUserSchema],
+        url_name="picture_identifications",
     )
     def fetch_identifications(self, picture_id: int):
         """Fetch the users that have been identified on the given picture."""
         picture = self.get_object_or_exception(Picture, pk=picture_id)
-        return picture.people.select_related("user")
+        return picture.people.viewable_by(self.context.request.user).select_related(
+            "user"
+        )
 
-    @route.put("/{picture_id}/identified", permissions=[CanView])
+    @route.put("/{picture_id}/identified", permissions=[IsAuthenticated, CanView])
     def identify_users(self, picture_id: NonNegativeInt, users: set[NonNegativeInt]):
         picture = self.get_object_or_exception(
             Picture.objects.select_related("parent"), pk=picture_id
@@ -202,7 +212,7 @@ class PicturesController(ControllerBase):
 
 @api_controller("/sas/relation", tags="User identification on SAS pictures")
 class UsersIdentifiedController(ControllerBase):
-    @route.delete("/{relation_id}")
+    @route.delete("/{relation_id}", permissions=[IsAuthenticated])
     def delete_relation(self, relation_id: NonNegativeInt):
         """Untag a user from a SAS picture.
 

sas/models.py

@@ -265,6 +265,15 @@ def sas_notification_callback(notif: Notification):
     notif.param = str(count)
 
 
+class PeoplePictureRelationQuerySet(models.QuerySet):
+    def viewable_by(self, user: User) -> Self:
+        if user.is_root or user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
+            return self
+        if user.was_subscribed:
+            return self.filter(Q(user_id=user.id) | Q(user__is_viewable=True))
+        return self.filter(user_id=user.id)
+
+
 class PeoplePictureRelation(models.Model):
     """The PeoplePictureRelation class makes the connection between User and Picture."""
 
@@ -281,6 +290,8 @@ class PeoplePictureRelation(models.Model):
         on_delete=models.CASCADE,
     )
 
+    objects = PeoplePictureRelationQuerySet.as_manager()
+
     class Meta:
         unique_together = ["user", "picture"]
 

sas/tests/test_api.py

@@ -55,7 +55,7 @@ class TestPictureSearch(TestSas):
 
     def test_anonymous_user_forbidden(self):
         res = self.client.get(self.url)
-        assert res.status_code == 401
+        assert res.status_code == 403
 
     def test_filter_by_album(self):
         self.client.force_login(self.user_b)
@@ -148,7 +148,7 @@ class TestPictureRelation(TestSas):
         relation = PeoplePictureRelation.objects.exclude(user=self.user_a).first()
 
         res = self.client.delete(f"/api/sas/relation/{relation.id}")
-        assert res.status_code == 401
+        assert res.status_code == 403
 
         for user in baker.make(User), self.user_a:
             self.client.force_login(user)
@@ -186,6 +186,29 @@ class TestPictureRelation(TestSas):
         assert res.status_code == 404
         assert PeoplePictureRelation.objects.count() == relation_count
 
+    def test_fetch_relations_including_hidden_users(self):
+        """Test that normal subscribers users cannot see hidden profiles"""
+        picture = self.album_a.children_pictures.last()
+        self.user_a.is_viewable = False
+        self.user_a.save()
+        url = reverse("api:picture_identifications", kwargs={"picture_id": picture.id})
+
+        # a normal subscriber user shouldn't see user_a as identified
+        self.client.force_login(subscriber_user.make())
+        response = self.client.get(url)
+        data = {user["user"]["id"] for user in response.json()}
+        assert data == {self.user_b.id, self.user_c.id}
+
+        # an admin should see everyone
+        self.client.force_login(
+            baker.make(
+                User, groups=[Group.objects.get(id=settings.SITH_GROUP_SAS_ADMIN_ID)]
+            )
+        )
+        response = self.client.get(url)
+        data = {user["user"]["id"] for user in response.json()}
+        assert data == {self.user_a.id, self.user_b.id, self.user_c.id}
+
 
 class TestPictureModeration(TestSas):
     @classmethod

sas/tests/test_model.py

@@ -1,10 +1,11 @@
+import pytest
 from django.test import TestCase
 from model_bakery import baker
 
 from core.baker_recipes import old_subscriber_user, subscriber_user
 from core.models import User
 from sas.baker_recipes import picture_recipe
-from sas.models import Picture
+from sas.models import PeoplePictureRelation, Picture
 
 
 class TestPictureQuerySet(TestCase):
@@ -44,3 +45,25 @@ class TestPictureQuerySet(TestCase):
         user.pictures.create(picture=self.pictures[1])  # moderated
         pictures = list(Picture.objects.viewable_by(user))
         assert pictures == [self.pictures[1]]
+
+
+@pytest.mark.django_db
+def test_identifications_viewable_by_user():
+    picture = baker.make(Picture)
+    identifications = baker.make(
+        PeoplePictureRelation, picture=picture, _quantity=10, _bulk_create=True
+    )
+    identifications[0].user.is_viewable = False
+    identifications[0].user.save()
+
+    assert (
+        list(picture.people.viewable_by(old_subscriber_user.make()))
+        == identifications[1:]
+    )
+    assert (
+        list(picture.people.viewable_by(baker.make(User, is_superuser=True)))
+        == identifications
+    )
+    assert list(picture.people.viewable_by(identifications[1].user)) == [
+        identifications[1]
+    ]

trombi/views.py

@@ -27,7 +27,7 @@ from datetime import date
 from django import forms
 from django.conf import settings
 from django.contrib import messages
-from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import PermissionDenied
 from django.db import IntegrityError
@@ -35,13 +35,17 @@ from django.forms.models import modelform_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse, reverse_lazy
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, RedirectView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView
 
 from club.models import Club
-from core.auth.mixins import CanEditMixin, CanEditPropMixin, CanViewMixin
+from core.auth.mixins import (
+    CanCreateMixin,
+    CanEditMixin,
+    CanEditPropMixin,
+    CanViewMixin,
+)
 from core.models import User
 from core.views.forms import SelectDate
 from core.views.mixins import TabedViewMixin
@@ -113,25 +117,19 @@ class TrombiForm(forms.ModelForm):
         widgets = {"subscription_deadline": SelectDate, "comments_deadline": SelectDate}
 
 
-class TrombiCreateView(UserPassesTestMixin, CreateView):
+class TrombiCreateView(CanCreateMixin, CreateView):
     """Create a trombi for a club."""
 
     model = Trombi
     form_class = TrombiForm
     template_name = "core/create.jinja"
 
-    @cached_property
-    def club(self):
-        return get_object_or_404(Club, id=self.kwargs["club_id"])
-
-    def test_func(self):
-        return self.request.user.can_edit(self.club)
-
     def post(self, request, *args, **kwargs):
         """Affect club."""
         form = self.get_form()
         if form.is_valid():
-            form.instance.club = self.club
+            club = get_object_or_404(Club, id=self.kwargs["club_id"])
+            form.instance.club = club
             ret = self.form_valid(form)
             return ret
         else: