adapt typescript to strict mode

fix: session not properly updated on counter login

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.15.13
+    rev: v0.15.19
     hooks:
       - id: ruff-check  # just check the code, and print the errors
       - id: ruff-check  # actually fix the fixable errors, but print nothing
@@ -12,7 +12,7 @@ repos:
     rev: v0.6.1
     hooks:
       - id: biome-check
-        additional_dependencies: ["@biomejs/biome@2.4.6"]
+        additional_dependencies: ["@biomejs/biome@2.5.1"]
   - repo: https://github.com/rtts/djhtml
     rev: 3.0.11
     hooks:

api/permissions.py

@@ -46,7 +46,7 @@ from django.http import HttpRequest
 from ninja_extra import ControllerBase
 from ninja_extra.permissions import BasePermission
 
-from counter.models import Counter
+from counter.utils import is_logged_in_counter
 
 
 class IsInGroup(BasePermission):
@@ -186,12 +186,7 @@ class IsLoggedInCounter(BasePermission):
     """Check that a user is logged in a counter."""
 
     def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
-        if "/counter/" not in request.META.get("HTTP_REFERER", ""):
+        return is_logged_in_counter(request)
-            return False
-        token = request.session.get("counter_token")
-        if not token:
-            return False
-        return Counter.objects.filter(token=token).exists()
 
 
 CanAccessLookup = IsLoggedInCounter | HasPerm("core.access_lookup")

biome.json

@@ -17,7 +17,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "style": {
         "useNamingConvention": "error"
       },

club/api.py

@@ -11,6 +11,7 @@ from club.models import Club, Membership
 from club.schemas import (
     ClubSchema,
     ClubSearchFilterSchema,
+    MembershipFilterSchema,
     SimpleClubSchema,
     UserMembershipSchema,
 )
@@ -62,3 +63,43 @@ class UserClubController(ControllerBase):
             .filter(user=user)
             .select_related("club", "user", "role")
         )
+
+
+@api_controller("/clubs/members/")
+class ClubMembershipController(ControllerBase):
+    @route.get(
+        "/new",
+        response=list[UserMembershipSchema],
+        auth=[ApiKeyAuth(), SessionAuth()],
+        permissions=[HasPerm("club.view_club")],
+        url_name="get_new_clubs_members_since_date",
+    )
+    def fetch_new_club_members(self, filters: Query[MembershipFilterSchema]):
+        """give all the members of all clubs that have joined since a given date"""
+        memberships = (
+            Membership.objects.ongoing()
+            .filter(start_date__gte=filters.since_date, end_date__isnull=True)
+            .select_related("user", "role", "club")
+        )
+        if filters.clubs_id:
+            memberships = memberships.filter(club_id__in=filters.clubs_id)
+
+        return memberships.order_by("start_date")
+
+    @route.get(
+        "/former",
+        response=list[UserMembershipSchema],
+        auth=[ApiKeyAuth(), SessionAuth()],
+        permissions=[HasPerm("club.view_club")],
+        url_name="get_former_clubs_members_since_date",
+    )
+    def fetch_former_club_members(self, filters: Query[MembershipFilterSchema]):
+        """give all the former members of all clubs that have left since a given date"""
+        memberships = Membership.objects.filter(
+            start_date__lt=filters.since_date,
+            end_date__gte=filters.since_date,
+        ).select_related("user", "role", "club")
+        if filters.clubs_id:
+            memberships = memberships.filter(club_id__in=filters.clubs_id)
+
+        return memberships.order_by("start_date")

club/forms.py

@@ -21,10 +21,13 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
+import itertools
+from operator import attrgetter
 
 from django import forms
 from django.db.models import Exists, OuterRef, Q, QuerySet
 from django.db.models.functions import Lower
+from django.forms.models import ModelChoiceField, ModelChoiceIterator
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 
@@ -46,6 +49,37 @@ from counter.models import Counter, Selling
 from counter.schemas import SaleFilterSchema
 
 
+class ClubRoleChoiceIterator(ModelChoiceIterator):
+    """Custom `ModelChoiceIterator` for `ClubRoleChoiceField`"""
+
+    def __iter__(self):
+        if self.field.empty_label is not None:
+            yield "", self.field.empty_label
+        queryset = self.queryset.select_related("club").order_by("club", "order")
+        groups = [
+            (club, [self.choice(role) for role in roles])
+            for club, roles in itertools.groupby(queryset, key=attrgetter("club"))
+        ]
+        if len(groups) == 1:
+            # there is only one club involved, no need to have optgroups
+            yield from groups[0][1]
+        else:
+            # there are multiple clubs, optgroups are necessary to differentiate
+            # roles having the same name
+            yield from groups
+
+
+class ClubRoleChoiceField(ModelChoiceField):
+    """Custom `ModelChoiceField` for `[ClubRole][club.models.ClubRole]`.
+
+    If only one club is involved, behave like the base `ModelChoiceField`.
+    If dealing with the roles of multiple clubs, group the roles
+    into a different `optgroup` for each club.
+    """
+
+    iterator = ClubRoleChoiceIterator
+
+
 class ClubLinkForm(forms.ModelForm):
     error_css_class = "error"
     required_css_class = "required"
@@ -392,6 +426,30 @@ class ClubRoleForm(forms.ModelForm):
             self.instance.order = cleaned_data["ORDER"] - 1
         return cleaned_data
 
+    def save(self, commit=True):  # noqa: FBT002
+        instance: ClubRole = super().save(commit=commit)
+        if commit and "is_board" in self.changed_data:
+            # if the role was moved from board to simple member,
+            # remove all users with that role from the club board group.
+            # If the role became a board role, add users with
+            # that role to the club board group.
+            group_id = instance.club.board_group_id
+            if self.cleaned_data["is_board"]:
+                User.groups.through.objects.bulk_create(
+                    [
+                        User.groups.through(user_id=u, group_id=group_id)
+                        for u in Membership.objects.ongoing()
+                        .filter(role=instance)
+                        .values_list("user_id", flat=True)
+                    ],
+                    ignore_conflicts=True,
+                )
+            else:
+                User.groups.through.objects.filter(
+                    user__memberships__role=instance, group_id=group_id
+                ).delete()
+        return instance
+
 
 class ClubRoleCreateForm(forms.ModelForm):
     """Form to create a club role.

club/migrations/0017_linktype_clublink.py

@@ -25,8 +25,7 @@ class Migration(migrations.Migration):
                     "url_base",
                     models.URLField(
                         help_text=(
-                            "The base url that links with this type "
+                            "The base url that links with this type must respect"
-                            "must respect (e.g. `https://www.instagram.com`)"
                         ),
                         unique=True,
                         verbose_name="url base",

club/models.py

@@ -793,10 +793,7 @@ class LinkType(models.Model):
     url_base = models.URLField(
         "url base",
         unique=True,
-        help_text=_(
+        help_text=_("The base url that links with this type must respect"),
-            "The base url that links with this type must respect (e.g. `%(url)s`)"
-        )
-        % {"url": "https://www.instagram.com"},
     )
     icon = models.CharField(
         _("icon"),

club/schemas.py

@@ -1,3 +1,4 @@
+from datetime import date
 from typing import Annotated
 
 from django.db.models import Q
@@ -79,3 +80,9 @@ class UserMembershipSchema(ModelSchema):
 
     club: SimpleClubSchema
     role: ClubRoleSchema
+    user: SimpleUserSchema
+
+
+class MembershipFilterSchema(FilterSchema):
+    since_date: Annotated[date, FilterLookup("date__lte")]
+    clubs_id: set[int] | None = None

club/static/bundled/club/components/ajax-select-index.ts

@@ -1,7 +1,6 @@
-import type { TomOption } from "tom-select/dist/types/types";
+import type { escape_html } from "tom-select/src/utils";
-import type { escape_html } from "tom-select/dist/types/utils";
+import { AjaxSelect } from "#core:core/components/ajax-select-base";
-import { AjaxSelect } from "#core:core/components/ajax-select-base.ts";
+import { registerComponent } from "#core:utils/web-components";
-import { registerComponent } from "#core:utils/web-components.ts";
 import { type ClubSchema, clubSearchClub } from "#openapi";
 
 @registerComponent("club-ajax-select")
@@ -10,7 +9,7 @@ export class ClubAjaxSelect extends AjaxSelect {
   protected labelField = "name";
   protected searchField = ["code", "name"];
 
-  protected async search(query: string): Promise<TomOption[]> {
+  protected async search(query: string) {
     const resp = await clubSearchClub({ query: { search: query } });
     if (resp.data) {
       return resp.data.results;

club/static/club/list.scss

@@ -45,3 +45,10 @@
     }
   }
 }
+
+@media screen and (max-width: 575px){
+  #club-list{
+    padding-left: 0;
+    padding-right: 0;
+  }
+}

club/tests/test_club_membership_controller.py

@@ -0,0 +1,203 @@
+from datetime import timedelta
+
+from django.contrib.auth.models import Permission
+from django.test import TestCase
+from django.urls import reverse
+from django.utils.timezone import localdate
+from model_bakery import baker
+
+from club.models import Club, ClubRole, Membership
+from core.baker_recipes import subscriber_user
+from core.models import User
+
+
+class TestMembershipAPI(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.user = baker.make(User)
+        perm = Permission.objects.get(codename="view_club")
+        cls.user.user_permissions.add(perm)
+        cls.clubs = baker.make(Club, _quantity=3, is_active=True)
+        cls.roles = baker.make(ClubRole, _quantity=3, is_active=True)
+        cls.expectedNumQueries = 5
+
+        # Clean existing data to avoid side effects
+        Membership.objects.all().delete()
+
+        cls.memberships = [
+            # on going
+            Membership.objects.create(
+                club=cls.clubs[0],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(weeks=1),
+            ),
+            # on going
+            Membership.objects.create(
+                club=cls.clubs[1],
+                user=subscriber_user.make(),
+                role=cls.roles[1],
+                start_date=localdate() - timedelta(days=1),
+            ),
+            # former
+            Membership.objects.create(
+                club=cls.clubs[1],
+                user=subscriber_user.make(),
+                role=cls.roles[2],
+                start_date=localdate() - timedelta(weeks=2),
+                end_date=localdate() - timedelta(days=6),
+            ),
+            # on going
+            Membership.objects.create(
+                club=cls.clubs[2],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(weeks=3),
+            ),
+            # former
+            Membership.objects.create(
+                club=cls.clubs[1],
+                user=subscriber_user.make(),
+                role=cls.roles[2],
+                start_date=localdate() - timedelta(days=4),
+                end_date=localdate() - timedelta(days=3),
+            ),
+            # on going
+            Membership.objects.create(
+                club=cls.clubs[2],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(days=1),
+            ),
+            # former
+            Membership.objects.create(
+                club=cls.clubs[0],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(weeks=6),
+                end_date=localdate() - timedelta(days=3),
+            ),
+            # former
+            Membership.objects.create(
+                club=cls.clubs[2],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(weeks=8),
+                end_date=localdate() - timedelta(days=6),
+            ),
+            # former
+            Membership.objects.create(
+                club=cls.clubs[1],
+                user=subscriber_user.make(),
+                role=cls.roles[0],
+                start_date=localdate() - timedelta(weeks=8),
+                end_date=localdate() - timedelta(weeks=7, days=5),
+            ),
+        ]
+
+
+class TestNewMembershipAPI(TestMembershipAPI):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.url = reverse("api:get_new_clubs_members_since_date")
+
+    def test_new_membership_one_club(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {"since_date": since_date, "clubs_id": self.clubs[0].id}
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [self.memberships[0].id]
+        assert membership_ids == expected_ids
+
+    def test_new_membership_multiple_club(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {
+            "since_date": since_date,
+            "clubs_id": [self.clubs[0].id, self.clubs[1].id],
+        }
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [self.memberships[0].id, self.memberships[1].id]
+        assert membership_ids == expected_ids
+
+    def test_new_membership_all_clubs(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {"since_date": since_date}
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [
+            self.memberships[0].id,
+            self.memberships[1].id,
+            self.memberships[5].id,
+        ]
+        assert membership_ids == expected_ids
+
+
+class TestFormerMembershipAPI(TestMembershipAPI):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.url = reverse("api:get_former_clubs_members_since_date")
+
+    def test_former_membership_one_club(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {"since_date": since_date, "clubs_id": self.clubs[1].id}
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [self.memberships[2].id]
+        assert membership_ids == expected_ids
+
+    def test_new_membership_multiple_club(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {
+            "since_date": since_date,
+            "clubs_id": [self.clubs[1].id, self.clubs[0].id],
+        }
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [self.memberships[6].id, self.memberships[2].id]
+        assert membership_ids == expected_ids
+
+    def test_new_membership_all_clubs(self):
+        self.client.force_login(self.user)
+        since_date = localdate() - timedelta(weeks=1)
+        arg = {"since_date": since_date}
+        with self.assertNumQueries(self.expectedNumQueries):
+            response = self.client.get(self.url, query_params=arg)
+        assert response.status_code == 200
+        data = response.json()
+
+        membership_ids = [e["id"] for e in data]
+        expected_ids = [
+            self.memberships[7].id,
+            self.memberships[6].id,
+            self.memberships[2].id,
+        ]
+        assert membership_ids == expected_ids

club/tests/test_clubrole.py

@@ -4,6 +4,7 @@ import pytest
 from django.contrib.auth.models import Permission
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.timezone import now
 from model_bakery import baker, seq
 from model_bakery.recipe import Recipe
 from pytest_django.asserts import assertRedirects
@@ -239,7 +240,7 @@ class TestClubRoleUpdate(TestCase):
 
     def test_president_moves_itself_out_of_the_presidency(self):
         """Test that if the user moves its own role out of the presidency,
-        then it's redirected to another page and loses access to the update page."""
+        then it loses access to the update page."""
         self.payload["roles-0-is_presidency"] = False
         self.client.force_login(self.user)
         res = self.client.post(self.url, data=self.payload)
@@ -251,3 +252,29 @@ class TestClubRoleUpdate(TestCase):
 
         res = self.client.get(self.url)
         assert res.status_code == 403
+
+    def test_role_stops_being_board(self):
+        """Test that if a role stops being a board role,
+        its users lose the club board group."""
+        self.payload["roles-0-is_board"] = False
+        self.payload["roles-0-is_presidency"] = False
+        self.payload["roles-1-is_board"] = False
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        assert not self.user.groups.contains(self.club.board_group)
+
+    def test_role_becomes_board(self):
+        """Test that if a role becomes a board role,
+        its active users get the club board group"""
+        members = [
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=None),
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=now()),
+        ]
+        self.payload["roles-2-is_board"] = True
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        # the second membership is finished, so its user shouldn't get the role
+        assert members[0].user.groups.contains(self.club.board_group)
+        assert not members[1].user.groups.contains(self.club.board_group)

club/tests/test_page.py

@@ -1,4 +1,5 @@
 import pytest
+from aemark import markdown
 from bs4 import BeautifulSoup
 from django.test import Client
 from django.urls import reverse
@@ -7,7 +8,6 @@ from pytest_django.asserts import assertHTMLEqual, assertRedirects
 
 from club.models import Club, ClubRole, Membership
 from core.baker_recipes import subscriber_user
-from core.markdown import markdown
 from core.models import PageRev, User
 
 

com/schemas.py

@@ -1,13 +1,13 @@
 from datetime import datetime
 from typing import Annotated
 
+from aemark import markdown
 from ninja import FilterLookup, FilterSchema, ModelSchema
 from ninja_extra import service_resolver
 from ninja_extra.context import RouteContext
 
 from club.schemas import ClubProfileSchema
 from com.models import News, NewsDate
-from core.markdown import markdown
 
 
 class NewsDateFilterSchema(FilterSchema):

com/static/bundled/com/components/ics-calendar-index.ts

@@ -1,4 +1,9 @@
-import { Calendar, type EventClickArg, type EventContentArg } from "@fullcalendar/core";
+import {
+  Calendar,
+  type EventClickArg,
+  type EventContentArg,
+  type EventInput,
+} from "@fullcalendar/core";
 import type { EventImpl } from "@fullcalendar/core/internal";
 import enLocale from "@fullcalendar/core/locales/en-gb";
 import frLocale from "@fullcalendar/core/locales/fr";
@@ -6,8 +11,8 @@ import dayGridPlugin from "@fullcalendar/daygrid";
 import iCalendarPlugin from "@fullcalendar/icalendar";
 import listPlugin from "@fullcalendar/list";
 import { type HTMLTemplateResult, html, render } from "lit-html";
-import { makeUrl } from "#core:utils/api.ts";
+import { type GenericEndpoint, makeUrl } from "#core:utils/api";
-import { inheritHtmlElement, registerComponent } from "#core:utils/web-components.ts";
+import { inheritHtmlElement, registerComponent } from "#core:utils/web-components";
 import {
   calendarCalendarInternal,
   calendarCalendarUnpublished,
@@ -19,11 +24,11 @@ import {
 @registerComponent("ics-calendar")
 export class IcsCalendar extends inheritHtmlElement("div") {
   static observedAttributes = ["locale", "can_moderate", "can_delete", "ics-help-url"];
-  private calendar: Calendar;
+  private calendar!: Calendar;
-  private locale = "en";
+  private locale? = "en";
-  private canModerate = false;
+  private canModerate? = false;
-  private canDelete = false;
+  private canDelete? = false;
-  private helpUrl = "";
+  private helpUrl? = "";
 
   // Hack variable to detect recurring events
   // The underlying ics library doesn't include any info about rrules
@@ -35,10 +40,12 @@ export class IcsCalendar extends inheritHtmlElement("div") {
       this.locale = newValue;
     }
     if (name === "can_moderate") {
-      this.canModerate = newValue.toLowerCase() === "true";
+      this.canModerate =
+        typeof newValue === "string" && newValue.toLowerCase() === "true";
     }
     if (name === "can_delete") {
-      this.canDelete = newValue.toLowerCase() === "true";
+      this.canDelete =
+        typeof newValue === "string" && newValue.toLowerCase() === "true";
     }
 
     if (name === "ics-help-url") {
@@ -94,7 +101,7 @@ export class IcsCalendar extends inheritHtmlElement("div") {
         .toString()
         .split("/")
         .filter((s) => s) // Remove blank characters
-        .pop(),
+        .pop() as string,
       10,
     );
   }
@@ -159,7 +166,7 @@ export class IcsCalendar extends inheritHtmlElement("div") {
     this.refreshEvents();
   }
 
-  async getEventSources() {
+  async getEventSources(): Promise<EventInput[]> {
     const tagRecurringEvents = (eventData: EventImpl) => {
       // This functions tags events with a similar event url
       // We rely on the fact that the event url is always the same
@@ -173,14 +180,14 @@ export class IcsCalendar extends inheritHtmlElement("div") {
     };
     return [
       {
-        url: `${await makeUrl(calendarCalendarInternal)}`,
+        url: `${await makeUrl(calendarCalendarInternal as GenericEndpoint)}`,
         format: "ics",
         className: "internal",
         cache: false,
         eventDataTransform: tagRecurringEvents,
       },
       {
-        url: `${await makeUrl(calendarCalendarUnpublished)}`,
+        url: `${await makeUrl(calendarCalendarUnpublished as GenericEndpoint)}`,
         format: "ics",
         color: "red",
         className: "unpublished",
@@ -213,7 +220,7 @@ export class IcsCalendar extends inheritHtmlElement("div") {
             ${event.title}
           </h4>
           <span class="event-details-row-content">
-            ${this.formatDate(event.start)} - ${this.formatDate(event.end)}
+            ${this.formatDate(event.start as Date)} - ${this.formatDate(event.end as Date)}
           </span>
         </div>
       `;
@@ -251,7 +258,7 @@ export class IcsCalendar extends inheritHtmlElement("div") {
       const buttons = [] as HTMLTemplateResult[];
 
       if (this.canModerate) {
-        if (event.source.internalEventSource.ui.classNames.includes("unpublished")) {
+        if (event.source?.internalEventSource.ui.classNames.includes("unpublished")) {
           const button = html`
             <button class="btn btn-green" @click="${() => this.publishNews(newsId)}">
               <i class="fa fa-check"></i>${gettext("Publish")}
@@ -338,9 +345,9 @@ export class IcsCalendar extends inheritHtmlElement("div") {
               button.classList.remove("text-copied");
             }
             button.setAttribute("tooltip", gettext("Link copied"));
-            navigator.clipboard.writeText(
+            await navigator.clipboard.writeText(
               new URL(
-                await makeUrl(calendarCalendarInternal),
+                await makeUrl(calendarCalendarInternal as GenericEndpoint),
                 window.location.origin,
               ).toString(),
             );

com/static/bundled/com/moderation-alert-index.ts

@@ -1,4 +1,9 @@
-import { newsDeleteNews, newsFetchNewsDates, newsPublishNews } from "#openapi";
+import {
+  newsDeleteNews,
+  newsFetchNewsDates,
+  newsPublishNews,
+  type PaginatedResponseSchemaNewsDateSchema,
+} from "#openapi";
 
 // This will be used in jinja templates,
 // so we cannot use real enums as those are purely an abstraction of Typescript
@@ -64,7 +69,8 @@ document.addEventListener("alpine:init", () => {
         // biome-ignore lint/style/useNamingConvention: api is snake-case
         query: { news_id: this.newsId, page: 1, page_size: 1 },
       });
-      return response.data.count;
+
+      return (response.data as PaginatedResponseSchemaNewsDateSchema).count;
     },
 
     weeklyEventWarningMessage(nbEvents: number): string {

com/static/bundled/com/upcoming-news-loader-index.ts

@@ -1,11 +1,11 @@
 import { type NewsDateSchema, newsFetchNewsDates } from "#openapi";
 
-interface ParsedNewsDateSchema extends Omit<NewsDateSchema, "start_date" | "end_date"> {
+type ParsedNewsDateSchema = Omit<NewsDateSchema, "start_date" | "end_date"> & {
   // biome-ignore lint/style/useNamingConvention: api is snake_case
   start_date: Date;
   // biome-ignore lint/style/useNamingConvention: api is snake_case
   end_date: Date;
-}
+};
 
 document.addEventListener("alpine:init", () => {
   Alpine.data("upcomingNewsLoader", (startDate: Date, locale: string) => ({
@@ -32,6 +32,11 @@ document.addEventListener("alpine:init", () => {
           page_size: this.pageSize,
         },
       });
+      if (response.response === undefined || response.data === undefined) {
+        // response may be undefined, because error may be
+        // from building the request object itself or from a network error
+        return;
+      }
       if (response.response.status === 404) {
         this.hasNext = false;
       } else if (response.data.next === null) {
@@ -44,7 +49,7 @@ document.addEventListener("alpine:init", () => {
       this.loading = false;
     },
 
-    groupedDates(): Record<string, NewsDateSchema[]> {
+    groupedDates(): Record<string, ParsedNewsDateSchema[]> {
       return this.newsDates
         .map(
           (date: NewsDateSchema): ParsedNewsDateSchema => ({

com/tests/test_api.py

@@ -2,6 +2,7 @@ from datetime import timedelta
 from pathlib import Path
 
 import pytest
+from aemark import markdown
 from django.conf import settings
 from django.contrib.auth.models import Permission
 from django.http import HttpResponse
@@ -13,7 +14,6 @@ from pytest_django.asserts import assertNumQueries
 
 from com.ics_calendar import IcsCalendar
 from com.models import News, NewsDate
-from core.markdown import markdown
 from core.models import User
 
 

com/views.py

@@ -170,7 +170,7 @@ class NewsUpdateView(PermissionOrAuthorRequiredMixin, UpdateView):
     form_class = NewsForm
     template_name = "com/news_edit.jinja"
     pk_url_kwarg = "news_id"
-    permission_required = "com.edit_news"
+    permission_required = "com.change_news"
 
     def form_valid(self, form):
         response = super().form_valid(form)  # Does the saving part

core/admin.py

@@ -99,9 +99,9 @@ class PageAdmin(admin.ModelAdmin):
 
 @admin.register(SithFile)
 class SithFileAdmin(admin.ModelAdmin):
-    list_display = ("name", "owner", "size", "date")
+    list_display = ("name", "owner", "size", "date", "is_in_sas")
     autocomplete_fields = ("parent", "owner", "moderator")
-    search_fields = ("name",)
+    search_fields = ("name", "parent__name")
 
 
 @admin.register(OperationLog)

core/api.py

@@ -1,4 +1,4 @@
-from typing import Annotated, Any, Literal
+from typing import Annotated, Literal
 
 from annotated_types import Ge, Le, MinLen
 from django.conf import settings
@@ -26,6 +26,7 @@ from core.schemas import (
     UserFilterSchema,
     UserProfileSchema,
     UserSchema,
+    ValidationErrorSchema,
 )
 from core.templatetags.renderer import markdown
 from counter.utils import is_logged_in_counter
@@ -45,7 +46,7 @@ class UploadController(ControllerBase):
         "/image",
         response={
             200: UploadedFileSchema,
-            422: dict[Literal["detail"], list[dict[str, Any]]],
+            422: ValidationErrorSchema,
             403: dict[Literal["detail"], str],
         },
         permissions=[HasPerm("core.add_quickuploadimage")],
@@ -110,7 +111,7 @@ class SithFileController(ControllerBase):
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
     def search_files(self, search: Annotated[str, MinLen(1)]):
-        return SithFile.objects.filter(name__icontains=search)
+        return SithFile.objects.filter(is_in_sas=False).filter(name__icontains=search)
 
 
 @api_controller("/group")

core/fixtures/SYNTAX.html

@@ -2,12 +2,9 @@
 <h1>Markdown-AE Documentation</h1>
 <p>Le Markdown le plus standard se trouve documenté ici:
 <a href="https://www.markdownguide.org/basic-syntax">https://www.markdownguide.org/basic-syntax</a>.<br />
-Si cette page n'est pas exhaustive vis à vis de la syntaxe du site AE,
+Si cette page n’est pas exhaustive vis à vis de la syntaxe du site AE,
 elle a au moins le mérite de bien documenter le Markdown original.</p>
-<p>Le réel parseur du site AE est une version tunée de <a href="https://github.com/lepture/mistune">mistune</a>.<br />
+<p>Le réel parseur du site AE est une version tunée de <a href="https://github.com/kivikakk/comrak">comrak</a>.</p>
-Les plus aventureux pourront aller lire ses <a href="https://github.com/lepture/mistune/blob/master/tests/fixtures">tests</a>
-afin d'en connaître la syntaxe le plus finement possible.<br />
-En pratique, cette page devrait déjà résumer une bonne partie.</p>
 <h2>Basique</h2>
 <ul>
 <li>Mettre le texte en <strong>gras</strong> : <code>**texte**</code></li>
@@ -15,8 +12,8 @@ En pratique, cette page devrait déjà résumer une bonne partie.</p>
 <li><u>Souligner</u> le texte : <code>__texte__</code></li>
 <li><del>Barrer du texte</del> : <code>~~texte~~</code></li>
 <li>On peut bien sûr tout <del><em><strong><u>combiner</u></strong></em></del> : <code>~~***__texte__***~~</code></li>
-<li>Mettre du texte^en exposant^ : <code>&lt;sup&gt;texte&lt;/sup&gt;</code></li>
+<li>Mettre du texte<sup>en exposant</sup> : <code>&lt;sup&gt;texte&lt;/sup&gt;</code></li>
-<li>Mettre du texte~en indice~ : <code>&lt;sub&gt;texte&lt;/sub&gt;</code></li>
+<li>Mettre du texte<sub>en indice</sub> : <code>&lt;sub&gt;texte&lt;/sub&gt;</code></li>
 </ul>
 <h2>Liens</h2>
 <ul>
@@ -28,10 +25,10 @@ En pratique, cette page devrait déjà résumer une bonne partie.</p>
 </ul>
 <p><a href="http://www.site.com">nom du lien</a></p>
 <ul>
-<li>Les liens peuvent être internes au site de l'AE, on peut dès lors éviter d'entrer
+<li>Les liens peuvent être internes au site de l’AE, on peut dès lors éviter d’entrer
-l'adresse complète d'une page : <code>[nom du lien](page://nomDeLaPage)</code></li>
+l’adresse complète d’une page : <code>[nom du lien](page://nomDeLaPage)</code></li>
 </ul>
-<p><a href="/page/nomDeLaPage/">nom du lien</a></p>
+<p><a href="/page/nomDeLaPage">nom du lien</a></p>
 <ul>
 <li>On peut également utiliser une image pour les liens :
 <code>[nom du lien]![images/imageDuSiteAE.png](/chemin/vers/image.png titre optionnel)(options)</code></li>
@@ -94,25 +91,25 @@ etc...
 <table>
 <thead>
 <tr>
-  <th>Titre</th>
+<th>Titre</th>
-  <th>Titre2</th>
+<th>Titre2</th>
-  <th>Titre3</th>
+<th>Titre3</th>
 </tr>
 </thead>
 <tbody>
 <tr>
-  <td>test</td>
+<td>test</td>
-  <td>test</td>
+<td>test</td>
-  <td>test</td>
+<td>test</td>
 </tr>
 <tr>
-  <td>test</td>
+<td>test</td>
-  <td>test</td>
+<td>test</td>
-  <td>test</td>
+<td>test</td>
 </tr>
 </tbody>
 </table>
-<p>L'alignement dans les cellules est géré comme suit, avec les ':' sur la ligne en dessous du titre:</p>
+<p>L’alignement dans les cellules est géré comme suit, avec les ‘:’ sur la ligne en dessous du titre:</p>
 <pre><code>|  Titre | Titre2 | Titre3 |
 |:-------|:------:|-------:|
 | gauche | centre | droite |
@@ -120,16 +117,16 @@ etc...
 <table>
 <thead>
 <tr>
-  <th style="text-align:left">Titre</th>
+<th align="left">Titre</th>
-  <th style="text-align:center">Titre2</th>
+<th align="center">Titre2</th>
-  <th style="text-align:right">Titre3</th>
+<th align="right">Titre3</th>
 </tr>
 </thead>
 <tbody>
 <tr>
-  <td style="text-align:left">gauche</td>
+<td align="left">gauche</td>
-  <td style="text-align:center">centre</td>
+<td align="center">centre</td>
-  <td style="text-align:right">droite</td>
+<td align="right">droite</td>
 </tr>
 </tbody>
 </table>
@@ -141,11 +138,11 @@ etc...
 ![image de 350 pixels de large](/static/core/img/logo.png?350 &quot;Image de 350 pixels&quot;)
 ![image de 350x100 pixels](/static/core/img/logo.png?350x100 &quot;Image de 350x100 pixels&quot;)
 </code></pre>
-<p><img src="/static/core/img/logo.png" alt="image à 50%" title="Image à 50%" style="width:50%;" /><br />
+<p><img src="/static/core/img/logo.png" style="width:50%" alt="image à 50%" title="Image à 50%" /><br />
 Image à 50% de la largeur de la page.</p>
-<p><img src="/static/core/img/logo.png" alt="image de 350 pixels de large" title="Image de 350 pixels" style="width:350px;" /><br />
+<p><img src="/static/core/img/logo.png" style="width:350px" alt="image de 350 pixels de large" title="Image de 350 pixels" /><br />
 Image de 350 pixels de large.</p>
-<p><img src="/static/core/img/logo.png" alt="image de 350x100 pixels" title="Image de 350x100 pixels" style="width:350px;height:100px;" /><br />
+<p><img src="/static/core/img/logo.png" style="width:350px;height:100px" alt="image de 350x100 pixels" title="Image de 350x100 pixels" /><br />
 Image de 350x100 pixels.</p>
 <p>(devrait pouvoir détecter si vidéo ou non)</p>
 <h2>Blocs de citations</h2>
@@ -159,9 +156,9 @@ Image de 350x100 pixels.</p>
 un bloc de
 citation</p>
 </blockquote>
-<p>Il est possible d'intégrer de la syntaxe Markdown-AE dans un tel bloc.</p>
+<p>Il est possible d’intégrer de la syntaxe Markdown-AE dans un tel bloc.</p>
 <h2>Note de bas de page</h2>
-<p>On les crée comme ça<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>:</p>
+<p>On les crée comme ça<sup class="footnote-ref"><a href="#fn-key" id="fnref-key" data-footnote-ref>1</a></sup>:</p>
 <pre><code>Je fais une note[^clef].
 
 [^clef]: je note ensuite où je veux le contenu de ma clef qui apparaîtra quand même en bas
@@ -175,13 +172,15 @@ citation</p>
 </code></pre>
 <h2>Échapper des caractères</h2>
 <ul>
-<li>Il est possible d'ignorer un caractère spécial en l'échappant à l'aide d'un \</li>
+<li>Il est possible d’ignorer un caractère spécial en l’échappant à l’aide d’un \</li>
-<li>L'échappement de blocs de codes complet se fera à l'aide de balises &lt;nosyntax&gt;&lt;/nosyntax&gt;</li>
+<li>L’échappement de blocs de codes complet se fera à l’aide de balises &lt;nosyntax&gt;&lt;/nosyntax&gt;</li>
 </ul>
-<h2>Autres (hérité de l'ancien wiki)</h2>
+<h2>Autres (hérité de l’ancien wiki)</h2>
 <p>Une ligne peut être créée avec une ligne contenant 4 tirets (<code>----</code>).</p>
-<section class="footnotes">
+<section class="footnotes" data-footnotes>
 <ol>
-<li id="fn-1"><p>ceci est le contenu de ma clef<a href="#fnref-1" class="footnote">&#8617;</a></p></li>
+<li id="fn-key">
+<p>ceci est le contenu de ma clef <a href="#fnref-key" class="footnote-backref" data-footnote-backref data-footnote-backref-idx="1" aria-label="Back to reference 1">↩</a></p>
+</li>
 </ol>
 </section>

core/fixtures/SYNTAX.md

@@ -7,10 +7,7 @@ https://www.markdownguide.org/basic-syntax.
 Si cette page n'est pas exhaustive vis à vis de la syntaxe du site AE,
 elle a au moins le mérite de bien documenter le Markdown original.
 
-Le réel parseur du site AE est une version tunée de [mistune](https://github.com/lepture/mistune).  
+Le réel parseur du site AE est une version tunée de [comrak](https://github.com/kivikakk/comrak).  
-Les plus aventureux pourront aller lire ses [tests](https://github.com/lepture/mistune/blob/master/tests/fixtures)
-afin d'en connaître la syntaxe le plus finement possible.  
-En pratique, cette page devrait déjà résumer une bonne partie.
 
 ## Basique
 

core/management/commands/markdown.py

@@ -22,11 +22,10 @@
 #
 
 
+from aemark import markdown
 from django.conf import settings
 from django.core.management.base import BaseCommand
 
-from core.markdown import markdown
-
 
 class Command(BaseCommand):
     help = "Output the fully rendered SYNTAX.md file"

core/management/commands/populate.py

@@ -20,7 +20,7 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
-from datetime import date, timedelta
+from datetime import date, datetime, timedelta
 from io import StringIO
 from pathlib import Path
 from typing import ClassVar, NamedTuple
@@ -33,7 +33,8 @@ from django.core.management.base import BaseCommand
 from django.db import connection
 from django.db.models import Q
 from django.utils import timezone
-from django.utils.timezone import localdate
+from django.utils.lorem_ipsum import paragraphs
+from django.utils.timezone import localdate, now
 from PIL import Image
 
 from club.models import Club, ClubLink, ClubRole, LinkType, Membership
@@ -43,13 +44,14 @@ from core.models import BanGroup, Group, Page, PageRev, SithFile, User
 from core.utils import resize_image
 from counter.models import (
     Counter,
+    CounterSellers,
     Price,
     Product,
     ProductType,
     ReturnableProduct,
     StudentCard,
 )
-from election.models import Candidature, Election, ElectionList, Role
+from election.models import Candidature, Election, ElectionList, Role, Vote
 from forum.models import Forum
 from pedagogy.models import UE
 from sas.models import Album, PeoplePictureRelation, Picture
@@ -124,9 +126,8 @@ class Command(BaseCommand):
         p.save(force_lock=True)
 
         club_root = SithFile.objects.create(name="clubs", owner=root)
-        sas = SithFile.objects.create(name="SAS", owner=root)
+        sas = SithFile.objects.create(
-        main_club = Club.objects.create(
+            name="SAS", owner=root, id=settings.SITH_SAS_ROOT_DIR_ID
-            id=1, name="AE", address="6 Boulevard Anatole France, 90000 Belfort"
         )
         clubs = self._create_clubs()
 
@@ -365,62 +366,15 @@ class Command(BaseCommand):
         Counter.objects.create(name="Carte AE", club=clubs.refound, type="OFFICE")
 
         # Add barman to counter
-        Counter.sellers.through.objects.bulk_create(
+        CounterSellers.objects.bulk_create(
             [
-                Counter.sellers.through(counter_id=1, user=skia),  # MDE
+                CounterSellers(counter_id=1, user=skia, is_regular=True),  # MDE
-                Counter.sellers.through(counter_id=2, user=krophil),  # Foyer
+                CounterSellers(counter_id=2, user=krophil, is_regular=True),  # Foyer
             ]
         )
 
         # Create an election
-        el = Election.objects.create(
+        self._create_elections(groups, clubs, skia, sli, krophil)
-            title="Élection 2017",
-            description="La roue tourne",
-            start_candidature="1942-06-12 10:28:45+01",
-            end_candidature="2042-06-12 10:28:45+01",
-            start_date="1942-06-12 10:28:45+01",
-            end_date="7942-06-12 10:28:45+01",
-        )
-        el.view_groups.add(groups.public)
-        el.edit_groups.add(clubs.ae.board_group)
-        el.candidature_groups.add(groups.subscribers)
-        el.vote_groups.add(groups.subscribers)
-        liste = ElectionList.objects.create(title="Candidature Libre", election=el)
-        listeT = ElectionList.objects.create(title="Troll", election=el)
-        pres = Role.objects.create(
-            election=el, title="Président AE", description="Roi de l'AE"
-        )
-        resp = Role.objects.create(
-            election=el, title="Co Respo Info", max_choice=2, description="Ghetto++"
-        )
-        Candidature.objects.bulk_create(
-            [
-                Candidature(
-                    role=resp,
-                    user=skia,
-                    election_list=liste,
-                    program="Refesons le site AE",
-                ),
-                Candidature(
-                    role=resp,
-                    user=sli,
-                    election_list=liste,
-                    program="Vasy je deviens mon propre adjoint",
-                ),
-                Candidature(
-                    role=resp,
-                    user=krophil,
-                    election_list=listeT,
-                    program="Le Pôle Troll !",
-                ),
-                Candidature(
-                    role=pres,
-                    user=sli,
-                    election_list=listeT,
-                    program="En fait j'aime pas l'info, je voulais faire GMC",
-                ),
-            ]
-        )
 
         # Forum
         room = Forum.objects.create(
@@ -576,20 +530,32 @@ class Command(BaseCommand):
         # SAS
         for f in self.SAS_FIXTURE_PATH.glob("*"):
             if f.is_dir():
-                album = Album.objects.create(name=f.name, is_moderated=True)
+                album = Album(
+                    parent=sas,
+                    name=f.name,
+                    owner=root,
+                    is_folder=True,
+                    is_in_sas=True,
+                    is_moderated=True,
+                )
+                album.clean()
+                album.save()
                 for p in f.iterdir():
                     file = resize_image(Image.open(p), 1000, "WEBP")
                     pict = Picture(
                         parent=album,
                         name=p.name,
-                        original=file,
+                        file=file,
                         owner=root,
+                        is_folder=False,
+                        is_in_sas=True,
                         is_moderated=True,
+                        mime_type="image/webp",
+                        size=file.size,
                     )
-                    pict.original.name = pict.name
+                    pict.file.name = p.name
-                    pict.generate_thumbnails()
+                    pict.full_clean()
-                    pict.full_clean(save=True)
+                    pict.generate_thumbnails(save=True)
-                album.generate_thumbnail()
 
         img_skia = Picture.objects.get(name="skia.jpg")
         img_sli = Picture.objects.get(name="sli.jpg")
@@ -999,3 +965,132 @@ class Command(BaseCommand):
         BanGroup.objects.create(name="Banned from buying alcohol", description="")
         BanGroup.objects.create(name="Banned from counters", description="")
         BanGroup.objects.create(name="Banned to subscribe", description="")
+
+    def _create_elections(
+        self,
+        groups: PopulatedGroups,
+        clubs: PopulatedClubs,
+        skia: User,
+        sli: User,
+        krophil: User,
+    ):
+        """Populate elections.
+
+        4 elections are created :
+
+        - one that has not started yet,
+        - one on the candidature period
+        - one on the vote period
+        - one that is finished
+
+        All elections have two lists, are linked to the AE and Troll clubs,
+        and have one role for each board role of thos two clubs, plus
+        an additional role linked to no club roles.
+
+        The ongoing vote and finished elections have candidates.
+
+        The finished election has 10 voters.
+        """
+
+        def election_factory(title: str, start_candidature: datetime):
+            return Election(
+                title=title,
+                description="",
+                start_candidature=start_candidature,
+                end_candidature=start_candidature + timedelta(days=7),
+                start_date=start_candidature + timedelta(days=7),
+                end_date=start_candidature + timedelta(days=14),
+            )
+
+        # create the elections
+        elections = Election.objects.bulk_create(
+            [
+                election_factory("Election terminée", now() - timedelta(days=14)),
+                election_factory("Votes en cours", now() - timedelta(days=7)),
+                election_factory("Candidatures en cours", now()),
+                election_factory("Election à venir", now() + timedelta(days=7)),
+            ]
+        )
+        finished, ongoing_vote, _ongoing_candidature, _not_started = elections
+
+        # set the groups (all elections have the same groups)
+        groups.public.viewable_elections.set(elections)
+        clubs.ae.board_group.editable_elections.set(elections)
+        groups.subscribers.candidate_elections.set(elections)
+        groups.subscribers.votable_elections.set(elections)
+
+        # link elections to clubs (AE and Troll for all elections)
+        Election.clubs.through.objects.bulk_create(
+            [
+                *[Election.clubs.through(club=clubs.ae, election=e) for e in elections],
+                *[
+                    Election.clubs.through(club=clubs.troll, election=e)
+                    for e in elections
+                ],
+            ]
+        )
+
+        # Create lists (all elections have two lists)
+        ElectionList.objects.bulk_create(
+            [
+                *[ElectionList(title="Candidat libre", election=e) for e in elections],
+                *[ElectionList(title="Troll", election=e) for e in elections],
+            ]
+        )
+
+        # Create roles.
+        # Elections have a role for each board club role of AE and Troll,
+        # +an additional role linked to no club role
+        club_roles = list(
+            ClubRole.objects.filter(club__in=[clubs.ae, clubs.troll], is_board=True)
+            .select_related("club")
+            .order_by("club_id", "order")
+        )
+        Role.objects.bulk_create(
+            [
+                *[
+                    Role(election=e, title=f"{r.name} {r.club.name}", club_role=r)
+                    for r in club_roles
+                    for e in elections
+                ],
+                *[Role(election=e, title="Rôle libre") for e in elections],
+            ]
+        )
+
+        # create candidatures for ongoing_vote and finished elections
+        candidatures = []
+        lipsum = "\n\n".join(paragraphs(2))
+        for election in ongoing_vote, finished:
+            lists = list(election.election_lists.order_by("id"))
+            roles = list(election.roles.order_by("order")[:3])
+            candidatures.extend(
+                [
+                    Candidature(
+                        role=roles[0], user=skia, election_list=lists[0], program=lipsum
+                    ),
+                    Candidature(
+                        role=roles[1], user=sli, election_list=lists[0], program=lipsum
+                    ),
+                    Candidature(
+                        role=roles[2], user=krophil, election_list=lists[1], program=""
+                    ),
+                    Candidature(
+                        role=roles[2], user=sli, election_list=lists[0], program=lipsum
+                    ),
+                ]
+            )
+        candidatures = Candidature.objects.bulk_create(candidatures)
+
+        skia, sli_vp, krophil, sli_treso = candidatures[4:]  # candidates of finished
+        votes = Vote.objects.bulk_create(
+            [
+                *[Vote(role=skia.role) for _ in range(6)],
+                *[Vote(role=sli_vp.role) for _ in range(8)],
+                *[Vote(role=krophil.role) for _ in range(9)],
+            ]
+        )
+        skia.votes.set(votes[:6])
+        sli_vp.votes.set(votes[6:14])
+        krophil.votes.set(votes[14:20])
+        sli_treso.votes.set(votes[20:23])
+        finished.voters.set(list(User.objects.all()[:10]))

core/markdown.py

@@ -1,132 +0,0 @@
-#
-# Copyright 2023 © AE UTBM
-# ae@utbm.fr / ae.info@utbm.fr
-#
-# This file is part of the website of the UTBM Student Association (AE UTBM),
-# https://ae.utbm.fr.
-#
-# You can find the source code of the website at https://github.com/ae-utbm/sith
-#
-# LICENSED UNDER THE GNU GENERAL PUBLIC LICENSE VERSION 3 (GPLv3)
-# SEE : https://raw.githubusercontent.com/ae-utbm/sith/master/LICENSE
-# OR WITHIN THE LOCAL FILE "LICENSE"
-#
-#
-from __future__ import annotations
-
-import re
-from typing import TYPE_CHECKING
-
-import mistune
-from django.urls import reverse
-from mistune import HTMLRenderer, Markdown
-
-if TYPE_CHECKING:
-    from mistune import InlineParser, InlineState
-
-# match __text__, without linebreak in the text, nor backslash prepending an underscore
-# Examples :
-#   - "__text__" : OK
-#   - "__te xt__" : OK
-#   - "__te_xt__" : nope (underscore in the middle)
-#   - "__te\_xt__" : Ok (the middle underscore is escaped)
-#   - "__te\nxt__" : nope (there is a linebreak in the text)
-#   - "\__text__" : nope (one of the underscores have a backslash prepended)
-#   - "\\__text__" : Ok (the backslash is ignored, because there is another backslash before)
-UNDERLINED_RE = (
-    r"(?<!\\)(?:\\{2})*"  # ignore if there is an odd number of backslashes before
-    r"_{2}"  # two underscores
-    r"(?P<underlined>([^\\_]|\\.)+)"  # the actual text
-    r"_{2}"  # closing underscores
-)
-
-SITH_LINK_RE = (
-    r"\[(?P<page_name>[\w\s]+)\]"  #  [nom du lien]
-    r"\(page:\/\/"  #  (page://
-    r"(?P<page_slug>[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9])"  # actual page name
-    r"\)"  # )
-)
-
-CUSTOM_DIMENSIONS_IMAGE_RE = (
-    r"\[(?P<img_name>[\w\s]+)\]"  # [nom du lien]
-    r"\(img:\/\/"  # (img://
-    r"(?P<img_slug>[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9])"  # actual page name
-    r"\)"  # )
-)
-
-
-def parse_underline(_inline: InlineParser, m: re.Match, state: InlineState):
-    state.append_token({"type": "underline", "raw": m.group("underlined")})
-    return m.end()
-
-
-def underline(md_instance: Markdown):
-    md_instance.inline.register(
-        "underline",
-        UNDERLINED_RE,
-        parse_underline,
-        before="emphasis",
-    )
-    md_instance.renderer.register("underline", lambda _, text: f"<u>{text}</u>")
-
-
-def parse_sith_link(_inline: InlineParser, m: re.Match, state: InlineState):
-    page_name = m.group("page_name")
-    page_slug = m.group("page_slug")
-    state.append_token(
-        {
-            "type": "link",
-            "children": [{"type": "text", "raw": page_name}],
-            "attrs": {"url": reverse("core:page", kwargs={"page_name": page_slug})},
-        }
-    )
-    return m.end()
-
-
-def sith_link(md_instance: Markdown):
-    md_instance.inline.register(
-        "sith_link",
-        SITH_LINK_RE,
-        parse_sith_link,
-        before="emphasis",
-    )
-    # no custom renderer here.
-    # we just add another parsing rule, but render it as if it was
-    # a regular markdown link
-
-
-class SithRenderer(HTMLRenderer):
-    def image(self, text: str, url: str, title=None) -> str:
-        if "?" not in url:
-            return super().image(text, url, title)
-
-        new_url, params = url.rsplit("?", maxsplit=1)
-        m = re.match(r"^(?P<width>\d+(%|px)?)(x(?P<height>\d+(%|px)?))?$", params)
-        if not m:
-            return super().image(text, url, title)
-
-        width, height = m.group("width"), m.group("height")
-        if not width.endswith(("%", "px")):
-            width += "px"
-        style = f"width:{width};"
-        if height is not None:
-            if not height.endswith(("%", "px")):
-                height += "px"
-            style += f"height:{height};"
-        return super().image(text, new_url, title).replace("/>", f'style="{style}" />')
-
-
-markdown = mistune.create_markdown(
-    renderer=SithRenderer(escape=True),
-    plugins=[
-        underline,
-        sith_link,
-        "strikethrough",
-        "footnotes",
-        "table",
-        "spoiler",
-        "subscript",
-        "superscript",
-        "url",
-    ],
-)

core/migrations/0049_remove_sithfiles.py

@@ -1,27 +0,0 @@
-# Generated by Django 4.2.17 on 2025-01-26 15:01
-
-from typing import TYPE_CHECKING
-
-from django.db import migrations
-from django.db.migrations.state import StateApps
-
-if TYPE_CHECKING:
-    import core.models
-
-
-def remove_sas_sithfiles(apps: StateApps, schema_editor):
-    SithFile: type[core.models.SithFile] = apps.get_model("core", "SithFile")
-    SithFile.objects.filter(is_in_sas=True).delete()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("core", "0048_alter_user_options"),
-        ("sas", "0007_alter_peoplepicturerelation_picture_and_more"),
-    ]
-
-    operations = [
-        migrations.RunPython(
-            remove_sas_sithfiles, reverse_code=migrations.RunPython.noop, elidable=True
-        )
-    ]

core/migrations/0050_remove_sithfile_is_in_sas.py

@@ -1,9 +0,0 @@
-# Generated by Django 4.2.17 on 2025-02-14 11:58
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [("core", "0049_remove_sithfiles")]
-
-    operations = [migrations.RemoveField(model_name="sithfile", name="is_in_sas")]

core/models.py

@@ -876,6 +876,9 @@ class SithFile(models.Model):
         on_delete=models.SET_NULL,
     )
     asked_for_removal = models.BooleanField(_("asked for removal"), default=False)
+    is_in_sas = models.BooleanField(
+        _("is in the SAS"), default=False, db_index=True
+    )  # Allows to query this flag, updated at each call to save()
 
     class Meta:
         verbose_name = _("file")
@@ -884,10 +887,24 @@ class SithFile(models.Model):
         return self.get_parent_path() + "/" + self.name
 
     def save(self, *args, **kwargs):
+        sas_id = settings.SITH_SAS_ROOT_DIR_ID
+        self.is_in_sas = self.id == sas_id or any(
+            p.id == sas_id for p in self.get_parent_list()
+        )
         adding = self._state.adding
         super().save(*args, **kwargs)
         if adding:
             self.copy_rights()
+        if self.is_in_sas:
+            for user in User.objects.filter(
+                groups__id__in=[settings.SITH_GROUP_SAS_ADMIN_ID]
+            ):
+                Notification(
+                    user=user,
+                    url=reverse("sas:moderation"),
+                    type="SAS_MODERATION",
+                    param="1",
+                ).save()
 
     def is_owned_by(self, user: User) -> bool:
         if user.is_anonymous:
@@ -900,6 +917,8 @@ class SithFile(models.Model):
             return user.is_board_member
         if user.is_com_admin:
             return True
+        if self.is_in_sas and user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
+            return True
         return user.id == self.owner_id
 
     def can_be_viewed_by(self, user: User) -> bool:
@@ -926,6 +945,8 @@ class SithFile(models.Model):
         super().clean()
         if "/" in self.name:
             raise ValidationError(_("Character '/' not authorized in name"))
+        if self == self.parent:
+            raise ValidationError(_("Loop in folder tree"), code="loop")
         if self == self.parent or (
             self.parent is not None and self in self.get_parent_list()
         ):
@@ -1006,6 +1027,18 @@ class SithFile(models.Model):
     def is_file(self):
         return not self.is_folder
 
+    @cached_property
+    def as_picture(self):
+        from sas.models import Picture
+
+        return Picture.objects.filter(id=self.id).first()
+
+    @cached_property
+    def as_album(self):
+        from sas.models import Album
+
+        return Album.objects.filter(id=self.id).first()
+
     def get_parent_list(self):
         parents = []
         current = self.parent

core/schemas.py

@@ -19,6 +19,16 @@ from core.utils import get_last_promo, is_image
 NonEmptyStr = Annotated[str, MinLen(1)]
 
 
+class ValidationErrorSchema(Schema):
+    class ValidationErrorItem(Schema):
+        loc: list[str | int]
+        msg: str
+        type: str
+        ctx: dict[str, str]
+
+    detail: list[ValidationErrorItem]
+
+
 class UploadedImage(UploadedFile):
     @classmethod
     def _validate(cls, v: Any, info: ValidationInfo) -> Any:

core/static/bundled/alpine/limited-choices.ts

@@ -25,7 +25,7 @@ export function limitedChoices(Alpine: AlpineType) {
   Alpine.directive(
     "limited-choices",
     (el, { expression }, { evaluateLater, effect }) => {
-      const getMaxChoices = evaluateLater(expression);
+      const getMaxChoices = evaluateLater<string>(expression);
       let maxChoices: number;
       const inputs: HTMLInputElement[] = Array.from(
         el.querySelectorAll("input[type='checkbox']"),
@@ -54,7 +54,7 @@ export function limitedChoices(Alpine: AlpineType) {
         });
       }
       effect(() => {
-        getMaxChoices((value: string) => {
+        getMaxChoices((value) => {
           const previousValue = maxChoices;
           maxChoices = Number.parseInt(value, 10);
           if (maxChoices < previousValue) {

core/static/bundled/base-bundle-index.ts

@@ -43,13 +43,19 @@ polyfillCountryFlagEmojis();
 /**
  * HTMX
  */
-document.body.addEventListener("htmx:beforeRequest", (event: CustomEvent) => {
+document.body.addEventListener(
-  event.detail.target.ariaBusy = true;
+  "htmx:beforeRequest" as keyof HTMLElementEventMap,
-});
+  (event) => {
+    (event as CustomEvent).detail.target.ariaBusy = true;
+  },
+);
 
-document.body.addEventListener("htmx:beforeSwap", (event: CustomEvent) => {
+document.body.addEventListener(
-  event.detail.target.ariaBusy = null;
+  "htmx:beforeSwap" as keyof HTMLElementEventMap,
-});
+  (event) => {
+    (event as CustomEvent).detail.target.ariaBusy = null;
+  },
+);
 
 Object.assign(window, { htmx });
 

core/static/bundled/core/components/ajax-select-base.ts

@@ -4,9 +4,9 @@ import type {
   TomLoadCallback,
   TomOption,
   TomSettings,
-} from "tom-select/dist/types/types";
+} from "tom-select/src/types";
-import type { escape_html } from "tom-select/dist/types/utils";
+import type { escape_html } from "tom-select/src/utils";
-import { inheritHtmlElement } from "#core:utils/web-components.ts";
+import { inheritHtmlElement } from "#core:utils/web-components";
 
 export class AutoCompleteSelectBase extends inheritHtmlElement("select") {
   static observedAttributes = [
@@ -15,7 +15,7 @@ export class AutoCompleteSelectBase extends inheritHtmlElement("select") {
     "max",
     "min-characters-for-search",
   ];
-  public widget: TomSelect;
+  public widget!: TomSelect;
 
   protected minCharNumberForSearch = 0;
   protected delay: number | null = null;
@@ -24,8 +24,8 @@ export class AutoCompleteSelectBase extends inheritHtmlElement("select") {
 
   protected attributeChangedCallback(
     name: string,
-    _oldValue?: string,
+    _oldValue: string,
-    newValue?: string,
+    newValue: string,
   ) {
     switch (name) {
       case "delay": {
@@ -73,7 +73,7 @@ export class AutoCompleteSelectBase extends inheritHtmlElement("select") {
       persist: false,
       maxItems: this.node.multiple ? this.max : 1,
       closeAfterSelect: true,
-      loadThrottle: this.delay,
+      loadThrottle: this.delay ?? undefined,
       placeholder: this.placeholder,
       shouldLoad: (query: string) => this.shouldLoad(query), // wraps the method to avoid shadowing `this` by the one from tom-select
       render: {
@@ -103,7 +103,7 @@ export class AutoCompleteSelectBase extends inheritHtmlElement("select") {
 }
 
 export abstract class AjaxSelect extends AutoCompleteSelectBase {
-  protected filter?: (items: TomOption[]) => TomOption[] = null;
+  protected filter?: (items: TomOption[]) => TomOption[];
   protected minCharNumberForSearch = 2;
   /**
    * A cache of researches that have been made using this input.

core/static/bundled/core/components/ajax-select-index.ts

@@ -1,11 +1,12 @@
+// @ts-expect-error TS2882
 import "tom-select/dist/css/tom-select.default.css";
-import type { TomOption } from "tom-select/dist/types/types";
+import type { TomOption } from "tom-select/src/types";
-import type { escape_html } from "tom-select/dist/types/utils";
+import type { escape_html } from "tom-select/src/utils";
 import {
   AjaxSelect,
   AutoCompleteSelectBase,
-} from "#core:core/components/ajax-select-base.ts";
+} from "#core:core/components/ajax-select-base";
-import { registerComponent } from "#core:utils/web-components.ts";
+import { registerComponent } from "#core:utils/web-components";
 import {
   type GroupSchema,
   groupSearchGroup,

core/static/bundled/core/components/easymde-index.ts

@@ -1,11 +1,13 @@
+// @ts-expect-error 2307
 // biome-ignore lint/correctness/noUndeclaredDependencies: shipped by easymde
 import "codemirror/lib/codemirror.css";
+// @ts-expect-error 2307
 import "easymde/src/css/easymde.css";
 // biome-ignore lint/correctness/noUndeclaredDependencies: Imported by EasyMDE
 import type CodeMirror from "codemirror";
 // biome-ignore lint/style/useNamingConvention: This is how they called their namespace
 import EasyMDE from "easymde";
-import { inheritHtmlElement, registerComponent } from "#core:utils/web-components.ts";
+import { inheritHtmlElement, registerComponent } from "#core:utils/web-components";
 import {
   markdownRenderMarkdown,
   type UploadUploadImageErrors,
@@ -25,11 +27,11 @@ const loadEasyMde = (textarea: HTMLTextAreaElement) => {
           file: file,
         },
       });
-      if (!response.response.ok) {
+      if (response.response !== undefined && !response.response.ok) {
-        if (response.response.status === 422) {
+        if (response?.response.status === 422) {
           onError(
             (response.error as UploadUploadImageErrors[422]).detail
-              .map((err: Record<"ctx", Record<"error", string>>) => err.ctx.error)
+              .map((err) => err.ctx.error)
               .join(" ; "),
           );
         } else if (response.response.status === 403) {
@@ -39,6 +41,10 @@ const loadEasyMde = (textarea: HTMLTextAreaElement) => {
         }
         return;
       }
+      if (response.data === undefined) {
+        // this can't happen, it's just for the type checker to know
+        return;
+      }
       onSuccess(response.data.href);
       // Workaround function to add an image name to uploaded image
       // Without this, you get ![](url) instead of ![name](url)
@@ -58,21 +64,18 @@ const loadEasyMde = (textarea: HTMLTextAreaElement) => {
       });
       easymde.codemirror.replaceSelection("\n");
     },
-    previewRender: (plainText: string, preview: MarkdownInput) => {
+    previewRender: (plainText, preview) => {
       /* This is wrapped this way to allow time for Alpine to be loaded on the page */
-      return Alpine.debounce((plainText: string, preview: MarkdownInput) => {
+      return Alpine.debounce(() => {
-        const func = async (
+        const func = async () => {
-          plainText: string,
-          preview: MarkdownInput,
-        ): Promise<null> => {
           preview.innerHTML = (
             await markdownRenderMarkdown({ body: { text: plainText } })
           ).data as string;
           return null;
         };
-        func(plainText, preview);
+        func().then();
         return null;
-      }, 300)(plainText, preview);
+      }, 300)();
     },
     forceSync: true, // Avoid validation error on generic create view
     imageTexts: {
@@ -222,9 +225,11 @@ const loadEasyMde = (textarea: HTMLTextAreaElement) => {
   });
 
   const submits: HTMLInputElement[] = Array.from(
-    textarea.closest("form").querySelectorAll('input[type="submit"]'),
+    (textarea.closest("form") as HTMLFormElement).querySelectorAll(
+      'input[type="submit"]',
+    ),
   );
-  const parentDiv = textarea.parentElement.parentElement;
+  const parentDiv = textarea.parentElement?.parentElement as HTMLElement;
 
   function checkMarkdownInput(event: Event) {
     // an attribute is null if it does not exist, else a string
@@ -249,6 +254,7 @@ const loadEasyMde = (textarea: HTMLTextAreaElement) => {
 };
 
 @registerComponent("markdown-input")
+// biome-ignore lint/correctness/noUnusedVariables: it is used in jinja
 class MarkdownInput extends inheritHtmlElement("textarea") {
   connectedCallback() {
     super.connectedCallback();

core/static/bundled/core/components/include-index.ts

@@ -2,7 +2,7 @@ import {
   type InheritedHtmlElement,
   inheritHtmlElement,
   registerComponent,
-} from "#core:utils/web-components.ts";
+} from "#core:utils/web-components";
 
 /**
  * ElementOnce web components
@@ -28,7 +28,7 @@ export function elementOnce<K extends keyof HTMLElementTagNameMap>(tagName: K) {
 
     clearNode() {
       while (this.firstChild) {
-        this.removeChild(this.lastChild);
+        this.removeChild(this.lastChild as ChildNode);
       }
     }
 
@@ -130,7 +130,7 @@ startObserver(observer);
 export class LinkOnce extends elementOnce("link") {
   getElementQuerySelector(): string {
     // We get href from node.attributes instead of node.href to avoid getting the domain part
-    return `link[href='${this.node.attributes.getNamedItem("href").nodeValue}']`;
+    return `link[href='${this.node.attributes.getNamedItem("href")?.nodeValue}']`;
   }
 }
 
@@ -142,6 +142,6 @@ export class LinkOnce extends elementOnce("link") {
 export class ScriptOnce extends inheritHtmlElement("script") {
   getElementQuerySelector(): string {
     // We get href from node.attributes instead of node.src to avoid getting the domain part
-    return `script[src='${this.node.attributes.getNamedItem("src").nodeValue}']`;
+    return `script[src='${this.node.attributes.getNamedItem("src")?.nodeValue}']`;
   }
 }

core/static/bundled/core/components/nfc-input-index.ts

@@ -1,4 +1,4 @@
-import { inheritHtmlElement, registerComponent } from "#core:utils/web-components.ts";
+import { inheritHtmlElement, registerComponent } from "#core:utils/web-components";
 
 @registerComponent("nfc-input")
 export class NfcInput extends inheritHtmlElement("input") {
@@ -26,9 +26,11 @@ export class NfcInput extends inheritHtmlElement("input") {
         window.alert(gettext("Unsupported NFC card"));
       });
 
-      ndef.addEventListener("reading", (event: NDEFReadingEvent) => {
+      ndef.addEventListener("reading", (event) => {
         this.removeAttribute("scan");
-        this.node.value = event.serialNumber.replace(/:/g, "").toUpperCase();
+        this.node.value = (event as NDEFReadingEvent).serialNumber
+          .replace(/:/g, "")
+          .toUpperCase();
         /* Auto submit form, we need another button to not trigger our previously defined click event */
         const submit = document.createElement("button");
         this.node.appendChild(submit);

core/static/bundled/core/components/tabs-index.ts

@@ -1,6 +1,6 @@
 import { html, render } from "lit-html";
 import { unsafeHTML } from "lit-html/directives/unsafe-html.js";
-import { registerComponent } from "#core:utils/web-components.ts";
+import { registerComponent } from "#core:utils/web-components";
 
 @registerComponent("ui-tab")
 export class Tab extends HTMLElement {
@@ -19,7 +19,7 @@ export class Tab extends HTMLElement {
     }
 
     if (name === "title") {
-      this.description = newValue;
+      this.description = newValue ?? "";
     }
     this.dispatchEvent(new CustomEvent("ui-tab-updated", { bubbles: true }));
   }
@@ -79,15 +79,15 @@ export class Tab extends HTMLElement {
 
 @registerComponent("ui-tab-group")
 export class TabGroup extends HTMLElement {
-  private node: HTMLDivElement;
+  private node!: HTMLDivElement;
 
   connectedCallback() {
     this.node = document.createElement("div");
     this.node.classList.add("tabs", "shadow");
     this.appendChild(this.node);
 
-    this.addEventListener("ui-tab-activated", (event: CustomEvent) => {
+    this.addEventListener("ui-tab-activated", (event) => {
-      const target = event.detail as Tab;
+      const target = (event as CustomEvent).detail as Tab;
       for (const tab of this.getElementsByTagName("ui-tab") as HTMLCollectionOf<Tab>) {
         if (tab !== target) {
           tab.setActive(false);

core/static/bundled/core/dynamic-formset-index.ts

@@ -26,19 +26,23 @@ document.addEventListener("alpine:init", () => {
    * `counter/templates/counter/product_form.jinja`
    */
   Alpine.data("dynamicFormSet", (config?: Config) => ({
+    formContainer: undefined as unknown as HTMLElement,
+    nbForms: 0,
+    template: undefined as unknown as HTMLTemplateElement,
+
     init() {
       this.formContainer = this.$refs.formContainer as HTMLElement;
       this.nbForms = this.formContainer.children.length as number;
       this.template = this.$refs.formTemplate as HTMLTemplateElement;
       const prefix = config?.prefix ?? "form";
-      this.$root
+      (
-        .querySelector(`#id_${prefix}-TOTAL_FORMS`)
+        this.$root.querySelector(`#id_${prefix}-TOTAL_FORMS`) as HTMLFormElement
-        .setAttribute(":value", "nbForms");
+      ).setAttribute(":value", "nbForms");
     },
 
     addForm() {
       this.formContainer.appendChild(document.importNode(this.template.content, true));
-      const newForm = this.formContainer.lastElementChild;
+      const newForm = this.formContainer.lastElementChild as Element;
       const inputs: NodeListOf<HTMLFormInputElement> = newForm.querySelectorAll(
         "input, select, textarea",
       );
@@ -59,7 +63,7 @@ document.addEventListener("alpine:init", () => {
       this.nbForms -= 1;
       // adjust the id of remaining forms
       for (let i = 0; i < this.nbForms; i++) {
-        const form: HTMLDivElement = this.formContainer.children[i];
+        const form = this.formContainer.children[i];
         const inputs: NodeListOf<HTMLFormInputElement> = form.querySelectorAll(
           "input, select, textarea",
         );

core/static/bundled/core/navbar.ts

@@ -1,5 +1,5 @@
 function showMenu() {
-  const navbar = document.getElementById("navbar-content");
+  const navbar = document.getElementById("navbar-content") as HTMLElement;
   const current = navbar.getAttribute("mobile-display");
   navbar.setAttribute("mobile-display", current === "hidden" ? "revealed" : "hidden");
 }
@@ -20,9 +20,12 @@ function navbarInit() {
         item.removeAttribute("open");
       }
     });
-    item.addEventListener("click", (event: MouseEvent) => {
+    item.addEventListener("click", (event) => {
       // Don't close when clicking on desktop mode
-      if ((event.target as HTMLElement).nodeName !== "SUMMARY" || event.detail === 0) {
+      if (
+        (event.target as HTMLElement).nodeName !== "SUMMARY" ||
+        (event as MouseEvent).detail === 0
+      ) {
         return;
       }
 

core/static/bundled/core/read-more-index.ts

@@ -1,3 +1,4 @@
+// @ts-expect-error 2307 this dependency does exist, but it's a little bit wacky
 import clip from "@arendjr/text-clipper";
 
 /*

core/static/bundled/core/tooltips-index.ts

@@ -70,15 +70,16 @@ function createTooltip(element: HTMLElement) {
 function updateTooltip(element: HTMLElement, tooltip: HTMLElement, status: Status) {
   // Update tooltip status and set it's attributes and content
   tooltip.setAttribute("tooltip-status", status);
-  tooltip.innerText = element.getAttribute("tooltip");
+  tooltip.innerText = element.getAttribute("tooltip") as string;
 
   for (const attributes of [
     { src: "tooltip-class", dst: "class", default: ["tooltip"] },
     { src: "tooltip-id", dst: "id", default: [] },
   ]) {
     const populated = attributes.default;
-    if (element.hasAttribute(attributes.src)) {
+    const attr = element.getAttribute(attributes.src);
-      populated.push(...element.getAttribute(attributes.src).split(" "));
+    if (attr !== null) {
+      populated.push(...attr.split(" "));
     }
     tooltip.setAttribute(attributes.dst, populated.join(" "));
   }
@@ -93,7 +94,7 @@ function getTooltip(element: HTMLElement) {
   return tooltip;
 }
 
-function tooltipMouseover(event: MouseEvent) {
+function tooltipMouseover(event: Event) {
   // We get the closest tooltip to have a consistent behavior
   // when hovering over a child element of a tooltip marked element
   const target = (event.target as HTMLElement).closest("[tooltip]") as HTMLElement;
@@ -111,7 +112,7 @@ function tooltipMouseover(event: MouseEvent) {
   });
 }
 
-function tooltipMouseout(event: MouseEvent) {
+function tooltipMouseout(event: Event) {
   // We get the closest tooltip to have a consistent behavior
   // when hovering over a child element of a tooltip marked element
   const target = (event.target as HTMLElement).closest("[tooltip]") as HTMLElement;
@@ -141,7 +142,7 @@ new MutationObserver((mutations: MutationRecord[]) => {
       }
     } else if (tooltips.has(target)) {
       // Remove corresponding tooltip
-      tooltips.get(target).remove();
+      tooltips.get(target)?.remove();
       tooltips.delete(target);
     }
   }
@@ -163,7 +164,7 @@ new MutationObserver((mutations: MutationRecord[]) => {
         continue;
       }
       if (tooltips.has(target)) {
-        tooltips.get(target).remove();
+        tooltips.get(target)?.remove();
         tooltips.delete(target);
       }
     }

core/static/bundled/types/web-nfc.d.ts

@@ -55,7 +55,6 @@ declare interface NDEFRecordInit {
 // biome-ignore lint/style/useNamingConvention: this is the official API name
 declare type NDEFMessageSource = string | BufferSource | NDEFMessageInit;
 
-// biome-ignore lint/correctness/noUnusedVariables: this is the official definition
 interface Window {
   // biome-ignore lint/style/useNamingConvention: this is the official API name
   NDEFReader: NDEFReader;

core/static/bundled/user/family-graph-index.ts

@@ -1,20 +1,13 @@
-import cytoscape, {
+import cytoscape, { type ElementDefinition, type Singular } from "cytoscape";
-  type ElementDefinition,
-  type NodeSingular,
-  type Singular,
-} from "cytoscape";
 import cxtmenu from "cytoscape-cxtmenu";
 import klay, { type KlayLayoutOptions } from "cytoscape-klay";
-import { History, initialUrlParams, updateQueryString } from "#core:utils/history.ts";
+import { History, initialUrlParams, updateQueryString } from "#core:utils/history";
 import { familyGetFamilyGraph, type UserProfileSchema } from "#openapi";
 
 cytoscape.use(klay);
 cytoscape.use(cxtmenu);
 
-type GraphData = (
+type GraphData = { data: UserProfileSchema | { source: number; target: number } }[];
-  | { data: UserProfileSchema }
-  | { data: { source: number; target: number } }
-)[];
 
 function isMobile() {
   return window.innerWidth < 500;
@@ -27,10 +20,8 @@ async function getGraphData(
 ): Promise<GraphData> {
   const data = (
     await familyGetFamilyGraph({
-      path: {
+      // biome-ignore lint/style/useNamingConvention: api is snake_case
-        // biome-ignore lint/style/useNamingConvention: api is snake_case
+      path: { user_id: userId },
-        user_id: userId,
-      },
       query: {
         // biome-ignore lint/style/useNamingConvention: api is snake_case
         godfathers_depth: godfathersDepth,
@@ -39,6 +30,10 @@ async function getGraphData(
       },
     })
   ).data;
+  if (data === undefined) {
+    console.error("Family graph request failed");
+    return [];
+  }
   return [
     ...data.users.map((user) => {
       return { data: user };
@@ -155,7 +150,7 @@ function createGraph(container: HTMLDivElement, data: GraphData, activeUserId: n
       {
         content: '<i class="fa fa-external-link fa-2x"></i>',
         select: (el) => {
-          window.open(el.data().profile_url, "_blank").focus();
+          window.open(el.data().profile_url, "_blank")?.focus();
         },
       },
 
@@ -195,12 +190,12 @@ document.addEventListener("alpine:init", () => {
     godfathersDepth: 0,
     godchildrenDepth: 0,
     reverse: initialUrlParams.get("reverse")?.toLowerCase?.() === "true",
-    graph: undefined as cytoscape.Core,
+    graph: undefined as unknown as cytoscape.Core,
-    graphData: {},
+    graphData: {} as GraphData,
     isZoomEnabled: !isMobile(),
 
     getInitialDepth(prop: string) {
-      const value = Number.parseInt(initialUrlParams.get(prop), 10);
+      const value = Number.parseInt(initialUrlParams.get(prop) as string, 10);
       if (Number.isNaN(value) || value < config.depthMin || value > config.depthMax) {
         return defaultDepth;
       }
@@ -223,8 +218,8 @@ document.addEventListener("alpine:init", () => {
           await delayedFetch();
         });
       }
-      this.$watch("reverse", async (value: number) => {
+      this.$watch("reverse", async (newValue, _oldValue) => {
-        updateQueryString("reverse", value.toString(), History.Replace);
+        updateQueryString("reverse", newValue.toString(), History.Replace);
         await this.reverseGraph();
       });
       this.$watch("graphData", async () => {
@@ -259,9 +254,9 @@ document.addEventListener("alpine:init", () => {
     },
 
     async reverseGraph() {
-      this.graph.elements((el: NodeSingular) => {
+      this.graph
-        el.position({ x: -el.position().x, y: -el.position().y });
+        .elements()
-      });
+        .positions((el, _) => ({ x: -el.position().x, y: -el.position().y }));
       this.graph.center(this.graph.elements());
     },
 

core/static/bundled/utils/alert-message.ts

@@ -5,9 +5,9 @@ interface AlertParams {
 
 export class AlertMessage {
   public open: boolean;
-  public success: boolean;
+  public success!: boolean;
   public content: string;
-  private timeoutId?: number;
+  private timeoutId: number | null;
   private readonly defaultDuration: number;
 
   constructor(params?: { defaultDuration: number }) {

core/static/bundled/utils/api.ts

@@ -37,6 +37,10 @@ export const paginated = async <T>(
   queryParams.query.page = 1;
 
   const firstPage = (await endpoint(queryParams)).data;
+  if (firstPage === undefined) {
+    console.error(`Request to "${options?.url}" failed`);
+    return [];
+  }
   const results = firstPage.results;
 
   const nbElements = firstPage.count;
@@ -45,9 +49,9 @@ export const paginated = async <T>(
   if (nbPages > 1) {
     const promises: Promise<T[]>[] = [];
     for (let i = 2; i <= nbPages; i++) {
-      const nextPage = structuredClone(queryParams);
+      const nextPage = structuredClone(queryParams) as Required<PaginatedRequest>;
       nextPage.query.page = i;
-      promises.push(endpoint(nextPage).then((res) => res.data.results));
+      promises.push(endpoint(nextPage).then((res) => res.data?.results ?? []));
     }
     results.push(...(await Promise.all(promises)).flat());
   }
@@ -61,8 +65,7 @@ interface Request extends TDataShape {
 interface InterceptorOptions {
   url: string;
 }
-
+export type GenericEndpoint = <ThrowOnError extends boolean = false>(
-type GenericEndpoint = <ThrowOnError extends boolean = false>(
   options?: Options<Request, ThrowOnError>,
 ) => RequestResult<unknown, unknown, ThrowOnError>;
 
@@ -71,7 +74,7 @@ type GenericEndpoint = <ThrowOnError extends boolean = false>(
  **/
 export const makeUrl = async (endpoint: GenericEndpoint) => {
   let url = "";
-  const interceptor = (_request: undefined, options: InterceptorOptions) => {
+  const interceptor = (_request: Request, options: InterceptorOptions) => {
     url = options.url;
     throw new Error("We don't want to send the request");
   };

core/static/bundled/utils/csv.ts

@@ -7,14 +7,14 @@ interface StringifyOptions<T extends object> {
   titleRow?: readonly string[];
 }
 
-function getNested<T extends object>(obj: T, key: NestedKeyOf<T>) {
+function getNested<T extends { [key: string]: unknown }>(obj: T, key: NestedKeyOf<T>) {
-  const path: (keyof object)[] = key.split(".") as (keyof unknown)[];
+  const path = key.split(".");
-  let res = obj[path.shift() as keyof T];
+  let res = obj[path.shift() as string] as { [key: string]: unknown } | undefined;
   for (const node of path) {
-    if (res === null) {
+    if (res === undefined) {
       break;
     }
-    res = res[node];
+    res = res[node] as { [key: string]: unknown } | undefined;
   }
   return res;
 }
@@ -29,18 +29,21 @@ function sanitizeCell(content: string): string {
 }
 
 export const csv = {
-  stringify: <T extends object>(objs: T[], options?: StringifyOptions<T>) => {
+  stringify: <T extends { [key: string]: unknown }>(
-    const columns = options.columns;
+    objs: T[],
+    options?: StringifyOptions<T>,
+  ) => {
+    const columns = options?.columns;
     const content = objs
       .map((obj) => {
-        return columns
+        return (columns ?? [])
           .map((col) => {
             return sanitizeCell((getNested(obj, col) ?? "").toString());
           })
           .join(",");
       })
       .join("\n");
-    if (!options.titleRow) {
+    if (!options?.titleRow) {
       return content;
     }
     const firstRow = options.titleRow.map(sanitizeCell).join(",");

core/static/bundled/utils/web-components.ts

@@ -29,6 +29,7 @@ export function registerComponent(name: string, options?: ElementDefinitionOptio
 export interface InheritedHtmlElement<K extends keyof HTMLElementTagNameMap>
   extends HTMLElement {
   readonly inheritedTagName: K;
+  // readonly initializedAttribute: "component-initialized";
   node: HTMLElementTagNameMap[K];
 }
 
@@ -47,8 +48,8 @@ export function inheritHtmlElement<K extends keyof HTMLElementTagNameMap>(tagNam
     implements InheritedHtmlElement<K>
   {
     readonly inheritedTagName = tagName;
-    private readonly initializedAttribute = "component-initialized";
+    readonly initializedAttribute = "component-initialized";
-    node: HTMLElementTagNameMap[K];
+    node!: HTMLElementTagNameMap[K];
 
     connectedCallback(autoAddNode?: boolean) {
       // When nesting inherited elements, we might trigger the wrapping twice

core/static/core/accordion.scss

@@ -46,6 +46,10 @@ details.accordion>.accordion-content {
   border-bottom-right-radius: 3px;
   border-bottom-left-radius: 3px;
   overflow: hidden;
+
+  @media screen and (max-width: 600px) {
+    padding: .75em 1.5em;
+  }
 }
 
 @mixin animation($selector) {

core/static/core/components/card.scss

@@ -29,7 +29,12 @@
   align-items: center;
   gap: 20px;
 
-  &.clickable:hover {
+  &:disabled {
+    background-color: darken($primary-neutral-light-color, 5%);
+    opacity: 65%;
+  }
+
+  &.clickable:not(:disabled):hover {
     background-color: darken($primary-neutral-light-color, 5%);
   }
 

core/static/core/forms.scss

@@ -23,7 +23,7 @@
     border-radius: 5px;
     color: black;
 
-    &:hover {
+    &:not(.link-like):not(:disabled):hover {
       background: hsl(0, 0%, 83%);
     }
   }
@@ -141,7 +141,6 @@ form {
   display: block;
   margin: calc(var(--nf-input-size) * 1.5) auto 10px;
   line-height: 1;
-  white-space: nowrap;
 
   .fields-centered {
     padding: 10px 10px 0;

core/static/core/header.scss

@@ -123,7 +123,7 @@ $background-color-hovered: #283747;
       justify-content: center;
     }
 
-    >.button {
+    a.button {
       box-sizing: border-box;
       height: 35px;
       background-color: transparent;
@@ -139,7 +139,7 @@ $background-color-hovered: #283747;
       font-size: .9em;
       width: 120px;
 
-      &:hover {
+      &:not(.link-like):not(:disabled):hover {
         background-color: $background-color-hovered;
       }
     }

core/templates/core/base/header.jinja

@@ -22,14 +22,9 @@
         </form>
         <ul class="bars">
           {% cache 100 "counters_activity" %}
-                      {# The sith has no periodic tasks manager
+            {# It would be cleaner to handle the timeout with django-celery-beat,
-                         and using cron jobs would be way too overkill here.
+               but doing it here is simpler and less error-prone #}
-                         Thus the barmen timeout is handled in the only place that
+            {% do Counter.objects.filter(type="BAR").handle_timeout() %}
-                         is loaded on every page : the header bar.
-                         However, let's be clear : this has nothing to do here.
-                         It's' merely a contrived workaround that should
-                         replaced by a proper task manager as soon as possible. #}
-            {% set _ = Counter.objects.filter(type="BAR").handle_timeout() %}
           {% endcache %}
           {% for bar in Counter.objects.annotate_has_barman(user).annotate_is_open().filter(type="BAR") %}
             <li>

core/templates/core/base/notifications.jinja

@@ -10,7 +10,7 @@
   <template x-for="(message, index) in $notifications.getAll()">
     <div class="alert" :class="`alert-${message.tag}`" x-transition>
       <span class="alert-main" x-text="message.text"></span>
-      <span class="clickable" @click="messages = messages.filter((item, i) => i !== index)">
+      <span class="clickable" @click="$store.notifications = $store.notifications.filter((item, i) => i !== index)">
         <i class="fa fa-close"></i>
       </span>
     </div>

core/templatetags/renderer.py

@@ -25,14 +25,13 @@
 import datetime
 
 import phonenumbers
+from aemark import markdown as md
 from django import template
 from django.forms import BoundField
 from django.template.defaultfilters import stringfilter
 from django.utils.safestring import mark_safe
 from django.utils.translation import ngettext
 
-from core.markdown import markdown as md
-
 register = template.Library()
 
 

core/tests/test_core.py

@@ -18,6 +18,7 @@ from smtplib import SMTPException
 
 import freezegun
 import pytest
+from aemark import markdown
 from bs4 import BeautifulSoup
 from django.contrib.auth.hashers import make_password
 from django.contrib.auth.models import Permission
@@ -34,7 +35,6 @@ from pytest_django.asserts import assertInHTML, assertRedirects
 from antispam.models import ToxicDomain
 from club.models import Club
 from core.baker_recipes import subscriber_user
-from core.markdown import markdown
 from core.models import AnonymousUser, Group, Page, User, validate_promo
 from core.utils import get_last_promo, get_semester_code, get_start_of_semester
 from core.views import AllowFragment
@@ -200,31 +200,28 @@ class TestUserLogin:
     [
         (
             "[nom du lien](page://nomDeLaPage)",
-            '<a href="/page/nomDeLaPage/">nom du lien</a>',
+            '<a href="/page/nomDeLaPage">nom du lien</a>',
         ),
         ("__texte__", "<u>texte</u>"),
         ("~~***__texte__***~~", "<del><em><strong><u>texte</u></strong></em></del>"),
         (
             '![tst_alt](/img.png?50% "tst_title")',
-            '<img src="/img.png" alt="tst_alt" title="tst_title" style="width:50%;" />',
+            '<img src="/img.png" style="width:50%" alt="tst_alt" title="tst_title" />',
-        ),
-        (
-            "[texte](page://tst-page)",
-            '<a href="/page/tst-page/">texte</a>',
         ),
+        ("[texte](page://tst-page)", '<a href="/page/tst-page">texte</a>'),
         (
             "![](/img.png?50x450)",
-            '<img src="/img.png" alt="" style="width:50px;height:450px;" />',
+            '<img src="/img.png" style="width:50px;height:450px" alt="" />',
         ),
         ("![](/img.png)", '<img src="/img.png" alt="" />'),
         (
             "![](/img.png?50%x120%)",
-            '<img src="/img.png" alt="" style="width:50%;height:120%;" />',
+            '<img src="/img.png" style="width:50%;height:120%" alt="" />',
         ),
-        ("![](/img.png?50px)", '<img src="/img.png" alt="" style="width:50px;" />'),
+        ("![](/img.png?50px)", '<img src="/img.png" style="width:50px" alt="" />'),
         (
             "![](/img.png?50pxx120%)",
-            '<img src="/img.png" alt="" style="width:50px;height:120%;" />',
+            '<img src="/img.png" style="width:50px;height:120%" alt="" />',
         ),
         # when the image dimension has a wrong format, don't touch the url
         ("![](/img.png?50pxxxxxxxx)", '<img src="/img.png?50pxxxxxxxx" alt="" />'),
@@ -350,7 +347,7 @@ http://git.an
             <p><a href="http://git.an">http://git.an</a></p>
             <h1>Swag</h1>
             <p>&lt;guy&gt;Bibou&lt;/guy&gt;</p>
-            <p>&lt;script&gt;alert('Guy');&lt;/script&gt;</p>
+            &lt;script&gt;alert('Guy');&lt;/script&gt;
             """
         assertInHTML(expected, response.text)
 

core/tests/test_files.py

@@ -5,7 +5,6 @@ from typing import Callable
 from uuid import uuid4
 
 import pytest
-from django.conf import settings
 from django.core.cache import cache
 from django.core.files.uploadedfile import SimpleUploadedFile, UploadedFile
 from django.test import Client, TestCase
@@ -18,8 +17,8 @@ from pytest_django.asserts import assertNumQueries
 from core.baker_recipes import board_user, old_subscriber_user, subscriber_user
 from core.models import Group, QuickUploadImage, SithFile, User
 from core.utils import RED_PIXEL_PNG
-from sas.baker_recipes import picture_recipe
 from sas.models import Picture
+from sith import settings
 
 
 @pytest.mark.django_db
@@ -31,19 +30,24 @@ class TestImageAccess:
             lambda: baker.make(
                 User, groups=[Group.objects.get(pk=settings.SITH_GROUP_SAS_ADMIN_ID)]
             ),
+            lambda: baker.make(
+                User, groups=[Group.objects.get(pk=settings.SITH_GROUP_COM_ADMIN_ID)]
+            ),
         ],
     )
     def test_sas_image_access(self, user_factory: Callable[[], User]):
         """Test that only authorized users can access the sas image."""
         user = user_factory()
-        picture = picture_recipe.make()
+        picture: SithFile = baker.make(
-        assert user.can_edit(picture)
+            Picture, parent=SithFile.objects.get(pk=settings.SITH_SAS_ROOT_DIR_ID)
+        )
+        assert picture.is_owned_by(user)
 
     def test_sas_image_access_owner(self):
         """Test that the owner of the image can access it."""
         user = baker.make(User)
-        picture = picture_recipe.make(owner=user)
+        picture: Picture = baker.make(Picture, owner=user)
-        assert user.can_edit(picture)
+        assert picture.is_owned_by(user)
 
     @pytest.mark.parametrize(
         "user_factory",
@@ -59,41 +63,7 @@ class TestImageAccess:
         user = user_factory()
         owner = baker.make(User)
         picture: Picture = baker.make(Picture, owner=owner)
-        assert not user.can_edit(picture)
+        assert not picture.is_owned_by(user)
-
-
-@pytest.mark.django_db
-class TestUserPicture:
-    def test_anonymous_user_unauthorized(self, client):
-        """An anonymous user shouldn't have access to an user's photo page."""
-        response = client.get(
-            reverse(
-                "sas:user_pictures",
-                kwargs={"user_id": User.objects.get(username="sli").pk},
-            )
-        )
-        assert response.status_code == 403
-
-    @pytest.mark.parametrize(
-        ("username", "status"),
-        [
-            ("guy", 403),
-            ("root", 200),
-            ("skia", 200),
-            ("sli", 200),
-        ],
-    )
-    def test_page_is_working(self, client, username, status):
-        """Only user that subscribed (or admins) should be able to see the page."""
-        # Test for simple user
-        client.force_login(User.objects.get(username=username))
-        response = client.get(
-            reverse(
-                "sas:user_pictures",
-                kwargs={"user_id": User.objects.get(username="sli").pk},
-            )
-        )
-        assert response.status_code == status
 
 
 # TODO: many tests on the pages:

core/tests/test_page.py

@@ -2,6 +2,7 @@ from datetime import timedelta
 
 import freezegun
 import pytest
+from aemark import markdown
 from bs4 import BeautifulSoup
 from django.conf import settings
 from django.contrib.auth.models import Permission
@@ -13,7 +14,6 @@ from pytest_django.asserts import assertHTMLEqual, assertRedirects
 
 from club.models import Club, Membership
 from core.baker_recipes import board_user, subscriber_user
-from core.markdown import markdown
 from core.models import AnonymousUser, Page, PageRev, User
 
 

core/tests/test_user.py

@@ -27,7 +27,6 @@ from counter.baker_recipes import sale_recipe
 from counter.models import Counter, Customer, Permanency, Refilling, Selling
 from counter.utils import is_logged_in_counter
 from eboutic.models import Invoice, InvoiceItem
-from sas.models import Picture
 
 
 class TestSearchUsers(TestCase):
@@ -35,7 +34,7 @@ class TestSearchUsers(TestCase):
     def setUpTestData(cls):
         # News.author has on_delete=PROTECT, so news must be deleted beforehand
         News.objects.all().delete()
-        Picture.objects.all().delete()  # same for pictures
+        SithFile.objects.all().delete()
         User.objects.all().delete()
         user_recipe = Recipe(
             User,
@@ -201,7 +200,11 @@ class TestFilterInactive(TestCase):
         ]
         sale_recipe.make(customer=cls.users[3].customer, date=time_active)
         baker.make(
-            Refilling, customer=cls.users[4].customer, date=time_active, counter=counter
+            Refilling,
+            customer=cls.users[4].customer,
+            date=time_active,
+            counter=counter,
+            amount=1,
         )
         sale_recipe.make(customer=cls.users[5].customer, date=time_inactive)
 
@@ -456,7 +459,9 @@ def test_user_preferences(client: Client):
 @pytest.mark.django_db
 def test_user_stats(client: Client):
     user = subscriber_user.make()
-    baker.make(Refilling, customer=user.customer, amount=99999)
+    baker.make(
+        Refilling, customer=user.customer, amount=settings.SITH_ACCOUNT_MAX_MONEY
+    )
     bars = [b[0] for b in settings.SITH_COUNTER_BARS]
     baker.make(
         Permanency,

core/utils.py

@@ -12,23 +12,18 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
-from dataclasses import dataclass
+
 from datetime import date, timedelta
 
 # Image utils
 from io import BytesIO
-from typing import Any, Final, Unpack
+from typing import Final
 
 import PIL
 from django.conf import settings
 from django.core.files.base import ContentFile
 from django.core.files.uploadedfile import UploadedFile
-from django.db import models
+from django.http import HttpRequest
-from django.forms import BaseForm
-from django.http import Http404, HttpRequest
-from django.shortcuts import get_list_or_404
-from django.template.loader import render_to_string
-from django.utils.safestring import SafeString
 from django.utils.timezone import localdate
 from PIL.Image import Image, Resampling
 
@@ -46,21 +41,6 @@ to generate a dummy image that is considered valid nonetheless
 """
 
 
-@dataclass
-class FormFragmentTemplateData[T: BaseForm]:
-    """Dataclass used to pre-render form fragments"""
-
-    form: T
-    template: str
-    context: dict[str, Any]
-
-    def render(self, request: HttpRequest) -> SafeString:
-        # Request is needed for csrf_tokens
-        return render_to_string(
-            self.template, context={"form": self.form, **self.context}, request=request
-        )
-
-
 def get_start_of_semester(today: date | None = None) -> date:
     """Return the date of the start of the semester of the given date.
     If no date is given, return the start date of the current semester.
@@ -208,56 +188,3 @@ def get_client_ip(request: HttpRequest) -> str | None:
             return ip
 
     return None
-
-
-Filterable = type[models.Model] | models.QuerySet | models.Manager
-ListFilter = dict[str, list | tuple | set]
-
-
-def get_list_exact_or_404(klass: Filterable, **kwargs: Unpack[ListFilter]) -> list:
-    """Use filter() to return a list of objects from a list of unique keys (like ids)
-    or raises Http404 if the list has not the same length as the given one.
-
-    Work like `get_object_or_404()` but for lists of objects, with some caveats :
-
-    - The filter must be a list, a tuple or a set.
-    - There can't be more than exactly one filter.
-    - There must be no duplicate in the filter.
-    - The filter should consist in unique keys (like ids), or it could fail randomly.
-
-    klass may be a Model, Manager, or QuerySet object. All other passed
-    arguments and keyword arguments are used in the filter() query.
-
-    Raises:
-        Http404: If the list is empty or doesn't have as many elements as the keys list.
-        ValueError: If the first argument is not a Model, Manager, or QuerySet object.
-        ValueError: If more than one filter is passed.
-        TypeError: If the given filter is not a list, a tuple or a set.
-
-    Examples:
-        Get all the products with ids 1, 2, 3: ::
-
-            products = get_list_exact_or_404(Product, id__in=[1, 2, 3])
-
-        Don't work with duplicate ids: ::
-
-            products = get_list_exact_or_404(Product, id__in=[1, 2, 3, 3])
-            # Raises Http404: "The list of keys must contain no duplicates."
-    """
-    if len(kwargs) > 1:
-        raise ValueError("get_list_exact_or_404() only accepts one filter.")
-    key, list_filter = next(iter(kwargs.items()))
-    if not isinstance(list_filter, (list, tuple, set)):
-        raise TypeError(
-            f"The given filter must be a list, a tuple or a set, not {type(list_filter)}"
-        )
-    if len(list_filter) != len(set(list_filter)):
-        raise ValueError("The list of keys must contain no duplicates.")
-    kwargs = {key: list_filter}
-    obj_list = get_list_or_404(klass, **kwargs)
-    if len(obj_list) != len(list_filter):
-        raise Http404(
-            "The given list of keys doesn't match the number of objects found."
-            f"Expected {len(list_filter)} items, got {len(obj_list)}."
-        )
-    return obj_list

core/views/files.py

@@ -374,7 +374,7 @@ class FileDeleteView(AllowFragment, CanEditPropMixin, DeleteView):
 class FileModerationView(AllowFragment, ListView):
     model = SithFile
     template_name = "core/file_moderation.jinja"
-    queryset = SithFile.objects.filter(is_moderated=False)
+    queryset = SithFile.objects.filter(is_moderated=False, is_in_sas=False)
     ordering = "id"
     paginate_by = 100
 

counter/fields.py

@@ -1,22 +1,68 @@
 from decimal import Decimal
 
 from django.conf import settings
+from django.core import checks
+from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db import models
+from django.utils.functional import cached_property
 
 
 class CurrencyField(models.DecimalField):
     """Custom database field used for currency."""
 
-    def __init__(self, *args, **kwargs):
+    def __init__(
-        kwargs["max_digits"] = 12
+        self, verbose_name=None, name=None, min_value=None, max_value=None, **kwargs
-        kwargs["decimal_places"] = 2
+    ):
-        super().__init__(*args, **kwargs)
+        kwargs.update({"max_digits": 12, "decimal_places": 2})
+        self.min_value = min_value
+        self.max_value = max_value
+        super().__init__(verbose_name, name, **kwargs)
 
     def to_python(self, value):
         if value is None:
             return None
         return super().to_python(value).quantize(Decimal("0.01"))
 
+    @cached_property
+    def validators(self):
+        res = []
+        if self.max_value:
+            res.append(MaxValueValidator(self.max_value))
+        if self.min_value:
+            res.append(MinValueValidator(self.min_value))
+        return [*super().validators, *res]
+
+    def check(self, **kwargs):  # pragma: no cover
+        # this is executed during runserver, but won't run in prod
+        errors = super().check(**kwargs)
+        for name, val in ("min_value", self.min_value), ("max_value", self.max_value):
+            if not val:
+                continue
+            try:
+                float(val)
+            except ValueError:
+                errors.append(
+                    checks.Error(
+                        f"CurrencyField.{name} must be a valid float",
+                        obj=self,
+                        id="sith.E001",
+                    )
+                )
+        return errors
+
+    def formfield(self, **kwargs):
+        return super().formfield(
+            **{"min_value": self.min_value, "max_value": self.max_value, **kwargs}
+        )
+
+    def deconstruct(self):
+        name, path, args, kwargs = super().deconstruct()
+        if self.min_value is not None:
+            kwargs["min_value"] = self.min_value
+        if self.max_value is not None:
+            kwargs["max_value"] = self.max_value
+        return name, path, args, kwargs
+
 
 if settings.TESTING:
     from model_bakery import baker

counter/forms.py

@@ -3,12 +3,16 @@ import math
 import uuid
 from collections import defaultdict
 from datetime import date, datetime, timezone
+from typing import ClassVar
 
 from dateutil.relativedelta import relativedelta
 from django import forms
+from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.db.models import Exists, OuterRef, Q
 from django.forms import BaseModelFormSet
+from django.http import HttpRequest
+from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_celery_beat.models import ClockedSchedule
@@ -17,6 +21,7 @@ from phonenumber_field.widgets import RegionalPhoneNumberWidget
 from club.models import Club
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.models import User, UserQuerySet
+from core.views import LoginForm
 from core.views.forms import (
     FutureDateTimeField,
     NFCTextInput,
@@ -37,6 +42,7 @@ from counter.models import (
     Customer,
     Eticket,
     InvoiceCall,
+    Permanency,
     Price,
     Product,
     ProductFormula,
@@ -91,30 +97,18 @@ class StudentCardForm(forms.ModelForm):
 
 
 class GetUserForm(forms.Form):
-    """The Form class aims at providing a valid user_id field in its cleaned data, in order to pass it to some view,
+    """Find a user to show its click page."""
-    reverse function, or any other use.
-
-    The Form implements a nice JS widget allowing the user to type a customer account id, or search the database with
-    some nickname, first name, or last name (TODO)
-    """
 
     code = forms.CharField(
         label="Code",
         max_length=StudentCard.UID_SIZE,
         required=False,
-        widget=NFCTextInput,
+        widget=NFCTextInput(attrs={"autofocus": True}),
     )
     id = forms.CharField(
-        label=_("Select user"),
+        label=_("Select user"), widget=AutoCompleteSelectUser, required=False
-        help_text=None,
-        widget=AutoCompleteSelectUser,
-        required=False,
     )
 
-    def as_p(self):
-        self.fields["code"].widget.attrs["autofocus"] = True
-        return super().as_p()
-
     def clean(self):
         cleaned_data = super().clean()
         customer = None
@@ -136,11 +130,41 @@ class GetUserForm(forms.Form):
 
         if customer is None or not customer.can_buy:
             raise forms.ValidationError(_("User not found"))
-        cleaned_data["user_id"] = customer.user.id
+        cleaned_data["user_id"] = customer.user_id
         cleaned_data["user"] = customer.user
         return cleaned_data
 
 
+class CounterLoginForm(LoginForm):
+    """LoginForm to log a barman in a counter.
+
+    To be able to log in a counter, a user must :
+
+    - be part of the sellers of the given counter
+    - not being already logged in any counter
+    """
+
+    def __init__(self, *args, request: HttpRequest, counter: Counter, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.counter = counter
+        self.request = request
+
+    def confirm_login_allowed(self, user: User):
+        super().confirm_login_allowed(user)
+        if not self.counter.sellers.contains(user):
+            raise ValidationError(
+                message=_("You are not a barman of this counter."), code="not_barman"
+            )
+        if Permanency.objects.filter(end=None, user=user).exists():
+            if user in self.request.barmen:
+                message = _("You are already logged in this counter.")
+            elif user in self.counter.barmen_list:
+                message = _("You are already logged in another counter.")
+            else:
+                message = _("You are already logged on another device")
+            raise ValidationError(message=message, code="already_logged_in")
+
+
 class RefillForm(forms.ModelForm):
     allowed_refilling_methods = [
         Refilling.PaymentMethod.CASH,
@@ -149,18 +173,19 @@ class RefillForm(forms.ModelForm):
 
     error_css_class = "error"
     required_css_class = "required"
-    amount = forms.FloatField(
-        min_value=0, widget=forms.NumberInput(attrs={"class": "focus"})
-    )
 
     class Meta:
         model = Refilling
         fields = ["amount", "payment_method"]
         widgets = {"payment_method": forms.RadioSelect}
 
-    def __init__(self, *args, **kwargs):
+    def __init__(
+        self, *args, counter: Counter, operator: User, customer: Customer, **kwargs
+    ):
         super().__init__(*args, **kwargs)
-
+        max_value = settings.SITH_ACCOUNT_MAX_MONEY - customer.amount
+        # server-side max_value validation is done by Refilling.clean
+        self.fields["amount"].widget.attrs["max"] = max_value
         self.fields["payment_method"].choices = (
             method
             for method in self.fields["payment_method"].choices
@@ -168,6 +193,9 @@ class RefillForm(forms.ModelForm):
         )
         if self.fields["payment_method"].initial not in self.allowed_refilling_methods:
             self.fields["payment_method"].initial = self.allowed_refilling_methods[0]
+        self.instance.counter = counter
+        self.instance.operator = operator
+        self.instance.customer = customer
 
 
 class CounterEditForm(forms.ModelForm):
@@ -409,6 +437,7 @@ class ProductForm(forms.ModelForm):
             "club",
             "limit_age",
             "tray",
+            "clic_limit",
             "archived",
         ]
         help_texts = {
@@ -540,16 +569,7 @@ class BasketItemForm(forms.Form):
     quantity = forms.IntegerField(min_value=1, required=True)
     price_id = forms.IntegerField(min_value=0, required=True)
 
-    def __init__(
+    def __init__(self, allowed_prices: dict[int, Price], *args, **kwargs):
-        self,
-        customer: Customer,
-        counter: Counter,
-        allowed_prices: dict[int, Price],
-        *args,
-        **kwargs,
-    ):
-        self.customer = customer  # Used by formset
-        self.counter = counter  # Used by formset
         self.allowed_prices = allowed_prices
         super().__init__(*args, **kwargs)
 
@@ -584,6 +604,15 @@ class BasketItemForm(forms.Form):
 
 
 class BaseBasketForm(forms.BaseFormSet):
+    # Minimum amount of money there must be on the account after the transaction
+    # If None, the min balance check is skipped
+    min_result_balance: ClassVar[int | None] = 0
+
+    def __init__(self, *args, customer: Customer, counter: Counter, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.customer = customer
+        self.counter = counter
+
     def clean(self):
         self.forms = [form for form in self.forms if form.cleaned_data != {}]
 
@@ -592,8 +621,8 @@ class BaseBasketForm(forms.BaseFormSet):
 
         self._check_forms_have_errors()
         self._check_product_are_unique()
-        self._check_recorded_products(self[0].customer)
+        self._check_recorded_products()
-        self._check_enough_money(self[0].counter, self[0].customer)
+        self._check_account_balance()
 
     def _check_forms_have_errors(self):
         if any(len(form.errors) > 0 for form in self):
@@ -604,12 +633,35 @@ class BaseBasketForm(forms.BaseFormSet):
         if len(price_ids) != len(self.forms):
             raise forms.ValidationError(_("Duplicated product entries."))
 
-    def _check_enough_money(self, counter: Counter, customer: Customer):
+    @cached_property
-        self.total_price = sum([data["total_price"] for data in self.cleaned_data])
+    def total_price(self):
-        if self.total_price > customer.amount:
+        refill = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING
-            raise forms.ValidationError(_("Not enough money"))
+        total_other = sum(
+            form.cleaned_data["total_price"]
+            for form in self.forms
+            if form.price.product.product_type_id != refill
+        )
+        total_refill = sum(
+            form.cleaned_data["total_price"]
+            for form in self.forms
+            if form.price.product.product_type_id == refill
+        )
+        return total_other - total_refill
 
-    def _check_recorded_products(self, customer: Customer):
+    def _check_account_balance(self):
+        result_balance = self.customer.amount - self.total_price
+        if (
+            self.min_result_balance is not None
+            and self.min_result_balance > result_balance
+        ):
+            raise forms.ValidationError(_("Not enough money"))
+        if result_balance > settings.SITH_ACCOUNT_MAX_MONEY:
+            raise ValidationError(
+                _("There cannot be more than %(money)d€ on an AE account")
+                % {"money": settings.SITH_ACCOUNT_MAX_MONEY}
+            )
+
+    def _check_recorded_products(self):
         """Check for, among other things, ecocups and pitchers"""
         items = defaultdict(int)
         for form in self.forms:
@@ -618,7 +670,7 @@ class BaseBasketForm(forms.BaseFormSet):
         returnables = list(
             ReturnableProduct.objects.filter(
                 Q(product_id__in=ids) | Q(returned_product_id__in=ids)
-            ).annotate_balance_for(customer)
+            ).annotate_balance_for(self.customer)
         )
         limit_reached = []
         for returnable in returnables:

counter/middleware.py

@@ -0,0 +1,66 @@
+from typing import TYPE_CHECKING, Callable
+
+from django.http import HttpRequest, HttpResponse
+from django.utils.functional import SimpleLazyObject
+
+from core.models import User
+from counter.models import Permanency
+
+if TYPE_CHECKING:
+    from django.contrib.sessions.backends.base import SessionBase
+
+
+SESSION_PERMANENCES_KEY = "permanence_ids"
+
+
+def get_cached_barmen(request: HttpRequest) -> set[User]:
+    if not hasattr(request, "_cached_barmen"):
+        session: SessionBase = request.session
+
+        if session_ids := session.get(SESSION_PERMANENCES_KEY, None):
+            # Get ongoing permanences which id is in session.
+            # Note : we store permanence ids rather than user id to be sure
+            # not to wrongfully mark someone as logged here,
+            # even if it logged out then logged in elsewhere.
+            permanences = (
+                Permanency.objects.filter(end=None, id__in=session_ids)
+                .order_by("id")
+                .select_related("user")
+            )
+
+            # if the list of permanences occurring on this device has changed
+            # since the last page load, change the ids stored in session
+            real_ids = [p.id for p in permanences]
+            if real_ids != session_ids:
+                session[SESSION_PERMANENCES_KEY] = real_ids
+
+            request._cached_barmen = {p.user for p in permanences}
+        else:
+            request._cached_barmen = set()
+
+    return request._cached_barmen
+
+
+class BarmenMiddleware:
+    """Inject barmen logged in the current session.
+
+    In a similar fashion as `request.user`, `request.barmen` contains
+    users that are barmen in the current session, and ONLY them ;
+    if a user is logged as a barman on another session,
+    it will not be in `request.barmen`.
+
+    Notes:
+        In case of ended permanence, users will be automatically
+        removed from `request.barmen`.
+        However, in case of newly started permanence, this middleware
+        cannot add new barmen in the session data, so that operation
+        must be explicitly done in the barman login view.
+    """
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest):
+        request.barmen = SimpleLazyObject(lambda: get_cached_barmen(request))
+
+        return self.get_response(request)

counter/migrations/0040_product_clic_limit.py

@@ -0,0 +1,25 @@
+# Generated by Django 5.2.13 on 2026-05-13 11:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0039_price")]
+
+    operations = [
+        migrations.RemoveField(model_name="product", name="buying_groups"),
+        migrations.AddField(
+            model_name="product",
+            name="clic_limit",
+            field=models.PositiveSmallIntegerField(
+                blank=True,
+                help_text=(
+                    "If a limit is set, the product won't be purchasable "
+                    "anymore on the eboutic once the latter is reached."
+                ),
+                null=True,
+                verbose_name="clic limit",
+            ),
+        ),
+        migrations.RemoveField(model_name="counter", name="token"),
+    ]

counter/migrations/0041_alter_billinginfo_country_and_more.py

@@ -0,0 +1,26 @@
+# Generated by Django 5.2.14 on 2026-06-02 10:45
+
+import django_countries.fields
+import phonenumber_field.modelfields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0040_product_clic_limit")]
+
+    operations = [
+        migrations.AlterField(
+            model_name="billinginfo",
+            name="country",
+            field=django_countries.fields.CountryField(
+                max_length=2, verbose_name="Country"
+            ),
+        ),
+        migrations.AlterField(
+            model_name="billinginfo",
+            name="phone_number",
+            field=phonenumber_field.modelfields.PhoneNumberField(
+                max_length=128, region=None, verbose_name="Phone number"
+            ),
+        ),
+    ]

counter/migrations/0042_alter_customer_amount_alter_refilling_amount.py

@@ -0,0 +1,30 @@
+# Generated by Django 5.2.15 on 2026-06-07 12:08
+
+from django.db import migrations
+
+import counter.fields
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0041_alter_billinginfo_country_and_more")]
+
+    operations = [
+        migrations.AlterField(
+            model_name="customer",
+            name="amount",
+            field=counter.fields.CurrencyField(
+                decimal_places=2,
+                default=0,
+                max_digits=12,
+                max_value=250,
+                verbose_name="amount",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="refilling",
+            name="amount",
+            field=counter.fields.CurrencyField(
+                decimal_places=2, max_digits=12, min_value=0.01, verbose_name="amount"
+            ),
+        ),
+    ]

counter/models.py

@@ -22,18 +22,19 @@ import string
 from datetime import date, datetime, timedelta
 from datetime import timezone as tz
 from decimal import Decimal
-from typing import TYPE_CHECKING, Literal, Self
+from typing import Literal, Self
 
 from dict2xml import dict2xml
 from django.conf import settings
 from django.core.validators import MinLengthValidator
 from django.db import models
-from django.db.models import Exists, F, OuterRef, Q, QuerySet, Subquery, Sum, Value
+from django.db.models import Exists, F, Max, OuterRef, Q, QuerySet, Subquery, Sum, Value
 from django.db.models.functions import Coalesce, Concat, Length
 from django.forms import ValidationError
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_celery_beat.models import PeriodicTask
 from django_countries.fields import CountryField
@@ -47,9 +48,6 @@ from core.utils import get_start_of_semester
 from counter.fields import CurrencyField
 from subscription.models import Subscription
 
-if TYPE_CHECKING:
-    from collections.abc import Sequence
-
 
 def get_eboutic() -> Counter:
     return Counter.objects.filter(type="EBOUTIC").order_by("id").first()
@@ -101,7 +99,9 @@ class Customer(models.Model):
 
     user = models.OneToOneField(User, primary_key=True, on_delete=models.CASCADE)
     account_id = models.CharField(_("account id"), max_length=10, unique=True)
-    amount = CurrencyField(_("amount"), default=0)
+    amount: CurrencyField = CurrencyField(
+        _("amount"), max_value=settings.SITH_ACCOUNT_MAX_MONEY, default=0
+    )
 
     objects = CustomerQuerySet.as_manager()
 
@@ -158,13 +158,15 @@ class Customer(models.Model):
             unique_fields=["customer", "returnable"],
         )
 
-    @property
+    @cached_property
     def can_buy(self) -> bool:
         """Check if whether this customer has the right to purchase any item."""
-        subscription = self.user.subscriptions.order_by("subscription_end").last()
+        subscription_end = self.user.subscriptions.aggregate(
-        if subscription is None:
+            res=Max("subscription_end")
+        ).get("res")
+        if subscription_end is None:
             return False
-        return (date.today() - subscription.subscription_end) < timedelta(days=90)
+        return (date.today() - subscription_end) < timedelta(days=90)
 
     @classmethod
     def get_or_create(cls, user: User) -> tuple[Customer, bool]:
@@ -230,15 +232,8 @@ class BillingInfo(models.Model):
     address_2 = models.CharField(_("Address 2"), max_length=50, blank=True, null=True)
     zip_code = models.CharField(_("Zip code"), max_length=16)  # code postal
     city = models.CharField(_("City"), max_length=50)
-    country = CountryField(blank_label=_("Country"))
+    country = CountryField(_("Country"))
-
+    phone_number = PhoneNumberField(_("Phone number"))
-    # This table was created during the A22 semester.
-    # However, later on, CA asked for the phone number to be added to the billing info.
-    # As the table was already created, this new field had to be nullable,
-    # even tough it is required by the bank and shouldn't be null.
-    # If one day there is no null phone number remaining,
-    # please make the field non-nullable.
-    phone_number = PhoneNumberField(_("Phone number"), null=True, blank=False)
 
     def __str__(self):
         return f"{self.first_name} {self.last_name}"
@@ -353,6 +348,40 @@ class ProductType(OrderedModel):
         return user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
 
 
+class ProductQuerySet(models.QuerySet):
+    def under_clic_limit(self) -> Self:
+        """Filter product which clic limit isn't reached yet.
+
+        The clic limit is reached when the amount of sales
+        and of items in a basket for less than 15 minutes
+        is greater or equal than `Product.clic_limit`.
+        """
+        # import here to avoid circular import
+        from eboutic.models import BasketItem
+
+        nb_click_subquery = Subquery(
+            Selling.objects.filter(product_id=OuterRef("id"))
+            .values("product_id")
+            .annotate(res=Sum("quantity", default=0))
+            .values("res")[:1]
+        )
+        nb_basket_items_subquery = Subquery(
+            BasketItem.objects.filter(
+                product_id=OuterRef("id"),
+                basket__date__gt=now()
+                - settings.SITH_EBOUTIC_BASKET_TIMEOUT
+                - settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT,
+            )
+            .values("product_id")
+            .annotate(res=Sum("quantity"))
+            .values("res")[:1]
+        )
+        return self.annotate(
+            clicked=Coalesce(nb_click_subquery, 0),
+            reserved=Coalesce(nb_basket_items_subquery, 0),
+        ).filter(Q(clic_limit=None) | Q(clic_limit__gt=(F("clicked") + F("reserved"))))
+
+
 class Product(models.Model):
     """A product, with all its related information."""
 
@@ -370,8 +399,7 @@ class Product(models.Model):
     )
     code = models.CharField(_("code"), max_length=16, blank=True)
     purchase_price = CurrencyField(
-        _("purchase price"),
+        _("purchase price"), help_text=_("Initial cost of purchasing the product")
-        help_text=_("Initial cost of purchasing the product"),
     )
     icon = ResizedImageField(
         height=70,
@@ -388,13 +416,21 @@ class Product(models.Model):
     tray = models.BooleanField(
         _("tray price"), help_text=_("Buy five, get the sixth free"), default=False
     )
-    buying_groups = models.ManyToManyField(
+    clic_limit = models.PositiveSmallIntegerField(
-        Group, related_name="products", verbose_name=_("buying groups"), blank=True
+        _("clic limit"),
+        help_text=_(
+            "If a limit is set, the product won't be purchasable "
+            "anymore on the eboutic once the latter is reached."
+        ),
+        null=True,
+        blank=True,
     )
     archived = models.BooleanField(_("archived"), default=False)
     created_at = models.DateTimeField(_("created at"), auto_now_add=True)
     updated_at = models.DateTimeField(_("updated at"), auto_now=True)
 
+    objects = ProductQuerySet.as_manager()
+
     class Meta:
         verbose_name = _("product")
 
@@ -580,7 +616,6 @@ class Counter(models.Model):
     view_groups = models.ManyToManyField(
         Group, related_name="viewable_counters", blank=True
     )
-    token = models.CharField(_("token"), max_length=30, null=True, blank=True)
 
     objects = CounterQuerySet.as_manager()
 
@@ -733,10 +768,8 @@ class Counter(models.Model):
         # but they share the same primary key
         return self.type == "BAR" and any(b.pk == customer.pk for b in self.barmen_list)
 
-    def get_prices_for(
+    def get_prices_for(self, customer: Customer) -> PriceQuerySet:
-        self, customer: Customer, *, order_by: Sequence[str] | None = None
+        return (
-    ) -> list[Price]:
-        qs = (
             Price.objects.filter(
                 product__counters=self, product__product_type__isnull=False
             )
@@ -744,9 +777,6 @@ class Counter(models.Model):
             .select_related("product", "product__product_type")
             .prefetch_related("groups")
         )
-        if order_by:
-            qs = qs.order_by(*order_by)
-        return list(qs)
 
 
 class CounterSellers(models.Model):
@@ -797,7 +827,7 @@ class Refilling(models.Model):
     counter = models.ForeignKey(
         Counter, related_name="refillings", blank=False, on_delete=models.CASCADE
     )
-    amount = CurrencyField(_("amount"))
+    amount: CurrencyField = CurrencyField(_("amount"), min_value=0.01)
     operator = models.ForeignKey(
         User,
         related_name="refillings_as_operator",
@@ -851,6 +881,14 @@ class Refilling(models.Model):
             return False
         return user.is_owner(self.counter) and self.payment_method != "CARD"
 
+    def clean(self):
+        super().clean()
+        if (self.amount + self.customer.amount) > settings.SITH_ACCOUNT_MAX_MONEY:
+            raise ValidationError(
+                _("There cannot be more than %(money)d€ on an AE account")
+                % {"money": settings.SITH_ACCOUNT_MAX_MONEY}
+            )
+
     def delete(self, *args, **kwargs):
         self.customer.amount -= self.amount
         self.customer.save()
@@ -1079,7 +1117,7 @@ class Permanency(models.Model):
         on_delete=models.CASCADE,
     )
     start = models.DateTimeField(_("start date"))
-    end = models.DateTimeField(_("end date"), null=True, db_index=True)
+    end = models.DateTimeField(_("end date"), null=True, blank=True, db_index=True)
     activity = models.DateTimeField(_("last activity date"), auto_now=True)
 
     class Meta:

counter/signals.py

@@ -20,41 +20,34 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
+import random
 
 from django.db.models.signals import pre_delete
 from django.dispatch import receiver
 
 from core.middleware import get_signal_request
 from core.models import OperationLog
-from counter.models import Counter, Refilling, Selling
+from counter.models import Refilling, Selling
 
 
-def write_log(instance, operation_type):
+def write_log(instance: Selling | Refilling, operation_type):
     def get_user():
         request = get_signal_request()
 
         if not request:
             return None
 
-        # Get a random barmen if deletion is from a counter
+        if request.barmen:
-        session = getattr(request, "session", {})
+            return random.choice(list(request.barmen))
-        session_token = session.get("counter_token", None)
-        if session_token:
-            counter = Counter.objects.filter(token=session_token).first()
-            if counter and len(counter.barmen_list) > 0:
-                return counter.get_random_barman()
 
         # Get the current logged user if not from a counter
-        if request.user and not request.user.is_anonymous:
+        if request.user.is_authenticated:
             return request.user
 
-        # Return None by default
         return None
 
     OperationLog(
-        label=str(instance),
+        label=str(instance), operator=get_user(), operation_type=operation_type
-        operator=get_user(),
-        operation_type=operation_type,
     ).save()
 
 

counter/static/bundled/counter/components/ajax-select-index.ts

@@ -1,7 +1,7 @@
-import type { TomOption } from "tom-select/dist/types/types";
+import type { TomOption } from "tom-select/src/types";
-import type { escape_html } from "tom-select/dist/types/utils";
+import type { escape_html } from "tom-select/src/utils";
-import { AjaxSelect } from "#core:core/components/ajax-select-base.ts";
+import { AjaxSelect } from "#core:core/components/ajax-select-base";
-import { registerComponent } from "#core:utils/web-components.ts";
+import { registerComponent } from "#core:utils/web-components";
 import {
   type CounterSchema,
   counterSearchCounter,
@@ -28,14 +28,18 @@ export class ProductAjaxSelect extends AjaxSelect {
     return [];
   }
 
+  private getName(item: SimpleProductSchema, sanitize: typeof escape_html): string {
+    return item.code ? `${sanitize(item.code)} - ${sanitize(item.name)}` : item.name;
+  }
+
   protected renderOption(item: SimpleProductSchema, sanitize: typeof escape_html) {
     return `<div class="select-item">
-            <span class="select-item-text">${sanitize(item.code)} - ${sanitize(item.name)}</span>
+            <span class="select-item-text">${this.getName(item, sanitize)}</span>
           </div>`;
   }
 
   protected renderItem(item: SimpleProductSchema, sanitize: typeof escape_html) {
-    return `<span>${sanitize(item.code)} - ${sanitize(item.name)}</span>`;
+    return `<span>${this.getName(item, sanitize)}</span>`;
   }
 }
 
@@ -44,7 +48,7 @@ export class ProductTypeAjaxSelect extends AjaxSelect {
   protected valueField = "id";
   protected labelField = "name";
   protected searchField = ["name"];
-  private productTypes = null as ProductTypeSchema[];
+  private productTypes = null as ProductTypeSchema[] | null;
 
   protected async search(query: string): Promise<TomOption[]> {
     // The production database has a grand total of 26 product types
@@ -52,7 +56,7 @@ export class ProductTypeAjaxSelect extends AjaxSelect {
     // Thus, it's appropriate to fetch all product types during first use,
     // then to reuse the result again and again.
     if (this.productTypes === null) {
-      this.productTypes = (await producttypeFetchAll()).data || null;
+      this.productTypes = (await producttypeFetchAll()).data || [];
     }
     return this.productTypes.filter((t) =>
       t.name.toLowerCase().includes(query.toLowerCase()),

counter/static/bundled/counter/components/counter-product-select-index.ts

@@ -1,12 +1,12 @@
-import type { RecursivePartial, TomSettings } from "tom-select/dist/types/types";
+import type { RecursivePartial, TomSettings } from "tom-select/src/types";
-import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base.ts";
+import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base";
-import { registerComponent } from "#core:utils/web-components.ts";
+import { registerComponent } from "#core:utils/web-components";
 
 const productParsingRegex = /^(\d+x)?(.*)/i;
 const codeParsingRegex = / \((\w+)\)$/;
 
 function parseProduct(query: string): [number, string] {
-  const parsed = productParsingRegex.exec(query);
+  const parsed = productParsingRegex.exec(query) as RegExpExecArray;
   return [Number.parseInt(parsed[1] || "1", 10), parsed[2]];
 }
 
@@ -59,17 +59,10 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
         return onOptionSelect.call(
           this.widget,
           evt,
-          this.widget.getOption(value, true),
+          this.widget.getOption(value, true) as HTMLElement,
         );
       },
     );
-
-    this.widget.hook("after", "onOptionSelect", () => {
-      /* Focus the next element if it's an input */
-      if (this.nextElementSibling.nodeName === "INPUT") {
-        (this.nextElementSibling as HTMLInputElement).focus();
-      }
-    });
   }
   protected tomSelectSettings(): RecursivePartial<TomSettings> {
     /* We disable the dropdown on focus because we're going to always autofocus the widget */
@@ -77,14 +70,15 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
       ...super.tomSelectSettings(),
       openOnFocus: false,
       // We make searching on exact code matching a higher priority
-      // We need to manually set weights or it results on an inconsistent
+      // We need to manually set weights, or it results on an inconsistent
       // behavior between production and development environment
+      //
+      // SearchField can be an object array (according to the docs),
+      // but it is unproperly typed, so we must force-cast to trick TS
       searchField: [
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "code", weight: 2 },
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "text", weight: 0.5 },
-      ],
+      ] as unknown as string[],
     };
   }
 }

counter/static/bundled/counter/counter-click-index.ts

@@ -3,7 +3,6 @@ import { BasketItem } from "#counter:counter/basket";
 import type {
   CounterConfig,
   CounterItem,
-  ErrorMessage,
   ProductFormula,
 } from "#counter:counter/types";
 import type { CounterProductSelect } from "./components/counter-product-select-index";
@@ -24,21 +23,24 @@ document.addEventListener("alpine:init", () => {
         }
       }
 
-      this.codeField = this.$refs.codeField;
+      this.codeField = this.$refs.codeField as CounterProductSelect;
+      this.codeField.widget.hook("after", "onOptionSelect", () => {
+        this.handleCode();
+      });
       this.codeField.widget.focus();
 
       // It's quite tricky to manually apply attributes to the management part
       // of a formset so we dynamically apply it here
       this.$refs.basketManagementForm
         .querySelector("#id_form-TOTAL_FORMS")
-        .setAttribute(":value", "getBasketSize()");
+        ?.setAttribute(":value", "getBasketSize()");
     },
 
     removeFromBasket(id: string) {
       delete this.basket[id];
     },
 
-    addToBasket(id: string, quantity: number): ErrorMessage {
+    addToBasket(id: string, quantity: number) {
       const item: BasketItem =
         this.basket[id] || new BasketItem(config.products[id], 0);
 
@@ -47,7 +49,7 @@ document.addEventListener("alpine:init", () => {
 
       if (item.quantity <= 0) {
         delete this.basket[id];
-        return "";
+        return;
       }
 
       this.basket[id] = item;
@@ -69,7 +71,7 @@ document.addEventListener("alpine:init", () => {
       const products = new Set(
         Object.values(this.basket).map((item: BasketItem) => item.product.productId),
       );
-      const formula: ProductFormula = config.formulas.find((f: ProductFormula) => {
+      const formula = config.formulas.find((f: ProductFormula) => {
         return f.products.every((p: number) => products.has(p));
       });
       if (formula === undefined) {
@@ -77,9 +79,13 @@ document.addEventListener("alpine:init", () => {
       }
       // Now that the formula is found, remove the items composing it from the basket
       for (const product of formula.products) {
-        const key = Object.entries(this.basket).find(
+        const item = Object.entries(this.basket).find(
           ([_, i]: [string, BasketItem]) => i.product.productId === product,
-        )[0];
+        );
+        if (item === undefined) {
+          continue;
+        }
+        const key = item[0];
         this.basket[key].quantity -= 1;
         if (this.basket[key].quantity <= 0) {
           this.removeFromBasket(key);
@@ -89,7 +95,7 @@ document.addEventListener("alpine:init", () => {
       const result = Object.values(config.products)
         .filter((item: CounterItem) => item.productId === formula.result)
         .reduce((acc, curr) => (acc.price.amount < curr.price.amount ? acc : curr));
-      this.addToBasket(result.price.id, 1);
+      this.addToBasket(result.price.id.toString(), 1);
       this.alertMessage.display(
         interpolate(
           gettext("Formula %(formula)s applied"),
@@ -116,14 +122,18 @@ document.addEventListener("alpine:init", () => {
     },
 
     onRefillingSuccess(event: CustomEvent) {
-      if (event.type !== "htmx:after-request" || event.detail.failed) {
+      if (
+        event.type !== "htmx:after-swap" ||
+        event.detail.failed ||
+        event.detail.elt.querySelector(".errorlist")
+      ) {
         return;
       }
       this.customerBalance += Number.parseFloat(
         (event.detail.target.querySelector("#id_amount") as HTMLInputElement).value,
       );
-      document.getElementById("selling-accordion").setAttribute("open", "");
+      document.getElementById("selling-accordion")?.setAttribute("open", "");
-      this.codeField.widget.focus();
+      this.codeField?.widget.focus();
     },
 
     finish() {
@@ -133,7 +143,7 @@ document.addEventListener("alpine:init", () => {
         });
         return;
       }
-      this.$refs.basketForm.submit();
+      (this.$refs.basketForm as HTMLFormElement).submit();
     },
 
     cancel() {
@@ -141,6 +151,8 @@ document.addEventListener("alpine:init", () => {
     },
 
     handleCode() {
+      if (!this.codeField) throw Error("Unexpected null codeField.");
+
       const [quantity, code] = this.codeField.getSelectedProduct() as [number, string];
 
       if (this.codeField.getOperationCodes().includes(code.toUpperCase())) {
@@ -154,6 +166,7 @@ document.addEventListener("alpine:init", () => {
         this.addToBasket(code, quantity);
       }
       this.codeField.widget.clear();
+      this.codeField.widget.setTextboxValue("");
       this.codeField.widget.focus();
     },
   }));

counter/static/bundled/counter/product-list-index.ts

@@ -1,9 +1,14 @@
 import { showSaveFilePicker } from "native-file-system-adapter";
 import type TomSelect from "tom-select";
+import type { ClubAjaxSelect } from "#club:club/components/ajax-select-index";
 import type { NestedKeyOf } from "#core:types/nested-key";
-import { paginated } from "#core:utils/api";
+import { type PaginatedRequest, paginated } from "#core:utils/api";
 import { csv } from "#core:utils/csv";
 import { getCurrentUrlParams, History, updateQueryString } from "#core:utils/history";
+import type {
+  CounterAjaxSelect,
+  ProductTypeAjaxSelect,
+} from "#counter:counter/components/ajax-select-index";
 import {
   type ProductSchema,
   type ProductSearchProductsDetailedData,
@@ -51,6 +56,8 @@ const csvColumnTitles = [
   gettext("archived"),
 ];
 
+type ProductStatus = "active" | "archived" | "both";
+
 document.addEventListener("alpine:init", () => {
   Alpine.data("productList", () => ({
     loading: false,
@@ -59,8 +66,7 @@ document.addEventListener("alpine:init", () => {
 
     /** Total number of elements corresponding to the current query. */
     nbPages: 0,
-
+    productStatus: "" as ProductStatus,
-    productStatus: "" as "active" | "archived" | "both",
     search: "",
     productTypes: [] as string[],
     clubs: [] as string[],
@@ -71,16 +77,18 @@ document.addEventListener("alpine:init", () => {
     async init() {
       const url = getCurrentUrlParams();
       this.search = url.get("search") || "";
-      this.productStatus = url.get("productStatus") ?? "active";
+      this.productStatus = (url.get("productStatus") ?? "active") as ProductStatus;
-      const productTypesWidget = this.$refs.productTypesInput.widget as TomSelect;
+      const productTypesWidget = (this.$refs.productTypesInput as ProductTypeAjaxSelect)
+        .widget as TomSelect;
       productTypesWidget.on("change", (items: string[]) => {
         this.productTypes = [...items];
       });
-      const clubsWidget = this.$refs.clubsInput.widget as TomSelect;
+      const clubsWidget = (this.$refs.clubsInput as ClubAjaxSelect).widget as TomSelect;
       clubsWidget.on("change", (items: string[]) => {
         this.clubs = [...items];
       });
-      const countersWidget = this.$refs.countersInput.widget as TomSelect;
+      const countersWidget = (this.$refs.countersInput as CounterAjaxSelect)
+        .widget as TomSelect;
       countersWidget.on("change", (items: string[]) => {
         this.counters = [...items];
       });
@@ -127,9 +135,9 @@ document.addEventListener("alpine:init", () => {
           // biome-ignore lint/style/useNamingConvention: api is in snake_case
           is_archived: isArchived,
           // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          product_type: [...this.productTypes],
+          product_type: [...this.productTypes.map(Number.parseInt)],
-          club: [...this.clubs],
+          club: [...this.clubs.map(Number.parseInt)],
-          counter: [...this.counters],
+          counter: [...this.counters.map(Number.parseInt)],
         },
       };
     },
@@ -141,6 +149,10 @@ document.addEventListener("alpine:init", () => {
       this.loading = true;
       const options = this.getQueryParams();
       const resp = await productSearchProductsDetailed(options);
+      if (resp.data === undefined) {
+        console.error("Product search request failed");
+        return;
+      }
       this.nbPages = Math.ceil(resp.data.count / defaultPageSize);
       this.products = resp.data.results.reduce<GroupedProducts>(
         (acc: GroupedProducts, curr: ProductSchema) => {
@@ -172,7 +184,10 @@ document.addEventListener("alpine:init", () => {
       // If not, fetch them.
       const products: ProductSchema[] =
         this.nbPages > 1
-          ? await paginated(productSearchProductsDetailed, this.getQueryParams())
+          ? await paginated(
+              productSearchProductsDetailed,
+              this.getQueryParams() as PaginatedRequest,
+            )
           : Object.values<ProductSchema[]>(this.products).flat();
       // CSV cannot represent nested data
       // so we create a row for each price of each product.

counter/static/bundled/counter/product-type-index.ts

@@ -1,5 +1,5 @@
 import Alpine from "alpinejs";
-import { AlertMessage } from "#core:utils/alert-message.ts";
+import { AlertMessage } from "#core:utils/alert-message";
 import { producttypeReorder } from "#openapi";
 
 document.addEventListener("alpine:init", () => {
@@ -22,7 +22,7 @@ document.addEventListener("alpine:init", () => {
       const productTypes = this.$refs.productTypes
         .childNodes as NodeListOf<HTMLLIElement>;
       const getId = (elem: HTMLLIElement) =>
-        Number.parseInt(elem.getAttribute("x-sort:item"), 10);
+        Number.parseInt(elem.getAttribute("x-sort:item") as string, 10);
       const query =
         newPosition === 0
           ? { above: getId(productTypes.item(1)) }
@@ -32,6 +32,10 @@ document.addEventListener("alpine:init", () => {
         path: { type_id: itemId },
         query: query,
       });
+      if (response.response === undefined) {
+        console.error("Product type reordering request failed");
+        return;
+      }
       this.openAlertMessage(response.response);
       this.loading = false;
     },

counter/static/counter/css/counter-click.scss

@@ -42,7 +42,28 @@
   min-width: 350px;
 
   ul {
-    list-style-type: none;
+    list-style: none;
+    display: flex;
+    flex-direction: column;
+    gap: .5rem;
+    margin-left: 0;
+
+    .basket-row {
+      display: flex;
+      align-items: center;
+      gap: 1rem;
+
+      .product-name {
+        flex: 1 2 0;
+        min-width: 0;
+        text-wrap: wrap;
+      }
+    }
+  }
+
+  form {
+    margin-top: .5rem;
+    margin-bottom: .5rem;
   }
 }
 

counter/templates/counter/counter_click.jinja

@@ -56,10 +56,15 @@
         <div class="accordion-content">
           {% set counter_click_url = url('counter:click', counter_id=counter.id, user_id=customer.user_id) %}
 
-          <form method="post" action=""
+          <form method="post" action="" @submit.prevent="handleCode">
-                class="code_form" @submit.prevent="handleCode">
 
-            <counter-product-select name="code" x-ref="codeField" autofocus required placeholder="{% trans %}Select a product...{% endtrans %}">
+            <counter-product-select
+              name="code"
+              x-ref="codeField"
+              autofocus
+              required
+              placeholder="{% trans %}Select a product...{% endtrans %}"
+            >
               <option value=""></option>
               <optgroup label="{% trans %}Operations{% endtrans %}">
                 <option value="FIN">{% trans %}Confirm (FIN){% endtrans %}</option>
@@ -68,13 +73,11 @@
               {%- for category, prices in categories.items() -%}
                 <optgroup label="{{ category }}">
                   {%- for price in prices -%}
-                    <option value="{{ price.id }}">{{ price.full_label }}</option>
+                    <option value="{{ price.id }}">{{ price.full_label }} ({{ price.product.code }})</option>
                   {%- endfor -%}
                 </optgroup>
               {%- endfor -%}
             </counter-product-select>
-
-            <input type="submit" value="{% trans %}Go{% endtrans %}"/>
           </form>
 
           {% for error in form.non_form_errors() %}
@@ -102,7 +105,9 @@
               {{ form.management_form }}
             </div>
             <ul>
-              <li x-show="getBasketSize() === 0">{% trans %}This basket is empty{% endtrans %}</li>
+              <li x-show="getBasketSize() === 0">
+                <em>{% trans %}This basket is empty{% endtrans %}</em>
+              </li>
               <template x-for="(item, index) in Object.values(basket)" :key="item.product.price.id">
                 <li>
                   <template x-for="error in item.errors">
@@ -110,19 +115,23 @@
                     </div>
                   </template>
 
-                  <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
+                  <div class="basket-row">
-                  <span class="quantity" x-text="item.quantity"></span>
+                    <div>
-                  <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                      <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
+                      <span class="quantity" x-text="item.quantity"></span>
+                      <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                    </div>
 
-                  <span x-text="item.product.name"></span> :
+                    <span class="product-name" x-text="item.product.name"></span>
-                  <span x-text="item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })">€</span>
+                    <span x-text="`${item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })} €`"></span>
-                  <span x-show="item.getBonusQuantity() > 0"
+                    <span x-show="item.getBonusQuantity() > 0"
-                        x-text="`${item.getBonusQuantity()} x P`"></span>
+                          x-text="`${item.getBonusQuantity()} x P`"></span>
 
-                  <button
+                    <button
-                    class="remove-item"
+                      class="remove-item"
-                    @click.prevent="removeFromBasket(item.product.price.id)"
+                      @click.prevent="removeFromBasket(item.product.price.id)"
-                  ><i class="fa fa-trash-can delete-action"></i></button>
+                    ><i class="fa fa-trash-can delete-action"></i></button>
+                  </div>
 
                   <input
                     type="hidden"
@@ -167,13 +176,17 @@
           </form>
         </div>
       </details>
-      <details class="accordion" name="selling">
+      <details
+        class="accordion"
+        name="selling"
+        @toggle="if ($event.newState === 'open') $el.querySelector('input[type=number]')?.focus()"
+      >
         <summary>{% trans %}Refilling{% endtrans %}</summary>
         {% if object.type == "BAR" %}
           {% if refilling_fragment %}
             <div
               class="accordion-content"
-              @htmx:after-request="onRefillingSuccess"
+              @htmx:after-swap="onRefillingSuccess"
             >
               {{ refilling_fragment }}
             </div>

counter/templates/counter/counter_main.jinja

@@ -32,12 +32,11 @@
       </ul>
       <p><strong>{% trans %}Total: {% endtrans %}{{ last_total }} €</strong></p>
     {% endif %}
-    {% if barmen %}
+    {% if can_click %}
       <p>{% trans %}Enter client code:{% endtrans %}</p>
-      <form method="post" action="">
+      <form method="post" action="" id="select-user-form">
         {% csrf_token %}
-        <input type="hidden" name="counter_token" value="{{ counter.token }}" />
+        {{ form }}
-        {{ form.as_p() }}
         <p><input type="submit" value="{% trans %}validate{% endtrans %}" /></p>
       </form>
     {% else %}
@@ -45,17 +44,36 @@
     {% endif %}
   </div>
   {% if counter.type == 'BAR' %}
-    <div>
+    <h3>{% trans %}Barmen:{% endtrans %}</h3>
-      <h3>{% trans %}Barman: {% endtrans %}</h3>
+
+    {% if barmen_here %}
+      <div class="row gap-2x">
+        <div>
+          <h4>{% trans %}On this device{% endtrans %}</h4>
+          {% for b in barmen_here %}
+            <p>{{ barman_logout_link(b) }}</p>
+          {% endfor %}
+        </div>
+        <div>
+          <h4>{% trans %}Elsewhere{% endtrans %}</h4>
+          {% if barmen_here|length == barmen|length %}
+            {# all logged barmen are logged in this session #}
+            <p><em>{% trans %}No barman logged elsewhere{% endtrans %}</em></p>
+          {% else %}
+            {% for b in barmen %}
+              {%- if b not in barmen_here -%}
+                <p>{{ barman_logout_link(b) }}</p>
+              {%- endif -%}
+            {% endfor %}
+          {% endif %}
+        </div>
+      </div>
+    {% else %}
       {% for b in barmen %}
         <p>{{ barman_logout_link(b) }}</p>
       {% endfor %}
-      <form method="post" action="{{ url('counter:login', counter_id=counter.id) }}">
+    {% endif %}
-        {% csrf_token %}
+    {{ login_fragment }}
-        {{ login_form.as_p() }}
-        <p><input type="submit" value="{% trans %}login{% endtrans %}" /></p>
-      </form>
-    </div>
   {% endif %}
 {% endblock %}
 
@@ -63,10 +81,10 @@
   {{ super() }}
   <script type="text/javascript">
     window.addEventListener("DOMContentLoaded", () => {
-      // The login form annoyingly takes priority over the code form 
+      {# The login form annoyingly takes priority over the code form
-      // This is due to the loading time of the web component
+         This is due to the loading time of the web component
-      // We can't rely on DOMContentLoaded to know if the component is there so we
+         We can't rely on DOMContentLoaded to know if the component is there so we
-      // periodically run a script until the field is there
+         periodically run a script until the field is there #}
       const autofocus = () => {
         const field = document.querySelector("input[id='id_code']");
         if (field === null){

counter/templates/counter/fragments/login.jinja

@@ -0,0 +1,5 @@
+<form hx-post="{{ action }}" hx-swap="outerHTML">
+  {% csrf_token %}
+  {{ form }}
+  <input type="submit" value="{% trans %}Confirm{% endtrans %}"/>
+</form>

counter/templates/counter/product_form.jinja

@@ -118,6 +118,7 @@
         </div>
       </div>
     </fieldset>
+    <fieldset><div>{{ form.clic_limit.as_field_group() }}</div></fieldset>
     <fieldset><div>{{ form.counters.as_field_group() }}</div></fieldset>
 
     <h3 class="margin-bottom">{% trans %}Prices{% endtrans %}</h3>

counter/tests/test_counter.py

@@ -17,9 +17,11 @@ from datetime import timedelta
 from decimal import Decimal
 
 import pytest
+from bs4 import BeautifulSoup
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
 from django.contrib.auth.models import Permission, make_password
+from django.contrib.messages import DEFAULT_LEVELS, get_messages
 from django.http import HttpResponse
 from django.shortcuts import resolve_url
 from django.test import Client, TestCase
@@ -37,6 +39,7 @@ from core.models import BanGroup, Group, User
 from counter.baker_recipes import price_recipe, product_recipe, sale_recipe
 from counter.models import (
     Counter,
+    CounterSellers,
     Customer,
     Permanency,
     ProductType,
@@ -66,10 +69,14 @@ class TestFullClickBase(TestCase):
         cls.subscriber = subscriber_user.make()
 
         cls.counter = baker.make(Counter, type="BAR")
-        cls.counter.sellers.add(cls.barmen, cls.board_admin)
-
         cls.other_counter = baker.make(Counter, type="BAR")
-        cls.other_counter.sellers.add(cls.barmen)
+        CounterSellers.objects.bulk_create(
+            [
+                CounterSellers(counter=cls.counter, user=cls.barmen),
+                CounterSellers(counter=cls.counter, user=cls.board_admin),
+                CounterSellers(counter=cls.other_counter, user=cls.barmen),
+            ]
+        )
 
         cls.yet_another_counter = baker.make(Counter, type="BAR")
 
@@ -114,7 +121,10 @@ class TestRefilling(TestFullClickBase):
     ) -> HttpResponse:
         used_client = client if client is not None else self.client
         return used_client.post(
-            reverse("counter:refilling_create", kwargs={"customer_id": user.pk}),
+            reverse(
+                "counter:refilling_create",
+                kwargs={"customer_id": user.pk, "counter_id": self.counter.pk},
+            ),
             {"amount": str(amount), "payment_method": Refilling.PaymentMethod.CASH},
             HTTP_REFERER=reverse(
                 "counter:click", kwargs={"counter_id": counter.id, "user_id": user.pk}
@@ -134,23 +144,28 @@ class TestRefilling(TestFullClickBase):
         assert self.updated_amount(self.customer) == 0
 
     def test_refilling_no_refer_fail(self):
+        """Check that the refill fails is the HTTP_REFERER header is missing"""
+
         def refill():
             return self.client.post(
                 reverse(
                     "counter:refilling_create",
-                    kwargs={"customer_id": self.customer.pk},
+                    kwargs={
+                        "customer_id": self.customer.pk,
+                        "counter_id": self.counter.pk,
+                    },
                 ),
                 {"amount": "10", "payment_method": "CASH"},
             )
 
         self.client.force_login(self.club_admin)
-        assert refill()
+        assert refill().status_code == 403
 
         self.client.force_login(self.root)
-        assert refill()
+        assert refill().status_code == 403
 
         self.client.force_login(self.subscriber)
-        assert refill()
+        assert refill().status_code == 403
 
         assert self.updated_amount(self.customer) == 0
 
@@ -186,6 +201,17 @@ class TestRefilling(TestFullClickBase):
             == 404
         )
 
+    def test_refilling_above_limit_fails(self):
+        """Test that it's forbidden to refill a customer above the limit."""
+        self.login_in_bar()
+        limit = settings.SITH_ACCOUNT_MAX_MONEY
+        # create a refilling to check that current balance is taken into account
+        baker.make(Refilling, customer=self.customer.customer, amount=limit // 2)
+        response = self.refill_user(self.customer, self.counter, (limit // 2) + 1)
+        assert response.status_code == 200  # no redirect = failure
+        self.customer.customer.refresh_from_db()
+        assert self.updated_amount(self.customer) == limit // 2
+
     def test_refilling_counter_success(self):
         self.login_in_bar()
 
@@ -442,9 +468,19 @@ class TestCounterClick(TestFullClickBase):
 
     def test_click_not_connected(self):
         force_refill_user(self.customer, 10)
+
+        # trying to click on a bar without being logged should result
+        # in a redirect to the counter page with an error message
         res = self.submit_basket(self.customer, [BasketItem(self.snack.id, 2)])
         assertRedirects(res, self.counter.get_absolute_url())
+        messages = list(get_messages(res.wsgi_request))
+        assert len(messages) == 1
+        assert messages[0].level == DEFAULT_LEVELS["ERROR"]
+        assert (
+            messages[0].message == "Vous ne pouvez pas cliquer des gens sur ce comptoir"
+        )
 
+        # trying to click on an office counter without permission should 403
         res = self.submit_basket(
             self.customer, [BasketItem(self.snack.id, 2)], counter=self.club_counter
         )
@@ -499,6 +535,19 @@ class TestCounterClick(TestFullClickBase):
 
         assert self.updated_amount(self.customer) == Decimal(10)
 
+    def test_unrecord_above_limit_fails(self):
+        """Test that it's forbidden to give back a recorded product
+        if it puts the account balance above the limit.
+        """
+        self.login_in_bar()
+        limit = settings.SITH_ACCOUNT_MAX_MONEY
+        # put the account balance just at the limit
+        baker.make(Refilling, customer=self.customer.customer, amount=limit)
+        response = self.submit_basket(self.customer, [BasketItem(self.dcons.id, 1)])
+        assert response.status_code == 200  # no redirect = failure
+        self.customer.customer.refresh_from_db()
+        assert self.updated_amount(self.customer) == limit
+
     def test_annotate_has_barman_queryset(self):
         """Test if the custom queryset method `annotate_has_barman` works as intended."""
         counters = Counter.objects.annotate_has_barman(self.barmen)
@@ -596,7 +645,7 @@ class TestCounterClick(TestFullClickBase):
             product=iter(_product_recipe.make(archived=False, _quantity=2)),
             groups=[group],
         )
-        customer_prices = counter.get_prices_for(customer)
+        customer_prices = list(counter.get_prices_for(customer))
         assert unarchived_prices == customer_prices
 
 
@@ -718,59 +767,154 @@ class TestCounterStats(TestCase):
 class TestBarmanConnection(TestCase):
     @classmethod
     def setUpTestData(cls):
-        cls.krophil = User.objects.get(username="krophil")
+        cls.barman = subscriber_user.make()
-        cls.skia = User.objects.get(username="skia")
+        cls.barman.set_password("plop")
-        cls.skia.customer.account = 800
+        cls.barman.save()
-        cls.krophil.customer.save()
+        cls.counter = baker.make(Counter, type="BAR", sellers=[cls.barman])
-        cls.skia.customer.save()
+        cls.login_url = reverse("counter:login", kwargs={"counter_id": cls.counter.id})
-
+        cls.detail_url = reverse(
-        cls.counter = Counter.objects.get(id=2)
+            "counter:details", kwargs={"counter_id": cls.counter.id}
+        )
 
     def test_barman_granted(self):
+        response = self.client.post(
+            self.login_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert response.status_code == 200
+        assert response.headers["HX-Redirect"] == self.detail_url
+        last_perm = Permanency.objects.last()
+        assert last_perm.counter == self.counter
+        assert last_perm.user == self.barman
+        assert last_perm.end is None
+        response = self.client.get(
+            self.detail_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert self.barman in response.wsgi_request.barmen
+        assert response.context_data.get("barmen") == [self.barman]
+        soup = BeautifulSoup(response.text, "lxml")
+        assert soup.find("form", id="select-user-form") is not None
+
+    def assert_counter_login_fails(self, user: User):
+        initial_perms = set(self.counter.permanencies.filter(user=user, end=None))
+        response = self.client.post(
+            self.login_url, {"username": user.username, "password": "plop"}
+        )
+        assert "HX-Redirect" not in response.headers
+        assert (
+            set(self.counter.permanencies.filter(user=user, end=None)) == initial_perms
+        )
+        if initial_perms:
+            # the user was already logged in, and we already tested
+            # that it didn't re-login, so we can skip the next assertions.
+            return
+
+        self.counter.refresh_from_db()
+        assert response.wsgi_request.barmen.isdisjoint(set(self.counter.barmen_list))
+
+        response = self.client.get(self.detail_url)
+        assert response.context_data.get("barmen") == []
+        soup = BeautifulSoup(response.text, "lxml")
+        assert soup.find("form", id="select-user-form") is None
+
+    def test_barman_not_seller(self):
+        """Test when the barman is not a seller of the counter"""
+        not_barman = subscriber_user.make()
+        not_barman.set_password("plop")
+        not_barman.save()
+        self.assert_counter_login_fails(not_barman)
+
+    def test_barman_already_logged(self):
+        """Test when the barman is already logged in the current counter."""
         self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
+            self.login_url, {"username": self.barman.username, "password": "plop"}
-            {"username": "krophil", "password": "plop"},
         )
-        response = self.client.get(reverse("counter:details", args=[self.counter.id]))
+        self.assert_counter_login_fails(self.barman)
 
-        assert "<p>Entrez un code client : </p>" in str(response.content)
+    def test_barman_already_logged_in_another_device(self):
+        """Test when the barman is already logged in the current counter on another device."""
+        other_client = Client()
+        other_client.post(
+            self.login_url, {"username": self.barman.username, "password": "plop"}
+        )
+        self.assert_counter_login_fails(self.barman)
 
-    def test_counters_list_barmen(self):
+    def test_barman_login_elsewhere(self):
+        """Test when the barman log himself out then log in on another device."""
         self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
+            self.login_url, {"username": self.barman.username, "password": "plop"}
-            {"username": "krophil", "password": "plop"},
         )
-        response = self.client.get(reverse("counter:activity", args=[self.counter.id]))
+        other_client = Client()
+        other_client.post(
+            reverse("counter:logout", kwargs={"counter_id": self.counter.id}),
+            data={"user_id": self.barman.id},
+        )
+        response = other_client.post(
+            self.login_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert response.status_code == 200
+        assert response.headers["HX-Redirect"] == self.detail_url
+        # the barmen should now be logged in `other_client`...
+        response = other_client.get(
+            self.detail_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert self.barman in response.wsgi_request.barmen
 
-        assert '<li><a href="/user/10/">Kro Phil&#39;</a></li>' in str(response.content)
+        # ... but not in `self.client`
+        response = self.client.get(
+            self.detail_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert self.barman not in response.wsgi_request.barmen
 
-    def test_barman_denied(self):
+    def test_barman_already_logged_elsewhere(self):
+        """Test when the barman is already logged in another counter."""
+        other_counter = baker.make(Counter, type="BAR")
+        CounterSellers.objects.create(counter=other_counter, user=self.barman)
         self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
+            reverse("counter:login", kwargs={"counter_id": other_counter.id}),
-            {"username": "skia", "password": "plop"},
+            {"username": self.barman.username, "password": "plop"},
         )
-        response_get = self.client.get(
+        self.assert_counter_login_fails(self.barman)
-            reverse("counter:details", args=[self.counter.id])
+
+    def test_login_on_non_bar_counter(self):
+        counter = baker.make(Counter, type="OFFICE")
+        CounterSellers.objects.create(counter=counter, user=self.barman)
+        url = reverse("counter:login", kwargs={"counter_id": counter.id})
+        response = self.client.get(url)
+        assert response.status_code == 403
+        response = self.client.post(
+            url, {"username": self.barman.username, "password": "plop"}
         )
+        assert response.status_code == 403
 
-        assert "<p>Merci de vous identifier</p>" in str(response_get.content)
+    def test_logout_then_login(self):
+        """Test that the login is successful if it is after a previous logout.
 
-    def test_counters_list_no_barmen(self):
+        This is a regression test for #1440
-        self.client.post(
+        """
-            reverse("counter:login", args=[self.counter.id]),
+        self.client.post(  # login
-            {"username": "krophil", "password": "plop"},
+            self.login_url, {"username": self.barman.username, "password": "plop"}
         )
-        response = self.client.get(reverse("counter:activity", args=[self.counter.id]))
+        self.client.post(  # logout
-
+            reverse("counter:logout", kwargs={"counter_id": self.counter.id}),
-        assert '<li><a href="/user/1/">S&#39; Kia</a></li>' not in str(response.content)
+            data={"user_id": self.barman.id},
+        )
+        response = self.client.post(  # and re-login
+            self.login_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert response.status_code == 200
+        assert response.headers["HX-Redirect"] == self.detail_url
+        response = self.client.get(
+            self.detail_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert self.barman in response.wsgi_request.barmen
 
 
 @pytest.mark.django_db
-def test_barman_timeout():
+def test_barman_timeout(client: Client):
     """Test that barmen timeout is well managed."""
     bar = baker.make(Counter, type="BAR")
     user = baker.make(User)
-    bar.sellers.add(user)
+    CounterSellers.objects.create(counter=bar, user=user)
     baker.make(Permanency, counter=bar, user=user, start=now())
 
     qs = Counter.objects.annotate_is_open().filter(pk=bar.pk)
@@ -786,6 +930,8 @@ def test_barman_timeout():
         bar = qs[0]
         assert not bar.is_open
         assert bar.barmen_list == []
+    res = client.get("")
+    assert res.wsgi_request.barmen == set()
 
 
 class TestClubCounterClickAccess(TestCase):
@@ -835,14 +981,14 @@ class TestClubCounterClickAccess(TestCase):
 
     def test_barman(self):
         """Sellers should be able to click on office counters"""
-        self.counter.sellers.add(self.user)
+        CounterSellers.objects.create(counter=self.counter, user=self.user)
         self.client.force_login(self.user)
         res = self.client.get(self.click_url)
         assert res.status_code == 200
 
     def test_both_barman_and_board_member(self):
         """If the user is barman and board member, he should be authorized as well."""
-        self.counter.sellers.add(self.user)
+        CounterSellers.objects.create(counter=self.counter, user=self.user)
         baker.make(
             Membership, club=self.counter.club, user=self.user, role=self.board_role
         )
@@ -866,16 +1012,17 @@ class TestCounterLogout:
                 reverse("counter:logout", kwargs={"counter_id": permanence.counter_id}),
                 data={"user_id": permanence.user_id},
             )
-            assertRedirects(
+        assertRedirects(
-                res,
+            res,
-                reverse(
+            reverse("counter:details", kwargs={"counter_id": permanence.counter_id}),
-                    "counter:details", kwargs={"counter_id": permanence.counter_id}
+        )
-                ),
+        permanence.refresh_from_db()
-            )
+        assert permanence.end == permanence.activity
-            permanence.refresh_from_db()
+        assert permanence.user not in res.wsgi_request.barmen
-            assert permanence.end == now()
 
     def test_logout_doesnt_change_old_permanences(self, client: Client):
+        # regression test for #1141
+        # https://github.com/ae-utbm/sith/pull/1141
         perm_counter = baker.make(Counter, type="BAR")
         permanence = baker.make(
             Permanency,
@@ -896,6 +1043,6 @@ class TestCounterLogout:
                 data={"user_id": permanence.user_id},
             )
             permanence.refresh_from_db()
-            assert permanence.end == now()
+            assert permanence.end == permanence.activity
             old_permanence.refresh_from_db()
             assert old_permanence.end == old_end

counter/tests/test_customer.py

@@ -15,6 +15,7 @@ from core.models import User
 from counter.baker_recipes import product_recipe, refill_recipe, sale_recipe
 from counter.models import (
     Counter,
+    CounterSellers,
     Customer,
     Refilling,
     ReturnableProduct,
@@ -38,7 +39,7 @@ class TestStudentCard(TestCase):
         cls.subscriber = subscriber_user.make()
 
         cls.counter = baker.make(Counter, type="BAR")
-        cls.counter.sellers.add(cls.barmen)
+        CounterSellers.objects.create(counter=cls.counter, user=cls.barmen)
 
         cls.club_counter = baker.make(Counter)
         role = baker.make(ClubRole, club=cls.club_counter.club, is_board=True)

counter/tests/test_product.py

@@ -1,3 +1,4 @@
+import itertools
 from io import BytesIO
 from typing import Callable
 from uuid import uuid4
@@ -8,6 +9,7 @@ from django.core.cache import cache
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.timezone import now
 from model_bakery import baker
 from model_bakery.recipe import Recipe
 from PIL import Image
@@ -16,9 +18,10 @@ from pytest_django.asserts import assertNumQueries, assertRedirects
 from club.models import Club
 from core.baker_recipes import board_user, subscriber_user
 from core.models import Group, User
-from counter.baker_recipes import product_recipe
+from counter.baker_recipes import product_recipe, sale_recipe
 from counter.forms import ProductForm, ProductPriceFormSet
-from counter.models import Price, Product, ProductType
+from counter.models import Price, Product, ProductType, Selling
+from eboutic.models import Basket, BasketItem
 
 
 @pytest.mark.django_db
@@ -222,3 +225,59 @@ def test_price_for_user():
     assert list(qs.for_user(users[0])) == [prices[0], prices[1], prices[4]]
     assert list(qs.for_user(users[1])) == [prices[0], prices[4]]
     assert list(qs.for_user(users[2])) == [prices[0], prices[3]]
+
+
+class TestProductClicLimit(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.products = product_recipe.make(
+            clic_limit=itertools.chain([5, 10, 15], itertools.repeat(None)),
+            _quantity=6,
+            _bulk_create=True,
+        )
+        cls.qs = Product.objects.filter(id__in=[p.id for p in cls.products])
+
+    def test_no_sales_or_basket(self):
+        """Test that it works if no sales has been made yet"""
+        assert list(self.qs.under_clic_limit()) == self.products
+
+    def test_with_sales(self):
+        """Test that it works when there are existing sales"""
+        sales = sale_recipe.make(
+            product=itertools.cycle(self.products),
+            _quantity=len(self.products) * 5,
+            _bulk_create=True,
+        )
+        Selling.objects.filter(id__in=[s.id for s in sales]).update(quantity=2)
+        assert list(self.qs.under_clic_limit()) == self.products[2:]
+
+    def test_with_sales_and_basket(self):
+        """Test that it works when there are existing sales and basket items."""
+        sales = sale_recipe.make(
+            product=itertools.cycle(self.products),
+            _quantity=len(self.products) * 5,
+            _bulk_create=True,
+        )
+        Selling.objects.filter(id__in=[s.id for s in sales]).update(quantity=1)
+        basket = baker.make(
+            Basket, date=now() - settings.SITH_EBOUTIC_BASKET_TIMEOUT / 2
+        )
+        items = baker.make(
+            BasketItem,
+            product=itertools.cycle(self.products),
+            basket=basket,
+            _quantity=len(self.products) * 5,
+        )
+        BasketItem.objects.filter(id__in=[i.id for i in items]).update(quantity=1)
+        assert list(self.qs.under_clic_limit()) == self.products[2:]
+
+        # expired basket items shouldn't be accounted when computing clic limit
+        item = BasketItem.objects.filter(product=self.products[1])[0]
+        item.basket = baker.make(
+            Basket,
+            date=now()
+            - settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            - settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT,
+        )
+        item.save()
+        assert list(self.qs.under_clic_limit()) == self.products[1:]

counter/urls.py

@@ -41,7 +41,6 @@ from counter.views.admin import (
     ReturnableProductUpdateView,
     SellingDeleteView,
 )
-from counter.views.auth import counter_login, counter_logout
 from counter.views.cash import (
     CashSummaryEditView,
     CashSummaryListView,
@@ -57,7 +56,9 @@ from counter.views.eticket import (
 from counter.views.home import (
     CounterActivityView,
     CounterLastOperationsView,
+    CounterLoginFragment,
     CounterMain,
+    counter_logout,
 )
 from counter.views.invoice import InvoiceCallView
 from counter.views.student_card import StudentCardDeleteView, StudentCardFormFragment
@@ -66,7 +67,7 @@ urlpatterns = [
     path("<int:counter_id>/", CounterMain.as_view(), name="details"),
     path("<int:counter_id>/click/<int:user_id>/", CounterClick.as_view(), name="click"),
     path(
-        "refill/<int:customer_id>/",
+        "<int:counter_id>/refill/<int:customer_id>/",
         RefillingCreateView.as_view(),
         name="refilling_create",
     ),
@@ -82,7 +83,7 @@ urlpatterns = [
     ),
     path("<int:counter_id>/activity/", CounterActivityView.as_view(), name="activity"),
     path("<int:counter_id>/stats/", CounterStatView.as_view(), name="stats"),
-    path("<int:counter_id>/login/", counter_login, name="login"),
+    path("<int:counter_id>/login/", CounterLoginFragment.as_view(), name="login"),
     path("<int:counter_id>/logout/", counter_logout, name="logout"),
     path("eticket/<int:selling_id>/pdf/", EticketPDFView.as_view(), name="eticket_pdf"),
     path(

counter/utils.py

@@ -3,8 +3,6 @@ from urllib.parse import urlparse
 from django.http import HttpRequest
 from django.urls import resolve
 
-from counter.models import Counter
-
 
 def is_logged_in_counter(request: HttpRequest) -> bool:
     """Check if the request is sent from a device logged to a counter.
@@ -20,24 +18,13 @@ def is_logged_in_counter(request: HttpRequest) -> bool:
       or the request path belongs to the counter app
       (eg. the barman went back to the main by missclick and go back
       to the counter)
-    - The current session has a counter token associated with it.
+    - There are barmen logged in the current session
-    - A counter with this token exists.
-    - The counter is open
     """
     referer_ok = (
         "HTTP_REFERER" in request.META
         and resolve(urlparse(request.META["HTTP_REFERER"]).path).app_name == "counter"
     )
-    has_token = (
+    if not referer_ok and request.resolver_match.app_name != "counter":
-        (referer_ok or request.resolver_match.app_name == "counter")
-        and "counter_token" in request.session
-        and request.session["counter_token"]
-    )
-    if not has_token:
         return False
 
-    return (
+    return bool(request.barmen)
-        Counter.objects.annotate_is_open()
-        .filter(token=request.session["counter_token"], is_open=True)
-        .exists()
-    )

counter/views/auth.py

@@ -1,53 +0,0 @@
-#
-# Copyright 2023 © AE UTBM
-# ae@utbm.fr / ae.info@utbm.fr
-#
-# This file is part of the website of the UTBM Student Association (AE UTBM),
-# https://ae.utbm.fr.
-#
-# You can find the source code of the website at https://github.com/ae-utbm/sith
-#
-# LICENSED UNDER THE GNU GENERAL PUBLIC LICENSE VERSION 3 (GPLv3)
-# SEE : https://raw.githubusercontent.com/ae-utbm/sith/master/LICENSE
-# OR WITHIN THE LOCAL FILE "LICENSE"
-#
-#
-
-from django.http import HttpRequest, HttpResponseRedirect
-from django.shortcuts import get_object_or_404, redirect
-from django.utils import timezone
-from django.utils.timezone import now
-from django.views.decorators.http import require_POST
-
-from core.views.forms import LoginForm
-from counter.models import Counter, Permanency
-
-
-@require_POST
-def counter_login(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
-    """Log a user in a counter.
-
-    A successful login will result in the beginning of a counter duty
-    for the user.
-    """
-    counter = get_object_or_404(Counter, pk=counter_id)
-    form = LoginForm(request, data=request.POST)
-    if not form.is_valid():
-        return redirect(counter.get_absolute_url() + "?credentials")
-    user = form.get_user()
-    if not counter.sellers.contains(user) or user in counter.barmen_list:
-        return redirect(counter.get_absolute_url() + "?sellers")
-    if len(counter.barmen_list) == 0:
-        counter.gen_token()
-    request.session["counter_token"] = counter.token
-    counter.permanencies.create(user=user, start=timezone.now())
-    return redirect(counter)
-
-
-@require_POST
-def counter_logout(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
-    """End the permanency of a user in this counter."""
-    Permanency.objects.filter(
-        counter=counter_id, user=request.POST["user_id"], end=None
-    ).update(end=now())
-    return redirect("counter:details", counter_id=counter_id)

counter/views/click.py

@@ -12,8 +12,10 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
+import random
 from collections import defaultdict
 
+from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.db.models import Q
@@ -21,7 +23,8 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, resolve_url
 from django.urls import reverse
 from django.utils.safestring import SafeString
-from django.views.generic import FormView
+from django.utils.translation import gettext as _
+from django.views.generic import CreateView, FormView
 from django.views.generic.detail import SingleObjectMixin
 from ninja.main import HttpRequest
 
@@ -33,6 +36,7 @@ from counter.models import (
     Counter,
     Customer,
     ProductFormula,
+    Refilling,
     ReturnableProduct,
     Selling,
 )
@@ -46,7 +50,7 @@ def get_operator(request: HttpRequest, counter: Counter, customer: Customer) ->
         return request.user
     if counter.customer_is_barman(customer):
         return customer.user
-    return counter.get_random_barman()
+    return random.choice(list(request.barmen))
 
 
 class CounterClick(
@@ -69,16 +73,16 @@ class CounterClick(
     current_tab = "counter"
 
     def get_form_kwargs(self):
-        kwargs = super().get_form_kwargs()
+        return super().get_form_kwargs() | {
-        kwargs["form_kwargs"] = {
             "customer": self.customer,
             "counter": self.object,
-            "allowed_prices": {price.id: price for price in self.prices},
+            "form_kwargs": {
+                "allowed_prices": {price.id: price for price in self.prices}
+            },
         }
-        return kwargs
 
     def dispatch(self, request, *args, **kwargs):
-        self.customer = get_object_or_404(Customer, user__id=self.kwargs["user_id"])
+        self.customer = get_object_or_404(Customer, user_id=self.kwargs["user_id"])
         obj: Counter = self.get_object()
 
         if not self.customer.can_buy or self.customer.user.is_banned_counter:
@@ -96,14 +100,13 @@ class CounterClick(
             # or a seller of this counter.
             raise PermissionDenied
 
-        if obj.type == "BAR" and (
+        if obj.type == "BAR" and not (
-            not obj.is_open
+            request.barmen and request.barmen.issubset(set(obj.barmen_list))
-            or "counter_token" not in request.session
-            or request.session["counter_token"] != obj.token
         ):
+            messages.error(request, _("You cannot click users on this counter"))
             return redirect(obj)  # Redirect to counter
 
-        self.prices = obj.get_prices_for(self.customer)
+        self.prices = list(obj.get_prices_for(self.customer))
 
         return super().dispatch(request, *args, **kwargs)
 
@@ -199,7 +202,7 @@ class CounterClick(
             )
         if self.object.can_refill():
             res["refilling_fragment"] = RefillingCreateView.as_fragment()(
-                self.request, customer=self.customer
+                self.request, customer=self.customer, counter=self.object
             )
         return res
 
@@ -223,9 +226,10 @@ class CounterClick(
         return kwargs
 
 
-class RefillingCreateView(FragmentMixin, FormView):
+class RefillingCreateView(FragmentMixin, CreateView):
     """This is a fragment only view which integrates with counter_click.jinja"""
 
+    model = Refilling
     form_class = RefillForm
     template_name = "counter/fragments/create_refill.jinja"
 
@@ -237,34 +241,35 @@ class RefillingCreateView(FragmentMixin, FormView):
         if not is_logged_in_counter(request):
             raise PermissionDenied
 
-        self.counter: Counter = get_object_or_404(
+        self.counter: Counter = get_object_or_404(Counter, id=self.kwargs["counter_id"])
-            Counter, token=request.session["counter_token"]
-        )
 
-        if not self.counter.can_refill():
+        if not (
+            request.barmen
+            and request.barmen.issubset(self.counter.barmen_list)
+            and self.counter.can_refill()
+        ):
             raise PermissionDenied
 
-        self.operator = get_operator(request, self.counter, self.customer)
-
         return super().dispatch(request, *args, **kwargs)
 
     def render_fragment(self, request, **kwargs) -> SafeString:
         self.customer = kwargs.pop("customer")
+        self.counter = kwargs.pop("counter")
+        self.object = None
         return super().render_fragment(request, **kwargs)
 
-    def form_valid(self, form):
+    def get_form_kwargs(self):
-        res = super().form_valid(form)
+        return super().get_form_kwargs() | {
-        form.clean()
+            "counter": self.counter,
-        form.instance.counter = self.counter
+            "operator": get_operator(self.request, self.counter, self.customer),
-        form.instance.operator = self.operator
+            "customer": self.customer,
-        form.instance.customer = self.customer
+        }
-        form.instance.save()
-        return res
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
         kwargs["action"] = reverse(
-            "counter:refilling_create", kwargs={"customer_id": self.customer.pk}
+            "counter:refilling_create",
+            kwargs={"customer_id": self.customer.pk, "counter_id": self.counter.pk},
         )
         return kwargs
 

counter/views/home.py

@@ -15,78 +15,122 @@
 from datetime import timedelta
 
 from django.conf import settings
-from django.http import HttpResponseRedirect
+from django.core.exceptions import PermissionDenied
-from django.urls import reverse, reverse_lazy
+from django.db.models import F
+from django.http import HttpRequest, HttpResponseRedirect
+from django.shortcuts import redirect
+from django.urls import reverse
 from django.utils import timezone
-from django.utils.translation import gettext_lazy as _
+from django.utils.safestring import SafeString
+from django.views.decorators.http import require_POST
 from django.views.generic import DetailView
-from django.views.generic.edit import FormMixin, ProcessFormView
+from django.views.generic.detail import SingleObjectMixin
+from django.views.generic.edit import FormView
 
 from core.auth.mixins import CanViewMixin
-from core.views.forms import LoginForm
+from core.views import FragmentMixin, UseFragmentsMixin
-from counter.forms import GetUserForm
+from counter.forms import CounterLoginForm, GetUserForm
-from counter.models import Counter
+from counter.middleware import SESSION_PERMANENCES_KEY
+from counter.models import Counter, Permanency
 from counter.utils import is_logged_in_counter
 from counter.views.mixins import CounterTabsMixin
 
 
+class CounterLoginFragment(FragmentMixin, SingleObjectMixin, FormView):
+    model = Counter
+    form_class = CounterLoginForm
+    reload_on_redirect = True
+    pk_url_kwarg = "counter_id"
+    template_name = "counter/fragments/login.jinja"
+
+    def dispatch(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        if self.object.type != "BAR":
+            # barmen have to log in only if it is a bar,
+            # so calling this view on a non-bar counter makes no sense
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {
+            "request": self.request,
+            "counter": self.object,
+        }
+
+    def form_valid(self, form: CounterLoginForm):
+        user = form.get_user()
+        perm = self.object.permanencies.create(user=user, start=timezone.now())
+        self.request.session.setdefault(SESSION_PERMANENCES_KEY, []).append(perm.id)
+        self.request.session.modified = True
+        self.success_url = reverse(
+            "counter:details", kwargs={"counter_id": self.object.id}
+        )
+        return super().form_valid(form)
+
+    def render_fragment(self, request, **kwargs) -> SafeString:
+        self.object = kwargs.pop("counter")
+        return super().render_fragment(request, **kwargs)
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {
+            "action": reverse("counter:login", kwargs={"counter_id": self.object.id})
+        }
+
+
+@require_POST
+def counter_logout(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
+    """End the permanency of a user in this counter."""
+    Permanency.objects.filter(
+        counter=counter_id, user=request.POST["user_id"], end=None
+    ).update(end=F("activity"))
+    return redirect("counter:details", counter_id=counter_id)
+
+
 class CounterMain(
-    CounterTabsMixin, CanViewMixin, DetailView, ProcessFormView, FormMixin
+    CounterTabsMixin, UseFragmentsMixin, CanViewMixin, SingleObjectMixin, FormView
 ):
     """The public (barman) view."""
 
     model = Counter
+    queryset = Counter.objects.exclude(type="EBOUTIC")
     template_name = "counter/counter_main.jinja"
     pk_url_kwarg = "counter_id"
-    form_class = (
+    form_class = GetUserForm
-        GetUserForm  # Form to enter a client code and get the corresponding user id
-    )
     current_tab = "counter"
 
-    def get_queryset(self):
+    def dispatch(self, request, *args, **kwargs):
-        return super().get_queryset().exclude(type="EBOUTIC")
+        self.object: Counter = self.get_object()
+        if self.object.type == "BAR":
+            self.object.update_activity()
+        return super().dispatch(request, *args, **kwargs)
 
-    def post(self, request, *args, **kwargs):
+    def get_fragment_context_data(self) -> dict[str, SafeString]:
-        self.object = self.get_object()
+        login_fragment = (
-        if self.object.type == "BAR" and not (
+            CounterLoginFragment.as_fragment()(self.request, counter=self.object)
-            "counter_token" in self.request.session
+            if self.object.type == "BAR"
-            and self.request.session["counter_token"] == self.object.token
+            else ""
-        ):  # Check the token to avoid the bar to be stolen
+        )
-            return HttpResponseRedirect(
+        return super().get_fragment_context_data() | {"login_fragment": login_fragment}
-                reverse_lazy(
-                    "counter:details",
-                    args=self.args,
-                    kwargs={"counter_id": self.object.id},
-                )
-                + "?bad_location"
-            )
-        return super().post(request, *args, **kwargs)
 
     def get_context_data(self, **kwargs):
         """We handle here the login form for the barman."""
-        if self.request.method == "POST":
-            self.object = self.get_object()
-        self.object.update_activity()
         kwargs = super().get_context_data(**kwargs)
-        kwargs["login_form"] = LoginForm()
-        kwargs["login_form"].fields["username"].widget.attrs["autofocus"] = True
-        kwargs[
-            "login_form"
-        ].cleaned_data = {}  # add_error fails if there are no cleaned_data
-        if "credentials" in self.request.GET:
-            kwargs["login_form"].add_error(None, _("Bad credentials"))
-        if "sellers" in self.request.GET:
-            kwargs["login_form"].add_error(None, _("User is not barman"))
-        kwargs["form"] = self.get_form()
-        kwargs["form"].cleaned_data = {}  # same as above
-        if "bad_location" in self.request.GET:
-            kwargs["form"].add_error(
-                None, _("Bad location, someone is already logged in somewhere else")
-            )
         if self.object.type == "BAR":
             kwargs["barmen"] = self.object.barmen_list
-        elif self.request.user.is_authenticated:
+            kwargs["barmen_here"] = list(
-            kwargs["barmen"] = [self.request.user]
+                self.request.barmen.intersection(self.object.barmen_list)
+            )
+        kwargs["can_click"] = (
+            self.object.type == "BAR"
+            and self.request.barmen
+            and self.request.barmen.issubset(set(self.object.barmen_list))
+        ) or (
+            self.object.type == "OFFICE"
+            and (
+                self.object.sellers.contains(self.request.user)
+                or self.object.club.has_rights_in_club(self.request.user)
+            )
+        )
         if "last_basket" in self.request.session:
             kwargs["last_basket"] = self.request.session.pop("last_basket")
             kwargs["last_customer"] = self.request.session.pop("last_customer")
@@ -96,14 +140,17 @@ class CounterMain(
             )
         return kwargs
 
-    def form_valid(self, form):
+    def form_valid(self, form: GetUserForm):
         """We handle here the redirection, passing the user id of the asked customer."""
-        self.kwargs["user_id"] = form.cleaned_data["user_id"]
+        self.success_url = reverse(
+            "counter:click",
+            kwargs={
+                "counter_id": self.kwargs["counter_id"],
+                "user_id": form.cleaned_data["user_id"],
+            },
+        )
         return super().form_valid(form)
 
-    def get_success_url(self):
-        return reverse_lazy("counter:click", args=self.args, kwargs=self.kwargs)
-
 
 class CounterLastOperationsView(CounterTabsMixin, CanViewMixin, DetailView):
     """Provide the last operations to allow barmen to delete them."""

docs/tutorial/etransaction.md

@@ -1,4 +1,6 @@
 
+## Fonctionnement général
+
 La boutique en ligne nécessite une interaction
 avec la banque pour son fonctionnement.
 
@@ -9,3 +11,32 @@ Nous ne pouvons donc que vous redirigez vers la doc du crédit
 agricole : 
 [https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-e-transactions/ma-documentation/](https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-e-transactions/ma-documentation/)
 
+## Limite de clic et expiration des paniers
+
+Certains produits peuvent avoir un quota de vente.
+Une fois ce dernier atteint, il ne doit plus être possible de les acheter.
+
+Pour éviter que cette limite soit dépassée si jamais plusieurs utilisateurs
+commandent et achètent ce produit à peu près en même temps,
+un produit est considéré comme « réservé » une fois placé dans un panier.
+La création du panier s'effectue lors de la soumission du formulaire sur l'eboutic.
+Une fois la transaction accomplie, le panier est supprimé.
+
+Cependant, il reste un problème : 
+que faire des utilisateurs qui créent un panier, mais ne terminent
+pas la transaction ?
+Pour résoudre ce cas, les paniers ont une durée de validité,
+définie dans le `settings.py`, grâce à deux variables :
+
+- `settings.SITH_EBOUTIC_BASKET_TIMEOUT` : 
+  le temps pendant lequel un utilisateur peut payer avec son compte AE
+  ou démarrer une etransaction
+- `settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT` :
+  le temps alloué à l'utilisateur pour effectuer une etransaction ;
+  au-delà de cette durée, la banque refusera le paiement
+  et notifiera le sith de l'erreur.
+
+Une fois expiré le temps défini par 
+`settings.SITH_EBOUTIC_BASKET_TIMEOUT + settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT`, 
+les produits contenus dans le panier sont à nouveau 
+disponibles à la vente.

docs/tutorial/groups.md

@@ -263,35 +263,3 @@ avec un unique champ permettant de sélectionner des groupes.
 Par défaut, seuls les utilisateurs avec la permission
 `auth.change_permission` auront accès à ce formulaire
 (donc, normalement, uniquement les utilisateurs Root).
-
-```mermaid
-sequenceDiagram
-    participant A as Utilisateur
-    participant B as ReverseProxy
-    participant C as MarkdownImage
-    participant D as Model
-
-    A->>B: GET /page/foo
-    B->>C: GET /page/foo
-    C-->>B: La page, avec les urls
-    B-->>A: La page, avec les urls
-    alt image publique 
-        A->>B: GET markdown/public/2025/img.webp
-        B-->>A: img.webp
-    end
-    alt image privée 
-        A->>B: GET markdown_image/{id}
-        B->>C: GET markdown_image/{id}
-        C->>D: user.can_view(image)
-        alt l'utilisateur a le droit de voir l'image
-            D-->>C: True
-            C-->>B: 200 (avec le X-Accel-Redirect)
-            B-->>A: img.webp
-        end
-        alt l'utilisateur n'a pas le droit de l'image
-            D-->>C: False
-            C-->>B: 403
-            B-->>A: 403
-        end
-    end
-```

eboutic/api.py

@@ -1,3 +1,6 @@
+from typing import Any
+
+from ninja import Status
 from ninja_extra import ControllerBase, api_controller, route
 from ninja_extra.exceptions import NotFound
 
@@ -8,13 +11,19 @@ from eboutic.models import Basket
 
 @api_controller("/etransaction", permissions=[CanView])
 class EtransactionInfoController(ControllerBase):
-    @route.get("/data/{basket_id}", url_name="etransaction_data")
+    @route.get(
+        "/data/{basket_id}",
+        url_name="etransaction_data",
+        response={200: dict[str, Any], 410: str},
+    )
     def fetch_etransaction_data(self, basket_id: int):
         """Generate the data to pay an eboutic command with paybox.
 
         The data is generated with the basket that is used by the current session.
         """
         basket: Basket = self.get_object_or_exception(Basket, pk=basket_id)
+        if basket.is_expired:
+            return Status(410, "This basket is expired.")
         try:
             return dict(basket.get_e_transaction_data())
         except BillingInfo.DoesNotExist as e:

eboutic/models.py

@@ -16,7 +16,6 @@ from __future__ import annotations
 
 import hmac
 from datetime import datetime
-from enum import Enum
 from typing import Self
 
 from dict2xml import dict2xml
@@ -24,6 +23,7 @@ from django.conf import settings
 from django.db import DataError, models
 from django.db.models import F, OuterRef, Subquery, Sum
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 
 from core.models import User
@@ -39,30 +39,6 @@ from counter.models import (
 )
 
 
-class BillingInfoState(Enum):
-    VALID = 1
-    EMPTY = 2
-    MISSING_PHONE_NUMBER = 3
-
-    @classmethod
-    def from_model(cls, info: BillingInfo | None) -> BillingInfoState:
-        if info is None:
-            return cls.EMPTY
-        for attr in [
-            "first_name",
-            "last_name",
-            "address_1",
-            "zip_code",
-            "city",
-            "country",
-        ]:
-            if getattr(info, attr) == "":
-                return cls.EMPTY
-        if info.phone_number is None:
-            return cls.MISSING_PHONE_NUMBER
-        return cls.VALID
-
-
 class Basket(models.Model):
     """Basket is built when the user connects to an eboutic page."""
 
@@ -95,6 +71,19 @@ class Basket(models.Model):
             ]
         )
 
+    @property
+    def is_expired(self) -> bool:
+        """Return True if this basket is expired.
+
+        An expired basket can no longer be used tp pay with sith account
+        or to start an etransaction.
+
+        Warnings:
+            Users have an additional time if they pay with an etransaction,
+            so an expired basket may be purchased after its expiration in that case.
+        """
+        return (self.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT) <= now()
+
     def generate_sales(
         self, counter, seller: User, payment_method: Selling.PaymentMethod
     ):
@@ -133,15 +122,22 @@ class Basket(models.Model):
         ]
 
     def get_e_transaction_data(self) -> list[tuple[str, str]]:
+        """Get data for etransaction payment.
+
+        Raises:
+            Customer.DoesNotExist: if the user linked to this basket
+                has no customer account
+            BillingInfo.DoesNotExist: if the user linked to this basket has no
+                billing infos, or incorrect billing infos.
+            ValueError: if this is called on a basket which payment delay is expired.
+        """
         user = self.user
         if not hasattr(user, "customer"):
             raise Customer.DoesNotExist
+        if self.is_expired:
+            raise ValueError("This method cannot be called on an expired basket.")
         customer = user.customer
-        if (
+        if not hasattr(user.customer, "billing_infos"):
-            not hasattr(user.customer, "billing_infos")
-            or BillingInfoState.from_model(user.customer.billing_infos)
-            != BillingInfoState.VALID
-        ):
             raise BillingInfo.DoesNotExist
         cart = {
             "shoppingcart": {"total": {"totalQuantity": min(self.items.count(), 99)}}
@@ -155,6 +151,10 @@ class Basket(models.Model):
             ("PBX_IDENTIFIANT", settings.SITH_EBOUTIC_PBX_IDENTIFIANT),
             ("PBX_TOTAL", str(int(self.total * 100))),
             ("PBX_DEVISE", "978"),  # This is Euro
+            (
+                "PBX_DISPLAY",
+                str(int(settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT.total_seconds())),
+            ),
             ("PBX_CMD", str(self.id)),
             ("PBX_PORTEUR", user.email),
             ("PBX_RETOUR", "Amount:M;BasketID:R;Auto:A;Error:E;Sig:K"),
@@ -219,16 +219,14 @@ class Invoice(models.Model):
         if self.validated:
             raise DataError(_("Invoice already validated"))
         customer, _created = Customer.get_or_create(user=self.user)
-        kwargs = {
+        kwargs = {"counter": get_eboutic(), "customer": customer, "date": self.date}
-            "counter": get_eboutic(),
-            "customer": customer,
-            "date": self.date,
-            "payment_method": Selling.PaymentMethod.CARD,
-        }
         for i in self.items.select_related("product"):
             if i.product.product_type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING:
                 Refilling.objects.create(
-                    **kwargs, operator=self.user, amount=i.unit_price * i.quantity
+                    **kwargs,
+                    operator=self.user,
+                    amount=i.unit_price * i.quantity,
+                    payment_method=Refilling.PaymentMethod.CARD,
                 )
             else:
                 Selling.objects.create(
@@ -239,6 +237,7 @@ class Invoice(models.Model):
                     seller=self.user,
                     unit_price=i.unit_price,
                     quantity=i.quantity,
+                    payment_method=Selling.PaymentMethod.CARD,
                 )
         self.validated = True
         self.save()

eboutic/static/bundled/eboutic/checkout-index.ts

@@ -1,22 +1,76 @@
+import { type Notification, NotificationLevel } from "#core:utils/notifications";
 import { etransactioninfoFetchEtransactionData } from "#openapi";
 
+interface Basket {
+  id: number;
+  timeout: Date;
+}
 document.addEventListener("alpine:init", () => {
-  Alpine.data("etransaction", (initialData, basketId: number) => ({
+  Alpine.data(
-    data: initialData,
+    "etransaction",
-    isCbAvailable: Object.keys(initialData).length > 0,
+    (initialData: Record<string, string>, basket: Basket) => ({
+      data: initialData,
+      isCbAvailable: Object.keys(initialData).length > 0,
+      isSithAvailable: true,
 
-    async fill() {
+      init() {
-      this.isCbAvailable = false;
+        const now = new Date();
-      const res = await etransactioninfoFetchEtransactionData({
+        const timeout = basket.timeout.getTime() - now.getTime();
-        path: {
+        if (timeout > 0) {
+          // if not going inside this condition, it means that
+          // basket was already outdated at initial page load,
+          // in which case disabling buttons and displaying
+          // error message has been done at rendering time
+          setTimeout(() => this.timeoutBasket(), timeout);
+        }
+      },
+
+      /**
+       * Make this basket into a timeout state.
+       * All submission inputs are disabled, and an error message is displayed.
+       */
+      timeoutBasket() {
+        this.isCbAvailable = false;
+        this.isSithAvailable = false;
+        const message = gettext("Basket expired");
+
+        const existingNotif: Notification | undefined = this.$notifications
+          .getAll()
+          .find(
+            (n: Notification) =>
+              n.tag === NotificationLevel.Error && n.text === message,
+          );
+        if (existingNotif === undefined) {
+          this.$notifications.error(message);
+        }
+      },
+
+      /**
+       * Refresh the data used for etransaction.
+       *
+       * Note: if this is called while the basket is expired, it will be a no-op
+       */
+      async fill() {
+        if (new Date() > basket.timeout) {
+          // refresh etransaction data only if the basket is still valid.
+          this.timeoutBasket();
+          return;
+        }
+        this.isCbAvailable = false;
+        const res = await etransactioninfoFetchEtransactionData({
           // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          basket_id: basketId,
+          path: { basket_id: basket.id },
-        },
+        });
-      });
+        if (res.response?.ok) {
-      if (res.response.ok) {
+          this.data = res.data as Record<string, string>;
-        this.data = res.data;
+          this.isCbAvailable = true;
-        this.isCbAvailable = true;
+        } else if (res.response?.status === 410) {
-      }
+          // The basket is expired, so no payment method should be available at all.
-    },
+          // This shouldn't happen, because we don't send the request
-  }));
+          // when the timeout is passed, but we are better safe than sorry
+          this.timeoutBasket();
+        }
+      },
+    }),
+  );
 });

eboutic/static/bundled/eboutic/eboutic-index.ts

@@ -5,13 +5,14 @@ interface BasketItem {
   name: string;
   quantity: number;
   unitPrice: number;
+  isRefill: boolean;
 }
 
 const BASKET_CACHE_KEY = "basket";
-const BASKET_CACHE_VERSION = 1;
+const BASKET_CACHE_VERSION = 2;
 
 document.addEventListener("alpine:init", () => {
-  Alpine.data("basket", (lastPurchaseTime?: number) => ({
+  Alpine.data("basket", (validPrices: number[], lastPurchaseTime?: number) => ({
     basket: [] as BasketItem[],
 
     init() {
@@ -19,25 +20,31 @@ document.addEventListener("alpine:init", () => {
       this.$watch("basket", () => {
         this.saveBasket();
       });
-      // Invalidate basket if a purchase was made
-      if (lastPurchaseTime !== null && localStorage.basketTimestamp !== undefined) {
-        if (
-          new Date(lastPurchaseTime) >=
-          new Date(Number.parseInt(localStorage.basketTimestamp, 10))
-        ) {
-          this.basket = [];
-        }
-      }
       document
         .getElementById("id_form-TOTAL_FORMS")
-        .setAttribute(":value", "basket.length");
+        ?.setAttribute(":value", "basket.length");
     },
 
     loadBasket(): BasketItem[] {
       const cached = versionedLocalStorage.getItem<BasketItem[]>(BASKET_CACHE_KEY, {
         version: BASKET_CACHE_VERSION,
       });
-      return cached ?? [];
+      if (!cached) {
+        return [];
+      }
+      if (
+        lastPurchaseTime &&
+        localStorage.basketTimestamp &&
+        new Date(lastPurchaseTime) >=
+          new Date(Number.parseInt(localStorage.basketTimestamp, 10))
+      ) {
+        // Invalidate basket if a purchase was made
+        return [];
+      }
+      // The basket is cached and not expired, so return it,
+      // but without items that are invalid
+      // (e.g. because the product is archived, or sold out)
+      return cached.filter((item) => validPrices.includes(item.priceId));
     },
 
     saveBasket() {
@@ -58,6 +65,19 @@ document.addEventListener("alpine:init", () => {
       );
     },
 
+    /**
+     * Get the total of money that would be added to the AE account on basket purchase.
+     */
+    getTotalAdded() {
+      return this.basket
+        .filter((item) => item.isRefill || item.unitPrice < 0)
+        .reduce(
+          (acc: number, item: BasketItem) =>
+            acc + Math.abs(item.quantity * item.unitPrice),
+          0,
+        );
+    },
+
     /**
      * Add 1 to the quantity of an item in the basket
      * @param {BasketItem} item
@@ -80,7 +100,7 @@ document.addEventListener("alpine:init", () => {
 
       if (this.basket[index].quantity === 0) {
         this.basket = this.basket.filter(
-          (e: BasketItem) => e.priceId !== this.basket[index].id,
+          (e: BasketItem) => e.priceId !== this.basket[index].priceId,
         );
       }
     },
@@ -97,14 +117,16 @@ document.addEventListener("alpine:init", () => {
      * @param id The id of the product to add
      * @param name The name of the product
      * @param price The unit price of the product
+     * @param isRefill true if the product is a refill bond
      * @returns The created item
      */
-    createItem(id: number, name: string, price: number): BasketItem {
+    createItem(id: number, name: string, price: number, isRefill: boolean): BasketItem {
       const newItem = {
         priceId: id,
         name,
         quantity: 0,
         unitPrice: price,
+        isRefill,
       } as BasketItem;
 
       this.basket.push(newItem);
@@ -119,16 +141,17 @@ document.addEventListener("alpine:init", () => {
      * @param id The id of the product to add
      * @param name The name of the product
      * @param price The unit price of the product
+     * @param isRefill true if the product is a refill bond
      */
-    addFromCatalog(id: number, name: string, price: number) {
+    addFromCatalog(id: number, name: string, price: number, isRefill: boolean) {
-      let item = this.basket.find((e: BasketItem) => e.priceId === id);
+      const item = this.basket.find((e: BasketItem) => e.priceId === id);
 
       // if the item is not in the basket, we create it
       // else we add + 1 to it
       if (item) {
         this.add(item);
       } else {
-        item = this.createItem(id, name, price);
+        this.createItem(id, name, price, isRefill);
       }
     },
   }));

eboutic/templates/eboutic/eboutic_billing_info.jinja

@@ -21,9 +21,10 @@
       hx-swap="outerHTML"
       hx-target="#billing-infos-fragment"
       x-show="collapsed"
+      x-cloak
     >
       {% csrf_token %}
-      {{ form.as_p() }}
+      {{ form }}
       <br>
       <input
         type="submit" class="btn btn-blue clickable"

eboutic/templates/eboutic/eboutic_checkout.jinja

@@ -16,17 +16,20 @@
   <h3>{% trans %}Eboutic{% endtrans %}</h3>
 
   <script type="text/javascript">
-    let billingInfos = {{ billing_infos|safe }};
+    const billingInfos = {{ billing_infos|safe }};
   </script>
 
-  <div x-data="etransaction(billingInfos, {{ basket.id }})">
+  <div x-data='etransaction(
+               billingInfos,
+               { id: {{ basket.id }}, timeout: new Date("{{ basket.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT }}") }
+               )'>
     <p>{% trans %}Basket: {% endtrans %}</p>
     <table>
       <thead>
         <tr>
           <td>Article</td>
-          <td>Quantity</td>
+          <td>{% trans %}Quantity{% endtrans %}</td>
-          <td>Unit price</td>
+          <td>{% trans %}Unit price{% endtrans %}</td>
         </tr>
       </thead>
       <tbody>
@@ -60,10 +63,41 @@
       <div @htmx:after-request="fill">
         {{ billing_infos_form }}
       </div>
-      {% include "core/base/notifications.jinja" %}
+    {% endif %}
+    {% include "core/base/notifications.jinja" %}
+    {% if settings.SITH_EBOUTIC_CB_ENABLED or (basket.total <= user.account_balance and not basket.contains_refilling_item) %}
+      {# don't display the cgv form if no payment mean is available #}
+      <form id="cgv-form" x-ref="cgvForm">
+      {# In order to have one CGV button for both payment means,
+         we have a third dummy form, containing only the cgv button,
+         which validation is triggered when one of the two other forms is submitted.
+         If the validation of this form fails, the submit event will be cancelled. #}
+        <div class="form-group">
+          <input
+            type="checkbox"
+            id="cgv-checkbox"
+            name="cgv"
+            required
+            {% if basket.is_expired %}
+              disabled="disabled"
+            {% else %}
+              :disabled="!isCbAvailable && !isSithAvailable"
+            {% endif %}
+          >
+          <label for="cgv-checkbox">
+            {% trans  trimmed %}I have read and I accept{% endtrans %}
+            <a href="{{ url('core:page', 'cgv') }}">{% trans %}the general terms and conditions{% endtrans%}</a>
+            {%trans%}of the student association of the UTBM{% endtrans %}
+          </label>
+        </div>
+      </form>
+    {% endif %}
+    {% if settings.SITH_EBOUTIC_CB_ENABLED %}
       <form
         method="post"
+        id="bank-payment-form"
         action="{{ settings.SITH_EBOUTIC_ET_URL }}"
+        @submit="if (!$refs.cgvForm.reportValidity()) $event.preventDefault()"
       >
         <template x-for="[key, value] in Object.entries(data)" :key="key">
           <input type="hidden" :name="key" :value="value">
@@ -72,7 +106,11 @@
           x-cloak
           type="submit"
           id="bank-submit-button"
-          :disabled="!isCbAvailable"
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isCbAvailable"
+          {% endif %}
           class="btn btn-blue"
           value="{% trans %}Pay with credit card{% endtrans %}"
         />
@@ -91,9 +129,23 @@
     {% elif basket.total > user.account_balance %}
       <p>{% trans %}AE account payment disabled because you do not have enough money remaining.{% endtrans %}</p>
     {% else %}
-      <form method="post" action="{{ url('eboutic:pay_with_sith', basket_id=basket.id) }}" name="sith-pay-form">
+      <form
+        method="post"
+        action="{{ url('eboutic:pay_with_sith', basket_id=basket.id) }}"
+        id="sith-payment-form"
+        @submit="if (!$refs.cgvForm.reportValidity()) $event.preventDefault()"
+      >
         {% csrf_token %}
-        <input class="btn btn-blue" type="submit" value="{% trans %}Pay with Sith account{% endtrans %}"/>
+        <input
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isSithAvailable"
+          {% endif %}
+          class="btn btn-blue"
+          type="submit"
+          value="{% trans %}Pay with Sith account{% endtrans %}"
+        />
       </form>
     {% endif %}
   </div>

eboutic/templates/eboutic/eboutic_main.jinja

@@ -30,7 +30,17 @@
 {% block content %}
   <h1 id="eboutic-title">{% trans %}Eboutic{% endtrans %}</h1>
 
-  <div id="eboutic" x-data="basket({{ last_purchase_time }})">
+  <div
+    id="eboutic"
+    x-data="basket(
+            [{%- for prices in categories -%}
+              {%- for p in prices -%}
+                {% if not p.sold_out %}{{ p.id }},{% endif %}
+              {%- endfor -%}
+            {%- endfor -%}],
+            {{ last_purchase_time }},
+            )"
+  >
     <div id="basket">
       <h3>Panier</h3>
       <form method="post" action="">
@@ -48,6 +58,17 @@
             </div>
           </div>
         {% endif %}
+        <template x-if="(getTotalAdded() + {{ customer_amount }}) > {{ settings.SITH_ACCOUNT_MAX_MONEY }}">
+          <div class="alert alert-red">
+            <div class="alert-main">
+              {% trans trimmed limit=settings.SITH_ACCOUNT_MAX_MONEY %}
+                You cannot purchase the current basket,
+                because it would put your AE account balance
+                above the {{ limit }}€ limit
+              {% endtrans %}
+            </div>
+          </div>
+        </template>
         <ul class="item-list">
           {# Starting money #}
           <li>
@@ -99,9 +120,12 @@
             <i class="fa fa-trash"></i>
             {% trans %}Clear{% endtrans %}
           </button>
-          <button class="btn btn-blue">
+          <button
+            class="btn btn-blue"
+            :disabled="(getTotalAdded() + {{ customer_amount }}) > {{ settings.SITH_ACCOUNT_MAX_MONEY }}"
+          >
             <i class="fa fa-check"></i>
-            <input type="submit" value="{% trans %}Validate{% endtrans %}"/>
+            {% trans %}Validate{% endtrans %}
           </button>
         </div>
       </form>
@@ -187,9 +211,15 @@
             {% for price in prices %}
               <button
                 id="{{ price.id }}"
-                class="card product-button clickable shadow"
+                class="card clickable shadow"
                 :class="{selected: basket.some((i) => i.priceId === {{ price.id }})}"
-                @click='addFromCatalog({{ price.id }}, {{ price.full_label|tojson }}, {{ price.amount }})'
+                @click='addFromCatalog(
+                        {{ price.id }},
+                        {{ price.full_label|tojson }},
+                        {{ price.amount }},
+                        {{ (price.product.product_type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING)|lower }}
+                        )'
+                {% if price.sold_out %}disabled{% endif %}
               >
                 {% if price.product.icon %}
                   <img
@@ -202,6 +232,9 @@
                 {% endif %}
                 <div class="card-content">
                   <h4 class="card-title">{{ price.full_label }}</h4>
+                  {% if price.sold_out -%}
+                    <p><em>{% trans %}Product sold out{% endtrans %}</em></p>
+                  {%- endif %}
                   <p>{{ price.amount }} €</p>
                 </div>
               </button>

eboutic/tests/test_basket.py

@@ -1,14 +1,19 @@
+import re
 from datetime import datetime, timezone
 
+import freezegun
 import pytest
+from bs4 import BeautifulSoup
+from django.conf import settings
 from django.http import HttpResponse
 from django.test import TestCase
 from django.test.client import Client
 from django.urls import reverse
-from django.utils.timezone import localdate
+from django.utils.timezone import localdate, now
 from model_bakery import baker
 from pytest_django.asserts import assertRedirects
 
+import eboutic.models
 from core.baker_recipes import subscriber_user
 from core.models import Group, User
 from counter.baker_recipes import (
@@ -130,9 +135,11 @@ def test_eboutic_basket_expiry(
             _bulk_create=True,
         )
 
+    soup = BeautifulSoup(client.get(reverse("eboutic:main")).text, "lxml")
     assert (
-        f'x-data="basket({int(expected.timestamp() * 1000) if expected else "null"})"'
+        # remove any space from the value before asserting
-        in client.get(reverse("eboutic:main")).text
+        re.sub(r"\s+", "", soup.find(id="eboutic").attrs["x-data"])
+        == f"basket([],{int(expected.timestamp() * 1000) if expected else 'null'},)"
     )
 
 
@@ -231,26 +238,66 @@ class TestEboutic(TestCase):
 
     def test_add_forbidden_product(self):
         self.client.force_login(self.new_customer)
-        response = self.submit_basket([BasketItem(self.beer.id, 1)])
+        for product in self.beer, self.cotiz, self.not_in_counter:
-        assert response.status_code == 200
+            response = self.submit_basket([BasketItem(product.id, 1)])
-        assert Basket.objects.first() is None
+            assert response.status_code == 200
+            assert not Basket.objects.exists()
 
-        response = self.submit_basket([BasketItem(self.cotiz.id, 1)])
+    def test_sold_out_product(self):
+        sold_out = product_recipe.make(
+            clic_limit=3, counters=[self.eboutic], product_type=baker.make(ProductType)
+        )
+        price = price_recipe.make(product=sold_out, groups=[self.group_cotiz], amount=0)
+        sale_recipe.make(
+            product=sold_out,
+            customer=self.subscriber.customer,
+            unit_price=0,
+            quantity=1,
+        )
+        baker.make(
+            eboutic.models.BasketItem,
+            basket=baker.make(Basket),
+            product=sold_out,
+            quantity=2,
+        )
+        self.client.force_login(self.subscriber)
+        response = self.submit_basket([BasketItem(price.id, 1)])
         assert response.status_code == 200
-        assert Basket.objects.first() is None
+        assert Basket.objects.count() == 1
+        with freezegun.freeze_time(
+            now()
+            + settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            + settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT
+        ):
+            # after a while, unpaid basket items should expire and make the
+            # product available again.
+            response = self.submit_basket([BasketItem(price.id, 1)])
+        assertRedirects(
+            response,
+            reverse("eboutic:checkout", kwargs={"basket_id": Basket.objects.last().id}),
+        )
+        assert Basket.objects.count() == 2
 
-        response = self.submit_basket([BasketItem(self.not_in_counter.id, 1)])
+    def test_refill_limit(self):
-        assert response.status_code == 200
+        """Test that an eboutic basket cannot refill an account above the limit."""
-        assert Basket.objects.first() is None
+        self.client.force_login(self.subscriber)
+        product = product_recipe.make(
+            product_type_id=settings.SITH_COUNTER_PRODUCTTYPE_REFILLING,
+            counters=[self.eboutic],
+        )
+        price = price_recipe.make(
+            product=product,
+            groups=[self.group_cotiz],
+            amount=settings.SITH_ACCOUNT_MAX_MONEY // 10,
+        )
 
-        self.client.force_login(self.new_customer)
+        response = self.submit_basket([BasketItem(price.id, 10)])
-        response = self.submit_basket([BasketItem(self.cotiz.id, 1)])
+        assert Basket.objects.count() == 1
-        assert response.status_code == 200
+        assertRedirects(response, reverse("eboutic:checkout", kwargs={"basket_id": 1}))
-        assert Basket.objects.first() is None
 
-        response = self.submit_basket([BasketItem(self.not_in_counter.id, 1)])
+        response = self.submit_basket([BasketItem(price.id, 11)])
-        assert response.status_code == 200
+        assert Basket.objects.count() == 1
-        assert Basket.objects.first() is None
+        assert response.status_code == 200  # no redirect = form validation failed
 
     def test_create_basket(self):
         self.client.force_login(self.new_customer)

eboutic/tests/test_billing_info.py

@@ -37,12 +37,9 @@ class TestBillingInfo:
 
     def test_edit_infos(self, client: Client, payload: dict[str, str]):
         user = subscriber_user.make()
-        baker.make(BillingInfo, customer=user.customer)
+        baker.make(BillingInfo, customer=user.customer, phone_number="06 01 02 03 04")
         client.force_login(user)
-        response = client.post(
+        response = client.post(reverse("eboutic:billing_infos"), payload)
-            reverse("eboutic:billing_infos"),
-            payload,
-        )
         user.refresh_from_db()
         infos = BillingInfo.objects.get(customer__user=user)
         assert response.status_code == 302

eboutic/tests/test_payment.py

@@ -3,6 +3,7 @@ import urllib
 from decimal import Decimal
 from typing import TYPE_CHECKING
 
+import freezegun
 from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.hazmat.primitives.hashes import SHA1
@@ -17,7 +18,7 @@ from pytest_django.asserts import assertRedirects
 
 from core.baker_recipes import old_subscriber_user, subscriber_user
 from counter.baker_recipes import price_recipe, product_recipe
-from counter.models import Product, ProductType, Selling
+from counter.models import Product, ProductType, Refilling, Selling
 from counter.tests.test_counter import force_refill_user
 from eboutic.models import Basket, BasketItem
 
@@ -105,7 +106,7 @@ class TestPaymentSith(TestPaymentBase):
             ),
             reverse("eboutic:payment_result", kwargs={"result": "success"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == Decimal(1)
 
@@ -139,10 +140,7 @@ class TestPaymentSith(TestPaymentBase):
         assert len(messages) == 1
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert messages[0].message == "Solde insuffisant"
-
+        assert not Basket.objects.filter(id=self.basket.id).exists()
-        assert Basket.objects.contains(self.basket), (
-            "After an unsuccessful request, the basket should be kept"
-        )
 
     def test_refilling_in_basket(self):
         BasketItem.from_price(self.refilling.prices.first(), 1, self.basket).save()
@@ -157,7 +155,7 @@ class TestPaymentSith(TestPaymentBase):
             response,
             reverse("eboutic:payment_result", kwargs={"result": "failure"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is not None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         messages = list(get_messages(response.wsgi_request))
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert (
@@ -167,6 +165,24 @@ class TestPaymentSith(TestPaymentBase):
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == initial_account_balance
 
+    def test_basket_expired(self):
+        self.client.force_login(self.customer)
+        initial_account_balance = self.customer.customer.amount
+        with freezegun.freeze_time(settings.SITH_EBOUTIC_BASKET_TIMEOUT):
+            response = self.client.post(
+                reverse("eboutic:pay_with_sith", kwargs={"basket_id": self.basket.id})
+            )
+        assertRedirects(
+            response,
+            reverse("eboutic:payment_result", kwargs={"result": "failure"}),
+        )
+        messages = list(get_messages(response.wsgi_request))
+        assert messages[0].level == DEFAULT_LEVELS["ERROR"]
+        assert messages[0].message == "Panier expiré"
+        assert not Basket.objects.filter(id=self.basket.id).exists()
+        self.customer.customer.refresh_from_db()
+        assert self.customer.customer.amount == initial_account_balance
+
 
 class TestPaymentCard(TestPaymentBase):
     def generate_bank_valid_answer(self, basket: Basket):
@@ -236,6 +252,10 @@ class TestPaymentCard(TestPaymentBase):
 
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == price.amount * 2
+        refill = self.customer.customer.refillings.last()
+        assert refill is not None
+        assert refill.amount == price.amount * 2
+        assert refill.payment_method == Refilling.PaymentMethod.CARD
 
     def test_multiple_responses(self):
         bank_response = self.generate_bank_valid_answer(self.basket)

eboutic/views.py

@@ -33,12 +33,14 @@ from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.db import DatabaseError, transaction
-from django.db.models import Subquery
+from django.db.models import Exists, OuterRef, Subquery
 from django.db.models.fields import forms
 from django.db.utils import cached_property
 from django.http import HttpResponse
 from django.shortcuts import redirect, render
 from django.urls import reverse
+from django.utils.formats import localize
+from django.utils.timezone import localtime
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.http import require_GET
 from django.views.generic import DetailView, FormView, TemplateView, UpdateView, View
@@ -56,7 +58,7 @@ from counter.models import (
     Selling,
     get_eboutic,
 )
-from eboutic.models import Basket, BasketItem, BillingInfoState, Invoice, InvoiceItem
+from eboutic.models import Basket, BasketItem, Invoice, InvoiceItem
 
 if TYPE_CHECKING:
     from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
@@ -64,9 +66,7 @@ if TYPE_CHECKING:
 
 
 class BaseEbouticBasketForm(BaseBasketForm):
-    def _check_enough_money(self, *args, **kwargs):
+    min_result_balance = None  # user can pay by card, so no minimum enforced
-        # Disable money check
-        ...
 
 
 EbouticBasketForm = forms.formset_factory(
@@ -86,13 +86,15 @@ class EbouticMainView(LoginRequiredMixin, FormView):
     form_class = EbouticBasketForm
 
     def get_form_kwargs(self):
-        kwargs = super().get_form_kwargs()
+        return super().get_form_kwargs() | {
-        kwargs["form_kwargs"] = {
             "customer": self.customer,
             "counter": get_eboutic(),
-            "allowed_prices": {price.id: price for price in self.prices},
+            "form_kwargs": {
+                "allowed_prices": {
+                    price.id: price for price in self.prices if not price.sold_out
+                }
+            },
         }
-        return kwargs
 
     def form_valid(self, formset):
         if len(formset) == 0:
@@ -116,9 +118,14 @@ class EbouticMainView(LoginRequiredMixin, FormView):
 
     @cached_property
     def prices(self) -> list[Price]:
-        return get_eboutic().get_prices_for(
+        eboutic = get_eboutic()
-            self.customer,
+        sold_out_subquery = ~Exists(
-            order_by=["product__product_type__order", "product_id", "amount"],
+            eboutic.products.under_clic_limit().filter(id=OuterRef("product_id"))
+        )
+        return list(
+            eboutic.get_prices_for(self.customer)
+            .annotate(sold_out=sold_out_subquery)
+            .order_by("product__product_type__order", "product_id", "amount")
         )
 
     @cached_property
@@ -178,7 +185,7 @@ def payment_result(request, result: str) -> HttpResponse:
 class BillingInfoFormFragment(
     LoginRequiredMixin, FragmentMixin, SuccessMessageMixin, UpdateView
 ):
-    """Update billing info"""
+    """Update or create billing info"""
 
     model = BillingInfo
     form_class = BillingInfoForm
@@ -187,9 +194,7 @@ class BillingInfoFormFragment(
 
     def get_initial(self):
         if self.object is None:
-            return {
+            return {"country": Country(code="FR")}
-                "country": Country(code="FR"),
-            }
         return {}
 
     def render_fragment(self, request, **kwargs) -> SafeString:
@@ -211,26 +216,15 @@ class BillingInfoFormFragment(
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
-        kwargs["billing_infos_state"] = BillingInfoState.from_model(self.object)
         kwargs["action"] = reverse("eboutic:billing_infos")
-        match BillingInfoState.from_model(self.object):
+        if not self.object:
-            case BillingInfoState.EMPTY:
+            messages.warning(
-                messages.warning(
+                self.request,
-                    self.request,
+                _(
-                    _(
+                    "You must fill your billing infos "
-                        "You must fill your billing infos if you want to pay with your credit card"
+                    "if you want to pay with your credit card"
-                    ),
+                ),
-                )
+            )
-            case BillingInfoState.MISSING_PHONE_NUMBER:
-                messages.warning(
-                    self.request,
-                    _(
-                        "The Crédit Agricole changed its policy related to the billing "
-                        + "information that must be provided in order to pay with a credit card. "
-                        + "If you want to pay with your credit card, you must add a phone number "
-                        + "to the data you already provided.",
-                    ),
-                )
         return kwargs
 
     def get_success_url(self, **kwargs):
@@ -255,10 +249,19 @@ class EbouticCheckout(CanViewMixin, UseFragmentsMixin, DetailView):
             kwargs["customer_amount"] = None
         kwargs["billing_infos"] = {}
 
-        with contextlib.suppress(BillingInfo.DoesNotExist):
+        if self.object.is_expired:
-            kwargs["billing_infos"] = json.dumps(
+            messages.error(self.request, _("Basket expired"))
-                dict(self.object.get_e_transaction_data())
+        else:
+            timeout = self.object.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            messages.warning(
+                self.request,
+                _("Basket available until %(until)s")
+                % {"until": localize(localtime(timeout).time())},
             )
+            with contextlib.suppress(BillingInfo.DoesNotExist):
+                kwargs["billing_infos"] = json.dumps(
+                    dict(self.object.get_e_transaction_data())
+                )
         return kwargs
 
 
@@ -268,9 +271,14 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
 
     def post(self, request, *args, **kwargs):
         basket = self.get_object()
+        if basket.is_expired:
+            messages.error(self.request, _("Basket expired"))
+            basket.delete()
+            return redirect("eboutic:payment_result", "failure")
         refilling = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING
         if basket.items.filter(product__product_type_id=refilling).exists():
             messages.error(self.request, _("You can't buy a refilling with sith money"))
+            basket.delete()
             return redirect("eboutic:payment_result", "failure")
 
         eboutic = get_eboutic()
@@ -288,6 +296,7 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
         except DatabaseError as e:
             sentry_sdk.capture_exception(e)
         except ValidationError as e:
+            basket.delete()
             messages.error(self.request, e.message)
         return redirect("eboutic:payment_result", "failure")