add condition for EBOUTIC counter type in subscription creation

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.14.4
+    rev: v0.11.13
     hooks:
       - id: ruff-check  # just check the code, and print the errors
       - id: ruff-check  # actually fix the fixable errors, but print nothing
@@ -14,7 +14,7 @@ repos:
       - id: biome-check
         additional_dependencies: ["@biomejs/biome@1.9.4"]
   - repo: https://github.com/rtts/djhtml
-    rev: 3.0.10
+    rev: 3.0.7
     hooks:
       - id: djhtml
         name: format templates

api/auth.py

@@ -6,8 +6,6 @@ from api.models import ApiClient, ApiKey
 
 
 class ApiKeyAuth(APIKeyHeader):
-    """Authentication through client api keys."""
-
     param_name = "X-APIKey"
 
     def authenticate(self, request: HttpRequest, key: str | None) -> ApiClient | None:

api/tests/test_mixed_auth.py

@@ -1,48 +0,0 @@
-import pytest
-from django.test import Client
-from django.urls import path
-from model_bakery import baker
-from ninja import NinjaAPI
-from ninja.security import SessionAuth
-
-from api.auth import ApiKeyAuth
-from api.hashers import generate_key
-from api.models import ApiClient, ApiKey
-
-api = NinjaAPI()
-
-
-@api.post("", auth=[ApiKeyAuth(), SessionAuth()])
-def post_method(*args, **kwargs) -> None:
-    """Dummy POST route authenticated by either api key or session cookie."""
-    pass
-
-
-urlpatterns = [path("", api.urls)]
-
-
-@pytest.mark.django_db
-@pytest.mark.urls(__name__)
-@pytest.mark.parametrize("user_logged_in", [False, True])
-def test_csrf_token(user_logged_in):
-    """Test that CSRF check happens only when no api key is used."""
-    client = Client(enforce_csrf_checks=True)
-    key, hashed = generate_key()
-    api_client = baker.make(ApiClient)
-    baker.make(ApiKey, client=api_client, hashed_key=hashed)
-    if user_logged_in:
-        client.force_login(api_client.owner)
-
-    response = client.post("")
-    assert response.status_code == 403
-    assert response.json()["detail"] == "CSRF check Failed"
-
-    # if using a valid API key, CSRF check should not occur
-    response = client.post("", headers={"X-APIKey": key})
-    assert response.status_code == 200
-
-    # if using a wrong API key, ApiKeyAuth should fail,
-    # leading to a fallback into SessionAuth and a CSRF check
-    response = client.post("", headers={"X-APIKey": generate_key()[0]})
-    assert response.status_code == 403
-    assert response.json()["detail"] == "CSRF check Failed"

api/urls.py

@@ -1,4 +1,3 @@
-from ninja.security import SessionAuth
 from ninja_extra import NinjaExtraAPI
 
 api = NinjaExtraAPI(
@@ -6,6 +5,6 @@ api = NinjaExtraAPI(
     description="Portail Interactif de Communication avec les Outils Numériques",
     version="0.2.0",
     urls_namespace="api",
-    auth=[SessionAuth()],
+    csrf=True,
 )
 api.auto_discover_controllers()

club/api.py

@@ -1,5 +1,7 @@
+from typing import Annotated
+
+from annotated_types import MinLen
 from django.db.models import Prefetch
-from ninja import Query
 from ninja.security import SessionAuth
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.pagination import PageNumberPaginationExtra
@@ -8,7 +10,7 @@ from ninja_extra.schemas import PaginatedResponseSchema
 from api.auth import ApiKeyAuth
 from api.permissions import CanAccessLookup, HasPerm
 from club.models import Club, Membership
-from club.schemas import ClubSchema, ClubSearchFilterSchema, SimpleClubSchema
+from club.schemas import ClubSchema, SimpleClubSchema
 
 
 @api_controller("/club")
@@ -16,18 +18,18 @@ class ClubController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimpleClubSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
         url_name="search_club",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
-    def search_club(self, filters: Query[ClubSearchFilterSchema]):
-        return filters.filter(Club.objects.all())
+    def search_club(self, search: Annotated[str, MinLen(1)]):
+        return Club.objects.filter(name__icontains=search).values()
 
     @route.get(
         "/{int:club_id}",
         response=ClubSchema,
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[HasPerm("club.view_club")],
         url_name="fetch_club",
     )

club/forms.py

@@ -252,7 +252,7 @@ class ClubAddMemberForm(ClubMemberForm):
         Board members can attribute roles lower than their own.
         Other users cannot attribute roles with this form
         """
-        if self.request_user.has_perm("club.add_membership"):
+        if self.request_user.has_perm("club.add_subscription"):
             return settings.SITH_CLUB_ROLES_ID["President"]
         membership = self.request_user_membership
         if membership is None or membership.role <= settings.SITH_MAXIMUM_FREE_ROLE:

club/schemas.py

@@ -1,26 +1,9 @@
-from typing import Annotated
-
-from annotated_types import MinLen
-from django.db.models import Q
-from ninja import Field, FilterSchema, ModelSchema
+from ninja import ModelSchema
 
 from club.models import Club, Membership
 from core.schemas import SimpleUserSchema
 
 
-class ClubSearchFilterSchema(FilterSchema):
-    search: Annotated[str, MinLen(1)] | None = Field(None, q="name__icontains")
-    is_active: bool | None = None
-    parent_id: int | None = None
-    parent_name: str | None = Field(None, q="parent__name__icontains")
-    exclude_ids: set[int] | None = None
-
-    def filter_exclude_ids(self, value: set[int] | None):
-        if value is None:
-            return Q()
-        return ~Q(id__in=value)
-
-
 class SimpleClubSchema(ModelSchema):
     class Meta:
         model = Club

club/templates/club/club_detail.jinja

@@ -9,18 +9,6 @@
   {{ club.short_description }}
 {%- endblock %}
 
-{% block metatags %}
-  <meta property="og:url" content="{{ request.build_absolute_uri(club.get_absolute_url()) }}" />
-  <meta property="og:type" content="website" />
-  <meta property="og:title" content="{{ club.name }}" />
-  <meta property="og:description" content="{{ club.short_description }}" />
-  {% if club.logo %}
-    <meta property="og:image" content="{{ request.build_absolute_uri(club.logo.url) }}" />
-  {% else %}
-    <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-  {% endif %}
-{% endblock %}
-
 {% block content %}
   <div id="club_detail">
     {% if club.logo %}
@@ -29,7 +17,7 @@
     {% if page_revision %}
       {{ page_revision|markdown }}
     {% else %}
-      <h3>{{ club.name }}</h3>
+      <h3>{% trans %}Club{% endtrans %}</h3>
     {% endif %}
   </div>
 {% endblock %}

club/templates/club/club_sellings.jinja

@@ -6,11 +6,11 @@ because it works with a somewhat dynamic form,
 but was written before Alpine was introduced in the project.
 TODO : rewrite the pagination used in this template an Alpine one
 #}
-{% macro paginate(page_obj, paginator) %}
-  {% set js = "formPagination(this)" %}
+{% macro paginate(page_obj, paginator, js_action) %}
+  {% set js = js_action|default('') %}
   {% if page_obj.has_previous() or page_obj.has_next() %}
     {% if page_obj.has_previous() %}
-      <a type="submit" onclick="{{ js }}" href="?page={{ page_obj.previous_page_number() }}">{% trans %}Previous{% endtrans %}</a>
+      <a {% if js %} type="submit" onclick="{{ js }}" {% endif %} href="?page={{ page_obj.previous_page_number() }}">{% trans %}Previous{% endtrans %}</a>
     {% else %}
       <span class="disabled">{% trans %}Previous{% endtrans %}</span>
     {% endif %}
@@ -18,11 +18,11 @@ TODO : rewrite the pagination used in this template an Alpine one
       {% if page_obj.number == i %}
         <span class="active">{{ i }} <span class="sr-only">({% trans %}current{% endtrans %})</span></span>
       {% else %}
-        <a type="submit" onclick="{{ js }}" href="?page={{ i }}">{{ i }}</a>
+        <a {% if js %} type="submit" onclick="{{ js }}" {% endif %} href="?page={{ i }}">{{ i }}</a>
       {% endif %}
     {% endfor %}
     {% if page_obj.has_next() %}
-      <a type="submit" onclick="{{ js }}" href="?page={{ page_obj.next_page_number() }}">{% trans %}Next{% endtrans %}</a>
+      <a {% if js %} type="submit" onclick="{{ js }}" {% endif %} href="?page={{ page_obj.next_page_number() }}">{% trans %}Next{% endtrans %}</a>
     {% else %}
       <span class="disabled">{% trans %}Next{% endtrans %}</span>
     {% endif %}
@@ -81,10 +81,6 @@ TODO : rewrite the pagination used in this template an Alpine one
       {% endfor %}
     </tbody>
   </table>
-  {{ paginate(paginated_result, paginator) }}
-{% endblock %}
-
-{% block script %}
   <script type="text/javascript">
     function formPagination(link){
       const form = document.getElementById("form")
@@ -93,6 +89,7 @@ TODO : rewrite the pagination used in this template an Alpine one
       form.submit();
     }
   </script>
+  {{ paginate(paginated_result, paginator, "formPagination(this)") }}
 {% endblock %}
 
 

club/tests/test_club_controller.py

@@ -1,8 +1,7 @@
 from datetime import date, timedelta
 
 import pytest
-from django.contrib.auth.models import Permission
-from django.test import Client, TestCase
+from django.test import Client
 from django.urls import reverse
 from model_bakery import baker
 from model_bakery.recipe import Recipe
@@ -10,54 +9,6 @@ from pytest_django.asserts import assertNumQueries
 
 from club.models import Club, Membership
 from core.baker_recipes import subscriber_user
-from core.models import Group, Page, User
-
-
-class TestClubSearch(TestCase):
-    @classmethod
-    def setUpTestData(cls):
-        cls.url = reverse("api:search_club")
-        cls.user = baker.make(
-            User, user_permissions=[Permission.objects.get(codename="access_lookup")]
-        )
-        # delete existing clubs to avoid side effect
-        groups = list(
-            Group.objects.exclude(club=None, club_board=None).values_list(
-                "id", flat=True
-            )
-        )
-        Page.objects.exclude(club=None).delete()
-        Club.objects.all().delete()
-        Group.objects.filter(id__in=groups).delete()
-
-        cls.clubs = baker.make(
-            Club,
-            _quantity=5,
-            name=iter(["AE", "ae 1", "Troll", "Dev AE", "pdf"]),
-            is_active=True,
-        )
-
-    def test_inactive_club(self):
-        self.client.force_login(self.user)
-        inactive_ids = {self.clubs[0].id, self.clubs[2].id}
-        Club.objects.filter(id__in=inactive_ids).update(is_active=False)
-        response = self.client.get(self.url, {"is_active": False})
-        assert response.status_code == 200
-        assert {d["id"] for d in response.json()["results"]} == inactive_ids
-
-    def test_excluded_id(self):
-        self.client.force_login(self.user)
-        response = self.client.get(self.url, {"exclude_ids": [self.clubs[1].id]})
-        assert response.status_code == 200
-        ids = {d["id"] for d in response.json()["results"]}
-        assert ids == {c.id for c in [self.clubs[0], *self.clubs[2:]]}
-
-    def test_club_search(self):
-        self.client.force_login(self.user)
-        response = self.client.get(self.url, {"search": "AE"})
-        assert response.status_code == 200
-        ids = {d["id"] for d in response.json()["results"]}
-        assert ids == {c.id for c in [self.clubs[0], self.clubs[1], self.clubs[3]]}
 
 
 @pytest.mark.django_db

club/views.py

@@ -23,7 +23,6 @@
 #
 
 import csv
-import itertools
 from typing import Any
 
 from django.conf import settings
@@ -31,14 +30,18 @@ from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import NON_FIELD_ERRORS, PermissionDenied, ValidationError
 from django.core.paginator import InvalidPage, Paginator
-from django.db.models import F, Q, Sum
-from django.http import Http404, HttpResponseRedirect, StreamingHttpResponse
+from django.db.models import Q, Sum
+from django.http import (
+    Http404,
+    HttpResponseRedirect,
+    StreamingHttpResponse,
+)
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse, reverse_lazy
 from django.utils import timezone
 from django.utils.safestring import SafeString
 from django.utils.timezone import now
-from django.utils.translation import gettext
+from django.utils.translation import gettext as _t
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView
@@ -52,7 +55,12 @@ from club.forms import (
     MailingForm,
     SellingsForm,
 )
-from club.models import Club, Mailing, MailingSubscription, Membership
+from club.models import (
+    Club,
+    Mailing,
+    MailingSubscription,
+    Membership,
+)
 from com.models import Poster
 from com.views import (
     PosterCreateBaseView,
@@ -60,7 +68,9 @@ from com.views import (
     PosterEditBaseView,
     PosterListBaseView,
 )
-from core.auth.mixins import CanEditMixin, PermissionOrClubBoardRequiredMixin
+from core.auth.mixins import (
+    CanEditMixin,
+)
 from core.models import PageRev
 from core.views import DetailFormView, PageEditViewBase, UseFragmentsMixin
 from core.views.mixins import FragmentMixin, FragmentRenderer, TabedViewMixin
@@ -371,7 +381,7 @@ class ClubOldMembersView(ClubTabsMixin, PermissionRequiredMixin, DetailView):
 
 
 class ClubSellingView(ClubTabsMixin, CanEditMixin, DetailFormView):
-    """Sales of a club."""
+    """Sellings of a club."""
 
     model = Club
     pk_url_kwarg = "club_id"
@@ -397,8 +407,9 @@ class ClubSellingView(ClubTabsMixin, CanEditMixin, DetailFormView):
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
+        qs = Selling.objects.filter(club=self.object)
 
-        kwargs["result"] = Selling.objects.none()
+        kwargs["result"] = qs[:0]
         kwargs["paginated_result"] = kwargs["result"]
         kwargs["total"] = 0
         kwargs["total_quantity"] = 0
@@ -406,7 +417,6 @@ class ClubSellingView(ClubTabsMixin, CanEditMixin, DetailFormView):
 
         form = self.get_form()
         if form.is_valid():
-            qs = Selling.objects.filter(club=self.object)
             if not len([v for v in form.cleaned_data.values() if v is not None]):
                 qs = Selling.objects.none()
             if form.cleaned_data["begin_date"]:
@@ -426,18 +436,18 @@ class ClubSellingView(ClubTabsMixin, CanEditMixin, DetailFormView):
             if len(selected_products) > 0:
                 qs = qs.filter(product__in=selected_products)
 
-            kwargs["total"] = qs.annotate(
-                price=F("quantity") * F("unit_price")
-            ).aggregate(total=Sum("price", default=0))["total"]
             kwargs["result"] = qs.select_related(
                 "counter", "counter__club", "customer", "customer__user", "seller"
             ).order_by("-id")
-            kwargs["total_quantity"] = qs.aggregate(total=Sum("quantity", default=0))[
-                "total"
-            ]
-            kwargs["benefit"] = qs.exclude(product=None).aggregate(
-                res=Sum("product__purchase_price", default=0)
-            )["res"]
+            kwargs["total"] = sum([s.quantity * s.unit_price for s in kwargs["result"]])
+            total_quantity = qs.all().aggregate(Sum("quantity"))
+            if total_quantity["quantity__sum"]:
+                kwargs["total_quantity"] = total_quantity["quantity__sum"]
+            benefit = (
+                qs.exclude(product=None).all().aggregate(Sum("product__purchase_price"))
+            )
+            if benefit["product__purchase_price__sum"]:
+                kwargs["benefit"] = benefit["product__purchase_price__sum"]
 
         kwargs["paginator"] = Paginator(kwargs["result"], self.paginate_by)
         try:
@@ -488,40 +498,40 @@ class ClubSellingCSVView(ClubSellingView):
         kwargs = self.get_context_data(**kwargs)
 
         # Use the StreamWriter class instead of request for streaming
-        writer = csv.writer(self.StreamWriter())
+        pseudo_buffer = self.StreamWriter()
+        writer = csv.writer(
+            pseudo_buffer, delimiter=";", lineterminator="\n", quoting=csv.QUOTE_ALL
+        )
 
-        first_rows = [
-            [gettext("Quantity"), kwargs["total_quantity"]],
-            [gettext("Total"), kwargs["total"]],
-            [gettext("Benefit"), kwargs["benefit"]],
+        writer.writerow([_t("Quantity"), kwargs["total_quantity"]])
+        writer.writerow([_t("Total"), kwargs["total"]])
+        writer.writerow([_t("Benefit"), kwargs["benefit"]])
+        writer.writerow(
             [
-                gettext("Date"),
-                gettext("Counter"),
-                gettext("Barman"),
-                gettext("Customer"),
-                gettext("Label"),
-                gettext("Quantity"),
-                gettext("Total"),
-                gettext("Payment method"),
-                gettext("Selling price"),
-                gettext("Purchase price"),
-                gettext("Benefit"),
-            ],
-        ]
+                _t("Date"),
+                _t("Counter"),
+                _t("Barman"),
+                _t("Customer"),
+                _t("Label"),
+                _t("Quantity"),
+                _t("Total"),
+                _t("Payment method"),
+                _t("Selling price"),
+                _t("Purchase price"),
+                _t("Benefit"),
+            ]
+        )
 
         # Stream response
         response = StreamingHttpResponse(
-            itertools.chain(
-                (writer.writerow(r) for r in first_rows),
-                (
-                    writer.writerow(self.write_selling(selling))
-                    for selling in kwargs["result"]
-                ),
+            (
+                writer.writerow(self.write_selling(selling))
+                for selling in kwargs["result"]
             ),
             content_type="text/csv",
         )
-        name = f"{gettext('Sellings')}_{self.object.name}.csv"
-        response["Content-Disposition"] = f"attachment; filename={name}"
+        name = _("Sellings") + "_" + self.object.name + ".csv"
+        response["Content-Disposition"] = "filename=" + name
 
         return response
 
@@ -759,13 +769,11 @@ class MailingAutoGenerationView(View):
         return redirect("club:mailing", club_id=club.id)
 
 
-class PosterListView(
-    PermissionOrClubBoardRequiredMixin, ClubTabsMixin, PosterListBaseView
-):
+class PosterListView(ClubTabsMixin, PosterListBaseView):
     """List communication posters."""
 
     current_tab = "posters"
-    permission_required = "com.view_poster"
+    extra_context = {"app": "club"}
 
     def get_queryset(self):
         return super().get_queryset().filter(club=self.club.id)
@@ -773,17 +781,6 @@ class PosterListView(
     def get_object(self):
         return self.club
 
-    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
-            "create_url": reverse_lazy(
-                "club:poster_create", kwargs={"club_id": self.club.id}
-            ),
-            "get_edit_url": lambda poster: reverse(
-                "club:poster_edit",
-                kwargs={"club_id": self.club.id, "poster_id": poster.id},
-            ),
-        }
-
 
 class PosterCreateView(ClubTabsMixin, PosterCreateBaseView):
     """Create communication poster."""

com/api.py

@@ -5,6 +5,7 @@ from django.utils.cache import add_never_cache_headers
 from ninja import Query
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.pagination import PageNumberPaginationExtra
+from ninja_extra.permissions import IsAuthenticated
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.permissions import HasPerm
@@ -16,13 +17,17 @@ from core.views.files import send_raw_file
 
 @api_controller("/calendar")
 class CalendarController(ControllerBase):
-    @route.get("/internal.ics", auth=None, url_name="calendar_internal")
+    @route.get("/internal.ics", url_name="calendar_internal")
     def calendar_internal(self):
         response = send_raw_file(IcsCalendar.get_internal())
         add_never_cache_headers(response)
         return response
 
-    @route.get("/unpublished.ics", url_name="calendar_unpublished")
+    @route.get(
+        "/unpublished.ics",
+        permissions=[IsAuthenticated],
+        url_name="calendar_unpublished",
+    )
     def calendar_unpublished(self):
         response = HttpResponse(
             IcsCalendar.get_unpublished(self.context.request.user),
@@ -69,7 +74,6 @@ class NewsController(ControllerBase):
 
     @route.get(
         "/date",
-        auth=None,
         url_name="fetch_news_dates",
         response=PaginatedResponseSchema[NewsDateSchema],
     )

com/models.py

@@ -144,7 +144,7 @@ class News(models.Model):
                 ),
                 groups__id=settings.SITH_GROUP_COM_ADMIN_ID,
             )
-            notif_url = reverse("com:news_admin_list", fragment="moderation")
+            notif_url = reverse("com:news_admin_list")
             new_notifs = [
                 Notification(user=user, url=notif_url, type="NEWS_MODERATION")
                 for user in admins_without_notif
@@ -402,7 +402,9 @@ class Poster(models.Model):
                 groups__id__in=[settings.SITH_GROUP_COM_ADMIN_ID]
             ):
                 Notification.objects.create(
-                    user=user, url=reverse("com:poster_list"), type="POSTER_MODERATION"
+                    user=user,
+                    url=reverse("com:poster_moderate_list"),
+                    type="POSTER_MODERATION",
                 )
         return super().save(*args, **kwargs)
 

com/static/com/css/news-list.scss

@@ -83,8 +83,7 @@
     #links_content {
       overflow: auto;
       box-shadow: $shadow-color 1px 1px 1px;
-      min-height: 20em;
-      padding-bottom: 1em;
+      height: 20em;
 
       h4 {
         margin-left: 5px;

com/static/com/css/posters.scss

@@ -20,7 +20,33 @@
       position: absolute;
       display: flex;
       bottom: 5px;
-      left: 0;
+
+      &.left {
+        left: 0;
+      }
+
+      &.right {
+        right: 0;
+      }
+
+      .link {
+        padding: 5px;
+        padding-left: 20px;
+        padding-right: 20px;
+        margin-left: 5px;
+        border-radius: 20px;
+        background-color: hsl(40, 100%, 50%);
+        color: black;
+
+        &:hover {
+          color: black;
+          background-color: hsl(40, 58%, 50%);
+        }
+
+        &.delete {
+          background-color: hsl(0, 100%, 40%);
+        }
+      }
     }
   }
 
@@ -117,15 +143,43 @@
         }
       }
 
-      .actions {
-        display: flex;
-        flex-direction: column;
-        align-items: stretch;
-        form {
-          margin: unset;
-          padding: unset;
-          button {
-            width: 100%;
+      .edit,
+      .moderate,
+      .slideshow {
+        padding: 5px;
+        border-radius: 20px;
+        background-color: hsl(40, 100%, 50%);
+        color: black;
+
+        &:hover {
+          color: black;
+          background-color: hsl(40, 58%, 50%);
+        }
+
+        &:nth-child(2n) {
+          margin-top: 5px;
+          margin-bottom: 5px;
+        }
+      }
+
+      .tooltip {
+        visibility: hidden;
+        width: 120px;
+        background-color: hsl(210, 20%, 98%);
+        color: hsl(0, 0%, 0%);
+        text-align: center;
+        padding: 5px 0;
+        border-radius: 6px;
+        position: absolute;
+        z-index: 10;
+
+        ul {
+          margin-left: 0;
+          display: inline-block;
+
+          li {
+            display: list-item;
+            list-style-type: none;
           }
         }
       }

com/templates/com/macros.jinja

@@ -76,20 +76,18 @@
               It will stay hidden for other users until it has been published.
             {% endtrans %}
           </p>
-          {%- if user.has_perm("com.moderate_news") -%}
+          {% if user.has_perm("com.moderate_news") %}
             {# This is an additional query for each non-moderated news,
             but it will be executed only for admin users, and only one time
-            (if they do their job and moderate news as soon as they see them),
+            (if they do their job and moderated news as soon as they see them),
             so it's still reasonable #}
             <div
-              {% if news is integer or news is string -%}
+              {% if news is integer or news is string %}
                 x-data="{ nbEvents: 0 }"
                 x-init="nbEvents = await nbToPublish()"
-              {%- elif news.is_published -%}
-                x-data="{ nbEvents: 0 }"
-              {%- else -%}
+              {% else %}
                 x-data="{ nbEvents: {{ news.dates.count() }} }"
-              {%- endif -%}
+              {% endif %}
             >
               <template x-if="nbEvents > 1">
                 <div>

com/templates/com/news_admin_list.jinja

@@ -131,7 +131,7 @@
       {% endfor %}
     </tbody>
   </table>
-  <h5 id="moderation">{% trans %}Events to moderate{% endtrans %}</h5>
+  <h5>{% trans %}Events to moderate{% endtrans %}</h5>
   <table>
     <thead>
       <tr>
@@ -165,3 +165,6 @@
     </tbody>
   </table>
 {% endblock %}
+
+
+

com/templates/com/news_detail.jinja

@@ -1,20 +1,15 @@
 {% extends "core/base.jinja" %}
-{% from 'core/macros.jinja' import user_profile_link, link_news_logo %}
+{% from 'core/macros.jinja' import user_profile_link, facebook_share, tweet, link_news_logo, gen_news_metatags %}
 {% from "com/macros.jinja" import news_moderation_alert %}
 
 {% block title %}
-  {% trans %}News{% endtrans %} - {{ object.title }}
+  {% trans %}News{% endtrans %} -
+  {{ object.title }}
 {% endblock %}
 
-{% block description %}{{ news.summary }}{% endblock %}
-
-{% block metatags %}
-  <meta property="og:url" content="{{ news.get_full_url() }}" />
-  <meta property="og:type" content="article" />
-  <meta property="article:section" content="{% trans %}News{% endtrans %}" />
-  <meta property="og:title" content="{{ news.title }}" />
-  <meta property="og:description" content="{{ news.summary }}" />
-  <meta property="og:image" content="{{ request.build_absolute_uri(link_news_logo(news)) }}" />
+{% block head %}
+  {{ super() }}
+  {{ gen_news_metatags(news) }}
 {% endblock %}
 
 
@@ -49,14 +44,8 @@
         <div><em>{{ news.summary|markdown }}</em></div>
         <br/>
         <div>{{ news.content|markdown }}</div>
-        <a
-          rel="nofollow"
-          target="#"
-          class="share_button facebook"
-          href="https://www.facebook.com/sharer/sharer.php?u={{ news.get_full_url() }}"
-        >
-          {% trans %}Share on Facebook{% endtrans %}
-        </a>
+        {{ facebook_share(news) }}
+        {{ tweet(news) }}
         <div class="news_meta">
           <p>{% trans %}Author: {% endtrans %}{{ user_profile_link(news.author) }}</p>
           {% if news.moderator %}

com/templates/com/news_list.jinja

@@ -205,10 +205,6 @@
               <i class="fa-solid fa-graduation-cap fa-xl"></i>
               <a href="{{ url("pedagogy:guide") }}">{% trans %}UV Guide{% endtrans %}</a>
             </li>
-            <li>
-              <i class="fa-solid fa-calendar-days fa-xl"></i>
-              <a href="{{ url("timetable:generator") }}">{% trans %}Timetable{% endtrans %}</a>
-            </li>
             <li>
               <i class="fa-solid fa-magnifying-glass fa-xl"></i>
               <a href="{{ url("matmat:search_clear") }}">{% trans %}Matmatronch{% endtrans %}</a>

com/templates/com/poster_list.jinja

@@ -13,53 +13,53 @@
 
     <div id="title">
       <h3>{% trans %}Posters{% endtrans %}</h3>
-      <div id="links">
-        <a id="create" class="btn btn-blue" href="{{ create_url }}">
-          <i class="fa fa-plus"></i>
-          {% trans %}Create{% endtrans %}
-        </a>
+      <div id="links" class="right">
+        {% if app == "com" %}
+          <a id="create" class="link" href="{{ url(app + ":poster_create") }}">{% trans %}Create{% endtrans %}</a>
+          <a id="moderation" class="link" href="{{ url("com:poster_moderate_list") }}">{% trans %}Moderation{% endtrans %}</a>
+        {% elif app == "club" %}
+          <a id="create" class="link" href="{{ url(app + ":poster_create", club.id) }}">{% trans %}Create{% endtrans %}</a>
+        {% endif %}
       </div>
     </div>
 
     <div id="posters">
-      {% for poster in poster_list %}
-        <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
-          <div class="name">{{ poster.name }}</div>
-          <div
-            class="image"
-            hover="{% trans %}Click to expand{% endtrans %}"
-            @click="active = $el.firstElementChild"
-            tooltip="{%- for screen in poster.screens.all() -%}
-                       {{ screen }}
-                     {% endfor %}"
-          >
-            <img src="{{ poster.file.url }}" alt="{{ poster.name }}">
-          </div>
-          <div class="dates">
-            <div class="begin">{{ poster.date_begin | localtime | date("d/M/Y H:m") }}</div>
-            <div class="end">{{ poster.date_end | localtime | date("d/M/Y H:m") }}</div>
-          </div>
-          <div class="actions">
-            {% if poster.is_editable %}
-              <a class="btn btn-blue" href="{{ get_edit_url(poster) }}">
-                <i class="fa fa-pen-to-square"></i>
-                {% trans %}Edit{% endtrans %}
-              </a>
-            {% endif %}
-            {% if not poster.is_moderated and user.has_perm("com.moderate_poster") %}
-              <form action="{{ url("com:poster_moderate", object_id=poster.id) }}" method="post">
-                {% csrf_token %}
-                <button type="submit" class="btn btn-green">
-                  <i class="fa fa-check"></i>
-                  {% trans %}Moderate{% endtrans %}
-                </button>
-              </form>
-            {% endif %}
-          </div>
-        </div>
-      {% else %}
+
+      {% if poster_list.count() == 0 %}
         <div id="no-posters">{% trans %}No posters{% endtrans %}</div>
-      {% endfor %}
+      {% else %}
+
+        {% for poster in poster_list %}
+          <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
+            <div class="name">{{ poster.name }}</div>
+            <div
+              class="image"
+              hover="{% trans %}Click to expand{% endtrans %}"
+              @click="active = $el.firstElementChild"
+            >
+              <img src="{{ poster.file.url }}"></img>
+            </div>
+            <div class="dates">
+              <div class="begin">{{ poster.date_begin | localtime | date("d/M/Y H:m") }}</div>
+              <div class="end">{{ poster.date_end | localtime | date("d/M/Y H:m") }}</div>
+            </div>
+            {% if app == "com" %}
+              <a class="edit" href="{{ url(app + ":poster_edit", poster.id) }}">{% trans %}Edit{% endtrans %}</a>
+            {% elif app == "club" %}
+              <a class="edit" href="{{ url(app + ":poster_edit", club.id, poster.id) }}">{% trans %}Edit{% endtrans %}</a>
+            {% endif %}
+            <div class="tooltip">
+              <ul>
+                {% for screen in poster.screens.all() %}
+                  <li>{{ screen }}</li>
+                {% endfor %}
+              </ul>
+            </div>
+          </div>
+        {% endfor %}
+
+      {% endif %}
+
     </div>
 
     <div
@@ -68,9 +68,7 @@
       @click="active = null"
       :class="{active: active !== null}"
     >
-      <div id="placeholder">
-        <img :src="active?.src" :alt="active?.name">
-      </div>
+      <div id="placeholder"><img :src="active?.src"></div>
     </div>
 
   </div>

com/templates/com/poster_moderate.jinja

@@ -0,0 +1,43 @@
+{% extends "core/base.jinja" %}
+
+{% block script %}
+  {{ super() }}
+  <script src="{{ static('com/js/poster_list.js') }}"></script>
+{% endblock %}
+
+{% block additional_css %}
+  <link rel="stylesheet" href="{{ static('com/css/posters.scss') }}">
+{% endblock %}
+
+{% block content %}
+  <div id="poster_list">
+
+    <div id="title">
+      <div id="links" class="left">
+        <a id="list" class="link" href="{{ url("com:poster_list") }}">{% trans %}List{% endtrans %}</a>
+      </div>
+      <h3>{% trans %}Posters - moderation{% endtrans %}</h3>
+    </div>
+
+    <div id="posters">
+
+      {% if object_list.count == 0 %}
+        <div id="no-posters">{% trans %}No objects{% endtrans %}</div>
+      {% else %}
+
+        {% for poster in object_list %}
+          <div class="poster{% if not poster.is_moderated %} not_moderated{% endif %}">
+            <div class="name"> {{ poster.name }} </div>
+            <div class="image"> <img src="{{ poster.file.url }}"></img> </div>
+            <a class="moderate" href="{{ url("com:poster_moderate", object_id=poster.id) }}">Moderate</a>
+          </div>
+        {% endfor %}
+
+      {% endif %}
+
+    </div>
+
+    <div id="view"><div id="placeholder"></div></div>
+
+  </div>
+{% endblock %}

com/tests/test_views.py

@@ -17,9 +17,7 @@ from unittest.mock import patch
 
 import pytest
 from django.conf import settings
-from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
-from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import Client, TestCase
 from django.urls import reverse
 from django.utils import html
@@ -29,10 +27,9 @@ from model_bakery import baker
 from pytest_django.asserts import assertNumQueries, assertRedirects
 
 from club.models import Club, Membership
-from com.models import News, NewsDate, Poster, Sith, Weekmail, WeekmailArticle
+from com.models import News, NewsDate, Sith, Weekmail, WeekmailArticle
 from core.baker_recipes import subscriber_user
 from core.models import AnonymousUser, Group, User
-from core.utils import RED_PIXEL_PNG
 
 
 @pytest.fixture()
@@ -317,6 +314,7 @@ def test_feed(client: Client):
     [
         reverse("com:poster_list"),
         reverse("com:poster_create"),
+        reverse("com:poster_moderate_list"),
     ],
 )
 def test_poster_management_views_crash_test(client: Client, url: str):
@@ -327,37 +325,3 @@ def test_poster_management_views_crash_test(client: Client, url: str):
     client.force_login(user)
     res = client.get(url)
     assert res.status_code == 200
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize(
-    "referer",
-    [
-        None,
-        reverse("com:poster_list"),
-        reverse("club:poster_list", kwargs={"club_id": settings.SITH_MAIN_CLUB_ID}),
-    ],
-)
-def test_moderate_poster(client: Client, referer: str | None):
-    poster = baker.make(
-        Poster,
-        is_moderated=False,
-        file=SimpleUploadedFile("test.png", content=RED_PIXEL_PNG),
-        club_id=settings.SITH_MAIN_CLUB_ID,
-    )
-    user = baker.make(
-        User,
-        user_permissions=Permission.objects.filter(
-            codename__in=["view_poster", "moderate_poster"]
-        ),
-    )
-    client.force_login(user)
-    headers = {"REFERER": f"https://{settings.SITH_URL}{referer}"} if referer else {}
-    response = client.post(
-        reverse("com:poster_moderate", kwargs={"object_id": poster.id}), headers=headers
-    )
-    result_url = referer or reverse("com:poster_list")
-    assertRedirects(response, result_url)
-    poster.refresh_from_db()
-    assert poster.is_moderated
-    assert poster.moderator == user

com/urls.py

@@ -33,6 +33,7 @@ from com.views import (
     PosterDeleteView,
     PosterEditView,
     PosterListView,
+    PosterModerateListView,
     PosterModerateView,
     ScreenCreateView,
     ScreenDeleteView,
@@ -101,6 +102,11 @@ urlpatterns = [
         PosterDeleteView.as_view(),
         name="poster_delete",
     ),
+    path(
+        "poster/moderate/",
+        PosterModerateListView.as_view(),
+        name="poster_moderate_list",
+    ),
     path(
         "poster/<int:object_id>/moderate/",
         PosterModerateView.as_view(),

com/views.py

@@ -25,7 +25,6 @@ import itertools
 from datetime import date, timedelta
 from smtplib import SMTPRecipientsRefused
 from typing import Any
-from urllib.parse import urlparse
 
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
@@ -35,7 +34,7 @@ from django.contrib.auth.mixins import (
 )
 from django.contrib.syndication.views import Feed
 from django.core.exceptions import PermissionDenied, ValidationError
-from django.db.models import Exists, Max, OuterRef, Value
+from django.db.models import Max
 from django.forms.models import modelform_factory
 from django.http import HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
@@ -46,7 +45,7 @@ from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView
 
-from club.models import Club, Mailing, Membership
+from club.models import Club, Mailing
 from com.forms import NewsDateForm, NewsForm, PosterForm
 from com.ics_calendar import IcsCalendar
 from com.models import News, NewsDate, Poster, Screen, Sith, Weekmail, WeekmailArticle
@@ -562,26 +561,16 @@ class MailingModerateView(View):
         raise PermissionDenied
 
 
-class PosterListBaseView(ListView):
+class PosterListBaseView(PermissionOrClubBoardRequiredMixin, ListView):
     """List communication posters."""
 
     model = Poster
     template_name = "com/poster_list.jinja"
     permission_required = "com.view_poster"
+    ordering = ["-date_begin"]
 
-    def get_queryset(self):
-        qs = Poster.objects.prefetch_related("screens")
-        if self.request.user.has_perm("com.edit_poster"):
-            qs = qs.annotate(is_editable=Value(value=True))
-        else:
-            qs = qs.annotate(
-                is_editable=Exists(
-                    Membership.objects.ongoing()
-                    .board()
-                    .filter(user=self.request.user, club=OuterRef("club_id"))
-                )
-            )
-        return qs.order_by("-date_begin")
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {"club": self.club}
 
 
 class PosterCreateBaseView(PermissionOrClubBoardRequiredMixin, CreateView):
@@ -644,17 +633,21 @@ class PosterDeleteBaseView(
     permission_required = "com.delete_poster"
 
 
-class PosterListView(PermissionRequiredMixin, ComTabsMixin, PosterListBaseView):
+class PosterListView(ComTabsMixin, PosterListBaseView):
     """List communication posters."""
 
     current_tab = "posters"
-    extra_context = {
-        "create_url": reverse_lazy("com:poster_create"),
-        "get_edit_url": lambda poster: reverse(
-            "com:poster_edit", kwargs={"poster_id": poster.id}
-        ),
-    }
-    permission_required = "com.view_poster"
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+        if self.request.user.has_perm("com.view_poster"):
+            return qs
+        return qs.filter(club=self.club.id)
+
+    def get_context_data(self, **kwargs):
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["app"] = "com"
+        return kwargs
 
 
 class PosterCreateView(ComTabsMixin, PosterCreateBaseView):
@@ -679,6 +672,17 @@ class PosterDeleteView(PosterDeleteBaseView):
     success_url = reverse_lazy("com:poster_list")
 
 
+class PosterModerateListView(PermissionRequiredMixin, ComTabsMixin, ListView):
+    """Moderate list communication poster."""
+
+    current_tab = "posters"
+    model = Poster
+    template_name = "com/poster_moderate.jinja"
+    queryset = Poster.objects.filter(is_moderated=False).all()
+    permission_required = "com.moderate_poster"
+    extra_context = {"app": "com"}
+
+
 class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
     """Moderate communication poster."""
 
@@ -686,21 +690,12 @@ class PosterModerateView(PermissionRequiredMixin, ComTabsMixin, View):
     permission_required = "com.moderate_poster"
     extra_context = {"app": "com"}
 
-    def post(self, request, *args, **kwargs):
+    def get(self, request, *args, **kwargs):
         obj = get_object_or_404(Poster, pk=kwargs["object_id"])
         obj.is_moderated = True
         obj.moderator = request.user
         obj.save()
-        # The moderation request may be originated from a club context (/club/poster)
-        # or a global context (/com/poster),
-        # so the redirection URL will be the URL of the page that called this view,
-        # as long as the latter belongs to the sith.
-        referer = self.request.META.get("HTTP_REFERER")
-        if referer:
-            parsed = urlparse(referer)
-            if parsed.netloc == settings.SITH_URL:
-                return redirect(parsed.path)
-        return redirect("com:poster_list")
+        return redirect("com:poster_moderate_list")
 
 
 class ScreenListView(PermissionRequiredMixin, ComTabsMixin, ListView):

core/api.py

@@ -99,7 +99,7 @@ class SithFileController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SithFileSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -112,7 +112,7 @@ class GroupController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[GroupSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)

core/auth/mixins.py

@@ -24,6 +24,7 @@
 from __future__ import annotations
 
 import types
+import warnings
 from typing import TYPE_CHECKING, Any, LiteralString
 
 from django.contrib.auth.mixins import AccessMixin, PermissionRequiredMixin
@@ -146,6 +147,45 @@ class GenericContentPermissionMixinBuilder(View):
         return super().dispatch(request, *arg, **kwargs)
 
 
+class CanCreateMixin(View):
+    """Protect any child view that would create an object.
+
+    Raises:
+        PermissionDenied:
+            If the user has not the necessary permission
+            to create the object of the view.
+    """
+
+    def __init_subclass__(cls, **kwargs):
+        warnings.warn(
+            f"{cls.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init_subclass__(**kwargs)
+
+    def __init__(self, *args, **kwargs):
+        warnings.warn(
+            f"{self.__class__.__name__} is deprecated and should be replaced "
+            "by other permission verification mecanism.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        super().__init__(*args, **kwargs)
+
+    def dispatch(self, request, *arg, **kwargs):
+        if not request.user.is_authenticated:
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
+
+    def form_valid(self, form):
+        obj = form.instance
+        if can_edit_prop(obj, self.request.user):
+            return super().form_valid(form)
+        raise PermissionDenied
+
+
 class CanEditPropMixin(GenericContentPermissionMixinBuilder):
     """Ensure the user has owner permissions on the child view object.
 

core/management/commands/check_fs.py

@@ -0,0 +1,40 @@
+#
+# Copyright 2018
+# - Skia <skia@libskia.so>
+#
+# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
+# http://ae.utbm.fr.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License a published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
+# Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+#
+
+from django.core.management.base import BaseCommand
+
+from core.models import SithFile
+
+
+class Command(BaseCommand):
+    help = "Recursively check the file system with respect to the DB"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "ids", metavar="ID", type=int, nargs="+", help="The file IDs to process"
+        )
+
+    def handle(self, *args, **options):
+        files = SithFile.objects.filter(id__in=options["ids"]).all()
+        for f in files:
+            f._check_fs()

core/management/commands/repair_fs.py

@@ -0,0 +1,41 @@
+#
+# Copyright 2018
+# - Skia <skia@libskia.so>
+#
+# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
+# http://ae.utbm.fr.
+#
+# This program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License a published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
+# details.
+#
+# You should have received a copy of the GNU General Public License along with
+# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
+# Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+#
+
+
+from django.core.management.base import BaseCommand
+
+from core.models import SithFile
+
+
+class Command(BaseCommand):
+    help = "Recursively repair the file system with respect to the DB"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "ids", metavar="ID", type=int, nargs="+", help="The file IDs to process"
+        )
+
+    def handle(self, *args, **options):
+        files = SithFile.objects.filter(id__in=options["ids"]).all()
+        for f in files:
+            f._repair_fs()

core/models.py

@@ -23,12 +23,14 @@
 #
 from __future__ import annotations
 
+import logging
+import os
 import string
 import unicodedata
 from datetime import timedelta
 from io import BytesIO
 from pathlib import Path
-from typing import TYPE_CHECKING, Self
+from typing import TYPE_CHECKING, Optional, Self
 from uuid import uuid4
 
 from django.conf import settings
@@ -95,6 +97,48 @@ def validate_promo(value: int) -> None:
         )
 
 
+def get_group(*, pk: int | None = None, name: str | None = None) -> Group | None:
+    """Search for a group by its primary key or its name.
+    Either one of the two must be set.
+
+    The result is cached for the default duration (should be 5 minutes).
+
+    Args:
+        pk: The primary key of the group
+        name: The name of the group
+
+    Returns:
+        The group if it exists, else None
+
+    Raises:
+        ValueError: If no group matches the criteria
+    """
+    if pk is None and name is None:
+        raise ValueError("Either pk or name must be set")
+
+    # replace space characters to hide warnings with memcached backend
+    pk_or_name: str | int = pk if pk is not None else name.replace(" ", "_")
+    group = cache.get(f"sith_group_{pk_or_name}")
+
+    if group == "not_found":
+        # Using None as a cache value is a little bit tricky,
+        # so we use a special string to represent None
+        return None
+    elif group is not None:
+        return group
+    # if this point is reached, the group is not in cache
+    if pk is not None:
+        group = Group.objects.filter(pk=pk).first()
+    else:
+        group = Group.objects.filter(name=name).first()
+    if group is not None:
+        name = group.name.replace(" ", "_")
+        cache.set_many({f"sith_group_{group.id}": group, f"sith_group_{name}": group})
+    else:
+        cache.set(f"sith_group_{pk_or_name}", "not_found")
+    return group
+
+
 class BanGroup(AuthGroup):
     """An anti-group, that removes permissions instead of giving them.
 
@@ -338,18 +382,19 @@ class User(AbstractUser):
         Returns:
              True if the user is the group, else False
         """
-        if not pk and not name:
+        if pk is not None:
+            group: Optional[Group] = get_group(pk=pk)
+        elif name is not None:
+            group: Optional[Group] = get_group(name=name)
+        else:
             raise ValueError("You must either provide the id or the name of the group")
-        group_id: int | None = (
-            pk or Group.objects.filter(name=name).values_list("id", flat=True).first()
-        )
-        if group_id is None:
+        if group is None:
             return False
-        if group_id == settings.SITH_GROUP_SUBSCRIBERS_ID:
+        if group.id == settings.SITH_GROUP_SUBSCRIBERS_ID:
             return self.is_subscribed
-        if group_id == settings.SITH_GROUP_ROOT_ID:
+        if group.id == settings.SITH_GROUP_ROOT_ID:
             return self.is_root
-        return any(g.id == group_id for g in self.cached_groups)
+        return group in self.cached_groups
 
     @cached_property
     def cached_groups(self) -> list[Group]:
@@ -409,6 +454,14 @@ class User(AbstractUser):
         else:
             raise ValidationError(_("A user with that username already exists"))
 
+    def get_profile(self):
+        return {
+            "last_name": self.last_name,
+            "first_name": self.first_name,
+            "nick_name": self.nick_name,
+            "date_of_birth": self.date_of_birth,
+        }
+
     def get_short_name(self):
         """Returns the short name for the user."""
         if self.nick_name:
@@ -598,6 +651,9 @@ class User(AbstractUser):
 
 
 class AnonymousUser(AuthAnonymousUser):
+    def __init__(self):
+        super().__init__()
+
     @property
     def was_subscribed(self):
         return False
@@ -606,6 +662,10 @@ class AnonymousUser(AuthAnonymousUser):
     def is_subscribed(self):
         return False
 
+    @property
+    def subscribed(self):
+        return False
+
     @property
     def is_root(self):
         return False
@@ -636,8 +696,8 @@ class AnonymousUser(AuthAnonymousUser):
         if pk is not None:
             return pk == allowed_id
         elif name is not None:
-            group = Group.objects.get(id=allowed_id)
-            return group.name == name
+            group = get_group(name=name)
+            return group is not None and group.id == allowed_id
         else:
             raise ValueError("You must either provide the id or the name of the group")
 
@@ -963,6 +1023,63 @@ class SithFile(models.Model):
         self.clean()
         self.save()
 
+    def _repair_fs(self):
+        """Rebuilds recursively the filesystem as it should be regarding the DB tree."""
+        if self.is_folder:
+            for c in self.children.all():
+                c._repair_fs()
+            return
+        elif not self._check_path_consistence():
+            # First get future parent path and the old file name
+            # Prepend "." so that we match all relative handling of Django's
+            # file storage
+            parent_path = "." + self.parent.get_full_path()
+            parent_full_path = settings.MEDIA_ROOT + parent_path
+            os.makedirs(parent_full_path, exist_ok=True)
+            old_path = self.file.name  # Should be relative: "./users/skia/bleh.jpg"
+            new_path = "." + self.get_full_path()
+            try:
+                # Make this atomic, so that a FS problem rolls back the DB change
+                with transaction.atomic():
+                    # Set the new filesystem path
+                    self.file.name = new_path
+                    self.save()
+                    # Really move at the FS level
+                    if os.path.exists(parent_full_path):
+                        os.rename(
+                            settings.MEDIA_ROOT + old_path,
+                            settings.MEDIA_ROOT + new_path,
+                        )
+                        # Empty directories may remain, but that's not really a
+                        # problem, and that can be solved with a simple shell
+                        # command: `find . -type d -empty -delete`
+            except Exception as e:
+                logging.error(e)
+
+    def _check_path_consistence(self):
+        file_path = str(self.file)
+        file_full_path = settings.MEDIA_ROOT + file_path
+        db_path = ".%s" % self.get_full_path()
+        if not os.path.exists(file_full_path):
+            print("%s: WARNING: real file does not exists!" % self.id)  # noqa T201
+            print("file path: %s" % file_path, end="")  # noqa T201
+            print("  db path: %s" % db_path)  # noqa T201
+            return False
+        if file_path != db_path:
+            print("%s: " % self.id, end="")  # noqa T201
+            print("file path: %s" % file_path, end="")  # noqa T201
+            print("  db path: %s" % db_path)  # noqa T201
+            return False
+        return True
+
+    def _check_fs(self):
+        if self.is_folder:
+            for c in self.children.all():
+                c._check_fs()
+            return
+        else:
+            self._check_path_consistence()
+
     @property
     def is_file(self):
         return not self.is_folder
@@ -1047,6 +1164,8 @@ class QuickUploadImage(models.Model):
         identifier = str(uuid4())
         name = Path(image.name).stem[: cls.IMAGE_NAME_SIZE - 1]
         file = File(convert_image(image), name=f"{identifier}.webp")
+        width, height = Image.open(file).size
+
         return cls.objects.create(
             uuid=identifier,
             name=name,

core/static/bundled/alpine-index.js

@@ -1,10 +1,9 @@
-import { limitedChoices } from "#core:alpine/limited-choices";
-import { alpinePlugin as notificationPlugin } from "#core:utils/notifications";
+import { alpinePlugin } from "#core:utils/notifications";
 import sort from "@alpinejs/sort";
 import Alpine from "alpinejs";
 
-Alpine.plugin([sort, limitedChoices]);
-Alpine.magic("notifications", notificationPlugin);
+Alpine.plugin(sort);
+Alpine.magic("notifications", alpinePlugin);
 window.Alpine = Alpine;
 
 window.addEventListener("DOMContentLoaded", () => {

core/static/bundled/alpine/limited-choices.ts

@@ -1,69 +0,0 @@
-import type { Alpine as AlpineType } from "alpinejs";
-
-export function limitedChoices(Alpine: AlpineType) {
-  /**
-   * Directive to limit the number of elements
-   * that can be selected in a group of checkboxes.
-   *
-   * When the max numbers of selectable elements is reached,
-   * new elements will still be inserted, but oldest ones will be deselected.
-   * For example, if checkboxes A, B and C have been selected and the max
-   * number of selections is 3, then selecting D will result in having
-   * B, C and D selected.
-   *
-   * # Example in template
-   * ```html
-   * <div x-data="{nbMax: 2}", x-limited-choices="nbMax">
-   *   <button @click="nbMax += 1">Click me to increase the limit</button>
-   *   <input type="checkbox" value="A" name="foo">
-   *   <input type="checkbox" value="B" name="foo">
-   *   <input type="checkbox" value="C" name="foo">
-   *   <input type="checkbox" value="D" name="foo">
-   * </div>
-   * ```
-   */
-  Alpine.directive(
-    "limited-choices",
-    (el, { expression }, { evaluateLater, effect }) => {
-      const getMaxChoices = evaluateLater(expression);
-      let maxChoices: number;
-      const inputs: HTMLInputElement[] = Array.from(
-        el.querySelectorAll("input[type='checkbox']"),
-      );
-      const checked = [] as HTMLInputElement[];
-
-      const manageDequeue = () => {
-        if (checked.length <= maxChoices) {
-          // There isn't too many checkboxes selected. Nothing to do
-          return;
-        }
-        const popped = checked.splice(0, checked.length - maxChoices);
-        for (const p of popped) {
-          p.checked = false;
-        }
-      };
-
-      for (const input of inputs) {
-        input.addEventListener("change", (_e) => {
-          if (input.checked) {
-            checked.push(input);
-          } else {
-            checked.splice(checked.indexOf(input), 1);
-          }
-          manageDequeue();
-        });
-      }
-      effect(() => {
-        getMaxChoices((value: string) => {
-          const previousValue = maxChoices;
-          maxChoices = Number.parseInt(value);
-          if (maxChoices < previousValue) {
-            // The maximum number of selectable items has been lowered.
-            // Some currently selected elements may need to be removed
-            manageDequeue();
-          }
-        });
-      });
-    },
-  );
-}

core/static/core/footer.scss

@@ -65,7 +65,7 @@ footer.bottom-links {
       flex-wrap: wrap;
       align-items: center;
       background-color: $primary-neutral-dark-color;
-      box-shadow: black 0 8px 15px;
+      box-shadow: $shadow-color 0 0 15px;
 
       a {
         color: $white-color;

core/static/core/forms.scss

@@ -154,8 +154,10 @@ form {
     margin-bottom: 1rem;
   }
 
-  .row > label {
-    margin: unset;
+  .row {
+    label {
+      margin: unset;
+    }
   }
 
   // ------------- LABEL

core/static/core/header.scss

@@ -11,8 +11,7 @@ $hovered-red-text-color: #ff4d4d;
 .header {
   box-sizing: border-box;
   background-color: $deepblue;
-  box-shadow: black 0 1px 3px 0,
-              black 0 4px 8px 3px;
+  box-shadow: 3px 3px 3px 0 #dfdfdf;
   border-radius: 0;
   width: 100%;
   display: flex;
@@ -100,7 +99,7 @@ $hovered-red-text-color: #ff4d4d;
         border-radius: 0;
         margin: 0;
         box-sizing: border-box;
-        background-color: transparent;
+        background-color: $deepblue;
         width: 45px;
         height: 25px;
         padding: 0;
@@ -332,7 +331,7 @@ $hovered-red-text-color: #ff4d4d;
           padding: 10px;
           z-index: 100;
           border-radius: 10px;
-          @include shadow;
+          box-shadow: 3px 3px 3px 0 #767676;
 
           >ul {
             list-style-type: none;

core/static/core/style.scss

@@ -271,9 +271,8 @@ body {
 
   /*--------------------------------CONTENT------------------------------*/
   #content {
-    padding: 1.5em 2%;
-    border-radius: 5px;
-    box-shadow: black 0 8px 15px;
+    padding: 1em 1%;
+    box-shadow: $shadow-color 0 5px 10px;
     background: $white-color;
     overflow: auto;
   }
@@ -504,10 +503,6 @@ th {
   text-align: center;
   padding: 5px 10px;
 
-  >input[type="checkbox"] {
-    padding: unset;
-  }
-
   >ul {
     margin-top: 0;
   }

core/templates/core/base.jinja

@@ -4,22 +4,12 @@
     {% block head %}
       <title>{% block title %}Association des Étudiants de l'UTBM{% endblock %}</title>
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <meta
-        name="description"
-        content="{% block description -%}
-                   {% trans trimmed %}
-                     AE UTBM is a voluntary organisation run by UTBM students.
-                     It organises student life at UTBM and manages its student facilities.
-                   {% endtrans %}
-                 {%- endblock %}"
-      >
-      <meta property="og:site_name" content="Association des Étudiants de l'UTBM" />
-      {% block metatags %}
-        <meta property="og:url" content="{{ request.build_absolute_uri() }}" />
-        <meta property="og:type" content="website" />
-        <meta property="og:title" content="Association des Étudiants de l'UTBM" />
-        <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-      {% endblock %}
+      <meta name="description" content="{% block description -%}
+                                          {% trans trimmed %}
+                                            AE UTBM is a voluntary organisation run by UTBM students.
+                                            It organises student life at UTBM and manages its student facilities.
+                                          {% endtrans %}
+                                        {%- endblock %}">
       <link rel="shortcut icon" href="{{ static('core/img/favicon.ico') }}">
       <link rel="stylesheet" href="{{ static('core/base.css') }}">
       <link rel="stylesheet" href="{{ static('core/style.scss') }}">
@@ -44,18 +34,6 @@
 
       {% block additional_css %}{% endblock %}
       {% block additional_js %}{% endblock %}
-      <style>
-        {# background image must be declared here, because the static names are
-           changed during the static collection step,
-           which means we must gather them with the `static` template function #}
-        .header {
-          background-image: url("{{ static("core/img/gala25_background.webp") }}");
-          background-position-y: 80%;  {# There are more stars in this part of the picture #}
-        }
-        body {
-          background-image: url("{{ static("core/img/gala25_background.webp") }}");
-        }
-      </style>
     {% endblock %}
   </head>
 

core/templates/core/base/header.jinja

@@ -1,6 +1,6 @@
 <header class="header">
   <div class="header-logo">
-    <a class="header-logo-picture" href="{{ url('core:index') }}" style="background-image: url('{{ static("core/img/gala25_logo.webp") }}')">
+    <a class="header-logo-picture" href="{{ url('core:index') }}" style="background-image: url('{{ static('core/img/logo_no_text.png') }}')">
       &nbsp;
     </a>
     <a class="header-logo-text" href="{{ url('core:index') }}">
@@ -77,22 +77,22 @@
         <div class="notification" x-data="{display: false}" :class="{white: display}">
           <a href="#" @click.prevent="display = !display">
             <i :class="`fa-${display ? 'solid': 'regular'} fa-bell`" x-transition></i>
-            {% set notifications = user.notifications.filter(viewed=False).order_by("-date")|list %}
+            {% set notification_count = user.notifications.filter(viewed=False).count() %}
 
-            {%- if notifications|length > 0 -%}
+            {% if notification_count > 0 %}
               <span>
-                {% if notifications|length < 100 %}
-                  {{ notifications|length }}
-                {%- else -%}
-                  99+
-                {%- endif -%}
+                {% if notification_count < 100 %}
+                  {{ notification_count }}
+                {% else %}
+                  &nbsp;
+                {% endif %}
               </span>
             {% endif %}
           </a>
           <div id="header_notif" x-show="display" x-cloak x-transition @click.outside="display = false">
             <ul>
-              {%- if notifications|length > 0 -%}
-                {%- for n in notifications -%}
+              {% if user.notifications.filter(viewed=False).count() > 0 %}
+                {% for n in user.notifications.filter(viewed=False).order_by('-date') %}
                   <li>
                     <a href="{{ url("core:notification", notif_id=n.id) }}">
                       <div class="datetime">
@@ -108,10 +108,10 @@
                       </div>
                     </a>
                   </li>
-                {%- endfor -%}
-              {%- else -%}
+                {% endfor %}
+              {% else %}
                 <li class="empty-notification">{% trans %}You do not have any unread notification{% endtrans %}</li>
-              {%- endif -%}
+              {% endif %}
             </ul>
             <div class="options">
               <a href="{{ url('core:notification_list') }}">

core/templates/core/base/notifications.jinja

@@ -13,10 +13,10 @@
              }"
      @quick-notification-add="(e) => messages.push(e?.detail)"
      @quick-notification-delete="messages = []">
-  <template x-for="(message, index) in messages">
-    <div class="alert" :class="`alert-${message.tag}`" x-transition>
+  <template x-for="message in messages">
+    <div x-data="{show: true}" class="alert" :class="`alert-${message.tag}`" x-show="show" x-transition>
       <span class="alert-main" x-text="message.text"></span>
-      <span class="clickable" @click="messages = messages.filter((item, i) => i !== index)">
+      <span class="clickable" @click="show = false">
         <i class="fa fa-close"></i>
       </span>
     </div>

core/templates/core/edit.jinja

@@ -21,6 +21,20 @@
   {% else %}
     <h2>{% trans %}Save{% endtrans %}</h2>
   {% endif %}
+  {% if messages %}
+    <div x-data="{show_alert: true}" class="alert alert-green" x-show="show_alert" x-transition>
+      <span class="alert-main">
+        {% for message in messages %}
+          {% if message.level_tag == "success" %}
+            {{ message }}
+          {% endif %}
+        {% endfor %}
+      </span>
+      <span class="clickable" @click="show_alert = false">
+        <i class="fa fa-close"></i>
+      </span>
+    </div>
+  {% endif %}
   <form action="" method="post" enctype="multipart/form-data">
     {% csrf_token %}
     {{ form.as_p() }}

core/templates/core/macros.jinja

@@ -13,11 +13,30 @@
 {%- endmacro %}
 
 {% macro link_news_logo(news) -%}
-  {%- if news.club.logo -%}
+  {% if news.club.logo -%}
     {{ news.club.logo.url }}
-  {%- else -%}
+  {% else -%}
     {{ static("com/img/news.png") }}
-  {%- endif -%}
+  {% endif %}
+{%- endmacro %}
+
+{% macro gen_news_metatags(news) -%}
+  <meta name="twitter:card" content="summary" />
+  <meta name="twitter:site" content="{{ settings.SITH_TWITTER }}" />
+  <meta name="twitter:creator" content= "{{ settings.SITH_TWITTER }}" />
+  <meta property="og:url"                content="{{ news.get_full_url() }}" />
+  <meta property="og:type"               content="article" />
+  <meta property="og:title"              content="{{ news.title }}" />
+  <meta property="og:description"        content="{{ news.summary }}" />
+  <meta property="og:image"              content="{{ "https://%s%s" % (settings.SITH_URL, link_news_logo(news)) }}" />
+{%- endmacro %}
+
+{% macro facebook_share(news) -%}
+  <a rel="nofollow" target="#" class="share_button facebook" href="https://www.facebook.com/sharer/sharer.php?u={{ news.get_full_url() }}">{% trans %}Share on Facebook{% endtrans %}</a>
+{%- endmacro %}
+
+{% macro tweet(news) -%}
+  <a rel="nofollow" target="#" class="share_button twitter" href="https://twitter.com/intent/tweet?text={{ news.get_full_url() }}">{% trans %}Tweet{% endtrans %}</a>
 {%- endmacro %}
 
 {% macro user_mini_profile(user) %}
@@ -134,7 +153,7 @@
         current_page (django.core.paginator.Page): the current page object
         paginator (django.core.paginator.Paginator): the paginator object
     #}
-  {{ paginate_server_side(current_page, paginator, False) }}
+  {{  paginate_server_side(current_page, paginator, False) }}
 {% endmacro %}
 
 {% macro paginate_htmx(current_page, paginator) %}
@@ -149,7 +168,7 @@
         current_page (django.core.paginator.Page): the current page object
         paginator (django.core.paginator.Paginator): the paginator object
     #}
-  {{ paginate_server_side(current_page, paginator, True) }}
+  {{  paginate_server_side(current_page, paginator, True) }}
 {% endmacro %}
 
 {% macro paginate_server_side(current_page, paginator, use_htmx) %}
@@ -226,26 +245,3 @@
   <button type="button" onclick="checkbox_{{form_id}}(true);">{% trans %}Select All{% endtrans %}</button>
   <button type="button" onclick="checkbox_{{form_id}}(false);">{% trans %}Unselect All{% endtrans %}</button>
 {% endmacro %}
-
-{% macro update_notifications(messages, clear) %}
-  {# Update notification area from new messages sent by django backend
-     This is useful when performing fragment swaps to keep messages up to date
-     Without this, the fragment would need to take control of the notification area and
-     this would be an issue when having more than one fragment
-
-     Parameters:
-      messages: messages from django.contrib
-      clear   : optional boolean that controls if notifications should be cleared first. True is the default
-  #}
-  {% set clear = clear|default(true) %}
-  {% if messages %}
-    <div x-init="() => {
-                 {% if clear %}
-                   $notifications.clear()
-                 {% endif %}
-                 {% for message in messages %}
-                   $notifications.{{ message.tags }}('{{ message }}')
-                 {% endfor %}
-                 }"></div>
-  {% endif %}
-{% endmacro %}

core/templates/core/page.jinja

@@ -12,18 +12,6 @@
   {% endif %}
 {% endblock %}
 
-{% block metatags %}
-  {% if page %}
-    <meta property="og:url" content="{{ request.build_absolute_uri(page.get_absolute_url()) }}" />
-    <meta property="og:type" content="article" />
-    <meta property="article:section" content="{% trans %}Page{% endtrans %}" />
-    <meta property="og:title" content="{{ page.get_display_name() }}" />
-    <meta property="og:image" content="{{ request.build_absolute_uri(static("core/img/logo_no_text.png")) }}" />
-  {% else %}
-    {{ super() }}
-  {% endif %}
-{% endblock %}
-
 {%- macro print_page_name(page) -%}
   {%- if page -%}
     {{ print_page_name(page.parent) }} >

core/templates/core/widgets/autocomplete_select.jinja

@@ -1,25 +1,23 @@
-{% spaceless %}
-  {% for js in statics.js %}
-    <script-once type="module" src="{{ js }}"></script-once>
-  {% endfor %}
-  {% for css in statics.css %}
-    <link-once rel="stylesheet" type="text/css" href="{{ css }}" defer></link-once>
-  {% endfor %}
+{% for js in statics.js %}
+  <script-once type="module" src="{{ js }}"></script-once>
+{% endfor %}
+{% for css in statics.css %}
+  <link-once rel="stylesheet" type="text/css" href="{{ css }}" defer></link-once>
+{% endfor %}
 
-  <{{ component }} name="{{ widget.name }}" {% include "django/forms/widgets/attrs.html" %}>
-  {% for group_name, group_choices, group_index in widget.optgroups %}
-    {% if group_name %}
-      <optgroup label="{{ group_name }}">
-    {% endif %}
-    {% for widget in group_choices %}
-      {% include widget.template_name %}
-    {% endfor %}
-    {% if group_name %}
-      </optgroup>
-    {% endif %}
-  {% endfor %}
-  {% if initial %}
-    <slot style="display:none" name="initial">{{ initial }}</slot>
+<{{ component }} name="{{ widget.name }}" {% include "django/forms/widgets/attrs.html" %}>
+{% for group_name, group_choices, group_index in widget.optgroups %}
+  {% if group_name %}
+    <optgroup label="{{ group_name }}">
   {% endif %}
-  </{{ component }}>
-{% endspaceless %}
+  {% for widget in group_choices %}
+    {% include widget.template_name %}
+  {% endfor %}
+  {% if group_name %}
+    </optgroup>
+  {% endif %}
+{% endfor %}
+{% if initial %}
+  <slot style="display:none" name="initial">{{ initial }}</slot>
+{% endif %}
+</{{ component }}>

core/tests/test_core.py

@@ -421,16 +421,18 @@ class TestUserIsInGroup(TestCase):
 
         # clear the cached property `User.cached_groups`
         self.public_user.__dict__.pop("cached_groups", None)
+        cache.clear()
         # Test when the user is in the group
-        with self.assertNumQueries(1):
+        with self.assertNumQueries(2):
             self.public_user.is_in_group(pk=group_in.id)
         with self.assertNumQueries(0):
             self.public_user.is_in_group(pk=group_in.id)
 
         group_not_in = baker.make(Group)
         self.public_user.__dict__.pop("cached_groups", None)
+        cache.clear()
         # Test when the user is not in the group
-        with self.assertNumQueries(1):
+        with self.assertNumQueries(2):
             self.public_user.is_in_group(pk=group_not_in.id)
         with self.assertNumQueries(0):
             self.public_user.is_in_group(pk=group_not_in.id)

core/tests/test_family.py

@@ -46,7 +46,7 @@ class TestFetchFamilyApi(TestCase):
         response = self.client.get(
             reverse("api:family_graph", args=[self.main_user.id])
         )
-        assert response.status_code == 401
+        assert response.status_code == 403
 
         self.client.force_login(baker.make(User))  # unsubscribed user
         response = self.client.get(

core/tests/test_files.py

@@ -269,7 +269,7 @@ def test_apply_rights_recursively():
             SimpleUploadedFile(
                 "test.jpg", content=RED_PIXEL_PNG, content_type="image/jpg"
             ),
-            401,
+            403,
         ),
         (
             lambda: baker.make(User),

core/views/forms.py

@@ -115,7 +115,7 @@ class SelectUser(TextInput):
 
 def validate_future_timestamp(value: date | datetime):
     if value <= now():
-        raise ValidationError(_("Ensure this timestamp is set in the future"))
+        raise ValueError(_("Ensure this timestamp is set in the future"))
 
 
 class FutureDateTimeField(forms.DateTimeField):

counter/admin.py

@@ -22,7 +22,6 @@ from counter.models import (
     Counter,
     Customer,
     Eticket,
-    InvoiceCall,
     Permanency,
     Product,
     ProductType,
@@ -161,11 +160,3 @@ class CashRegisterSummaryAdmin(SearchModelAdmin):
 class EticketAdmin(SearchModelAdmin):
     list_display = ("product", "event_date", "event_title")
     search_fields = ("product__name", "event_title")
-
-
-@admin.register(InvoiceCall)
-class InvoiceCallAdmin(SearchModelAdmin):
-    list_display = ("club", "month", "is_validated")
-    search_fields = ("club__name",)
-    list_filter = (("club", admin.RelatedOnlyFieldListFilter),)
-    date_hierarchy = "month"

counter/api.py

@@ -64,7 +64,7 @@ class CounterController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimplifiedCounterSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -77,7 +77,7 @@ class ProductController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[SimpleProductSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -117,7 +117,7 @@ class ProductTypeController(ControllerBase):
     def fetch_all(self):
         return ProductType.objects.order_by("order")
 
-    @route.patch("/{type_id}/move", url_name="reorder_product_type")
+    @route.patch("/{type_id}/move")
     def reorder(self, type_id: int, other_id: Query[ReorderProductTypeSchema]):
         """Change the order of a product type.
 

counter/forms.py

@@ -1,26 +1,13 @@
-import json
 import math
-import uuid
-from datetime import date
 
-from dateutil.relativedelta import relativedelta
 from django import forms
-from django.db.models import Exists, OuterRef, Q
-from django.forms import BaseModelFormSet
-from django.utils.timezone import now
+from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
-from django_celery_beat.models import ClockedSchedule
 from phonenumber_field.widgets import RegionalPhoneNumberWidget
 
-from club.models import Club
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.models import User
-from core.views.forms import (
-    FutureDateTimeField,
-    NFCTextInput,
-    SelectDate,
-    SelectDateTime,
-)
+from core.views.forms import NFCTextInput, SelectDate, SelectDateTime
 from core.views.widgets.ajax_select import (
     AutoCompleteSelect,
     AutoCompleteSelectMultipleGroup,
@@ -32,14 +19,10 @@ from counter.models import (
     Counter,
     Customer,
     Eticket,
-    InvoiceCall,
     Product,
     Refilling,
     ReturnableProduct,
-    ScheduledProductAction,
-    Selling,
     StudentCard,
-    get_product_actions,
 )
 from counter.widgets.ajax_select import (
     AutoCompleteSelectMultipleCounter,
@@ -175,101 +158,7 @@ class CounterEditForm(forms.ModelForm):
         }
 
 
-class ScheduledProductActionForm(forms.ModelForm):
-    """Form for automatic product archiving.
-
-    The `save` method will update or create tasks using celery-beat.
-    """
-
-    required_css_class = "required"
-    prefix = "scheduled"
-
-    class Meta:
-        model = ScheduledProductAction
-        fields = ["task"]
-        widgets = {"task": forms.RadioSelect(choices=get_product_actions)}
-        labels = {"task": _("Action")}
-        help_texts = {"task": ""}
-
-    trigger_at = FutureDateTimeField(
-        label=_("Date and time of action"), widget=SelectDateTime
-    )
-    counters = forms.ModelMultipleChoiceField(
-        label=_("New counters"),
-        help_text=_("The selected counters will replace the current ones"),
-        required=False,
-        widget=AutoCompleteSelectMultipleCounter,
-        queryset=Counter.objects.all(),
-    )
-
-    def __init__(self, *args, product: Product, **kwargs):
-        self.product = product
-        super().__init__(*args, **kwargs)
-        if not self.instance._state.adding:
-            self.fields["trigger_at"].initial = self.instance.clocked.clocked_time
-            self.fields["counters"].initial = json.loads(self.instance.kwargs).get(
-                "counters"
-            )
-
-    def clean(self):
-        if not self.changed_data or "trigger_at" in self.errors:
-            return super().clean()
-        if "trigger_at" in self.changed_data:
-            if not self.instance.clocked_id:
-                self.instance.clocked = ClockedSchedule(
-                    clocked_time=self.cleaned_data["trigger_at"]
-                )
-            else:
-                self.instance.clocked.clocked_time = self.cleaned_data["trigger_at"]
-            self.instance.clocked.save()
-        task_kwargs = {"product_id": self.product.id}
-        if (
-            self.cleaned_data["task"] == "counter.tasks.change_counters"
-            and "counters" in self.changed_data
-        ):
-            task_kwargs["counters"] = [c.id for c in self.cleaned_data["counters"]]
-        self.instance.product = self.product
-        self.instance.kwargs = json.dumps(task_kwargs)
-        self.instance.name = (
-            f"{self.cleaned_data['task']} - {self.product} - {uuid.uuid4()}"
-        )
-        return super().clean()
-
-
-class BaseScheduledProductActionFormSet(BaseModelFormSet):
-    def __init__(self, *args, product: Product, **kwargs):
-        if product.id:
-            queryset = (
-                product.scheduled_actions.filter(
-                    enabled=True, clocked__clocked_time__gt=now()
-                )
-                .order_by("clocked__clocked_time")
-                .select_related("clocked")
-            )
-        else:
-            queryset = ScheduledProductAction.objects.none()
-        form_kwargs = {"product": product}
-        super().__init__(*args, queryset=queryset, form_kwargs=form_kwargs, **kwargs)
-
-    def delete_existing(self, obj: ScheduledProductAction, commit: bool = True):  # noqa FBT001
-        clocked = obj.clocked
-        super().delete_existing(obj, commit=commit)
-        if commit:
-            clocked.delete()
-
-
-ScheduledProductActionFormSet = forms.modelformset_factory(
-    ScheduledProductAction,
-    ScheduledProductActionForm,
-    formset=BaseScheduledProductActionFormSet,
-    absolute_max=None,
-    can_delete=True,
-    can_delete_extra=False,
-    extra=2,
-)
-
-
-class ProductForm(forms.ModelForm):
+class ProductEditForm(forms.ModelForm):
     error_css_class = "error"
     required_css_class = "required"
 
@@ -310,21 +199,22 @@ class ProductForm(forms.ModelForm):
         queryset=Counter.objects.all(),
     )
 
-    def __init__(self, *args, instance=None, **kwargs):
-        super().__init__(*args, instance=instance, **kwargs)
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
         if self.instance.id:
             self.fields["counters"].initial = self.instance.counters.all()
-        self.action_formset = ScheduledProductActionFormSet(
-            *args, product=self.instance, **kwargs
-        )
-
-    def is_valid(self):
-        return super().is_valid() and self.action_formset.is_valid()
 
     def save(self, *args, **kwargs):
         ret = super().save(*args, **kwargs)
-        self.instance.counters.set(self.cleaned_data["counters"])
-        self.action_formset.save()
+        if self.fields["counters"].initial:
+            # Remove the product from all counter it was added to
+            # It will then only be added to selected counters
+            for counter in self.fields["counters"].initial:
+                counter.products.remove(self.instance)
+                counter.save()
+        for counter in self.cleaned_data["counters"]:
+            counter.products.add(self.instance)
+            counter.save()
         return ret
 
 
@@ -376,7 +266,7 @@ class CloseCustomerAccountForm(forms.Form):
     )
 
 
-class BasketProductForm(forms.Form):
+class ProductForm(forms.Form):
     quantity = forms.IntegerField(min_value=1, required=True)
     id = forms.IntegerField(min_value=0, required=True)
 
@@ -481,50 +371,5 @@ class BaseBasketForm(forms.BaseFormSet):
 
 
 BasketForm = forms.formset_factory(
-    BasketProductForm, formset=BaseBasketForm, absolute_max=None, min_num=1
+    ProductForm, formset=BaseBasketForm, absolute_max=None, min_num=1
 )
-
-
-class InvoiceCallForm(forms.Form):
-    def __init__(self, *args, month: date, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.month = month
-        self.clubs = list(
-            Club.objects.filter(
-                Exists(
-                    Selling.objects.filter(
-                        club=OuterRef("pk"),
-                        date__gte=month,
-                        date__lte=month + relativedelta(months=1),
-                    )
-                )
-            ).annotate(
-                validated_invoice=Exists(
-                    InvoiceCall.objects.filter(
-                        club=OuterRef("pk"), month=month, is_validated=True
-                    )
-                )
-            )
-        )
-        self.fields = {
-            str(club.id): forms.BooleanField(
-                required=False, initial=club.validated_invoice
-            )
-            for club in self.clubs
-        }
-
-    def save(self):
-        invoice_calls = [
-            InvoiceCall(
-                month=self.month,
-                club_id=club.id,
-                is_validated=self.cleaned_data.get(str(club.id), False),
-            )
-            for club in self.clubs
-        ]
-        InvoiceCall.objects.bulk_create(
-            invoice_calls,
-            update_conflicts=True,
-            update_fields=["is_validated"],
-            unique_fields=["month", "club"],
-        )

counter/migrations/0032_scheduledproductaction.py

@@ -1,40 +0,0 @@
-# Generated by Django 5.2.3 on 2025-09-14 11:29
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("counter", "0031_alter_counter_options"),
-        ("django_celery_beat", "0019_alter_periodictasks_options"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="ScheduledProductAction",
-            fields=[
-                (
-                    "periodictask_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="django_celery_beat.periodictask",
-                    ),
-                ),
-                (
-                    "product",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="scheduled_actions",
-                        to="counter.product",
-                    ),
-                ),
-            ],
-            options={"verbose_name": "Product scheduled action"},
-            bases=("django_celery_beat.periodictask",),
-        ),
-    ]

counter/migrations/0033_invoicecall.py

@@ -1,51 +0,0 @@
-# Generated by Django 5.2.3 on 2025-10-15 21:54
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-import counter.models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("club", "0014_alter_club_options_rename_unix_name_club_slug_name_and_more"),
-        ("counter", "0032_scheduledproductaction"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="InvoiceCall",
-            fields=[
-                (
-                    "id",
-                    models.AutoField(
-                        auto_created=True,
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="ID",
-                    ),
-                ),
-                (
-                    "is_validated",
-                    models.BooleanField(default=False, verbose_name="is validated"),
-                ),
-                ("month", counter.models.MonthField(verbose_name="invoice date")),
-                (
-                    "club",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="club.club"
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Invoice call",
-                "verbose_name_plural": "Invoice calls",
-                "constraints": [
-                    models.UniqueConstraint(
-                        fields=("club", "month"),
-                        name="counter_invoicecall_unique_club_month",
-                    )
-                ],
-            },
-        ),
-    ]

counter/migrations/0034_alter_selling_date_selling_date_month_idx.py

@@ -1,15 +0,0 @@
-# Generated by Django 5.2.3 on 2025-11-05 08:47
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [("counter", "0033_invoicecall")]
-
-    operations = [
-        migrations.AlterField(
-            model_name="selling",
-            name="date",
-            field=models.DateTimeField(db_index=True, verbose_name="date"),
-        ),
-    ]

counter/models.py

@@ -15,7 +15,6 @@
 from __future__ import annotations
 
 import base64
-import contextlib
 import os
 import random
 import string
@@ -35,7 +34,6 @@ from django.urls import reverse
 from django.utils import timezone
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
-from django_celery_beat.models import PeriodicTask
 from django_countries.fields import CountryField
 from ordered_model.models import OrderedModel
 from phonenumber_field.modelfields import PhoneNumberField
@@ -86,7 +84,7 @@ class CustomerQuerySet(models.QuerySet):
             .annotate(res=Sum(F("unit_price") * F("quantity"), default=0))
             .values("res")
         )
-        return self.update(amount=Coalesce(money_in - money_out, Decimal(0)))
+        return self.update(amount=Coalesce(money_in - money_out, Decimal("0")))
 
 
 class Customer(models.Model):
@@ -447,8 +445,7 @@ class Product(models.Model):
         buying_groups = list(self.buying_groups.all())
         if not buying_groups:
             return True
-        res = any(user.is_in_group(pk=group.id) for group in buying_groups)
-        return res
+        return any(user.is_in_group(pk=group.id) for group in buying_groups)
 
     @property
     def profit(self):
@@ -482,7 +479,7 @@ class CounterQuerySet(models.QuerySet):
         return self.annotate(has_annotated_barman=Exists(subquery))
 
     def annotate_is_open(self) -> Self:
-        """Annotate the queryset with the `is_open` field.
+        """Annotate tue queryset with the `is_open` field.
 
         For each counter, if `is_open=True`, then the counter is currently opened.
         Else the counter is closed.
@@ -849,7 +846,7 @@ class Selling(models.Model):
         blank=False,
         on_delete=models.SET_NULL,
     )
-    date = models.DateTimeField(_("date"), db_index=True)
+    date = models.DateTimeField(_("date"))
     payment_method = models.CharField(
         _("payment method"),
         max_length=255,
@@ -884,6 +881,7 @@ class Selling(models.Model):
             if (
                 self.product
                 and self.product.id == settings.SITH_PRODUCT_SUBSCRIPTION_ONE_SEMESTER
+                and self.counter.type == "EBOUTIC"
             ):
                 sub = Subscription(
                     member=user,
@@ -907,6 +905,7 @@ class Selling(models.Model):
             elif (
                 self.product
                 and self.product.id == settings.SITH_PRODUCT_SUBSCRIPTION_TWO_SEMESTERS
+                and self.counter.type == "EBOUTIC"
             ):
                 sub = Subscription(
                     member=user,
@@ -1360,85 +1359,3 @@ class ReturnableProductBalance(models.Model):
             f"return balance of {self.customer} "
             f"for {self.returnable.product_id} : {self.balance}"
         )
-
-
-def get_product_actions():
-    return [
-        ("counter.tasks.archive_product", _("Archiving")),
-        ("counter.tasks.change_counters", _("Counters change")),
-    ]
-
-
-class ScheduledProductAction(PeriodicTask):
-    """Extension of celery-beat tasks dedicated to perform actions on Product."""
-
-    product = models.ForeignKey(
-        Product, related_name="scheduled_actions", on_delete=models.CASCADE
-    )
-
-    class Meta:
-        verbose_name = _("Product scheduled action")
-
-    def __init__(self, *args, **kwargs):
-        self._meta.get_field("task").choices = get_product_actions()
-        super().__init__(*args, **kwargs)
-
-    def full_clean(self, *args, **kwargs):
-        self.one_off = True  # A product action should occur one time only
-        return super().full_clean(*args, **kwargs)
-
-    def clean_clocked(self):
-        if not self.clocked:
-            raise ValidationError(_("Product actions must declare a clocked schedule."))
-
-    def validate_unique(self, *args, **kwargs):
-        # The checks done in PeriodicTask.validate_unique aren't
-        # adapted in the case of scheduled product action,
-        # so we skip it and execute directly Model.validate_unique
-        return super(PeriodicTask, self).validate_unique(*args, **kwargs)
-
-
-class MonthField(models.DateField):
-    description = _("Year + month field (day forced to 1)")
-    default_error_messages = {
-        "invalid": _(
-            "“%(value)s” value has an invalid date format. It must be "
-            "in YYYY-MM format."
-        ),
-        "invalid_date": _(
-            "“%(value)s” value has the correct format (YYYY-MM) "
-            "but it is an invalid date."
-        ),
-    }
-
-    def to_python(self, value):
-        if isinstance(value, str):
-            with contextlib.suppress(ValueError):
-                # If the string is given as YYYY-mm, try to parse it.
-                # If it fails, it means that the string may be in the form YYYY-mm-dd
-                # or in an invalid format.
-                # Whatever the case, we let Django deal with it
-                # and raise an error if needed
-                value = datetime.strptime(value, "%Y-%m")
-        value = super().to_python(value)
-        if value is None:
-            return None
-        return value.replace(day=1)
-
-
-class InvoiceCall(models.Model):
-    is_validated = models.BooleanField(verbose_name=_("is validated"), default=False)
-    club = models.ForeignKey(Club, on_delete=models.CASCADE)
-    month = MonthField(verbose_name=_("invoice date"))
-
-    class Meta:
-        verbose_name = _("Invoice call")
-        verbose_name_plural = _("Invoice calls")
-        constraints = [
-            models.UniqueConstraint(
-                fields=["club", "month"], name="counter_invoicecall_unique_club_month"
-            )
-        ]
-
-    def __str__(self):
-        return f"invoice call of {self.month} made by {self.club}"

counter/static/counter/css/counter-click.scss

@@ -39,7 +39,6 @@
   flex: auto;
   margin: 0.2em;
   width: 20%;
-  min-width: 350px;
 
   ul {
     list-style-type: none;

counter/tasks.py

@@ -1,19 +0,0 @@
-# Create your tasks here
-
-from celery import shared_task
-
-from counter.models import Counter, Product
-
-
-@shared_task
-def archive_product(*, product_id: int, **kwargs):
-    product = Product.objects.get(id=product_id)
-    product.archived = True
-    product.save()
-
-
-@shared_task
-def change_counters(*, product_id: int, counters: list[int], **kwargs):
-    product = Product.objects.get(id=product_id)
-    counters = Counter.objects.filter(id__in=counters)
-    product.counters.set(counters)

counter/templates/counter/counter_click.jinja

@@ -67,13 +67,13 @@
                 <option value="FIN">{% trans %}Confirm (FIN){% endtrans %}</option>
                 <option value="ANN">{% trans %}Cancel (ANN){% endtrans %}</option>
               </optgroup>
-              {%- for category in categories.keys() -%}
+              {% for category in categories.keys() %}
                 <optgroup label="{{ category }}">
-                  {%- for product in categories[category] -%}
+                  {% for product in categories[category] %}
                     <option value="{{ product.id }}">{{ product }}</option>
-                  {%- endfor -%}
+                  {% endfor %}
                 </optgroup>
-              {%- endfor -%}
+              {% endfor %}
             </counter-product-select>
 
             <input type="submit" value="{% trans %}Go{% endtrans %}"/>

counter/templates/counter/invoices_call.jinja

@@ -4,49 +4,35 @@
   {% trans %}Invoices call{% endtrans %}
 {% endblock %}
 
-{% block notifications %}{# Notifications are moved below #}{% endblock %}
-
 {% block content %}
   <h3>{% trans date=start_date|date("F Y") %}Invoices call for {{ date }}{% endtrans %}</h3>
+  <p>{% trans %}Choose another month: {% endtrans %}</p>
   <form method="get" action="">
-    <label for="id_form_other_month">{% trans %}Choose another month: {% endtrans %}</label>
-    <select name="month" id="id_form_other_month">
+    <select name="month">
       {% for m in months %}
         <option value="{{ m|date("Y-m") }}">{{ m|date("Y-m") }}</option>
       {% endfor %}
     </select>
     <input type="submit" value="{% trans %}Go{% endtrans %}" />
   </form>
-
   <br>
   <p>{% trans %}CB Payments{% endtrans %} : {{ sum_cb }} €</p>
   <br>
-
-  {% include "core/base/notifications.jinja" %}
-
-  <form method="post" action="">
-    {% csrf_token %}
-    <table>
-      <thead>
+  <table>
+    <thead>
+      <td>{% trans %}Club{% endtrans %}</td>
+      <td>{% trans %}Sum{% endtrans %}</td>
+    </thead>
+    <tbody>
+      {% for i in sums %}
         <tr>
-          <td>{% trans %}Club{% endtrans %}</td>
-          <td>{% trans %}Sum{% endtrans %}</td>
-          <td>{% trans %}Validated{% endtrans %}</td>
+          <td>{{ i['club__name'] }}</td>
+          <td>{{ i['selling_sum'] }} €</td>
         </tr>
-      </thead>
-      <tbody>
-        {% for invoice in invoices %}
-          <tr>
-            <td>{{ invoice.club__name }}</td>
-            <td>{{ "%.2f"|format(invoice.selling_sum) }} €</td>
-            <td>
-              {{ form[invoice.club_id|string] }}
-            </td>
-          </tr>
-        {% endfor %}
-      </tbody>
-    </table>
-    <input type="hidden" name="month" value="{{ start_date|date('Y-m') }}">
-    <button type="submit">{% trans %}Save{% endtrans %}</button>
-  </form>
-{% endblock %}
+      {% endfor %}
+    </tbody>
+  </table>
+{% endblock %}
+
+
+

counter/templates/counter/product_form.jinja

@@ -1,56 +0,0 @@
-{% extends "core/base.jinja" %}
-
-{% block content %}
-  {% if object %}
-    <h2>{% trans name=object %}Edit product {{ name }}{% endtrans %}</h2>
-  {% else %}
-    <h2>{% trans %}Product creation{% endtrans %}</h2>
-  {% endif %}
-  <form method="post" enctype="multipart/form-data">
-    {% csrf_token %}
-    {{ form.as_p() }}
-
-    <br />
-
-    <h3>{% trans %}Automatic actions{% endtrans %}</h3>
-
-    <p class="margin-bottom">
-      <em>
-        {%- trans trimmed -%}
-          Automatic actions allows to schedule product changes
-          ahead of time.
-        {%- endtrans -%}
-      </em>
-    </p>
-
-    {{ form.action_formset.management_form }}
-    {%- for action_form in form.action_formset.forms -%}
-      <fieldset x-data="{action: '{{ action_form.task.initial }}'}">
-        {{ action_form.non_field_errors() }}
-        <div class="row gap-2x margin-bottom">
-          <div>
-            {{ action_form.task.errors }}
-            {{ action_form.task.label_tag() }}
-            {{ action_form.task|add_attr("x-model=action") }}
-          </div>
-          <div>{{ action_form.trigger_at.as_field_group() }}</div>
-        </div>
-        <div x-show="action==='counter.tasks.change_counters'" class="margin-bottom">
-          {{ action_form.counters.as_field_group() }}
-        </div>
-        {%- if action_form.DELETE -%}
-          <div class="row gap">
-            {{ action_form.DELETE.as_field_group() }}
-          </div>
-        {%- endif -%}
-        {%- for field in action_form.hidden_fields() -%}
-          {{ field }}
-        {%- endfor -%}
-      </fieldset>
-      {%- if not loop.last -%}
-        <hr class="margin-bottom">
-      {%- endif -%}
-    {%- endfor -%}
-    <p><input type="submit" value="{% trans %}Save{% endtrans %}" /></p>
-  </form>
-{% endblock %}

counter/tests/test_auto_actions.py

@@ -1,116 +0,0 @@
-import json
-from datetime import timedelta
-
-import pytest
-from django.conf import settings
-from django.test import Client
-from django.urls import reverse
-from django.utils.timezone import now
-from django_celery_beat.models import ClockedSchedule
-from model_bakery import baker
-
-from core.models import Group, User
-from counter.baker_recipes import counter_recipe, product_recipe
-from counter.forms import ScheduledProductActionForm, ScheduledProductActionFormSet
-from counter.models import ScheduledProductAction
-
-
-@pytest.mark.django_db
-def test_edit_product(client: Client):
-    client.force_login(
-        baker.make(
-            User, groups=[Group.objects.get(id=settings.SITH_GROUP_COUNTER_ADMIN_ID)]
-        )
-    )
-    product = product_recipe.make()
-    url = reverse("counter:product_edit", kwargs={"product_id": product.id})
-    res = client.get(url)
-    assert res.status_code == 200
-
-    res = client.post(url, data={})
-    # This is actually a failure, but we just want to check that
-    # we don't have a 403 or a 500.
-    # The actual behaviour will be tested directly on the form.
-    assert res.status_code == 200
-
-
-@pytest.mark.django_db
-class TestProductActionForm:
-    def test_single_form_archive(self):
-        product = product_recipe.make()
-        trigger_at = now() + timedelta(minutes=10)
-        form = ScheduledProductActionForm(
-            product=product,
-            data={
-                "scheduled-task": "counter.tasks.archive_product",
-                "scheduled-trigger_at": trigger_at,
-            },
-        )
-        assert form.is_valid()
-        instance = form.save()
-        assert instance.clocked.clocked_time == trigger_at
-        assert instance.enabled is True
-        assert instance.one_off is True
-        assert instance.task == "counter.tasks.archive_product"
-        assert instance.kwargs == json.dumps({"product_id": product.id})
-
-    def test_single_form_change_counters(self):
-        product = product_recipe.make()
-        counter = counter_recipe.make()
-        trigger_at = now() + timedelta(minutes=10)
-        form = ScheduledProductActionForm(
-            product=product,
-            data={
-                "scheduled-task": "counter.tasks.change_counters",
-                "scheduled-trigger_at": trigger_at,
-                "scheduled-counters": [counter.id],
-            },
-        )
-        assert form.is_valid()
-        instance = form.save()
-        instance.refresh_from_db()
-        assert instance.clocked.clocked_time == trigger_at
-        assert instance.enabled is True
-        assert instance.one_off is True
-        assert instance.task == "counter.tasks.change_counters"
-        assert instance.kwargs == json.dumps(
-            {"product_id": product.id, "counters": [counter.id]}
-        )
-
-    def test_delete(self):
-        product = product_recipe.make()
-        clocked = baker.make(ClockedSchedule, clocked_time=now() + timedelta(minutes=2))
-        task = baker.make(
-            ScheduledProductAction,
-            product=product,
-            one_off=True,
-            clocked=clocked,
-            task="counter.tasks.archive_product",
-        )
-        formset = ScheduledProductActionFormSet(product=product)
-        formset.delete_existing(task)
-        assert not ScheduledProductAction.objects.filter(id=task.id).exists()
-        assert not ClockedSchedule.objects.filter(id=clocked.id).exists()
-
-
-@pytest.mark.django_db
-class TestProductActionFormSet:
-    def test_ok(self):
-        product = product_recipe.make()
-        counter = counter_recipe.make()
-        trigger_at = now() + timedelta(minutes=10)
-        formset = ScheduledProductActionFormSet(
-            product=product,
-            data={
-                "form-TOTAL_FORMS": "2",
-                "form-INITIAL_FORMS": "0",
-                "form-0-task": "counter.tasks.archive_product",
-                "form-0-trigger_at": trigger_at,
-                "form-1-task": "counter.tasks.change_counters",
-                "form-1-trigger_at": trigger_at,
-                "form-1-counters": [counter.id],
-            },
-        )
-        assert formset.is_valid()
-        formset.save()
-        assert ScheduledProductAction.objects.filter(product=product).count() == 2

counter/tests/test_counter.py

@@ -355,7 +355,7 @@ class TestCounterClick(TestFullClickBase):
             self.submit_basket(self.barmen, [BasketItem(self.beer.id, 1)])
         ).status_code == 302
 
-        assert self.updated_amount(self.barmen) == Decimal(9)
+        assert self.updated_amount(self.barmen) == Decimal("9")
 
     def test_click_tray_price(self):
         force_refill_user(self.customer, 20)
@@ -364,12 +364,12 @@ class TestCounterClick(TestFullClickBase):
         # Not applying tray price
         res = self.submit_basket(self.customer, [BasketItem(self.beer_tap.id, 2)])
         assert res.status_code == 302
-        assert self.updated_amount(self.customer) == Decimal(17)
+        assert self.updated_amount(self.customer) == Decimal("17")
 
         # Applying tray price
         res = self.submit_basket(self.customer, [BasketItem(self.beer_tap.id, 7)])
         assert res.status_code == 302
-        assert self.updated_amount(self.customer) == Decimal(8)
+        assert self.updated_amount(self.customer) == Decimal("8")
 
     def test_click_alcool_unauthorized(self):
         self.login_in_bar()
@@ -381,13 +381,13 @@ class TestCounterClick(TestFullClickBase):
             res = self.submit_basket(user, [BasketItem(self.snack.id, 2)])
             assert res.status_code == 302
 
-            assert self.updated_amount(user) == Decimal(7)
+            assert self.updated_amount(user) == Decimal("7")
 
             # Buy product without age limit
             res = self.submit_basket(user, [BasketItem(self.beer.id, 2)])
             assert res.status_code == 200
 
-            assert self.updated_amount(user) == Decimal(7)
+            assert self.updated_amount(user) == Decimal("7")
 
     def test_click_unauthorized_customer(self):
         self.login_in_bar()
@@ -401,7 +401,7 @@ class TestCounterClick(TestFullClickBase):
             assert resp.status_code == 302
             assert resp.url == resolve_url(self.counter)
 
-            assert self.updated_amount(user) == Decimal(10)
+            assert self.updated_amount(user) == Decimal("10")
 
     def test_click_user_without_customer(self):
         self.login_in_bar()
@@ -418,7 +418,7 @@ class TestCounterClick(TestFullClickBase):
         )
         assert res.status_code == 302
 
-        assert self.updated_amount(self.customer_old_can_buy) == Decimal(7)
+        assert self.updated_amount(self.customer_old_can_buy) == Decimal("7")
 
     def test_click_wrong_counter(self):
         self.login_in_bar()
@@ -443,7 +443,7 @@ class TestCounterClick(TestFullClickBase):
         )
         assertRedirects(res, self.counter.get_absolute_url())
 
-        assert self.updated_amount(self.customer) == Decimal(10)
+        assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_click_not_connected(self):
         force_refill_user(self.customer, 10)
@@ -455,7 +455,7 @@ class TestCounterClick(TestFullClickBase):
         )
         assert res.status_code == 403
 
-        assert self.updated_amount(self.customer) == Decimal(10)
+        assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_click_product_not_in_counter(self):
         force_refill_user(self.customer, 10)
@@ -463,7 +463,7 @@ class TestCounterClick(TestFullClickBase):
 
         res = self.submit_basket(self.customer, [BasketItem(self.stamps.id, 2)])
         assert res.status_code == 200
-        assert self.updated_amount(self.customer) == Decimal(10)
+        assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_basket_empty(self):
         force_refill_user(self.customer, 10)
@@ -477,7 +477,7 @@ class TestCounterClick(TestFullClickBase):
                 self.submit_basket(self.customer, basket),
                 self.counter.get_absolute_url(),
             )
-            assert self.updated_amount(self.customer) == Decimal(10)
+            assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_click_product_invalid(self):
         force_refill_user(self.customer, 10)
@@ -490,7 +490,7 @@ class TestCounterClick(TestFullClickBase):
             BasketItem(self.beer.id, None),
         ]:
             assert self.submit_basket(self.customer, [item]).status_code == 200
-            assert self.updated_amount(self.customer) == Decimal(10)
+            assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_click_not_enough_money(self):
         force_refill_user(self.customer, 10)
@@ -501,7 +501,7 @@ class TestCounterClick(TestFullClickBase):
         )
         assert res.status_code == 200
 
-        assert self.updated_amount(self.customer) == Decimal(10)
+        assert self.updated_amount(self.customer) == Decimal("10")
 
     def test_annotate_has_barman_queryset(self):
         """Test if the custom queryset method `annotate_has_barman` works as intended."""

counter/tests/test_invoices.py

@@ -1,76 +0,0 @@
-from datetime import date, datetime
-
-import pytest
-from dateutil.relativedelta import relativedelta
-from django.contrib.auth.models import Permission
-from django.core.exceptions import ValidationError
-from django.test import Client
-from django.urls import reverse
-from django.utils.timezone import localdate
-from model_bakery import baker
-from pytest_django.asserts import assertRedirects
-
-from club.models import Club
-from core.models import User
-from counter.baker_recipes import sale_recipe
-from counter.forms import InvoiceCallForm
-from counter.models import Customer, InvoiceCall, Selling
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize(
-    "month", [date(2025, 10, 20), "2025-10", datetime(2025, 10, 15, 12, 30)]
-)
-def test_invoice_date_with_date(month: date | datetime | str):
-    club = baker.make(Club)
-    invoice = InvoiceCall.objects.create(club=club, month=month)
-    invoice.refresh_from_db()
-    assert not invoice.is_validated
-    assert invoice.month == date(2025, 10, 1)
-
-
-@pytest.mark.django_db
-def test_invoice_call_invalid_month_string():
-    club = baker.make(Club)
-
-    with pytest.raises(ValidationError):
-        InvoiceCall.objects.create(club=club, month="2025-13")
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize("query", [None, {"month": "2025-08"}])
-def test_invoice_call_view(client: Client, query: dict | None):
-    user = baker.make(
-        User,
-        user_permissions=[
-            *Permission.objects.filter(
-                codename__in=["view_invoicecall", "change_invoicecall"]
-            )
-        ],
-    )
-    client.force_login(user)
-    url = reverse("counter:invoices_call", query=query)
-    assert client.get(url).status_code == 200
-    assertRedirects(client.post(url), url)
-
-
-@pytest.mark.django_db
-def test_invoice_call_form():
-    Selling.objects.all().delete()
-    month = localdate() - relativedelta(months=1)
-    clubs = baker.make(Club, _quantity=2)
-    recipe = sale_recipe.extend(date=month, customer=baker.make(Customer, amount=10000))
-    recipe.make(club=clubs[0], quantity=2, unit_price=200)
-    recipe.make(club=clubs[0], quantity=3, unit_price=5)
-    recipe.make(club=clubs[1], quantity=20, unit_price=10)
-    form = InvoiceCallForm(
-        month=month, data={str(clubs[0].id): True, str(clubs[1].id): False}
-    )
-    assert form.is_valid()
-    form.save()
-    assert InvoiceCall.objects.filter(
-        club=clubs[0], month=month, is_validated=True
-    ).exists()
-    assert InvoiceCall.objects.filter(
-        club=clubs[1], month=month, is_validated=False
-    ).exists()

counter/tests/test_product.py

@@ -6,16 +6,14 @@ import pytest
 from django.conf import settings
 from django.core.cache import cache
 from django.core.files.uploadedfile import SimpleUploadedFile
-from django.test import Client, TestCase
+from django.test import Client
 from django.urls import reverse
 from model_bakery import baker
 from PIL import Image
-from pytest_django.asserts import assertNumQueries, assertRedirects
+from pytest_django.asserts import assertNumQueries
 
-from club.models import Club
 from core.baker_recipes import board_user, subscriber_user
 from core.models import Group, User
-from counter.forms import ProductForm
 from counter.models import Product, ProductType
 
 
@@ -86,49 +84,3 @@ def test_fetch_product_nb_queries(client: Client):
         # - 1 for the actual request
         # - 1 to prefetch the related buying_groups
         client.get(reverse("api:search_products_detailed"))
-
-
-class TestCreateProduct(TestCase):
-    @classmethod
-    def setUpTestData(cls):
-        cls.product_type = baker.make(ProductType)
-        cls.club = baker.make(Club)
-        cls.data = {
-            "name": "foo",
-            "description": "bar",
-            "product_type": cls.product_type.id,
-            "club": cls.club.id,
-            "code": "FOO",
-            "purchase_price": 1.0,
-            "selling_price": 1.0,
-            "special_selling_price": 1.0,
-            "limit_age": 0,
-            "form-TOTAL_FORMS": 0,
-            "form-INITIAL_FORMS": 0,
-        }
-
-    def test_form(self):
-        form = ProductForm(data=self.data)
-        assert form.is_valid()
-        instance = form.save()
-        assert instance.club == self.club
-        assert instance.product_type == self.product_type
-        assert instance.name == "foo"
-        assert instance.selling_price == 1.0
-
-    def test_view(self):
-        self.client.force_login(
-            baker.make(
-                User,
-                groups=[Group.objects.get(id=settings.SITH_GROUP_COUNTER_ADMIN_ID)],
-            )
-        )
-        url = reverse("counter:new_product")
-        response = self.client.get(url)
-        assert response.status_code == 200
-        response = self.client.post(url, data=self.data)
-        assertRedirects(response, reverse("counter:product_list"))
-        product = Product.objects.last()
-        assert product.name == "foo"
-        assert product.club == self.club
-        assert product.product_type == self.product_type

counter/tests/test_product_type.py

@@ -3,9 +3,11 @@ from django.conf import settings
 from django.test import Client
 from django.urls import reverse
 from model_bakery import baker, seq
+from ninja_extra.testing import TestClient
 
 from core.baker_recipes import board_user, subscriber_user
 from core.models import Group, User
+from counter.api import ProductTypeController
 from counter.models import ProductType
 
 
@@ -17,43 +19,24 @@ def product_types(db) -> list[ProductType]:
     return baker.make(ProductType, _quantity=5, order=seq(0))
 
 
-@pytest.fixture()
-def counter_admin_client(db, client: Client) -> Client:
-    client.force_login(
-        baker.make(
-            User, groups=[Group.objects.get(id=settings.SITH_GROUP_COUNTER_ADMIN_ID)]
-        )
-    )
-    return client
-
-
 @pytest.mark.django_db
-def test_fetch_product_types(
-    counter_admin_client: Client, product_types: list[ProductType]
-):
+def test_fetch_product_types(product_types: list[ProductType]):
     """Test that the API returns the right products in the right order"""
-    response = counter_admin_client.get(reverse("api:fetch_product_types"))
+    client = TestClient(ProductTypeController)
+    response = client.get("")
     assert response.status_code == 200
     assert [i["id"] for i in response.json()] == [t.id for t in product_types]
 
 
 @pytest.mark.django_db
-def test_move_below_product_type(
-    counter_admin_client: Client, product_types: list[ProductType]
-):
+def test_move_below_product_type(product_types: list[ProductType]):
     """Test that moving a product below another works"""
-    response = counter_admin_client.patch(
-        reverse(
-            "api:reorder_product_type",
-            kwargs={"type_id": product_types[-1].id},
-            query={"below": product_types[0].id},
-        ),
+    client = TestClient(ProductTypeController)
+    response = client.patch(
+        f"/{product_types[-1].id}/move", query={"below": product_types[0].id}
     )
     assert response.status_code == 200
-    new_order = [
-        i["id"]
-        for i in counter_admin_client.get(reverse("api:fetch_product_types")).json()
-    ]
+    new_order = [i["id"] for i in client.get("").json()]
     assert new_order == [
         product_types[0].id,
         product_types[-1].id,
@@ -62,22 +45,14 @@ def test_move_below_product_type(
 
 
 @pytest.mark.django_db
-def test_move_above_product_type(
-    counter_admin_client: Client, product_types: list[ProductType]
-):
+def test_move_above_product_type(product_types: list[ProductType]):
     """Test that moving a product above another works"""
-    response = counter_admin_client.patch(
-        reverse(
-            "api:reorder_product_type",
-            kwargs={"type_id": product_types[1].id},
-            query={"above": product_types[0].id},
-        ),
+    client = TestClient(ProductTypeController)
+    response = client.patch(
+        f"/{product_types[1].id}/move", query={"above": product_types[0].id}
     )
     assert response.status_code == 200
-    new_order = [
-        i["id"]
-        for i in counter_admin_client.get(reverse("api:fetch_product_types")).json()
-    ]
+    new_order = [i["id"] for i in client.get("").json()]
     assert new_order == [
         product_types[1].id,
         product_types[0].id,

counter/views/admin.py

@@ -32,7 +32,7 @@ from core.utils import get_semester_code, get_start_of_semester
 from counter.forms import (
     CloseCustomerAccountForm,
     CounterEditForm,
-    ProductForm,
+    ProductEditForm,
     ReturnableProductForm,
 )
 from counter.models import (
@@ -146,8 +146,8 @@ class ProductCreateView(CounterAdminTabsMixin, CounterAdminMixin, CreateView):
     """A create view for the admins."""
 
     model = Product
-    form_class = ProductForm
-    template_name = "counter/product_form.jinja"
+    form_class = ProductEditForm
+    template_name = "core/create.jinja"
     current_tab = "products"
 
 
@@ -155,9 +155,9 @@ class ProductEditView(CounterAdminTabsMixin, CounterAdminMixin, UpdateView):
     """An edit view for the admins."""
 
     model = Product
-    form_class = ProductForm
+    form_class = ProductEditForm
     pk_url_kwarg = "product_id"
-    template_name = "counter/product_form.jinja"
+    template_name = "core/edit.jinja"
     current_tab = "products"
 
 

counter/views/invoice.py

@@ -12,81 +12,77 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
-from datetime import datetime
-from urllib.parse import urlencode
+from datetime import datetime, timedelta
+from datetime import timezone as tz
 
-from dateutil.relativedelta import relativedelta
-from django.contrib.auth.mixins import PermissionRequiredMixin
-from django.contrib.messages.views import SuccessMessageMixin
-from django.db.models import F, Sum
-from django.utils.timezone import localdate, make_aware
-from django.utils.translation import gettext_lazy as _
-from django.views.generic import FormView
+from django.db.models import F
+from django.utils import timezone
+from django.views.generic import TemplateView
 
-from counter.forms import InvoiceCallForm
+from counter.fields import CurrencyField
 from counter.models import Refilling, Selling
-from counter.views.mixins import CounterAdminTabsMixin
+from counter.views.mixins import CounterAdminMixin, CounterAdminTabsMixin
 
 
-class InvoiceCallView(
-    CounterAdminTabsMixin, PermissionRequiredMixin, SuccessMessageMixin, FormView
-):
+class InvoiceCallView(CounterAdminTabsMixin, CounterAdminMixin, TemplateView):
     template_name = "counter/invoices_call.jinja"
     current_tab = "invoices_call"
-    permission_required = ["counter.view_invoicecall", "counter.change_invoicecall"]
-    form_class = InvoiceCallForm
-    success_message = _("Invoice calls status has been updated.")
-
-    def get_month(self):
-        kwargs = self.request.GET or self.request.POST
-        if "month" in kwargs:
-            return make_aware(datetime.strptime(kwargs["month"], "%Y-%m"))
-        return localdate().replace(day=1) - relativedelta(months=1)
-
-    def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"month": self.get_month()}
-
-    def form_valid(self, form):
-        form.save()
-        return super().form_valid(form)
-
-    def get_success_url(self):
-        # redirect to the month from which the request is originated
-        url = self.request.path
-        kwargs = self.request.GET or self.request.POST
-        if "month" in kwargs:
-            query = urlencode({"month": kwargs["month"]})
-            url += f"?{query}"
-        return url
 
     def get_context_data(self, **kwargs):
         """Add sums to the context."""
         kwargs = super().get_context_data(**kwargs)
         kwargs["months"] = Selling.objects.datetimes("date", "month", order="DESC")
-        start_date = self.get_month()
-        end_date = start_date + relativedelta(months=1)
-
-        kwargs["sum_cb"] = Refilling.objects.filter(
-            payment_method="CARD",
-            is_validated=True,
-            date__gte=start_date,
-            date__lte=end_date,
-        ).aggregate(res=Sum("amount", default=0))["res"]
-        kwargs["sum_cb"] += (
-            Selling.objects.filter(
-                payment_method="CARD",
-                is_validated=True,
-                date__gte=start_date,
-                date__lte=end_date,
+        if "month" in self.request.GET:
+            start_date = datetime.strptime(self.request.GET["month"], "%Y-%m")
+        else:
+            start_date = datetime(
+                year=timezone.now().year,
+                month=(timezone.now().month + 10) % 12 + 1,
+                day=1,
             )
-            .annotate(amount=F("unit_price") * F("quantity"))
-            .aggregate(res=Sum("amount", default=0))["res"]
+        start_date = start_date.replace(tzinfo=tz.utc)
+        end_date = (start_date + timedelta(days=32)).replace(
+            day=1, hour=0, minute=0, microsecond=0
+        )
+        from django.db.models import Case, Sum, When
+
+        kwargs["sum_cb"] = sum(
+            [
+                r.amount
+                for r in Refilling.objects.filter(
+                    payment_method="CARD",
+                    is_validated=True,
+                    date__gte=start_date,
+                    date__lte=end_date,
+                )
+            ]
+        )
+        kwargs["sum_cb"] += sum(
+            [
+                s.quantity * s.unit_price
+                for s in Selling.objects.filter(
+                    payment_method="CARD",
+                    is_validated=True,
+                    date__gte=start_date,
+                    date__lte=end_date,
+                )
+            ]
         )
         kwargs["start_date"] = start_date
-        kwargs["invoices"] = (
-            Selling.objects.filter(date__gte=start_date, date__lt=end_date)
-            .values("club_id", "club__name")
-            .annotate(selling_sum=Sum(F("unit_price") * F("quantity")))
+        kwargs["sums"] = (
+            Selling.objects.values("club__name")
+            .annotate(
+                selling_sum=Sum(
+                    Case(
+                        When(
+                            date__gte=start_date,
+                            date__lt=end_date,
+                            then=F("unit_price") * F("quantity"),
+                        ),
+                        output_field=CurrencyField(),
+                    )
+                )
+            )
             .exclude(selling_sum=None)
             .order_by("-selling_sum")
         )

docs/explanation/technos.md

@@ -182,19 +182,29 @@ ainsi même que de l'héritage de templates.
     si on souhaite faire des modifications côté client, 
     il faut utiliser du Javascript, rien ne change à ce niveau-là.
 
-### Typescript
+### jQuery
 
-[Site officiel](https://www.typescriptlang.org/)
+[Site officiel](https://jquery.com/)
 
-Pour rendre le site interactif, nous n'utilisons 
-pas directement Javascript, mais Typescript.
-Il s'agit d'un langage construit par-dessus Javascript,
-en ajoutant un typage statique et des éléments de sucre syntaxique.
-Grâce au système de type, le code est plus lisible,
-à la fois par les humains et par l'IDE, et plus fiable.
+jQuery est une bibliothèque JavaScript 
+libre et multiplateforme créée pour faciliter
+l'écriture de scripts côté client 
+dans le code HTML des pages web. 
+La première version est lancée en janvier 2006 par John Resig.
 
-Il faut parfois se battre un peu contre le système de types de Typescript,
-mais globalement Typescript est une alternative largement préférable à Javascript.
+C'est une vieille technologie et certains
+feront remarquer à juste titre que le Javascript 
+moderne permet d'utiliser assez simplement 
+la majorité de ce que fournit jQuery 
+sans rien avoir à installer. 
+Cependant, de nombreuses dépendances du projet
+utilisent encore jQuery qui est toujours 
+très implanté aujourd'hui. 
+Le sucre syntaxique qu'offre cette librairie 
+reste très agréable à utiliser et économise
+parfois beaucoup de temps. 
+Ça fonctionne et ça fonctionne très bien.
+C'est maintenu et pratique.
 
 
 ### AlpineJS
@@ -260,6 +270,17 @@ sur tous les navigateurs contrairement
 à un simple icône unicode qui s'affiche 
 lui différemment selon la plate-forme.
 
+!!!note
+
+    C'est une dépendance capricieuse qui évolue très vite 
+    et qu'il faut très souvent mettre à jour.
+
+!!!warning
+
+    Il a été décidé de **ne pas utiliser**
+    de CDN puisque le site ralentissait régulièrement.
+    Il est préférable de fournir cette dépendance avec le site.
+
 ## Workflow
 
 ### Git

docs/howto/querysets.md

@@ -1,4 +1,4 @@
-L'ORM de Django est puissant, très puissant, non pas parce qu'il
+L'ORM de Django est puissant, très puissant, non par parce qu'il
 est performant (après tout, ce n'est qu'une interface, le gros du boulot,
 c'est la db qui le fait), mais parce qu'il permet d'écrire
 de manière relativement simple un grand panel de requêtes.

docs/howto/statics.md

@@ -51,7 +51,7 @@ Pour accéder au fichier, il faut utiliser `static` comme pour le reste mais en
 	Le bundler ne génère que des modules javascript.
 	Ajouter `type="module"` n'est pas optionnel !
 
-### Les imports au sein des fichiers javascript bundlés
+### Les imports au sein des fichiers des fichiers javascript bundlés
 
 Pour importer au sein d'un fichier js bundlé, il faut préfixer ses imports de `#app:`.
 

docs/howto/subscriptions.md

@@ -36,4 +36,11 @@ SITH_SUBSCRIPTIONS = {
 }
 ```
 
-Après ça, n'oubliez pas de gérer les traductions (cf. [ici](./translation.md))
+Une fois ceci fait, il faut créer une nouvelle migration :
+
+```bash
+python ./manage.py makemigrations subscription
+python ./manage.py migrate
+```
+
+N'oubliez pas non plus les traductions (cf. [ici](./translation.md))

docs/reference/core/auth.md

@@ -17,6 +17,7 @@
             - can_edit_prop
             - can_edit
             - can_view
+            - CanCreateMixin
             - CanEditMixin
             - CanViewMixin
             - CanEditPropMixin

docs/tutorial/api/dev.md

@@ -1,3 +1,4 @@
+
 Pour l'API, nous utilisons `django-ninja` et sa surcouche `django-ninja-extra`.
 Ce sont des librairies relativement simples et qui présentent
 l'immense avantage d'offrir des mécanismes de validation et de sérialisation
@@ -48,9 +49,8 @@ Notre API offre deux moyens d'authentification :
 - par clef d'API
 
 La plus grande partie des routes de l'API utilisent la méthode par cookie de session.
-Cette dernière est donc activée par défaut.
 
-Pour changer la méthode d'authentification,
+Pour placer une route d'API derrière l'une de ces méthodes (ou bien les deux),
 utilisez l'attribut `auth` et les classes `SessionAuth` et 
 [`ApiKeyAuth`][api.auth.ApiKeyAuth].
 
@@ -60,17 +60,13 @@ utilisez l'attribut `auth` et les classes `SessionAuth` et
     @api_controller("/foo")
     class FooController(ControllerBase):
         # Cette route sera accessible uniquement avec l'authentification
-        # par clef d'API
-        @route.get("", auth=[ApiKeyAuth()])
+        # par cookie de session
+        @route.get("", auth=[SessionAuth()])
         def fetch_foo(self, club_id: int): ...
 
-        # Celle-ci sera accessible avec les deux méthodes d'authentification
-        @route.get("/bar", auth=[ApiKeyAuth(), SessionAuth()])
+        # Et celle-ci sera accessible peut importe la méthode d'authentification
+        @route.get("/bar", auth=[SessionAuth(), ApiKeyAuth()])
         def fetch_bar(self, club_id: int): ...
-
-        # Et celle-ci sera accessible aussi aux utilisateurs non-connectés
-        @route.get("/public", auth=None)
-        def fetch_public(self, club_id: int): ...
     ```
 
 ### Permissions
@@ -83,7 +79,9 @@ par-dessus `django-ninja`, le système de permissions de django
 et notre propre système.
 Cette dernière est documentée [ici](../perms.md).
 
-### Incompatibilité avec certaines permissions
+### Limites des clefs d'API
+
+#### Incompatibilité avec certaines permissions
 
 Le système des clefs d'API est apparu très tard dans l'histoire du site
 (en P25, 10 ans après le début du développement).
@@ -114,33 +112,10 @@ Les principaux points de friction sont :
 - `IsLoggedInCounter`, qui utilise encore un autre système 
   d'authentification maison et qui n'est pas fait pour être utilisé en dehors du site.
 
-### CSRF
+#### Incompatibilité avec les tokens csrf
 
-!!!info "A propos du csrf"
-
-    Le [CSRF (*cross-site request forgery*)](https://fr.wikipedia.org/wiki/Cross-site_request_forgery)
-    est un vecteur d'attaque sur le web consistant
-    à soumettre des données au serveur à l'insu
-    de l'utilisateur, en profitant de sa session.
-
-    C'est une attaque qui peut se produire lorsque l'utilisateur
-    est authentifié par cookie de session.
-    En effet, les cookies sont joints automatiquement à
-    toutes les requêtes ;
-    en l'absence de protection contre le CSRF, 
-    un attaquant parvenant à insérer un formulaire 
-    dans la page de l'utilisateur serait en mesure
-    de faire presque n'importe quoi en son nom,
-    et ce sans même que l'utilisateur ni les administrateurs
-    ne s'en rendent compte avant qu'il ne soit largement trop tard !
-
-    Sur le CSRF et les moyens de s'en prémunir, voir :
-
-    - [https://owasp.org/www-community/attacks/csrf]()
-    - [https://security.stackexchange.com/questions/166724/should-i-use-csrf-protection-on-rest-api-endpoints]()
-    - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html]()
-    
-Le CSRF, c'est dangereux.
+Le [CSRF (*cross-site request forgery*)](https://fr.wikipedia.org/wiki/Cross-site_request_forgery)
+est un des multiples facteurs d'attaque sur le web.
 Heureusement, Django vient encore une fois à notre aide,
 avec des mécanismes intégrés pour s'en protéger.
 Ceux-ci incluent notamment un système de 
@@ -148,39 +123,16 @@ Ceux-ci incluent notamment un système de
 à fournir dans les requêtes POST/PUT/PATCH.
 
 Ceux-ci sont bien adaptés au cycle requêtes/réponses
-typiques de l'expérience utilisateur sur un navigateur, 
+typique de l'expérience utilisateur sur un navigateur, 
 où les requêtes POST sont toujours effectuées après une requête
 GET au cours de laquelle on a pu récupérer un token csrf.
-Cependant, ils sont également gênants et moins utiles
-dans le cadre d'une API REST, étant donné
-que l'authentification cesse d'être implicite :
-la clef d'API doit être explicitement jointe aux headers,
-pour chaque requête.
+Cependant, le flux des requêtes sur une API est bien différent ;
+de ce fait, il est à attendre que les requêtes POST envoyées à l'API
+par un client externe n'aient pas de token CSRF et se retrouvent 
+donc bloquées.
 
-Pour ces raisons, la vérification CSRF ne prend place
-que pour la vérification de l'authentification
-par cookie de session.
-
-!!!warning "L'ordre est important"
-
-    Si vous écrivez le code suivant, l'authentification par clef d'API
-    ne marchera plus :
-    
-    ```python
-    @api_controller("/foo")
-    class FooController(ControllerBase):
-        @route.post("/bar", auth=[SessionAuth(), ApiKeyAuth()])
-        def post_bar(self, club_id: int): ...
-    ```
-    
-    En effet, la vérification du cookie de session intègrera
-    toujours la vérification CSRF.
-    Or, un échec de cette dernière est traduit par django en un code HTTP 403
-    au lieu d'un HTTP 401.
-    L'authentification se retrouve alors court-circuitée,
-    faisant que la vérification de la clef d'API ne sera jamais appelée.
-    
-    `SessionAuth` doit donc être déclaré **après** `ApiKeyAuth`.
+Pour ces raisons, l'accès aux requêtes POST/PUT/PATCH de l'API
+par un client externe ne marche pas.
 
 ## Créer un client et une clef d'API
 
@@ -219,3 +171,5 @@ qui en a besoin.
 Dites-lui bien de garder cette clef en lieu sûr !
 Si la clef est perdue, il n'y a pas moyen de la récupérer,
 vous devrez en recréer une.
+
+

docs/tutorial/devtools.md

@@ -157,18 +157,16 @@ que sont VsCode et Sublime Text.
     Si vous avez réussi à terminer l'installation, vous n'avez donc pas de configuration
     supplémentaire à effectuer.
 
-Pour utiliser Biome, placez-vous à la racine du projet et lancez la commande suivante:
+Pour utiliser Biome, placez-vous à la racine du projet et lancer la commande suivante:
 
 ```bash
     npx @biomejs/biome check # Pour checker le code avec le linter et le formater
-    npx @biomejs/biome check --write # Pour appliquer les changements
+    npx @biomejs/biome check --write # Pour appliquer les changemnts
 ```
 
 Biome va alors faire son travail sur l'ensemble du projet puis vous dire
 si des documents ont été reformatés (si vous avez fait `npx @biomejs/biome format --write`)
-ou bien s'il y a des erreurs à réparer 
-(si vous avez fait `npx @biomejs/biome lint`)
-ou les deux (si vous avez fait `npx @biomejs/biome check --write`).
+ou bien s'il y a des erreurs à réparer (si vous avez faire `npx @biomejs/biome lint`) ou les deux (si vous avez fait `npx @biomejs/biome check --write`).
 
 Appeler Biome en ligne de commandes avant de pousser votre code sur Github
 est une technique qui marche très bien.

docs/tutorial/fragments.md

@@ -30,7 +30,7 @@ opérations, telles que la validation de formulaire.
 En effet, valider un formulaire demande beaucoup
 de travail de nettoyage des données et d'affichage
 des messages d'erreur appropriés.
-Or, tout ce travail existe déjà dans Django.
+Or, tout ce travail existe déjà dans django.
 
 On veut donc, dans ces cas-là, ne pas demander
 toute une page HTML au serveur, mais uniquement
@@ -84,7 +84,7 @@ Grâce à ça, on peut écrire des vues qui
 fonctionnent dans les deux contextes.
 
 Par exemple, supposons que nous avons
-une `UpdateView` très simple, contenant
+une `EditView` très simple, contenant
 uniquement un formulaire.
 On peut écrire la vue et le template de la manière
 suivante :
@@ -94,10 +94,8 @@ suivante :
     ```python
     from django.views.generic import UpdateView
 
-    from core.views import AllowFragment
 
-
-    class FooUpdateView(AllowFragment, UpdateView):
+    class FooUpdateView(UpdateView):
         model = Foo
         fields = ["foo", "bar"]
         pk_url_kwarg = "foo_id"
@@ -134,7 +132,7 @@ Dans ces situations, pouvoir décomposer une vue
 en plusieurs vues de fragment permet de ne plus 
 raisonner en termes de condition, mais en termes
 de composition : on n'a pas un seul template
-qui peut changer selon les situations, on a plusieurs
+qui peut changer les situations, on a plusieurs
 templates que l'on injecte dans un template principal.
 
 Supposons, par exemple, que nous n'avons plus un,
@@ -240,10 +238,10 @@ qui se comportera alors comme une vue normale.
 
 #### La méthode `as_fragment`
 
-Il est à noter que l'instanciation d'un fragment
+Il est à noter que l'instantiation d'un fragment
 se fait en deux étapes :
 
-- on commence par instancier la vue en tant que renderer.
+- on commence par instantier la vue en tant que renderer.
 - on appelle le renderer en lui-même
 
 Ce qui donne la syntaxe `Fragment.as_fragment()()`.

docs/tutorial/install.md

@@ -76,7 +76,7 @@ cd /mnt/<la_lettre_du_disque>/vos/fichiers/comme/dhab
         ```bash
         sudo pacman -Syu  # on s'assure que les dépôts et le système sont à jour
 
-        sudo pacman -S uv gcc git gettext pkgconf npm valkey
+        sudo pacman -S uv gcc git gettext pkgconf npm redis
         ```
 
 === "macOS"

docs/tutorial/perms.md

@@ -212,7 +212,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
             obj = self.get_object()
             obj.is_moderated = True
             obj.save()
-            return redirect("com:news_list")
+            return redirect(reverse("com:news_list"))
     ```
 
 === "Function-based view"
@@ -233,7 +233,7 @@ Pour les vues sous forme de fonction, il y a le décorateur
         news = get_object_or_404(News, id=news_id)
         news.is_moderated = True
         news.save()
-        return redirect("com:news_list")
+        return redirect(reverse("com:news_list"))
     ```
 
 ## Accès à des éléments en particulier
@@ -447,9 +447,10 @@ l'utilisateur recevra une liste vide d'objet.
 Voici un exemple d'utilisation en reprenant l'objet Article crée précédemment :
 
 ```python
-from django.views.generic import DetailView
+from django.views.generic import CreateView, DetailView
+
+from core.auth.mixins import CanViewMixin, CanCreateMixin
 
-from core.auth.mixins import CanViewMixin
 from com.models import WeekmailArticle
 
 
@@ -458,15 +459,48 @@ from com.models import WeekmailArticle
 # d'une classe de base pour fonctionner correctement.
 class ArticlesDetailView(CanViewMixin, DetailView):
     model = WeekmailArticle
+
+
+# Même chose pour une vue de création de l'objet Article
+class ArticlesCreateView(CanCreateMixin, CreateView):
+    model = WeekmailArticle
 ```
 
 Les mixins suivants sont implémentés :
 
+- [CanCreateMixin][core.auth.mixins.CanCreateMixin] : l'utilisateur peut-il créer l'objet ?
+  Ce mixin existe, mais est déprécié et ne doit plus être utilisé !
 - [CanEditPropMixin][core.auth.mixins.CanEditPropMixin] : l'utilisateur peut-il éditer les propriétés de l'objet ?
 - [CanEditMixin][core.auth.mixins.CanEditMixin] : L'utilisateur peut-il éditer l'objet ?
 - [CanViewMixin][core.auth.mixins.CanViewMixin] : L'utilisateur peut-il voir l'objet ?
 - [FormerSubscriberMixin][core.auth.mixins.FormerSubscriberMixin] : L'utilisateur a-t-il déjà été cotisant ?
 
+!!!danger "CanCreateMixin"
+
+    L'usage de `CanCreateMixin` est dangereux et ne doit en aucun cas être
+    étendu.
+    La façon dont ce mixin marche est qu'il valide le formulaire
+    de création et crée l'objet sans le persister en base de données, puis
+    vérifie les droits sur cet objet non-persisté.
+    Le danger de ce système vient de multiples raisons :
+
+    - Les vérifications se faisant sur un objet non persisté,
+      l'utilisation de mécanismes nécessitant une persistance préalable
+      peut mener à des comportements indésirés, voire à des erreurs.
+    - Les développeurs de django ayant tendance à restreindre progressivement
+      les actions qui peuvent être faites sur des objets non-persistés,
+      les mises-à-jour de django deviennent plus compliquées.
+    - La vérification des droits ne se fait que dans les requêtes POST,
+      à la toute fin de la requête.
+      Tout ce qui arrive avant n'est absolument pas protégé.
+      Toute opération (même les suppressions et les créations) qui ont
+      lieu avant la persistance de l'objet seront appliquées,
+      même sans permission.
+    - Si un développeur du site fait l'erreur de surcharger
+      la méthode `form_valid` (ce qui est plutôt courant,
+      lorsqu'on veut accomplir certaines actions 
+      quand un formulaire est valide), on peut se retrouver
+      dans une situation où l'objet est persisté sans aucune protection.
 
 !!!danger "Performance"
 

eboutic/models.py

@@ -242,7 +242,7 @@ class Invoice(models.Model):
     def validate(self):
         if self.validated:
             raise DataError(_("Invoice already validated"))
-        customer, _created = Customer.get_or_create(user=self.user)
+        customer, created = Customer.get_or_create(user=self.user)
         eboutic = Counter.objects.filter(type="EBOUTIC").first()
         for i in self.items.all():
             if i.type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING:

eboutic/templates/eboutic/eboutic_billing_info.jinja

@@ -1,5 +1,3 @@
-{% from 'core/macros.jinja' import update_notifications %}
-
 <div id=billing-infos-fragment>
   <div
     class="collapse"
@@ -31,6 +29,7 @@
       >
     </form>
   </div>
+
   <br>
-  {{ update_notifications(messages) }}
+  {% include "core/base/notifications.jinja" %}
 </div>

eboutic/templates/eboutic/eboutic_checkout.jinja

@@ -1,7 +1,7 @@
 {% extends "core/base.jinja" %}
 
 {% block notifications %}
-  {# Notifications are moved under the billing form #}
+  {# Notifications are moved inside the billing info fragment #}
 {% endblock %}
 
 {% block title %}
@@ -60,7 +60,6 @@
       <div @htmx:after-request="fill">
         {{ billing_infos_form }}
       </div>
-      {% include "core/base/notifications.jinja" %}
       <form
         method="post"
         action="{{ settings.SITH_EBOUTIC_ET_URL }}"

eboutic/tests/test_payment.py

@@ -108,7 +108,7 @@ class TestPaymentSith(TestPaymentBase):
         )
         assert Basket.objects.filter(id=self.basket.id).first() is None
         self.customer.customer.refresh_from_db()
-        assert self.customer.customer.amount == Decimal(1)
+        assert self.customer.customer.amount == Decimal("1")
 
         sellings = Selling.objects.filter(customer=self.customer.customer).order_by(
             "quantity"

eboutic/views.py

@@ -48,7 +48,7 @@ from django_countries.fields import Country
 
 from core.auth.mixins import CanViewMixin
 from core.views.mixins import FragmentMixin, UseFragmentsMixin
-from counter.forms import BaseBasketForm, BasketProductForm, BillingInfoForm
+from counter.forms import BaseBasketForm, BillingInfoForm, ProductForm
 from counter.models import (
     BillingInfo,
     Customer,
@@ -78,7 +78,7 @@ class BaseEbouticBasketForm(BaseBasketForm):
 
 
 EbouticBasketForm = forms.formset_factory(
-    BasketProductForm, formset=BaseEbouticBasketForm, absolute_max=None, min_num=1
+    ProductForm, formset=BaseEbouticBasketForm, absolute_max=None, min_num=1
 )
 
 

election/forms.py

@@ -1,155 +0,0 @@
-from django import forms
-from django.utils.translation import gettext_lazy as _
-
-from core.models import User
-from core.views.forms import SelectDateTime
-from core.views.widgets.ajax_select import (
-    AutoCompleteSelect,
-    AutoCompleteSelectMultipleGroup,
-    AutoCompleteSelectUser,
-)
-from core.views.widgets.markdown import MarkdownInput
-from election.models import Candidature, Election, ElectionList, Role
-
-
-class LimitedCheckboxField(forms.ModelMultipleChoiceField):
-    """A `ModelMultipleChoiceField`, with a max limit of selectable inputs."""
-
-    def __init__(self, queryset, max_choice, **kwargs):
-        self.max_choice = max_choice
-        super().__init__(queryset, **kwargs)
-
-    def clean(self, value):
-        qs = super().clean(value)
-        self.validate(qs)
-        return qs
-
-    def validate(self, qs):
-        if qs.count() > self.max_choice:
-            raise forms.ValidationError(
-                _("You have selected too many candidates."), code="invalid"
-            )
-
-
-class CandidateForm(forms.ModelForm):
-    """Form to candidate."""
-
-    required_css_class = "required"
-
-    class Meta:
-        model = Candidature
-        fields = ["user", "role", "program", "election_list"]
-        labels = {
-            "user": _("User to candidate"),
-        }
-        widgets = {
-            "program": MarkdownInput,
-            "user": AutoCompleteSelectUser,
-            "role": AutoCompleteSelect,
-            "election_list": AutoCompleteSelect,
-        }
-
-    def __init__(self, *args, election: Election, can_edit: bool = False, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields["role"].queryset = election.roles.select_related("election")
-        self.fields["election_list"].queryset = election.election_lists.all()
-        if not can_edit:
-            self.fields["user"].widget = forms.HiddenInput()
-
-
-class VoteForm(forms.Form):
-    def __init__(self, election: Election, user: User, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        if not election.can_vote(user):
-            return
-        for role in election.roles.all():
-            cand = role.candidatures
-            if role.max_choice > 1:
-                self.fields[role.title] = LimitedCheckboxField(
-                    cand, role.max_choice, required=False
-                )
-            else:
-                self.fields[role.title] = forms.ModelChoiceField(
-                    cand,
-                    required=False,
-                    widget=forms.RadioSelect(),
-                    empty_label=_("Blank vote"),
-                )
-
-
-class RoleForm(forms.ModelForm):
-    """Form for creating a role."""
-
-    class Meta:
-        model = Role
-        fields = ["title", "election", "description", "max_choice"]
-        widgets = {"election": AutoCompleteSelect}
-
-    def __init__(self, *args, **kwargs):
-        election_id = kwargs.pop("election_id", None)
-        super().__init__(*args, **kwargs)
-        if election_id:
-            self.fields["election"].queryset = Election.objects.filter(
-                id=election_id
-            ).all()
-
-    def clean(self):
-        cleaned_data = super().clean()
-        title = cleaned_data.get("title")
-        election = cleaned_data.get("election")
-        if Role.objects.filter(title=title, election=election).exists():
-            raise forms.ValidationError(
-                _("This role already exists for this election"), code="invalid"
-            )
-
-
-class ElectionListForm(forms.ModelForm):
-    class Meta:
-        model = ElectionList
-        fields = ("title", "election")
-        widgets = {"election": AutoCompleteSelect}
-
-    def __init__(self, *args, **kwargs):
-        election_id = kwargs.pop("election_id", None)
-        super().__init__(*args, **kwargs)
-        if election_id:
-            self.fields["election"].queryset = Election.objects.filter(
-                id=election_id
-            ).all()
-
-
-class ElectionForm(forms.ModelForm):
-    class Meta:
-        model = Election
-        fields = [
-            "title",
-            "description",
-            "archived",
-            "start_candidature",
-            "end_candidature",
-            "start_date",
-            "end_date",
-            "edit_groups",
-            "view_groups",
-            "vote_groups",
-            "candidature_groups",
-        ]
-        widgets = {
-            "edit_groups": AutoCompleteSelectMultipleGroup,
-            "view_groups": AutoCompleteSelectMultipleGroup,
-            "vote_groups": AutoCompleteSelectMultipleGroup,
-            "candidature_groups": AutoCompleteSelectMultipleGroup,
-        }
-
-    start_date = forms.DateTimeField(
-        label=_("Start date"), widget=SelectDateTime, required=True
-    )
-    end_date = forms.DateTimeField(
-        label=_("End date"), widget=SelectDateTime, required=True
-    )
-    start_candidature = forms.DateTimeField(
-        label=_("Start candidature"), widget=SelectDateTime, required=True
-    )
-    end_candidature = forms.DateTimeField(
-        label=_("End candidature"), widget=SelectDateTime, required=True
-    )

election/migrations/0005_alter_candidature_program_alter_candidature_user.py

@@ -1,30 +0,0 @@
-# Generated by Django 4.2.20 on 2025-03-14 18:18
-
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-        ("election", "0004_auto_20191006_0049"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="candidature",
-            name="program",
-            field=models.TextField(blank=True, default="", verbose_name="description"),
-        ),
-        migrations.AlterField(
-            model_name="candidature",
-            name="user",
-            field=models.ForeignKey(
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="candidates",
-                to=settings.AUTH_USER_MODEL,
-                verbose_name="user",
-            ),
-        ),
-    ]

election/models.py

@@ -1,7 +1,5 @@
 from django.db import models
-from django.db.models import Count
 from django.utils import timezone
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from ordered_model.models import OrderedModel
 
@@ -24,18 +22,21 @@ class Election(models.Model):
         verbose_name=_("edit groups"),
         blank=True,
     )
+
     view_groups = models.ManyToManyField(
         Group,
         related_name="viewable_elections",
         verbose_name=_("view groups"),
         blank=True,
     )
+
     vote_groups = models.ManyToManyField(
         Group,
         related_name="votable_elections",
         verbose_name=_("vote groups"),
         blank=True,
     )
+
     candidature_groups = models.ManyToManyField(
         Group,
         related_name="candidate_elections",
@@ -44,7 +45,7 @@ class Election(models.Model):
     )
 
     voters = models.ManyToManyField(
-        User, verbose_name=_("voters"), related_name="voted_elections"
+        User, verbose_name=("voters"), related_name="voted_elections"
     )
     archived = models.BooleanField(_("archived"), default=False)
 
@@ -54,20 +55,20 @@ class Election(models.Model):
     @property
     def is_vote_active(self):
         now = timezone.now()
-        return self.start_date <= now <= self.end_date
+        return bool(now <= self.end_date and now >= self.start_date)
 
     @property
     def is_vote_finished(self):
-        return timezone.now() > self.end_date
+        return bool(timezone.now() > self.end_date)
 
     @property
     def is_candidature_active(self):
         now = timezone.now()
-        return self.start_candidature <= now <= self.end_candidature
+        return bool(now <= self.end_candidature and now >= self.start_candidature)
 
     @property
     def is_vote_editable(self):
-        return timezone.now() <= self.end_candidature
+        return bool(timezone.now() <= self.end_candidature)
 
     def can_candidate(self, user):
         for group_id in self.candidature_groups.values_list("pk", flat=True):
@@ -86,7 +87,7 @@ class Election(models.Model):
     def has_voted(self, user):
         return self.voters.filter(id=user.id).exists()
 
-    @cached_property
+    @property
     def results(self):
         results = {}
         total_vote = self.voters.count()
@@ -94,6 +95,12 @@ class Election(models.Model):
             results[role.title] = role.results(total_vote)
         return results
 
+    def delete(self, *args, **kwargs):
+        self.election_lists.all().delete()
+        super().delete(*args, **kwargs)
+
+    # Permissions
+
 
 class Role(OrderedModel):
     """This class allows to create a new role avaliable for a candidature."""
@@ -108,37 +115,36 @@ class Role(OrderedModel):
     description = models.TextField(_("description"), null=True, blank=True)
     max_choice = models.IntegerField(_("max choice"), default=1)
 
-    def __str__(self):
-        return f"{self.title} - {self.election.title}"
-
-    def results(self, total_vote: int) -> dict[str, dict[str, int | float]]:
-        if total_vote == 0:
-            candidates = self.candidatures.values_list("user__username")
-            return {
-                key: {"vote": 0, "percent": 0} for key in ["blank_votes", *candidates]
-            }
+    def results(self, total_vote):
+        results = {}
         total_vote *= self.max_choice
-        results = {"total vote": total_vote}
         non_blank = 0
-        candidatures = self.candidatures.annotate(nb_votes=Count("votes")).values(
-            "nb_votes", "user__username"
-        )
-        for candidature in candidatures:
-            non_blank += candidature["nb_votes"]
-            results[candidature["user__username"]] = {
-                "vote": candidature["nb_votes"],
-                "percent": candidature["nb_votes"] * 100 / total_vote,
+        for candidature in self.candidatures.all():
+            cand_results = {}
+            cand_results["vote"] = self.votes.filter(candidature=candidature).count()
+            if total_vote == 0:
+                cand_results["percent"] = 0
+            else:
+                cand_results["percent"] = cand_results["vote"] * 100 / total_vote
+            non_blank += cand_results["vote"]
+            results[candidature.user.username] = cand_results
+        results["total vote"] = total_vote
+        if total_vote == 0:
+            results["blank vote"] = {"vote": 0, "percent": 0}
+        else:
+            results["blank vote"] = {
+                "vote": total_vote - non_blank,
+                "percent": (total_vote - non_blank) * 100 / total_vote,
             }
-        results["blank vote"] = {
-            "vote": total_vote - non_blank,
-            "percent": (total_vote - non_blank) * 100 / total_vote,
-        }
         return results
 
     @property
     def edit_groups(self):
         return self.election.edit_groups
 
+    def __str__(self):
+        return ("%s : %s") % (self.election.title, self.title)
+
 
 class ElectionList(models.Model):
     """To allow per list vote."""
@@ -157,6 +163,11 @@ class ElectionList(models.Model):
     def can_be_edited_by(self, user):
         return user.can_edit(self.election)
 
+    def delete(self, *args, **kwargs):
+        for candidature in self.candidatures.all():
+            candidature.delete()
+        super().delete(*args, **kwargs)
+
 
 class Candidature(models.Model):
     """This class is a component of responsability."""
@@ -171,9 +182,10 @@ class Candidature(models.Model):
         User,
         verbose_name=_("user"),
         related_name="candidates",
+        blank=True,
         on_delete=models.CASCADE,
     )
-    program = models.TextField(_("description"), default="", blank=True)
+    program = models.TextField(_("description"), null=True, blank=True)
     election_list = models.ForeignKey(
         ElectionList,
         related_name="candidatures",
@@ -184,10 +196,13 @@ class Candidature(models.Model):
     def __str__(self):
         return f"{self.role.title} : {self.user.username}"
 
+    def delete(self):
+        for vote in self.votes.all():
+            vote.delete()
+        super().delete()
+
     def can_be_edited_by(self, user):
-        return (
-            (user == self.user) or user.can_edit(self.role.election)
-        ) and self.role.election.is_vote_editable
+        return (user == self.user) or user.can_edit(self.role.election)
 
 
 class Vote(models.Model):

election/templates/election/election_detail.jinja

@@ -31,7 +31,7 @@
       <time datetime="{{ election.end_date }}">{{ election.end_date|localtime|date(DATETIME_FORMAT)}}</time>
       {% trans %} at {% endtrans %}<time>{{ election.end_date|localtime|time(DATETIME_FORMAT)}}</time>
     </p>
-    {%- if user_has_voted %}
+    {%- if election.has_voted(user) %}
       <p class="election__elector-infos">
         {%- if election.is_vote_active %}
           <span>{% trans %}You already have submitted your vote.{% endtrans %}</span>
@@ -45,11 +45,12 @@
     <form action="{{ url('election:vote', election.id) }}" method="post" class="election__vote-form" name="vote-form" id="vote-form">
       {% csrf_token %}
       <table class="election_table">
+        {%- set election_lists = election.election_lists.all() -%}
         <thead class="lists">
           <tr>
-            <th class="column" style="width: {{ 100 / (election_lists|length + 1) }}%">{% trans %}Blank vote{% endtrans %}</th>
+            <th class="column" style="width: {{ 100 / (election_lists.count() + 1) }}%">{% trans %}Blank vote{% endtrans %}</th>
             {%- for election_list in election_lists %}
-              <th class="column" style="width: {{ 100 / (election_lists|length + 1) }}%">
+              <th class="column" style="width: {{ 100 / (election_lists.count() + 1) }}%">
                 <span>{{ election_list.title }}</span>
                 {% if user.can_edit(election_list) and election.is_vote_editable -%}
                   <a href="{{ url('election:delete_list', list_id=election_list.id) }}"><i class="fa-regular fa-trash-can delete-action"></i></a>
@@ -58,26 +59,18 @@
             {%- endfor %}
           </tr>
         </thead>
-        {%- for role in election_roles %}
+        {%- set role_list = election.roles.order_by('order').all() %}
+        {%- for role in role_list %}
+          {%- set count = [0] %}
           {%- set role_data = election_form.data.getlist(role.title) if role.title in election_form.data else [] %}
-
-          <tbody
-            {% if role.max_choice > 1 -%}
-              x-data x-limited-choices="{{ role.max_choice }}"
-            {%- endif %}
-            class="role {% if role.title in election_form.errors %}role_error{% endif %}"
-          >
+          <tbody data-max-choice="{{role.max_choice}}" class="role{{ ' role_error' if role.title in election_form.errors else '' }}{{ ' role__multiple-choices' if role.max_choice > 1 else ''}}">
             <tr>
               <td class="role_title">
                 <div class="role_text">
                   <h4>{{ role.title }}</h4>
                   <p class="role_description" show-more="300">{{ role.description }}</p>
-                  {%- if role.max_choice > 1 and show_vote_buttons %}
-                    <strong>
-                      {% trans trimmed nb_choices=role.max_choice %}
-                        You may choose up to {{ nb_choices }} people.
-                      {% endtrans %}
-                    </strong>
+                  {%- if role.max_choice > 1 and not election.has_voted(user) and election.can_vote(user) %}
+                    <strong>{% trans %}You may choose up to{% endtrans %} {{ role.max_choice }} {% trans %}people.{% endtrans %}</strong>
                   {%- endif %}
 
                   {%- if election_form.errors[role.title] is defined %}
@@ -88,40 +81,36 @@
                 </div>
                 {% if user.can_edit(role) and election.is_vote_editable -%}
                   <div class="role_buttons">
-                    <a href="{{ url('election:update_role', role_id=role.id) }}">️
-                      <i class="fa-regular fa-pen-to-square edit-action"></i>
-                    </a>
-                    <a href="{{ url('election:delete_role', role_id=role.id) }}">
-                      <i class="fa-regular fa-trash-can delete-action"></i>
-                    </a>
-                    {%- if loop.last -%}
+                    <a href="{{url('election:update_role', role_id=role.id)}}">️<i class="fa-regular fa-pen-to-square edit-action"></i></a>
+                    <a href="{{url('election:delete_role', role_id=role.id)}}"><i class="fa-regular fa-trash-can delete-action"></i></a>
+                    {%- if role == role_list.last() %}
                       <button disabled><i class="fa fa-arrow-down"></i></button>
                       <button disabled><i class="fa fa-caret-down"></i></button>
-                    {%- else -%}
+                    {%- else %}
                       <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=bottom');"><i class="fa fa-arrow-down"></i></button>
                       <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=down');"><i class="fa fa-caret-down"></i></button>
-                    {%- endif -%}
-                    {%- if loop.first -%}
+                    {%- endif %}
+                    {% if role == role_list.first() %}
                       <button disabled><i class="fa fa-caret-up"></i></button>
                       <button disabled><i class="fa fa-arrow-up"></i></button>
-                    {%- else -%}
+                    {% else %}
                       <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=up');"><i class="fa fa-caret-up"></i></button>
                       <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=top');"><i class="fa fa-arrow-up"></i></button>
-                    {%- endif -%}
+                    {% endif %}
                   </div>
                 {%- endif -%}
               </td>
             </tr>
             <tr class="role_candidates">
-              <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%">
-                {%- if role.max_choice == 1 and show_vote_buttons %}
+              <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists.count() + 1) }}%">
+                {%- if role.max_choice == 1 and election.can_vote(user) %}
                   <div class="radio-btn">
-                    {% set input_id = "blank_vote_" + role.id|string %}
-                    <input id="{{ input_id }}" type="radio" name="{{ role.title }}">
-                    <label for="{{ input_id }}">
+                    <input id="id_{{ role.title }}_{{ count[0] }}" type="radio" name="{{ role.title }}" value {{ '' if role_data in election_form else 'checked' }} {{ 'disabled' if election.has_voted(user) else '' }}>
+                    <label for="id_{{ role.title }}_{{ count[0] }}">
                       <span>{% trans %}Choose blank vote{% endtrans %}</span>
                     </label>
                   </div>
+                  {%- set _ = count.append(count.pop() + 1) %}
                 {%- endif %}
                 {%- if election.is_vote_finished %}
                   {%- set results = election_results[role.title]['blank vote'] %}
@@ -131,14 +120,13 @@
                 {%- endif %}
               </td>
               {%- for election_list in election_lists %}
-                <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%">
+                <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists.count() + 1) }}%">
                   <ul class="candidates">
-                    {%- for candidature in election_list.candidatures.select_related("user", "user__profile_pict").filter(role=role) %}
+                    {%- for candidature in election_list.candidatures.filter(role=role) %}
                       <li class="candidate">
-                        {%- if show_vote_buttons %}
-                          {% set input_id = "candidature_" + candidature.id|string %}
-                          <input id="{{ input_id }}" type="{{ 'checkbox' if role.max_choice > 1 else 'radio' }}" {{ 'checked' if candidature.id|string in role_data else '' }} {{ 'disabled' if user_has_voted else '' }} name="{{ role.title }}" value="{{ candidature.id }}">
-                          <label for="{{ input_id }}">
+                        {%- if election.can_vote(user) %}
+                          <input id="id_{{ role.title }}_{{ count[0] }}" type="{{ 'checkbox' if role.max_choice > 1 else 'radio' }}" {{ 'checked' if candidature.id|string in role_data else '' }} {{ 'disabled' if election.has_voted(user) else '' }} name="{{ role.title }}" value="{{ candidature.id }}">
+                          <label for="id_{{ role.title }}_{{ count[0] }}">
                         {%- endif %}
                         <figure>
                           {%- if user.is_subscriber_viewable %}
@@ -152,7 +140,7 @@
                             <h5>{{ candidature.user.first_name }} <em>{{candidature.user.nick_name or ''}} </em>{{ candidature.user.last_name }}</h5>
                             {%- if not election.is_vote_finished %}
                               <q class="candidate_program" show-more="200">
-                                {{ candidature.program|markdown }}
+                                {{ candidature.program|markdown or '' }}
                               </q>
                             {%- endif %}
                           </figcaption>
@@ -165,8 +153,9 @@
                             {%- endif -%}
                           {%- endif -%}
                         </figure>
-                        {%- if show_vote_buttons %}
+                        {%- if election.can_vote(user) %}
                           </label>
+                          {%- set _ = count.append(count.pop() + 1) %}
                         {%- endif %}
                         {%- if election.is_vote_finished %}
                           {%- set results = election_results[role.title][candidature.user.username] %}
@@ -202,9 +191,36 @@
       <a  class="button" href="{{ url('election:delete', election_id=object.id) }}">{% trans %}Delete{% endtrans %}</a>
     {%- endif %}
   </section>
-  {%- if show_vote_buttons %}
+  {%- if not election.has_voted(user) and election.can_vote(user) %}
     <section class="buttons">
       <button class="button button_send" form="vote-form">{% trans %}Submit the vote !{% endtrans %}</button>
     </section>
   {%- endif %}
 {% endblock %}
+
+{% block script %}
+  {{ super() }}
+  <script type="text/javascript">
+    document.querySelectorAll('.role__multiple-choices').forEach(setupRestrictions);
+
+    function setupRestrictions(role) {
+      var selectedChoices = [];
+      role.querySelectorAll('input').forEach(setupRestriction);
+
+      function setupRestriction(choice) {
+        if (choice.checked)
+          selectedChoices.push(choice);
+        choice.addEventListener('change', onChange);
+
+        function onChange() {
+          if (choice.checked)
+            selectedChoices.push(choice);
+          else
+            selectedChoices.splice(selectedChoices.indexOf(choice), 1);
+          while (selectedChoices.length > role.dataset.maxChoice)
+            selectedChoices.shift().checked = false;
+        }
+      }
+    }
+  </script>
+{% endblock %}

election/tests.py

@@ -1,15 +1,9 @@
-from datetime import timedelta
-
-import pytest
 from django.conf import settings
-from django.test import Client, TestCase
+from django.test import TestCase
 from django.urls import reverse
-from django.utils.timezone import now
-from model_bakery import baker
 
-from core.baker_recipes import subscriber_user
 from core.models import Group, User
-from election.models import Candidature, Election, ElectionList, Role, Vote
+from election.models import Election
 
 
 class TestElection(TestCase):
@@ -18,7 +12,8 @@ class TestElection(TestCase):
         cls.election = Election.objects.first()
         cls.public_group = Group.objects.get(id=settings.SITH_GROUP_PUBLIC_ID)
         cls.sli = User.objects.get(username="sli")
-        cls.public = baker.make(User)
+        cls.subscriber = User.objects.get(username="subscriber")
+        cls.public = User.objects.get(username="public")
 
 
 class TestElectionDetail(TestElection):
@@ -41,7 +36,7 @@ class TestElectionDetail(TestElection):
 
 class TestElectionUpdateView(TestElection):
     def test_permission_denied(self):
-        self.client.force_login(subscriber_user.make())
+        self.client.force_login(self.subscriber)
         response = self.client.get(
             reverse("election:update", args=str(self.election.id))
         )
@@ -50,68 +45,3 @@ class TestElectionUpdateView(TestElection):
             reverse("election:update", args=str(self.election.id))
         )
         assert response.status_code == 403
-
-
-@pytest.mark.django_db
-def test_election_create_list_permission(client: Client):
-    election = baker.make(Election, end_candidature=now() + timedelta(hours=1))
-    groups = [
-        Group.objects.get(pk=settings.SITH_GROUP_SUBSCRIBERS_ID),
-        baker.make(Group),
-    ]
-    election.candidature_groups.add(groups[0])
-    election.edit_groups.add(groups[1])
-    url = reverse("election:create_list", kwargs={"election_id": election.id})
-    for user in subscriber_user.make(), baker.make(User, groups=[groups[1]]):
-        client.force_login(user)
-        assert client.get(url).status_code == 200
-        # the post is a 200 instead of a 302, because we don't give form data,
-        # but we don't care as we only test permissions here
-        assert client.post(url).status_code == 200
-    client.force_login(baker.make(User))
-    assert client.get(url).status_code == 403
-    assert client.post(url).status_code == 403
-
-
-@pytest.mark.django_db
-def test_election_results():
-    election = baker.make(
-        Election, voters=baker.make(User, _quantity=50, _bulk_create=True)
-    )
-    lists = baker.make(ElectionList, election=election, _quantity=2, _bulk_create=True)
-    roles = baker.make(
-        Role, election=election, max_choice=iter([1, 2]), _quantity=2, _bulk_create=True
-    )
-    users = baker.make(User, _quantity=4, _bulk_create=True)
-    cand = [
-        baker.make(Candidature, role=roles[0], user=users[0], election_list=lists[0]),
-        baker.make(Candidature, role=roles[0], user=users[1], election_list=lists[1]),
-        baker.make(Candidature, role=roles[1], user=users[2], election_list=lists[0]),
-        baker.make(Candidature, role=roles[1], user=users[3], election_list=lists[1]),
-    ]
-    votes = [
-        baker.make(Vote, role=roles[0], _quantity=20, _bulk_create=True),
-        baker.make(Vote, role=roles[0], _quantity=25, _bulk_create=True),
-        baker.make(Vote, role=roles[1], _quantity=20, _bulk_create=True),
-        baker.make(Vote, role=roles[1], _quantity=35, _bulk_create=True),
-        baker.make(Vote, role=roles[1], _quantity=10, _bulk_create=True),
-    ]
-    cand[0].votes.set(votes[0])
-    cand[1].votes.set(votes[1])
-    cand[2].votes.set([*votes[2], *votes[4]])
-    cand[3].votes.set([*votes[3], *votes[4]])
-
-    assert election.results == {
-        roles[0].title: {
-            cand[0].user.username: {"percent": 40.0, "vote": 20},
-            cand[1].user.username: {"percent": 50.0, "vote": 25},
-            "blank vote": {"percent": 10.0, "vote": 5},
-            "total vote": 50,
-        },
-        roles[1].title: {
-            cand[2].user.username: {"percent": 30.0, "vote": 30},
-            cand[3].user.username: {"percent": 45.0, "vote": 45},
-            "blank vote": {"percent": 25.0, "vote": 25},
-            "total vote": 100,
-        },
-    }

election/views.py

@@ -1,34 +1,183 @@
 from typing import TYPE_CHECKING
 
-from cryptography.utils import cached_property
-from django.conf import settings
-from django.contrib.auth.mixins import (
-    LoginRequiredMixin,
-    PermissionRequiredMixin,
-    UserPassesTestMixin,
-)
+from django import forms
+from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin
 from django.core.exceptions import PermissionDenied
 from django.db import transaction
-from django.db.models import QuerySet
-from django.shortcuts import get_object_or_404
+from django.db.models.query import QuerySet
+from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse, reverse_lazy
+from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView
 from django.views.generic.edit import CreateView, DeleteView, FormView, UpdateView
 
-from core.auth.mixins import CanEditMixin, CanViewMixin
-from election.forms import (
-    CandidateForm,
-    ElectionForm,
-    ElectionListForm,
-    RoleForm,
-    VoteForm,
+from core.auth.mixins import CanCreateMixin, CanEditMixin, CanViewMixin
+from core.views.forms import SelectDateTime
+from core.views.widgets.ajax_select import (
+    AutoCompleteSelect,
+    AutoCompleteSelectMultipleGroup,
+    AutoCompleteSelectUser,
 )
+from core.views.widgets.markdown import MarkdownInput
 from election.models import Candidature, Election, ElectionList, Role, Vote
 
 if TYPE_CHECKING:
     from core.models import User
 
 
+# Custom form field
+
+
+class LimitedCheckboxField(forms.ModelMultipleChoiceField):
+    """A `ModelMultipleChoiceField`, with a max limit of selectable inputs."""
+
+    def __init__(self, queryset, max_choice, **kwargs):
+        self.max_choice = max_choice
+        super().__init__(queryset, **kwargs)
+
+    def clean(self, value):
+        qs = super().clean(value)
+        self.validate(qs)
+        return qs
+
+    def validate(self, qs):
+        if qs.count() > self.max_choice:
+            raise forms.ValidationError(
+                _("You have selected too much candidates."), code="invalid"
+            )
+
+
+# Forms
+
+
+class CandidateForm(forms.ModelForm):
+    """Form to candidate."""
+
+    class Meta:
+        model = Candidature
+        fields = ["user", "role", "program", "election_list"]
+        labels = {
+            "user": _("User to candidate"),
+        }
+        widgets = {
+            "program": MarkdownInput,
+            "user": AutoCompleteSelectUser,
+            "role": AutoCompleteSelect,
+            "election_list": AutoCompleteSelect,
+        }
+
+    def __init__(self, *args, **kwargs):
+        election_id = kwargs.pop("election_id", None)
+        can_edit = kwargs.pop("can_edit", False)
+        super().__init__(*args, **kwargs)
+        if election_id:
+            self.fields["role"].queryset = Role.objects.filter(
+                election__id=election_id
+            ).all()
+            self.fields["election_list"].queryset = ElectionList.objects.filter(
+                election__id=election_id
+            ).all()
+        if not can_edit:
+            self.fields["user"].widget = forms.HiddenInput()
+
+
+class VoteForm(forms.Form):
+    def __init__(self, election, user, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not election.has_voted(user):
+            for role in election.roles.all():
+                cand = role.candidatures
+                if role.max_choice > 1:
+                    self.fields[role.title] = LimitedCheckboxField(
+                        cand, role.max_choice, required=False
+                    )
+                else:
+                    self.fields[role.title] = forms.ModelChoiceField(
+                        cand,
+                        required=False,
+                        widget=forms.RadioSelect(),
+                        empty_label=_("Blank vote"),
+                    )
+
+
+class RoleForm(forms.ModelForm):
+    """Form for creating a role."""
+
+    class Meta:
+        model = Role
+        fields = ["title", "election", "description", "max_choice"]
+        widgets = {"election": AutoCompleteSelect}
+
+    def __init__(self, *args, **kwargs):
+        election_id = kwargs.pop("election_id", None)
+        super().__init__(*args, **kwargs)
+        if election_id:
+            self.fields["election"].queryset = Election.objects.filter(
+                id=election_id
+            ).all()
+
+    def clean(self):
+        cleaned_data = super().clean()
+        title = cleaned_data.get("title")
+        election = cleaned_data.get("election")
+        if Role.objects.filter(title=title, election=election).exists():
+            raise forms.ValidationError(
+                _("This role already exists for this election"), code="invalid"
+            )
+
+
+class ElectionListForm(forms.ModelForm):
+    class Meta:
+        model = ElectionList
+        fields = ("title", "election")
+        widgets = {"election": AutoCompleteSelect}
+
+    def __init__(self, *args, **kwargs):
+        election_id = kwargs.pop("election_id", None)
+        super().__init__(*args, **kwargs)
+        if election_id:
+            self.fields["election"].queryset = Election.objects.filter(
+                id=election_id
+            ).all()
+
+
+class ElectionForm(forms.ModelForm):
+    class Meta:
+        model = Election
+        fields = [
+            "title",
+            "description",
+            "archived",
+            "start_candidature",
+            "end_candidature",
+            "start_date",
+            "end_date",
+            "edit_groups",
+            "view_groups",
+            "vote_groups",
+            "candidature_groups",
+        ]
+        widgets = {
+            "edit_groups": AutoCompleteSelectMultipleGroup,
+            "view_groups": AutoCompleteSelectMultipleGroup,
+            "vote_groups": AutoCompleteSelectMultipleGroup,
+            "candidature_groups": AutoCompleteSelectMultipleGroup,
+        }
+
+    start_date = forms.DateTimeField(
+        label=_("Start date"), widget=SelectDateTime, required=True
+    )
+    end_date = forms.DateTimeField(
+        label=_("End date"), widget=SelectDateTime, required=True
+    )
+    start_candidature = forms.DateTimeField(
+        label=_("Start candidature"), widget=SelectDateTime, required=True
+    )
+    end_candidature = forms.DateTimeField(
+        label=_("End candidature"), widget=SelectDateTime, required=True
+    )
+
+
 # Display elections
 
 
@@ -36,21 +185,25 @@ class ElectionsListView(CanViewMixin, ListView):
     """A list of all non archived elections visible."""
 
     model = Election
-    queryset = model.objects.filter(archived=False)
     ordering = ["-id"]
     paginate_by = 10
     template_name = "election/election_list.jinja"
 
+    def get_queryset(self):
+        return super().get_queryset().filter(archived=False).all()
+
 
 class ElectionListArchivedView(CanViewMixin, ListView):
     """A list of all archived elections visible."""
 
     model = Election
-    queryset = model.objects.filter(archived=True)
     ordering = ["-id"]
     paginate_by = 10
     template_name = "election/election_list.jinja"
 
+    def get_queryset(self):
+        return super().get_queryset().filter(archived=True).all()
+
 
 class ElectionDetailView(CanViewMixin, DetailView):
     """Details an election responsability by responsability."""
@@ -59,67 +212,46 @@ class ElectionDetailView(CanViewMixin, DetailView):
     template_name = "election/election_detail.jinja"
     pk_url_kwarg = "election_id"
 
-    @staticmethod
-    def _reorder_votes(action: str, role: int):
-        role = Role.objects.filter(id=role).first()
-        if not role:
-            return
-        if action == "up":
-            role.up()
-        elif action == "down":
-            role.down()
-        elif action == "bottom":
-            role.bottom()
-        elif action == "top":
-            role.top()
-
     def get(self, request, *arg, **kwargs):
+        response = super().get(request, *arg, **kwargs)
         election: Election = self.get_object()
-        if election.is_vote_editable and request.user.can_edit(election):
+        if request.user.can_edit(election) and election.is_vote_editable:
             action = request.GET.get("action", None)
             role = request.GET.get("role", None)
-            if action and role and role.isdigit():
-                self._reorder_votes(action, int(role))
-        return super().get(request, *arg, **kwargs)
+            if action and role and Role.objects.filter(id=role).exists():
+                if action == "up":
+                    Role.objects.get(id=role).up()
+                elif action == "down":
+                    Role.objects.get(id=role).down()
+                elif action == "bottom":
+                    Role.objects.get(id=role).bottom()
+                elif action == "top":
+                    Role.objects.get(id=role).top()
+                return redirect(
+                    reverse("election:detail", kwargs={"election_id": election.id})
+                )
+        return response
 
     def get_context_data(self, **kwargs):
         """Add additionnal data to the template."""
-        user: User = self.request.user
-        return super().get_context_data(**kwargs) | {
-            "election_form": VoteForm(self.object, user),
-            "show_vote_buttons": self.object.can_vote(user),
-            "user_has_voted": self.object.has_voted(user),
-            "election_results": (
-                self.object.results if self.object.is_vote_finished else None
-            ),
-            "election_lists": list(self.object.election_lists.all()),
-            "election_roles": list(self.object.roles.order_by("order")),
-        }
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["election_form"] = VoteForm(self.object, self.request.user)
+        kwargs["election_results"] = self.object.results
+        return kwargs
 
 
 # Form view
 
 
-class VoteFormView(LoginRequiredMixin, UserPassesTestMixin, FormView):
+class VoteFormView(CanCreateMixin, FormView):
     """Alows users to vote."""
 
     form_class = VoteForm
     template_name = "election/election_detail.jinja"
 
-    @cached_property
-    def election(self):
-        return get_object_or_404(Election, pk=self.kwargs["election_id"])
-
-    def test_func(self):
-        groups = set(self.election.vote_groups.values_list("id", flat=True))
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+    def dispatch(self, request, *arg, **kwargs):
+        self.election = get_object_or_404(Election, pk=kwargs["election_id"])
+        return super().dispatch(request, *arg, **kwargs)
 
     def vote(self, election_data):
         with transaction.atomic():
@@ -139,16 +271,20 @@ class VoteFormView(LoginRequiredMixin, UserPassesTestMixin, FormView):
             self.election.voters.add(self.request.user)
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {
-            "election": self.election,
-            "user": self.request.user,
-        }
+        kwargs = super().get_form_kwargs()
+        kwargs["election"] = self.election
+        kwargs["user"] = self.request.user
+        return kwargs
 
     def form_valid(self, form):
         """Verify that the user is part in a vote group."""
         data = form.clean()
-        self.vote(data)
-        return super().form_valid(form)
+        res = super(FormView, self).form_valid(form)
+        for grp_id in self.election.vote_groups.values_list("pk", flat=True):
+            if self.request.user.is_in_group(pk=grp_id):
+                self.vote(data)
+                return res
+        return res
 
     def get_success_url(self, **kwargs):
         return reverse_lazy("election:detail", kwargs={"election_id": self.election.id})
@@ -174,22 +310,26 @@ class CandidatureCreateView(LoginRequiredMixin, CreateView):
 
     def dispatch(self, request, *arg, **kwargs):
         self.election = get_object_or_404(Election, pk=kwargs["election_id"])
-        self.can_edit = self.request.user.can_edit(self.election)
         return super().dispatch(request, *arg, **kwargs)
 
     def get_initial(self):
-        return {"user": self.request.user.id}
+        init = {}
+        self.can_edit = self.request.user.can_edit(self.election)
+        init["user"] = self.request.user.id
+        return init
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {
-            "election": self.election,
-            "can_edit": self.can_edit,
-        }
+        kwargs = super().get_form_kwargs()
+        kwargs["election_id"] = self.election.id
+        kwargs["can_edit"] = self.can_edit
+        return kwargs
 
-    def form_valid(self, form: CandidateForm):
+    def form_valid(self, form):
         """Verify that the selected user is in candidate group."""
         obj = form.instance
         obj.election = self.election
+        if not hasattr(obj, "user"):
+            obj.user = self.request.user
         if (obj.election.can_candidate(obj.user)) and (
             obj.user == self.request.user or self.can_edit
         ):
@@ -197,7 +337,9 @@ class CandidatureCreateView(LoginRequiredMixin, CreateView):
         raise PermissionDenied
 
     def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {"election": self.election}
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["election"] = self.election
+        return kwargs
 
     def get_success_url(self, **kwargs):
         return reverse_lazy("election:detail", kwargs={"election_id": self.election.id})
@@ -213,79 +355,80 @@ class ElectionCreateView(PermissionRequiredMixin, CreateView):
         return reverse("election:detail", kwargs={"election_id": self.object.id})
 
 
-class RoleCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class RoleCreateView(CanCreateMixin, CreateView):
     model = Role
     form_class = RoleForm
     template_name = "core/create.jinja"
 
-    @cached_property
-    def election(self):
-        return get_object_or_404(Election, pk=self.kwargs["election_id"])
-
-    def test_func(self):
+    def dispatch(self, request, *arg, **kwargs):
+        self.election = get_object_or_404(Election, pk=kwargs["election_id"])
         if not self.election.is_vote_editable:
-            return False
-        if self.request.user.has_perm("election.add_role"):
-            return True
-        groups = set(self.election.edit_groups.values_list("id", flat=True))
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
 
     def get_initial(self):
-        return {"election": self.election}
+        init = {}
+        init["election"] = self.election
+        return init
+
+    def form_valid(self, form):
+        """Verify that the user can edit properly."""
+        obj: Role = form.instance
+        user: User = self.request.user
+        if obj.election:
+            for grp_id in obj.election.edit_groups.values_list("pk", flat=True):
+                if user.is_in_group(pk=grp_id):
+                    return super(CreateView, self).form_valid(form)
+        raise PermissionDenied
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"election_id": self.election.id}
+        kwargs = super().get_form_kwargs()
+        kwargs["election_id"] = self.election.id
+        return kwargs
 
     def get_success_url(self, **kwargs):
-        return reverse(
-            "election:detail", kwargs={"election_id": self.object.election_id}
+        return reverse_lazy(
+            "election:detail", kwargs={"election_id": self.object.election.id}
         )
 
 
-class ElectionListCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ElectionListCreateView(CanCreateMixin, CreateView):
     model = ElectionList
     form_class = ElectionListForm
     template_name = "core/create.jinja"
 
-    @cached_property
-    def election(self):
-        return get_object_or_404(Election, pk=self.kwargs["election_id"])
-
-    def test_func(self):
+    def dispatch(self, request, *arg, **kwargs):
+        self.election = get_object_or_404(Election, pk=kwargs["election_id"])
         if not self.election.is_vote_editable:
-            return False
-        if self.request.user.has_perm("election.add_electionlist"):
-            return True
-        groups = set(
-            self.election.candidature_groups.values("id")
-            .union(self.election.edit_groups.values("id"))
-            .values_list("id", flat=True)
-        )
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
 
     def get_initial(self):
-        return {"election": self.election}
+        init = {}
+        init["election"] = self.election
+        return init
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"election_id": self.election.id}
+        kwargs = super().get_form_kwargs()
+        kwargs["election_id"] = self.election.id
+        return kwargs
+
+    def form_valid(self, form):
+        """Verify that the user can vote on this election."""
+        obj: ElectionList = form.instance
+        user: User = self.request.user
+        if obj.election:
+            for grp_id in obj.election.candidature_groups.values_list("pk", flat=True):
+                if user.is_in_group(pk=grp_id):
+                    return super(CreateView, self).form_valid(form)
+            for grp_id in obj.election.edit_groups.values_list("pk", flat=True):
+                if user.is_in_group(pk=grp_id):
+                    return super(CreateView, self).form_valid(form)
+        raise PermissionDenied
 
     def get_success_url(self, **kwargs):
-        return reverse(
-            "election:detail", kwargs={"election_id": self.object.election_id}
+        return reverse_lazy(
+            "election:detail", kwargs={"election_id": self.object.election.id}
         )
 
 
@@ -314,23 +457,45 @@ class ElectionUpdateView(CanEditMixin, UpdateView):
         return reverse_lazy("election:detail", kwargs={"election_id": self.object.id})
 
 
-class CandidatureUpdateView(LoginRequiredMixin, CanEditMixin, UpdateView):
+class CandidatureUpdateView(CanEditMixin, UpdateView):
     model = Candidature
     form_class = CandidateForm
     template_name = "core/edit.jinja"
     pk_url_kwarg = "candidature_id"
 
-    def get_form(self, *args, **kwargs):
-        form = super().get_form(*args, **kwargs)
-        form.fields.pop("role", None)
-        return form
+    def dispatch(self, request, *arg, **kwargs):
+        self.object = self.get_object()
+        if not self.object.role.election.is_vote_editable:
+            raise PermissionDenied
+        return super().dispatch(request, *arg, **kwargs)
+
+    def remove_fields(self):
+        self.form.fields.pop("role", None)
+
+    def get(self, request, *args, **kwargs):
+        self.form = self.get_form()
+        self.remove_fields()
+        return self.render_to_response(self.get_context_data(form=self.form))
+
+    def post(self, request, *args, **kwargs):
+        self.form = self.get_form()
+        self.remove_fields()
+        if (
+            request.user.is_authenticated
+            and request.user.can_edit(self.object)
+            and self.form.is_valid()
+        ):
+            return super().form_valid(self.form)
+        return self.form_invalid(self.form)
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"election": self.object.role.election}
+        kwargs = super().get_form_kwargs()
+        kwargs["election_id"] = self.object.role.election.id
+        return kwargs
 
     def get_success_url(self, **kwargs):
-        return reverse(
-            "election:detail", kwargs={"election_id": self.object.role.election_id}
+        return reverse_lazy(
+            "election:detail", kwargs={"election_id": self.object.role.election.id}
         )
 
 
@@ -381,12 +546,18 @@ class RoleUpdateView(CanEditMixin, UpdateView):
 # Delete Views
 
 
-class ElectionDeleteView(PermissionRequiredMixin, DeleteView):
+class ElectionDeleteView(DeleteView):
     model = Election
     template_name = "core/delete_confirm.jinja"
     pk_url_kwarg = "election_id"
-    permission_required = "election.delete_election"
-    success_url = reverse_lazy("election:list")
+
+    def dispatch(self, request, *args, **kwargs):
+        if request.user.is_root:
+            return super().dispatch(request, *args, **kwargs)
+        raise PermissionDenied
+
+    def get_success_url(self, **kwargs):
+        return reverse_lazy("election:list")
 
 
 class CandidatureDeleteView(CanEditMixin, DeleteView):
@@ -402,7 +573,7 @@ class CandidatureDeleteView(CanEditMixin, DeleteView):
         return super().dispatch(request, *arg, **kwargs)
 
     def get_success_url(self, **kwargs):
-        return reverse("election:detail", kwargs={"election_id": self.election.id})
+        return reverse_lazy("election:detail", kwargs={"election_id": self.election.id})
 
 
 class RoleDeleteView(CanEditMixin, DeleteView):
@@ -418,7 +589,7 @@ class RoleDeleteView(CanEditMixin, DeleteView):
         return super().dispatch(request, *arg, **kwargs)
 
     def get_success_url(self, **kwargs):
-        return reverse("election:detail", kwargs={"election_id": self.election.id})
+        return reverse_lazy("election:detail", kwargs={"election_id": self.election.id})
 
 
 class ElectionListDeleteView(CanEditMixin, DeleteView):
@@ -434,4 +605,4 @@ class ElectionListDeleteView(CanEditMixin, DeleteView):
         return super().dispatch(request, *args, **kwargs)
 
     def get_success_url(self, **kwargs):
-        return reverse("election:detail", kwargs={"election_id": self.election.id})
+        return reverse_lazy("election:detail", kwargs={"election_id": self.election.id})

forum/views.py

@@ -27,14 +27,14 @@ from functools import partial
 
 from django import forms
 from django.conf import settings
-from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.core.exceptions import PermissionDenied
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
 from django.db import IntegrityError
 from django.shortcuts import get_object_or_404
 from django.urls import reverse_lazy
 from django.utils import html, timezone
 from django.utils.decorators import method_decorator
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, RedirectView
 from django.views.generic.detail import SingleObjectMixin
@@ -44,6 +44,7 @@ from honeypot.decorators import check_honeypot
 
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.auth.mixins import (
+    CanCreateMixin,
     CanEditMixin,
     CanEditPropMixin,
     CanViewMixin,
@@ -179,19 +180,11 @@ class ForumForm(forms.ModelForm):
     )
 
 
-class ForumCreateView(UserPassesTestMixin, CreateView):
+class ForumCreateView(CanCreateMixin, CreateView):
     model = Forum
     form_class = ForumForm
     template_name = "core/create.jinja"
 
-    def test_func(self):
-        if self.request.user.has_perm("forum.add_forum"):
-            return True
-        parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
-        if parent is not None:
-            return self.request.user.is_owner(parent)
-        return False
-
     def get_initial(self):
         init = super().get_initial()
         parent = Forum.objects.filter(id=self.request.GET["parent"]).first()
@@ -265,19 +258,18 @@ class TopicForm(forms.ModelForm):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumTopicCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumTopicCreateView(CanCreateMixin, CreateView):
     model = ForumMessage
     form_class = TopicForm
     template_name = "forum/reply.jinja"
 
-    @cached_property
-    def forum(self):
-        return get_object_or_404(Forum, id=self.kwargs["forum_id"], is_category=False)
-
-    def test_func(self):
-        return self.request.user.has_perm("forum.add_forumtopic") or (
-            self.request.user.can_view(self.forum)
+    def dispatch(self, request, *args, **kwargs):
+        self.forum = get_object_or_404(
+            Forum, id=self.kwargs["forum_id"], is_category=False
         )
+        if not request.user.can_view(self.forum):
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
 
     def form_valid(self, form):
         topic = ForumTopic(
@@ -412,7 +404,7 @@ class ForumMessageUndeleteView(SingleObjectMixin, RedirectView):
 @method_decorator(
     partial(check_honeypot, field_name=settings.HONEYPOT_FIELD_NAME_FORUM), name="post"
 )
-class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
+class ForumMessageCreateView(CanCreateMixin, CreateView):
     model = ForumMessage
     form_class = forms.modelform_factory(
         model=ForumMessage,
@@ -421,14 +413,11 @@ class ForumMessageCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView
     )
     template_name = "forum/reply.jinja"
 
-    @cached_property
-    def topic(self):
-        return get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
-
-    def test_func(self):
-        return self.request.user.has_perm(
-            "forum.add_forummessage"
-        ) or self.request.user.can_view(self.topic)
+    def dispatch(self, request, *args, **kwargs):
+        self.topic = get_object_or_404(ForumTopic, id=self.kwargs["topic_id"])
+        if not request.user.can_view(self.topic):
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
 
     def get_initial(self):
         init = super().get_initial()

galaxy/management/commands/rule_galaxy.py

@@ -45,9 +45,8 @@ class Command(BaseCommand):
                 "verbosity level should be between 0 and 2 included", stacklevel=2
             )
 
-        if options["verbosity"] >= 2:
+        if options["verbosity"] == 2:
             logger.setLevel(logging.DEBUG)
-            logging.getLogger("django.db.backends").setLevel(logging.DEBUG)
         elif options["verbosity"] == 1:
             logger.setLevel(logging.INFO)
         else:
@@ -60,3 +59,6 @@ class Command(BaseCommand):
         Galaxy.objects.filter(state__isnull=True).delete()
 
         logger.info("Ruled the galaxy in {} queries.".format(len(connection.queries)))
+        if options["verbosity"] > 2:
+            for q in connection.queries:
+                logger.debug(q)

galaxy/models.py

@@ -31,14 +31,13 @@ from collections import defaultdict
 from typing import NamedTuple, TypedDict
 
 from django.db import models
-from django.db.models import Count, Exists, F, OuterRef, Q, QuerySet
-from django.utils.timezone import localdate, now
+from django.db.models import Count, F, Q, QuerySet
+from django.utils.timezone import localdate
 from django.utils.translation import gettext_lazy as _
 
 from club.models import Membership
 from core.models import User
 from sas.models import PeoplePictureRelation, Picture
-from subscription.models import Subscription
 
 
 class GalaxyStar(models.Model):
@@ -199,16 +198,8 @@ class Galaxy(models.Model):
         cls, picture_count_threshold: int = DEFAULT_PICTURE_COUNT_THRESHOLD
     ) -> QuerySet[User]:
         return (
-            User.objects.filter(is_subscriber_viewable=True)
-            .exclude(subscriptions=None)
-            .annotate(
-                pictures_count=Count("pictures"),
-                is_active_in_galaxy=Exists(
-                    Subscription.objects.filter(
-                        member=OuterRef("id"), subscription_end__gt=now()
-                    )
-                ),
-            )
+            User.objects.exclude(subscriptions=None)
+            .annotate(pictures_count=Count("pictures"))
             .filter(pictures_count__gt=picture_count_threshold)
             .distinct()
         )
@@ -299,9 +290,9 @@ class Galaxy(models.Model):
         31/12/2022 (also two years, but with an offset of one year), then their
         club score is 365.
         """
-        memberships = user.memberships.values("start_date", "end_date", "club_id")
+        memberships = user.memberships.only("start_date", "end_date", "club_id")
         result = defaultdict(int)
-        today = localdate()
+        now = localdate()
         for membership in memberships:
             # This is a N+1 query, but 92% of galaxy users have less than 10 memberships.
             # Only 5 users have more than 30 memberships.
@@ -309,23 +300,23 @@ class Galaxy(models.Model):
                 Membership.objects.exclude(user=user)
                 .filter(
                     Q(  # start2 <= start1 <= end2
-                        start_date__lte=membership["start_date"],
-                        end_date__gte=membership["start_date"],
+                        start_date__lte=membership.start_date,
+                        end_date__gte=membership.start_date,
                     )
-                    | Q(  # start2 <= start1 <= today
-                        start_date__lte=membership["start_date"], end_date=None
+                    | Q(  # start2 <= start1 <= now
+                        start_date__lte=membership.start_date, end_date=None
                     )
                     | Q(  # start1 <= start2 <= end2
-                        start_date__gte=membership["start_date"],
-                        start_date__lte=membership["end_date"] or today,
+                        start_date__gte=membership.start_date,
+                        start_date__lte=membership.end_date or now,
                     ),
-                    club_id=membership["club_id"],
+                    club_id=membership.club_id,
                 )
                 .only("start_date", "end_date", "user_id")
             )
             for other in common_memberships:
-                start = max(membership["start_date"], other.start_date)
-                end = min(membership["end_date"] or today, other.end_date or today)
+                start = max(membership.start_date, other.start_date)
+                end = min(membership.end_date or now, other.end_date or now)
                 result[other.user_id] += (end - start).days * cls.CLUBS_POINTS
         return result
 
@@ -391,22 +382,18 @@ class Galaxy(models.Model):
         # this is memory expensive but prevents a lot of db hits, therefore
         # is far more time efficient
 
-        rulable_users_qs = self.get_rulable_users(picture_count_threshold)
-        active_users_count = rulable_users_qs.filter(is_active_in_galaxy=True).count()
-        rulable_users = list(rulable_users_qs)
+        rulable_users = list(self.get_rulable_users(picture_count_threshold))
+        rulable_users_count = len(rulable_users)
         user1_count = 0
         self.logger.info(
-            f" {len(rulable_users)} citizens (with {active_users_count} active ones) "
-            f"have been listed. Starting to rule."
+            f"{rulable_users_count} citizen have been listed. Starting to rule."
         )
 
         self.logger.info("Creating stars for all citizen")
         individual_scores = self.compute_individual_scores()
         GalaxyStar.objects.bulk_create(
             [
-                GalaxyStar(
-                    owner_id=user.id, galaxy=self, mass=individual_scores[user.id]
-                )
+                GalaxyStar(owner=user, galaxy=self, mass=individual_scores[user.id])
                 for user in rulable_users
             ]
         )
@@ -418,9 +405,9 @@ class Galaxy(models.Model):
         t_global_start = time.time()
         while len(rulable_users) > 0:
             user1 = rulable_users.pop()
-            if not user1.is_active_in_galaxy:
-                continue
             user1_count += 1
+            rulable_users_count2 = len(rulable_users)
+
             star1 = stars[user1.id]
 
             lanes = []
@@ -461,20 +448,17 @@ class Galaxy(models.Model):
                 self.logger.info("")
                 self.logger.info(f" Ruling of {self} ".center(60, "#"))
                 self.logger.info(
-                    f"Progression: {user1_count}/{active_users_count} "
-                    f"citizen -- {active_users_count - user1_count} remaining"
+                    f"Progression: {user1_count}/{rulable_users_count} "
+                    f"citizen -- {rulable_users_count - user1_count} remaining"
                 )
                 self.logger.info(f"Speed: {global_avg_speed:.2f} citizen per second")
-                eta = len(rulable_users) // global_avg_speed
+                eta = rulable_users_count2 // global_avg_speed
                 self.logger.info(
                     f"ETA: {int(eta // 60 % 60)} minutes {int(eta % 60)} seconds"
                 )
                 self.logger.info("#" * 60)
             t_global_start = time.time()
 
-        count, _ = self.stars.filter(Q(lanes1=None) & Q(lanes2=None)).delete()
-        self.logger.info(f"{count} orphan stars have been trimmed.")
-
         # Here, we get the IDs of the old galaxies that we'll need to delete. In normal operation, only one galaxy
         # should be returned, and we can't delete it yet, as it's the one still displayed by the Sith.
         old_galaxies_pks = list(

galaxy/tests.py

@@ -122,7 +122,7 @@ class TestGalaxyModel(TestCase):
             self.com,
         ]
 
-        with self.assertNumQueries(38):
+        with self.assertNumQueries(44):
             while len(users) > 0:
                 user1 = users.pop(0)
                 family_scores = Galaxy.compute_user_family_score(user1)
@@ -150,7 +150,7 @@ class TestGalaxyModel(TestCase):
         that the number of queries to rule the galaxy is stable.
         """
         galaxy = Galaxy.objects.create()
-        with self.assertNumQueries(36):
+        with self.assertNumQueries(39):
             galaxy.rule(0)  # We want everybody here
 
 

locale/fr/LC_MESSAGES/django.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-11-07 14:50+0100\n"
+"POT-Creation-Date: 2025-09-26 17:36+0200\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -117,7 +117,7 @@ msgstr "S'abonner"
 msgid "Remove"
 msgstr "Retirer"
 
-#: club/forms.py counter/forms.py pedagogy/templates/pedagogy/moderation.jinja
+#: club/forms.py pedagogy/templates/pedagogy/moderation.jinja
 msgid "Action"
 msgstr "Action"
 
@@ -141,12 +141,12 @@ msgstr "vous devez spécifier au moins un utilisateur ou une adresse email"
 msgid "Begin date"
 msgstr "Date de début"
 
-#: club/forms.py com/forms.py counter/forms.py election/forms.py
+#: club/forms.py com/forms.py counter/forms.py election/views.py
 #: subscription/forms.py
 msgid "End date"
 msgstr "Date de fin"
 
-#: club/forms.py club/templates/club/club_sellings.jinja club/views.py
+#: club/forms.py club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: counter/templates/counter/cash_summary_list.jinja counter/views/mixins.py
 msgid "Counter"
@@ -409,7 +409,7 @@ msgstr "Total : "
 msgid "Benefit: "
 msgstr "Bénéfice : "
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: counter/templates/counter/cash_summary_list.jinja
 #: counter/templates/counter/last_ops.jinja
@@ -419,34 +419,34 @@ msgstr "Bénéfice : "
 msgid "Date"
 msgstr "Date"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: counter/templates/counter/last_ops.jinja
 msgid "Barman"
 msgstr "Barman"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: counter/templates/counter/counter_click.jinja
 #: counter/templates/counter/last_ops.jinja
 #: counter/templates/counter/refilling_list.jinja
 msgid "Customer"
 msgstr "Client"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: counter/templates/counter/last_ops.jinja
 #: rootplace/templates/rootplace/logs.jinja
 msgid "Label"
 msgstr "Étiquette"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: core/templates/core/user_stats.jinja
 #: counter/templates/counter/last_ops.jinja
 msgid "Quantity"
 msgstr "Quantité"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account.jinja
 #: core/templates/core/user_account_detail.jinja
 #: counter/templates/counter/cash_summary_list.jinja
@@ -456,7 +456,7 @@ msgstr "Quantité"
 msgid "Total"
 msgstr "Total"
 
-#: club/templates/club/club_sellings.jinja club/views.py
+#: club/templates/club/club_sellings.jinja
 #: core/templates/core/user_account_detail.jinja
 #: core/templates/core/user_detail.jinja
 #: counter/templates/counter/last_ops.jinja
@@ -556,8 +556,6 @@ msgstr ""
 #: core/templates/core/user_godfathers_tree.jinja
 #: core/templates/core/user_preferences.jinja
 #: counter/templates/counter/cash_register_summary.jinja
-#: counter/templates/counter/invoices_call.jinja
-#: counter/templates/counter/product_form.jinja
 #: forum/templates/forum/reply.jinja
 #: subscription/templates/subscription/fragments/creation_form.jinja
 #: trombi/templates/trombi/comment.jinja
@@ -690,32 +688,20 @@ msgstr "Vente"
 msgid "Mailing list"
 msgstr "Listes de diffusion"
 
-#: club/views.py
-msgid "You are now a member of this club."
-msgstr "Vous êtes maintenant membre de ce club."
-
 #: club/views.py
 #, python-format
 msgid "%(user)s has been added to club."
 msgstr "%(user)s a été ajouté au club."
 
 #: club/views.py
-msgid "Benefit"
-msgstr "Bénéfice"
-
-#: club/views.py
-msgid "Selling price"
-msgstr "Prix de vente"
-
-#: club/views.py
-msgid "Purchase price"
-msgstr "Prix d'achat"
+msgid "You are now a member of this club."
+msgstr "Vous êtes maintenant membre de ce club."
 
 #: com/forms.py
 msgid "Format: 16:9 | Resolution: 1920x1080"
 msgstr "Format : 16:9 | Résolution : 1920x1080"
 
-#: com/forms.py election/forms.py subscription/forms.py
+#: com/forms.py election/views.py subscription/forms.py
 msgid "Start date"
 msgstr "Date de début"
 
@@ -905,8 +891,7 @@ msgstr "Administration des mailing listes"
 msgid "Actions"
 msgstr "Actions"
 
-#: com/templates/com/mailing_admin.jinja com/templates/com/poster_list.jinja
-#: core/templates/core/file_detail.jinja
+#: com/templates/com/mailing_admin.jinja core/templates/core/file_detail.jinja
 #: core/templates/core/file_moderation.jinja sas/templates/sas/moderation.jinja
 #: sas/templates/sas/picture.jinja
 msgid "Moderate"
@@ -1043,7 +1028,7 @@ msgstr "Événements aujourd'hui et dans les prochains jours"
 
 #: com/templates/com/news_list.jinja
 msgid "Administrate news"
-msgstr "Administrer les nouvelles"
+msgstr "Administrer les news"
 
 #: com/templates/com/news_list.jinja
 msgid "Nothing to come..."
@@ -1076,10 +1061,6 @@ msgstr "Nos services"
 msgid "UV Guide"
 msgstr "Guide des UVs"
 
-#: com/templates/com/news_list.jinja
-msgid "Timetable"
-msgstr "Emploi du temps"
-
 #: com/templates/com/news_list.jinja core/templates/core/base/navbar.jinja
 msgid "Matmatronch"
 msgstr "Matmatronch"
@@ -1122,7 +1103,8 @@ msgstr "Vous n'avez pas accès à ce contenu"
 msgid "Poster"
 msgstr "Affiche"
 
-#: com/templates/com/poster_edit.jinja com/templates/com/screen_edit.jinja
+#: com/templates/com/poster_edit.jinja com/templates/com/poster_moderate.jinja
+#: com/templates/com/screen_edit.jinja
 msgid "List"
 msgstr "Liste"
 
@@ -1135,14 +1117,26 @@ msgstr "Affiche - modifier"
 msgid "Create"
 msgstr "Créer"
 
-#: com/templates/com/poster_list.jinja com/templates/com/screen_slideshow.jinja
-msgid "Click to expand"
-msgstr "Cliquez pour agrandir"
+#: com/templates/com/poster_list.jinja
+msgid "Moderation"
+msgstr "Modération"
 
 #: com/templates/com/poster_list.jinja
 msgid "No posters"
 msgstr "Aucune affiche"
 
+#: com/templates/com/poster_list.jinja com/templates/com/screen_slideshow.jinja
+msgid "Click to expand"
+msgstr "Cliquez pour agrandir"
+
+#: com/templates/com/poster_moderate.jinja
+msgid "Posters - moderation"
+msgstr "Affiches - modération"
+
+#: com/templates/com/poster_moderate.jinja
+msgid "No objects"
+msgstr "Aucun éléments"
+
 #: com/templates/com/screen_edit.jinja
 msgid "Screen"
 msgstr "Écran"
@@ -2957,18 +2951,6 @@ msgstr "Cet UID est invalide"
 msgid "User not found"
 msgstr "Utilisateur non trouvé"
 
-#: counter/forms.py
-msgid "Date and time of action"
-msgstr "Date et heure de l'action"
-
-#: counter/forms.py
-msgid "New counters"
-msgstr "Nouveaux comptoirs"
-
-#: counter/forms.py
-msgid "The selected counters will replace the current ones"
-msgstr "Les comptoirs sélectionnés remplaceront les comptoirs actuels"
-
 #: counter/forms.py
 msgid ""
 "Describe the product. If it's an event's click, give some insights about it, "
@@ -3303,52 +3285,6 @@ msgid "The returnable product cannot be the same as the returned one"
 msgstr ""
 "Le produit consigné ne peut pas être le même que le produit de déconsigne"
 
-#: counter/models.py
-msgid "Archiving"
-msgstr "Archivage"
-
-#: counter/models.py
-msgid "Counters change"
-msgstr "Changement des comptoirs"
-
-#: counter/models.py
-msgid "Product scheduled action"
-msgstr "Actions sur produit planifiées"
-
-#: counter/models.py
-msgid "Product actions must declare a clocked schedule."
-msgstr "Les actions sur les produits doivent avoir un horaire planifié."
-
-#: counter/models.py
-msgid "Year + month field (day forced to 1)"
-msgstr "Champ Année + mois (jour forcé à 1)"
-
-#: counter/models.py
-#, python-format
-msgid ""
-"“%(value)s” value has an invalid date format. It must be in YYYY-MM format."
-msgstr ""
-"La valeur « %(value)s » a un format de date invalide. Ce doit être au format "
-"YYYY-MM."
-
-#: counter/models.py
-#, python-format
-msgid ""
-"“%(value)s” value has the correct format (YYYY-MM) but it is an invalid date."
-msgstr "La valeur « %(value)s » a le bon format, mais est une date invalide."
-
-#: counter/models.py
-msgid "invoice date"
-msgstr "date de la facture"
-
-#: counter/models.py
-msgid "Invoice call"
-msgstr "Appel à facture"
-
-#: counter/models.py
-msgid "Invoice calls"
-msgstr "Appels à facture"
-
 #: counter/templates/counter/activity.jinja
 #, python-format
 msgid "%(counter_name)s activity"
@@ -3579,10 +3515,6 @@ msgstr "Payements en Carte Bancaire"
 msgid "Sum"
 msgstr "Somme"
 
-#: counter/templates/counter/invoices_call.jinja
-msgid "Validated"
-msgstr "Validé"
-
 #: counter/templates/counter/last_ops.jinja
 #, python-format
 msgid "%(counter_name)s last operations"
@@ -3671,25 +3603,6 @@ msgstr ""
 "votre cotisation. Si vous ne renouvelez pas votre cotisation, il n'y aura "
 "aucune conséquence autre que le retrait de l'argent de votre compte."
 
-#: counter/templates/counter/product_form.jinja
-#, python-format
-msgid "Edit product %(name)s"
-msgstr "Édition du produit %(name)s"
-
-#: counter/templates/counter/product_form.jinja
-msgid "Product creation"
-msgstr "Création de produit"
-
-#: counter/templates/counter/product_form.jinja
-msgid "Automatic actions"
-msgstr "Actions automatiques"
-
-#: counter/templates/counter/product_form.jinja
-msgid "Automatic actions allows to schedule product changes ahead of time."
-msgstr ""
-"Les actions automatiques vous permettent de planifier des modifications du "
-"produit à l'avance."
-
 #: counter/templates/counter/product_list.jinja
 msgid "Product list"
 msgstr "Liste des produits"
@@ -3872,10 +3785,6 @@ msgstr "L'utilisateur n'est pas barman."
 msgid "Bad location, someone is already logged in somewhere else"
 msgstr "Mauvais comptoir, quelqu'un est déjà connecté ailleurs"
 
-#: counter/views/invoice.py
-msgid "Invoice calls status has been updated."
-msgstr "Le statut des appels à facture a été mis à jour."
-
 #: counter/views/mixins.py
 msgid "Cash summary"
 msgstr "Relevé de caisse"
@@ -4043,30 +3952,6 @@ msgstr ""
 msgid "You can't buy a refilling with sith money"
 msgstr "Vous ne pouvez pas acheter un rechargement avec de l'argent du sith"
 
-#: election/forms.py
-msgid "You have selected too many candidates."
-msgstr "Vous avez sélectionné trop de candidats."
-
-#: election/forms.py
-msgid "User to candidate"
-msgstr "Utilisateur se présentant"
-
-#: election/forms.py election/templates/election/election_detail.jinja
-msgid "Blank vote"
-msgstr "Vote blanc"
-
-#: election/forms.py
-msgid "This role already exists for this election"
-msgstr "Ce rôle existe déjà pour cette élection"
-
-#: election/forms.py
-msgid "Start candidature"
-msgstr "Début des candidatures"
-
-#: election/forms.py
-msgid "End candidature"
-msgstr "Fin des candidatures"
-
 #: election/models.py
 msgid "start candidature"
 msgstr "début des candidatures"
@@ -4091,10 +3976,6 @@ msgstr "groupe de vote"
 msgid "candidature groups"
 msgstr "groupe de candidature"
 
-#: election/models.py
-msgid "voters"
-msgstr "électeurs"
-
 #: election/models.py
 msgid "election"
 msgstr "élection"
@@ -4150,10 +4031,17 @@ msgstr "Vous avez déjà soumis votre vote."
 msgid "You have voted in this election."
 msgstr "Vous avez déjà voté pour cette élection."
 
+#: election/templates/election/election_detail.jinja election/views.py
+msgid "Blank vote"
+msgstr "Vote blanc"
+
 #: election/templates/election/election_detail.jinja
-#, python-format
-msgid "You may choose up to %(nb_choices)s people."
-msgstr "Vous pouvez choisir jusqu'à %(nb_choices)s personnes."
+msgid "You may choose up to"
+msgstr "Vous pouvez choisir jusqu'à"
+
+#: election/templates/election/election_detail.jinja
+msgid "people."
+msgstr "personne(s)"
 
 #: election/templates/election/election_detail.jinja
 msgid "Choose blank vote"
@@ -4195,6 +4083,26 @@ msgstr "au"
 msgid "Polls open from"
 msgstr "Votes ouverts du"
 
+#: election/views.py
+msgid "You have selected too much candidates."
+msgstr "Vous avez sélectionné trop de candidats."
+
+#: election/views.py
+msgid "User to candidate"
+msgstr "Utilisateur se présentant"
+
+#: election/views.py
+msgid "This role already exists for this election"
+msgstr "Ce rôle existe déjà pour cette élection"
+
+#: election/views.py
+msgid "Start candidature"
+msgstr "Début des candidatures"
+
+#: election/views.py
+msgid "End candidature"
+msgstr "Fin des candidatures"
+
 #: forum/models.py
 msgid "is a category"
 msgstr "est une catégorie"
@@ -5066,47 +4974,47 @@ msgstr "Suppression de rechargement"
 
 #: sith/settings.py
 msgid "One semester"
-msgstr "Un semestre"
+msgstr "Un semestre, 20 €"
 
 #: sith/settings.py
 msgid "Two semesters"
-msgstr "Deux semestres"
+msgstr "Deux semestres, 35 €"
 
 #: sith/settings.py
 msgid "Common core cursus"
-msgstr "Cursus tronc commun"
+msgstr "Cursus tronc commun, 60 €"
 
 #: sith/settings.py
 msgid "Branch cursus"
-msgstr "Cursus branche"
+msgstr "Cursus branche, 60 €"
 
 #: sith/settings.py
 msgid "Alternating cursus"
-msgstr "Cursus alternant"
+msgstr "Cursus alternant, 30 €"
 
 #: sith/settings.py
 msgid "Honorary member"
-msgstr "Membre honoraire"
+msgstr "Membre honoraire, 0 €"
 
 #: sith/settings.py
 msgid "Assidu member"
-msgstr "Membre d'Assidu"
+msgstr "Membre d'Assidu, 0 €"
 
 #: sith/settings.py
 msgid "Amicale/DOCEO member"
-msgstr "Membre de l'Amicale/DOCEO"
+msgstr "Membre de l'Amicale/DOCEO, 0 €"
 
 #: sith/settings.py
 msgid "UT network member"
-msgstr "Cotisant du réseau UT"
+msgstr "Cotisant du réseau UT, 0 €"
 
 #: sith/settings.py
 msgid "CROUS member"
-msgstr "Membres du CROUS"
+msgstr "Membres du CROUS, 0 €"
 
 #: sith/settings.py
 msgid "Sbarro/ESTA member"
-msgstr "Membre de Sbarro ou de l'ESTA"
+msgstr "Membre de Sbarro ou de l'ESTA, 20 €"
 
 #: sith/settings.py
 msgid "One semester Welcome Week"
@@ -5133,28 +5041,28 @@ msgid "One day"
 msgstr "Un jour"
 
 #: sith/settings.py
-msgid "GA staff member (2 weeks)"
-msgstr "Membre staff GA (2 semaines)"
+msgid "GA staff member"
+msgstr "Membre staff GA (2 semaines), 1 €"
 
 #: sith/settings.py
 msgid "One semester (-20%)"
-msgstr "Un semestre (-20%)"
+msgstr "Un semestre (-20%), 12 €"
 
 #: sith/settings.py
 msgid "Two semesters (-20%)"
-msgstr "Deux semestres (-20%)"
+msgstr "Deux semestres (-20%), 22 €"
 
 #: sith/settings.py
 msgid "Common core cursus (-20%)"
-msgstr "Cursus tronc commun (-20%)"
+msgstr "Cursus tronc commun (-20%), 36 €"
 
 #: sith/settings.py
 msgid "Branch cursus (-20%)"
-msgstr "Cursus branche (-20%)"
+msgstr "Cursus branche (-20%), 36 €"
 
 #: sith/settings.py
 msgid "Alternating cursus (-20%)"
-msgstr "Cursus alternant (-20%)"
+msgstr "Cursus alternant (-20%), 24 €"
 
 #: sith/settings.py
 msgid "One year for free(CA offer)"
@@ -5328,18 +5236,6 @@ msgstr "Membre existant"
 msgid "the groups that can create subscriptions"
 msgstr "les groupes pouvant créer des cotisations"
 
-#: timetable/templates/timetable/generator.jinja
-msgid "Timetable generator"
-msgstr "Générateur d'emploi du temps"
-
-#: timetable/templates/timetable/generator.jinja
-msgid "Generate"
-msgstr "Générer"
-
-#: timetable/templates/timetable/generator.jinja
-msgid "Save to PNG"
-msgstr "Sauver en PNG"
-
 #: trombi/models.py
 msgid "subscription deadline"
 msgstr "fin des inscriptions"

package.json

@@ -24,48 +24,47 @@
     "#com:*": "./com/static/bundled/*"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
-    "@babel/preset-env": "^7.28.5",
-    "@biomejs/biome": "^1.9.4",
+    "@babel/core": "^7.25.2",
+    "@babel/preset-env": "^7.25.4",
+    "@biomejs/biome": "1.9.4",
     "@hey-api/openapi-ts": "^0.73.0",
     "@rollup/plugin-inject": "^5.0.5",
-    "@types/alpinejs": "^3.13.11",
-    "@types/cytoscape-cxtmenu": "^3.4.5",
-    "@types/cytoscape-klay": "^3.1.5",
+    "@types/alpinejs": "^3.13.10",
+    "@types/cytoscape-cxtmenu": "^3.4.4",
+    "@types/cytoscape-klay": "^3.1.4",
     "@types/js-cookie": "^3.0.6",
-    "typescript": "^5.9.3",
-    "vite": "^6.4.1",
+    "typescript": "^5.8.3",
+    "vite": "^6.3.6",
     "vite-bundle-visualizer": "^1.2.1",
-    "vite-plugin-static-copy": "^3.1.4"
+    "vite-plugin-static-copy": "^3.1.2"
   },
   "dependencies": {
-    "@alpinejs/sort": "^3.15.1",
+    "@alpinejs/sort": "^3.14.7",
     "@arendjr/text-clipper": "npm:@jsr/arendjr__text-clipper@^3.0.0",
-    "@floating-ui/dom": "^1.7.4",
-    "@fortawesome/fontawesome-free": "^6.7.2",
-    "@fullcalendar/core": "^6.1.19",
-    "@fullcalendar/daygrid": "^6.1.19",
-    "@fullcalendar/icalendar": "^6.1.19",
-    "@fullcalendar/list": "^6.1.19",
-    "@sentry/browser": "^9.46.0",
-    "@zip.js/zip.js": "^2.8.9",
-    "3d-force-graph": "^1.79.0",
-    "alpinejs": "^3.15.1",
-    "chart.js": "^4.5.1",
+    "@floating-ui/dom": "^1.6.13",
+    "@fortawesome/fontawesome-free": "^6.6.0",
+    "@fullcalendar/core": "^6.1.15",
+    "@fullcalendar/daygrid": "^6.1.15",
+    "@fullcalendar/icalendar": "^6.1.15",
+    "@fullcalendar/list": "^6.1.15",
+    "@sentry/browser": "^9.29.0",
+    "@zip.js/zip.js": "^2.7.52",
+    "3d-force-graph": "^1.73.4",
+    "alpinejs": "^3.14.7",
+    "chart.js": "^4.4.4",
     "country-flag-emoji-polyfill": "^0.1.8",
-    "cytoscape": "^3.33.1",
+    "cytoscape": "^3.30.2",
     "cytoscape-cxtmenu": "^3.5.0",
     "cytoscape-klay": "^3.1.4",
-    "d3-force-3d": "^3.0.6",
-    "easymde": "^2.20.0",
-    "glob": "^11.0.3",
-    "html2canvas": "^1.4.1",
-    "htmx.org": "^2.0.8",
+    "d3-force-3d": "^3.0.5",
+    "easymde": "^2.19.0",
+    "glob": "^11.0.0",
+    "htmx.org": "^2.0.3",
     "js-cookie": "^3.0.5",
-    "lit-html": "^3.3.1",
+    "lit-html": "^3.3.0",
     "native-file-system-adapter": "^3.0.1",
     "three": "^0.177.0",
-    "three-spritetext": "^1.10.0",
-    "tom-select": "^2.4.3"
+    "three-spritetext": "^1.9.0",
+    "tom-select": "^2.3.1"
   }
 }

pedagogy/api.py

@@ -19,7 +19,7 @@ from pedagogy.utbm_api import UtbmApiClient
 class UvController(ControllerBase):
     @route.get(
         "/{code}",
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[
             # this route will almost always be called in the context
             # of a UV creation/edition
@@ -45,7 +45,7 @@ class UvController(ControllerBase):
         "",
         response=PaginatedResponseSchema[SimpleUvSchema],
         url_name="fetch_uvs",
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[HasPerm("pedagogy.view_uv")],
     )
     @paginate(PageNumberPaginationExtra, page_size=100)

pyproject.toml

@@ -19,36 +19,36 @@ authors = [
 license = { text = "GPL-3.0-only" }
 requires-python = "<4.0,>=3.12"
 dependencies = [
-    "django>=5.2.8,<6.0.0",
-    "django-ninja>=1.4.5,<2.0.0",
-    "django-ninja-extra>=0.30.2,<1.0.0",
-    "Pillow>=12.0.0,<13.0.0",
-    "mistune>=3.1.4,<4.0.0",
+    "django>=5.2.1,<6.0.0",
+    "django-ninja<2.0.0,>=1.4.0",
+    "django-ninja-extra<1.0.0,>=0.22.9",
+    "Pillow<12.0.0,>=11.1.0",
+    "mistune<4.0.0,>=3.1.3",
     "django-jinja<3.0.0,>=2.11.0",
-    "cryptography>=46.0.3,<47.0.0",
-    "django-phonenumber-field>=8.3.0,<9.0.0",
-    "phonenumbers>=9.0.18,<10.0.0",
-    "reportlab>=4.4.4,<5.0.0",
+    "cryptography>=45.0.3,<46.0.0",
+    "django-phonenumber-field<9.0.0,>=8.1.0",
+    "phonenumbers>=9.0.2,<10.0.0",
+    "reportlab<5.0.0,>=4.3.1",
     "django-haystack<4.0.0,>=3.3.0",
     "xapian-haystack<4.0.0,>=3.1.0",
     "libsass<1.0.0,>=0.23.0",
     "django-ordered-model<4.0.0,>=3.7.4",
     "django-simple-captcha<1.0.0,>=0.6.2",
     "python-dateutil<3.0.0.0,>=2.9.0.post0",
-    "sentry-sdk>=2.43.0,<3.0.0",
+    "sentry-sdk<3.0.0,>=2.25.1",
     "jinja2<4.0.0,>=3.1.6",
-    "django-countries>=8.0.0,<9.0.0",
-    "dict2xml>=1.7.7,<2.0.0",
+    "django-countries<8.0.0,>=7.6.1",
+    "dict2xml<2.0.0,>=1.7.6",
     "Sphinx<6,>=5",
-    "tomli>=2.3.0,<3.0.0",
+    "tomli<3.0.0,>=2.2.1",
     "django-honeypot>=1.3.0,<2",
-    "pydantic-extra-types>=2.10.6,<3.0.0",
-    "ical>=11.1.0,<12",
+    "pydantic-extra-types<3.0.0,>=2.10.3",
+    "ical>=11,<12",
     "redis[hiredis]<7,>=5.3.0",
-    "environs[django]>=14.5.0,<15.0.0",
-    "requests>=2.32.5,<3.0.0",
+    "environs[django]<15.0.0,>=14.1.1",
+    "requests>=2.32.3",
     "honcho>=2.0.0",
-    "psutil>=7.1.3,<8.0.0",
+    "psutil>=7.0.0",
     "celery[redis]>=5.5.2",
     "django-celery-results>=2.5.1",
     "django-celery-beat>=2.7.0",
@@ -60,32 +60,32 @@ documentation = "https://sith-ae.readthedocs.io/"
 
 [dependency-groups]
 prod = [
-    "psycopg[c]>=3.2.12,<4.0.0",
+    "psycopg[c]>=3.2.9,<4.0.0",
 ]
 dev = [
-    "django-debug-toolbar>=6.1.0,<7",
-    "ipython>=9.7.0,<10.0.0",
-    "pre-commit>=4.3.0,<5.0.0",
-    "ruff>=0.14.4,<1.0.0",
-    "djhtml>=3.0.10,<4.0.0",
-    "faker>=37.12.0,<38.0.0",
-    "rjsmin>=1.2.5,<2.0.0",
+    "django-debug-toolbar>=6,<7",
+    "ipython<10.0.0,>=9.0.2",
+    "pre-commit<5.0.0,>=4.1.0",
+    "ruff>=0.11.13,<1.0.0",
+    "djhtml<4.0.0,>=3.0.7",
+    "faker<38.0.0,>=37.0.0",
+    "rjsmin<2.0.0,>=1.2.4",
 ]
 tests = [
-    "freezegun>=1.5.5,<2.0.0",
-    "pytest>=8.4.2,<9.0.0",
-    "pytest-cov>=7.0.0,<8.0.0",
+    "freezegun<2.0.0,>=1.5.1",
+    "pytest<9.0.0,>=8.3.5",
+    "pytest-cov<7.0.0,>=6.0.0",
     "pytest-django<5.0.0,>=4.10.0",
     "model-bakery<2.0.0,>=1.20.4",
-    "beautifulsoup4>=4.14.2,<5",
-    "lxml>=6.0.2,<7",
+    "beautifulsoup4>=4.13.3,<5",
+    "lxml>=6,<7",
 ]
 docs = [
     "mkdocs<2.0.0,>=1.6.1",
-    "mkdocs-material>=9.6.23,<10.0.0",
-    "mkdocstrings>=0.30.1,<1.0.0",
-    "mkdocstrings-python>=1.18.2,<2.0.0",
-    "mkdocs-include-markdown-plugin>=7.2.0,<8.0.0",
+    "mkdocs-material<10.0.0,>=9.6.7",
+    "mkdocstrings<1.0.0,>=0.28.3",
+    "mkdocstrings-python<2.0.0,>=1.16.3",
+    "mkdocs-include-markdown-plugin<8.0.0,>=7.1.5",
 ]
 
 [tool.uv]

sas/api.py

@@ -8,6 +8,7 @@ from ninja.security import SessionAuth
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.exceptions import NotFound, PermissionDenied
 from ninja_extra.pagination import PageNumberPaginationExtra
+from ninja_extra.permissions import IsAuthenticated
 from ninja_extra.schemas import PaginatedResponseSchema
 from pydantic import NonNegativeInt
 
@@ -40,6 +41,7 @@ class AlbumController(ControllerBase):
     @route.get(
         "/search",
         response=PaginatedResponseSchema[AlbumSchema],
+        permissions=[IsAuthenticated],
         url_name="search-album",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -52,7 +54,7 @@ class AlbumController(ControllerBase):
     @route.get(
         "/autocomplete-search",
         response=PaginatedResponseSchema[AlbumAutocompleteSchema],
-        auth=[ApiKeyAuth(), SessionAuth()],
+        auth=[SessionAuth(), ApiKeyAuth()],
         permissions=[CanAccessLookup],
     )
     @paginate(PageNumberPaginationExtra, page_size=50)
@@ -72,7 +74,12 @@ class AlbumController(ControllerBase):
 
 @api_controller("/sas/picture")
 class PicturesController(ControllerBase):
-    @route.get("", response=PaginatedResponseSchema[PictureSchema], url_name="pictures")
+    @route.get(
+        "",
+        response=PaginatedResponseSchema[PictureSchema],
+        permissions=[IsAuthenticated],
+        url_name="pictures",
+    )
     @paginate(PageNumberPaginationExtra, page_size=100)
     def fetch_pictures(self, filters: Query[PictureFilterSchema]):
         """Find pictures viewable by the user corresponding to the given filters.
@@ -134,7 +141,7 @@ class PicturesController(ControllerBase):
 
     @route.get(
         "/{picture_id}/identified",
-        permissions=[CanView],
+        permissions=[IsAuthenticated, CanView],
         response=list[IdentifiedUserSchema],
     )
     def fetch_identifications(self, picture_id: int):
@@ -142,7 +149,7 @@ class PicturesController(ControllerBase):
         picture = self.get_object_or_exception(Picture, pk=picture_id)
         return picture.people.select_related("user")
 
-    @route.put("/{picture_id}/identified", permissions=[CanView])
+    @route.put("/{picture_id}/identified", permissions=[IsAuthenticated, CanView])
     def identify_users(self, picture_id: NonNegativeInt, users: set[NonNegativeInt]):
         picture = self.get_object_or_exception(
             Picture.objects.select_related("parent"), pk=picture_id
@@ -202,7 +209,7 @@ class PicturesController(ControllerBase):
 
 @api_controller("/sas/relation", tags="User identification on SAS pictures")
 class UsersIdentifiedController(ControllerBase):
-    @route.delete("/{relation_id}")
+    @route.delete("/{relation_id}", permissions=[IsAuthenticated])
     def delete_relation(self, relation_id: NonNegativeInt):
         """Untag a user from a SAS picture.
 

sas/static/bundled/sas/pictures-download-index.ts

@@ -5,13 +5,12 @@ import type { PictureSchema } from "#openapi";
 document.addEventListener("alpine:init", () => {
   Alpine.data("pictures_download", () => ({
     isDownloading: false,
-    downloadPictures: [] as PictureSchema[],
 
     async downloadZip() {
       this.isDownloading = true;
       const bar = this.$refs.progress;
       bar.value = 0;
-      bar.max = this.downloadPictures.length;
+      bar.max = this.pictures.length;
 
       const incrementProgressBar = (_total: number): undefined => {
         bar.value++;
@@ -30,7 +29,7 @@ document.addEventListener("alpine:init", () => {
       const zipWriter = new ZipWriter(await fileHandle.createWritable());
 
       await Promise.all(
-        this.downloadPictures.map(async (p: PictureSchema) => {
+        this.pictures.map((p: PictureSchema) => {
           const imgName = `${p.album}/IMG_${p.date.replace(/[:\-]/g, "_")}${p.name.slice(p.name.lastIndexOf("."))}`;
           return zipWriter.add(imgName, new HttpReader(p.full_size_url), {
             level: 9,

sas/static/bundled/sas/user/pictures-index.ts

@@ -7,7 +7,6 @@ import {
 
 interface PagePictureConfig {
   userId: number;
-  nbPictures?: number;
 }
 
 interface Album {
@@ -21,27 +20,11 @@ document.addEventListener("alpine:init", () => {
     loading: true,
     albums: [] as Album[],
 
-    async fetchPictures(): Promise<PictureSchema[]> {
-      const localStorageKey = `user${config.userId}Pictures`;
-      const localStorageInvalidationKey = `user${config.userId}PicturesNumber`;
-      const lastCachedNumber = localStorage.getItem(localStorageInvalidationKey);
-      if (
-        lastCachedNumber !== null &&
-        Number.parseInt(lastCachedNumber) === config.nbPictures
-      ) {
-        return JSON.parse(localStorage.getItem(localStorageKey));
-      }
+    async init() {
       const pictures = await paginated(picturesFetchPictures, {
         // biome-ignore lint/style/useNamingConvention: from python api
         query: { users_identified: [config.userId] },
       } as PicturesFetchPicturesData);
-      localStorage.setItem(localStorageInvalidationKey, config.nbPictures.toString());
-      localStorage.setItem(localStorageKey, JSON.stringify(pictures));
-      return pictures;
-    },
-
-    async init() {
-      const pictures = await this.fetchPictures();
       const groupedAlbums = Object.groupBy(pictures, (i: PictureSchema) => i.album.id);
       this.albums = Object.values(groupedAlbums).map((pictures: PictureSchema[]) => {
         return {
@@ -57,9 +40,5 @@ document.addEventListener("alpine:init", () => {
       }
       this.loading = false;
     },
-
-    allPictures(): PictureSchema[] {
-      return this.albums.flatMap((album: Album) => album.pictures);
-    },
   }));
 });