add translations

style: improve ue comments appearance
style: improve ue comment form appearance
2026-10-16 15:39:21 +00:00 · 2026-09-25 15:48:53 +02:00 · 2026-09-25 15:48:53 +02:00 · 2026-09-25 15:48:53 +02:00 · 2026-09-25 15:48:53 +02:00
76 changed files with 2366 additions and 2606 deletions
@@ -1,7 +1,7 @@
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
-    rev: v0.16.10
+    rev: v0.16.0
    hooks:
      - id: ruff-check  # just check the code, and print the errors
      - id: ruff-check  # actually fix the fixable errors, but print nothing
@@ -12,7 +12,7 @@ repos:
    rev: v0.6.1
    hooks:
      - id: biome-check
-        additional_dependencies: ["@biomejs/biome@2.5.15"]
+        additional_dependencies: ["@biomejs/biome@2.5.1"]
  - repo: https://github.com/rtts/djhtml
    rev: 3.0.11
    hooks:
@@ -21,15 +21,6 @@ class ApiClientAdmin(admin.ModelAdmin):
        "owner__nick_name",
    )
    autocomplete_fields = ("owner", "groups", "client_permissions")
    readonly_fields = ("hmac_key",)
    actions = ("reset_hmac_key",)
    @admin.action(permissions=["change"], description=_("Reset HMAC key"))
    def reset_hmac_key(self, _request: HttpRequest, queryset: QuerySet[ApiClient]):
        objs = list(queryset)
        for obj in objs:
            obj.reset_hmac(commit=False)
        ApiClient.objects.bulk_update(objs, fields=["hmac_key"])
@admin.register(ApiKey)
@@ -1,16 +0,0 @@
 from ninja_extra import ControllerBase, api_controller, route
 from api.auth import ApiKeyAuth
 from api.schemas import ApiClientSchema
@api_controller("/client")
 class ApiClientController(ControllerBase):
    @route.get(
        "/me",
        auth=[ApiKeyAuth()],
        response=ApiClientSchema,
        url_name="api-client-infos",
    )
    def get_client_info(self):
        return self.context.request.auth
@@ -1,35 +0,0 @@
 from django import forms
 from django.forms import HiddenInput
 from django.utils.translation import gettext_lazy as _
 class ThirdPartyAuthForm(forms.Form):
    """Form to complete to authenticate on the sith from a third-party app.
    For the form to be valid, the user approve the EULA (french: CGU)
    and give its username from the third-party app.
    """
    cgu_accepted = forms.BooleanField(
        required=True,
        label=_("I have read and I accept the terms and conditions of use"),
        error_messages={
            "required": _("You must approve the terms and conditions of use.")
        },
    )
    is_username_valid = forms.BooleanField(
        required=True,
        error_messages={"required": _("You must confirm that this is your username.")},
    )
    client_id = forms.IntegerField(widget=HiddenInput())
    third_party_app = forms.CharField(widget=HiddenInput())
    privacy_link = forms.URLField(widget=HiddenInput())
    username = forms.CharField(widget=HiddenInput())
    callback_url = forms.URLField(widget=HiddenInput())
    signature = forms.CharField(widget=HiddenInput())
    def __init__(self, *args, label_suffix: str = "", initial, **kwargs):
        super().__init__(*args, label_suffix=label_suffix, initial=initial, **kwargs)
        self.fields["is_username_valid"].label = _(
            "I confirm that %(username)s is my username on %(app)s"
        ) % {"username": initial.get("username"), "app": initial.get("third_party_app")}
@@ -1,19 +0,0 @@
 # Generated by Django 5.2.3 on 2025-10-26 10:15
 from django.db import migrations, models
 import api.models
 class Migration(migrations.Migration):
    dependencies = [("api", "0001_initial")]
    operations = [
        migrations.AddField(
            model_name="apiclient",
            name="hmac_key",
            field=models.CharField(
                default=api.models.get_hmac_key, max_length=128, verbose_name="HMAC Key"
            ),
        ),
    ]
@@ -1,20 +1,13 @@
 import secrets
 from typing import Iterable
 from django.contrib.auth.models import Permission
 from django.db import models
 from django.db.models import Q
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import pgettext_lazy
 from core.models import Group, User
 def get_hmac_key():
    return secrets.token_hex(64)
 class ApiClient(models.Model):
    name = models.CharField(_("name"), max_length=64)
    owner = models.ForeignKey(
@@ -33,10 +26,11 @@ class ApiClient(models.Model):
        help_text=_("Specific permissions for this api client."),
        related_name="clients",
    )
    hmac_key = models.CharField(_("HMAC Key"), max_length=128, default=get_hmac_key)
    created_at = models.DateTimeField(auto_now_add=True)
    updated_at = models.DateTimeField(auto_now=True)
    _perm_cache: set[str] | None = None
    class Meta:
        verbose_name = _("api client")
        verbose_name_plural = _("api clients")
@@ -44,38 +38,33 @@ class ApiClient(models.Model):
    def __str__(self):
        return self.name
-    @cached_property
+    def has_perm(self, perm: str):
-    def all_permissions(self) -> set[str]:
+        """Return True if the client has the specified permission."""
-        permissions = (
+
-            Permission.objects.filter(
+        if self._perm_cache is None:
-                Q(group__group__in=self.groups.all()) | Q(clients=self)
+            group_permissions = (
-            )
+                Permission.objects.filter(group__group__in=self.groups.all())
                .values_list("content_type__app_label", "codename")
                .order_by()
            )
-        return {f"{content_type}.{name}" for content_type, name in permissions}
+            client_permissions = self.client_permissions.values_list(
                "content_type__app_label", "codename"
            ).order_by()
            self._perm_cache = {
                f"{content_type}.{name}"
                for content_type, name in (*group_permissions, *client_permissions)
            }
        return perm in self._perm_cache
-    def has_perm(self, perm: str):
+    def has_perms(self, perm_list):
-        """Return True if the client has the specified permission."""
+        """
-        return perm in self.all_permissions
+        Return True if the client has each of the specified permissions. If
-
+        object is passed, check if the client has all required perms for it.
-    def has_perms(self, perm_list: Iterable[str]) -> bool:
+        """
        """Return True if the client has each of the specified permissions."""
        if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
            raise ValueError("perm_list must be an iterable of permissions.")
        return all(self.has_perm(perm) for perm in perm_list)
    def reset_hmac(self, *, commit: bool = True) -> str:
        """Reset and return the HMAC key for this client.
        Args:
            commit: if True (the default), persist the new hmac in db.
        """
        self.hmac_key = get_hmac_key()
        if commit:
            self.save()
        return self.hmac_key
 class ApiKey(models.Model):
    PREFIX_LENGTH = 5
@@ -1,23 +0,0 @@
 from ninja import ModelSchema, Schema
 from pydantic import Field, HttpUrl
 from api.models import ApiClient
 from core.schemas import SimpleUserSchema
 class ApiClientSchema(ModelSchema):
    class Meta:
        model = ApiClient
        fields = ["id", "name"]
    owner: SimpleUserSchema
    permissions: list[str] = Field(alias="all_permissions")
 class ThirdPartyAuthParamsSchema(Schema):
    client_id: int
    third_party_app: str
    privacy_link: HttpUrl
    username: str
    callback_url: HttpUrl
    signature: str
@@ -1,32 +0,0 @@
 {% extends "core/base.jinja" %}
 {% block content %}
  <form method="post">
    {% csrf_token %}
    <h3>{% trans %}Confidentiality{% endtrans %}</h3>
    <p>
      {% trans trimmed app=third_party_app %}
        By ticking this box and clicking on the send button, you
        acknowledge and agree to provide {{ app }} with your
        first name, last name, nickname and any other information
        that was the third party app was explicitly authorized to fetch
        and that it must have acknowledged to you, in a complete and accurate manner.
      {% endtrans %}
    </p>
    <p class="margin-bottom">
      {% trans trimmed app=third_party_app, privacy_link=third_party_cgu, sith_cgu_link=sith_cgu %}
        The privacy policies of <a href="{{ privacy_link }}">{{ app }}</a>
        and of <a href="{{ sith_cgu_link }}">the Students' Association</a>
        applies as soon as the form is submitted.
      {% endtrans %}
    </p>
    <div class="row">{{ form.cgu_accepted }} {{ form.cgu_accepted.label_tag() }}</div>
    <br>
    <h3 class="margin-bottom">{% trans %}Confirmation of identity{% endtrans %}</h3>
    <div class="row margin-bottom">
      {{ form.is_username_valid }} {{ form.is_username_valid.label_tag() }}
    </div>
    {% for field in form.hidden_fields() %}{{ field }}{% endfor %}
    <input type="submit" class="btn btn-blue">
  </form>
 {% endblock %}
@@ -1,24 +0,0 @@
 import pytest
 from django.contrib.admin import AdminSite
 from django.http import HttpRequest
 from model_bakery import baker
 from pytest_django.asserts import assertNumQueries
 from api.admin import ApiClientAdmin
 from api.models import ApiClient
@pytest.mark.django_db
 def test_reset_hmac_action():
    client_admin = ApiClientAdmin(ApiClient, AdminSite())
    api_clients = baker.make(ApiClient, _quantity=4, _bulk_create=True)
    old_hmac_keys = [c.hmac_key for c in api_clients]
    with assertNumQueries(2):
        qs = ApiClient.objects.filter(id__in=[c.id for c in api_clients[2:4]])
        client_admin.reset_hmac_key(HttpRequest(), qs)
    for c in api_clients:
        c.refresh_from_db()
    assert api_clients[0].hmac_key == old_hmac_keys[0]
    assert api_clients[1].hmac_key == old_hmac_keys[1]
    assert api_clients[2].hmac_key != old_hmac_keys[2]
    assert api_clients[3].hmac_key != old_hmac_keys[3]
@@ -1,22 +0,0 @@
 from typing import TYPE_CHECKING
 import pytest
 from django.urls import reverse
 from model_bakery import baker
 from api.hashers import generate_key
 from api.models import ApiClient, ApiKey
 from api.schemas import ApiClientSchema
 if TYPE_CHECKING:
    from django.test import Client
@pytest.mark.django_db
 def test_api_client_controller(client: Client):
    key, hashed = generate_key()
    api_client = baker.make(ApiClient)
    baker.make(ApiKey, client=api_client, hashed_key=hashed)
    res = client.get(reverse("api:api-client-infos"), headers={"X-APIKey": key})
    assert res.status_code == 200
    assert res.json() == ApiClientSchema.from_orm(api_client).model_dump()
@@ -1,59 +0,0 @@
 import pytest
 from django.contrib.auth.models import Permission
 from django.test import TestCase
 from model_bakery import baker
 from api.models import ApiClient
 from core.models import Group
 class TestClientPermissions(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.api_client = baker.make(ApiClient)
        cls.perms = baker.make(Permission, _quantity=10, _bulk_create=True)
        cls.api_client.groups.set(
            [
                baker.make(Group, permissions=cls.perms[0:3]),
                baker.make(Group, permissions=cls.perms[3:5]),
            ]
        )
        cls.api_client.client_permissions.set(
            [cls.perms[3], cls.perms[5], cls.perms[6], cls.perms[7]]
        )
    def test_all_permissions(self):
        assert self.api_client.all_permissions == {
            f"{p.content_type.app_label}.{p.codename}" for p in self.perms[0:8]
        }
    def test_has_perm(self):
        assert self.api_client.has_perm(
            f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}"
        )
        assert not self.api_client.has_perm(
            f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}"
        )
    def test_has_perms(self):
        assert self.api_client.has_perms(
            [
                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
                f"{self.perms[2].content_type.app_label}.{self.perms[2].codename}",
            ]
        )
        assert not self.api_client.has_perms(
            [
                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
                f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}",
            ],
        )
@pytest.mark.django_db
 def test_reset_hmac_key():
    client = baker.make(ApiClient)
    original_key = client.hmac_key
    client.reset_hmac(commit=True)
    assert len(client.hmac_key) == len(original_key)
    assert client.hmac_key != original_key
@@ -1,140 +0,0 @@
 from unittest import mock
 from unittest.mock import Mock
 from django.contrib.messages import Message, get_messages
 from django.db.models import Max
 from django.test import TestCase
 from django.urls import reverse
 from model_bakery import baker
 from pytest_django.asserts import assertRedirects
 from api.models import ApiClient, get_hmac_key
 from core.baker_recipes import subscriber_user
 from core.schemas import UserProfileSchema
 from core.utils import hmac_hexdigest
 def mocked_post(*, ok: bool):
    class MockedResponse(Mock):
        @property
        def ok(self):
            return ok
    def mocked():
        return MockedResponse()
    return mocked
 class TestThirdPartyAuth(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.user = subscriber_user.make()
        cls.api_client = baker.make(ApiClient)
    def setUp(self):
        self.query = {
            "client_id": self.api_client.id,
            "third_party_app": "app",
            "privacy_link": "https://foobar.fr/",
            "username": "bibou",
            "callback_url": "https://callback.fr/",
        }
        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
        self.callback_data = {
            "user": UserProfileSchema.from_orm(self.user).model_dump()
        }
        self.callback_data["signature"] = hmac_hexdigest(
            self.api_client.hmac_key, self.callback_data["user"]
        )
        self.url = reverse("api-link:third-party-auth", query=self.query)
    def test_auth_ok(self):
        self.client.force_login(self.user)
        res = self.client.get(self.url)
        assert res.status_code == 200
        with mock.patch("requests.post", new_callable=mocked_post(ok=True)) as mocked:
            res = self.client.post(
                self.url,
                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
            )
            mocked.assert_called_once_with(
                self.query["callback_url"], json=self.callback_data
            )
        assertRedirects(
            res,
            reverse("api-link:third-party-auth-result", kwargs={"result": "success"}),
        )
    def test_callback_error(self):
        """Test that the user see the failure page if the callback request failed."""
        self.client.force_login(self.user)
        with mock.patch("requests.post", new_callable=mocked_post(ok=False)) as mocked:
            res = self.client.post(
                self.url,
                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
            )
            mocked.assert_called_once_with(
                self.query["callback_url"], json=self.callback_data
            )
        assertRedirects(
            res,
            reverse("api-link:third-party-auth-result", kwargs={"result": "failure"}),
        )
    def test_wrong_signature(self):
        """Test that a 403 is raised if the signature of the query is wrong."""
        self.client.force_login(subscriber_user.make())
        new_key = get_hmac_key()
        del self.query["signature"]
        self.query["signature"] = hmac_hexdigest(new_key, self.query)
        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
        assert list(get_messages(res.wsgi_request)) == [
            Message(
                level=40,
                message=(
                    "La signature est incorrecte. "
                    "Nous ne pouvons pas garantir l'authenticité de la requête."
                ),
            )
        ]
        res = self.client.post(self.url, data=self.query)
        assert res.status_code == 200
    def test_cgu_not_accepted(self):
        self.client.force_login(self.user)
        res = self.client.get(self.url)
        assert res.status_code == 200
        res = self.client.post(self.url, data=self.query)
        assert res.status_code == 200  # no redirect means invalid form
        res = self.client.post(
            self.url,
            data={"cgu_accepted": False, "is_username_valid": False, **self.query},
        )
        assert res.status_code == 200
    def test_invalid_client(self):
        self.client.force_login(self.user)
        self.query["client_id"] = ApiClient.objects.aggregate(res=Max("id"))["res"] + 1
        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
        assert list(get_messages(res.wsgi_request)) == [
            Message(
                level=40,
                message="Les données fournies pour l'authentification sont incorrectes.",
            )
        ]
    def test_missing_parameter(self):
        self.client.force_login(self.user)
        del self.query["username"]
        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
        assert list(get_messages(res.wsgi_request)) == [
            Message(
                level=40,
                message="Les données fournies pour l'authentification sont incorrectes.",
            )
        ]
        res = self.client.post(self.url, data=self.query)
        assert res.status_code == 200
@@ -1,10 +1,6 @@
 from django.urls import path, register_converter
 from ninja.security import SessionAuth
 from ninja_extra import NinjaExtraAPI
 from api.views import ThirdPartyAuthResultView, ThirdPartyAuthView
 from core.converters import ResultConverter
 api = NinjaExtraAPI(
    title="PICON",
    description="Portail Interactif de Communication avec les Outils Numériques",
@@ -13,14 +9,3 @@ api = NinjaExtraAPI(
    auth=[SessionAuth()],
 )
 api.auto_discover_controllers()
 register_converter(ResultConverter, "res")
 urlpatterns = [
    path("auth/", ThirdPartyAuthView.as_view(), name="third-party-auth"),
    path(
        "auth/<res:result>/",
        ThirdPartyAuthResultView.as_view(),
        name="third-party-auth-result",
    ),
 ]
@@ -1,146 +0,0 @@
 import hmac
 from urllib.parse import unquote
 import pydantic
 import requests
 import sentry_sdk
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.mixins import AccessMixin, LoginRequiredMixin
 from django.shortcuts import render
 from django.urls import reverse, reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.generic import FormView, TemplateView
 from ninja_extra.shortcuts import get_object_or_none
 from api.forms import ThirdPartyAuthForm
 from api.models import ApiClient
 from api.schemas import ThirdPartyAuthParamsSchema
 from core.models import Page
 from core.schemas import UserProfileSchema
 from core.utils import hmac_hexdigest
 class ThirdPartyAuthView(AccessMixin, FormView):
    form_class = ThirdPartyAuthForm
    template_name = "api/third_party/auth.jinja"
    success_url = reverse_lazy("core:index")
    def parse_params(self) -> ThirdPartyAuthParamsSchema | None:
        """Parse and check the authentication parameters.
        If parsing fails, messages will be created using the django message
        infrastructure.
        Returns:
            The parses parameters, or None if the parsing failed.
        """
        # This is here rather than in ThirdPartyAuthForm because
        # the given parameters and their signature are checked during both
        # POST (for obvious reasons) and GET (in order not to make
        # the user fill a form just to get an error he won't understand)
        params = self.request.GET if self.request.method == "GET" else self.request.POST
        params = {key: unquote(val) for key, val in params.dict().items()}
        try:
            params = ThirdPartyAuthParamsSchema(**params)
        except pydantic.ValidationError:
            messages.error(
                self.request, _("The data provided for authentication is incorrect")
            )
            return None
        client: ApiClient | None = get_object_or_none(ApiClient, id=params.client_id)
        if not client:
            messages.error(
                self.request, _("The data provided for authentication is incorrect")
            )
            return None
        if not hmac.compare_digest(
            hmac_hexdigest(client.hmac_key, params.model_dump(exclude={"signature"})),
            params.signature,
        ):
            messages.error(
                self.request,
                _(
                    "The signature is incorrect. "
                    "We cannot ensure the provenance of the request."
                ),
            )
            return None
        return params
    def dispatch(self, request, *args, **kwargs):
        if not request.user.is_authenticated:
            return self.handle_no_permission()
        if (params := self.parse_params()) is None:
            # if parameters parsing failed, shortcut the operation and display
            # an empty page with just the error messages.
            return render(request, "core/base.jinja")
        self.params = params
        return super().dispatch(request, *args, **kwargs)
    def get(self, *args, **kwargs):
        messages.warning(
            self.request,
            _(
                "You are going to link your AE account and your %(app)s account. "
                "Continue only if this page was opened from %(app)s."
            )
            % {"app": self.params.third_party_app},
        )
        return super().get(*args, **kwargs)
    def get_initial(self):
        return self.params.model_dump()
    def form_valid(self, form):
        client = ApiClient.objects.get(id=form.cleaned_data["client_id"])
        user = UserProfileSchema.from_orm(self.request.user).model_dump()
        data = {"user": user, "signature": hmac_hexdigest(client.hmac_key, user)}
        try:
            ok = requests.post(form.cleaned_data["callback_url"], json=data).ok
        except requests.RequestException as e:
            sentry_sdk.capture_exception(e)
            ok = False
        self.success_url = reverse(
            "api-link:third-party-auth-result",
            kwargs={"result": "success" if ok else "failure"},
        )
        return super().form_valid(form)
    def get_context_data(self, **kwargs):
        return super().get_context_data(**kwargs) | {
            "third_party_app": self.params.third_party_app,
            "third_party_cgu": self.params.privacy_link,
            "sith_cgu": Page.objects.get(_full_name=settings.SITH_CGU_PAGE),
        }
 class ThirdPartyAuthResultView(LoginRequiredMixin, TemplateView):
    """View that the user will see if its authentication on sith was successful.
    This can show either a success or a failure message :
    - success : everything is good, the user is successfully authenticated
      and can close the page
    - failure : the authentication has been processed on the sith side,
      but the request to the callback url received an error.
      In such a case, there is nothing much we can do but to advice
      the user to contact the developers of the third-party app.
    """
    template_name = "core/base.jinja"
    success_message = _(
        "You have been successfully authenticated. You can now close this page."
    )
    error_message = _(
        "Your authentication on the AE website was successful, "
        "but an error happened during the interaction "
        "with the third-party application. "
        "Please contact the managers of the latter."
    )
    def get(self, request, *args, **kwargs):
        if self.kwargs.get("result") == "success":
            messages.success(request, self.success_message)
        else:
            messages.error(request, self.error_message)
        return super().get(request, *args, **kwargs)
@@ -31,10 +31,20 @@ from django.forms.models import ModelChoiceField, ModelChoiceIterator
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
-from club.models import Club, ClubLink, ClubRole, Membership
+from club.models import (
    Club,
    ClubLink,
    ClubRole,
    Mailing,
    MailingSubscription,
    Membership,
 )
 from core.models import User
 from core.views.forms import SelectDateTime
-from core.views.widgets.ajax_select import AutoCompleteSelectUser
+from core.views.widgets.ajax_select import (
    AutoCompleteSelectMultipleUser,
    AutoCompleteSelectUser,
 )
 from counter.models import Counter, Selling
 from counter.schemas import SaleFilterSchema
@@ -121,6 +131,107 @@ class ClubAdminEditForm(ClubEditForm):
        fields = ["name", "parent", "is_active", *ClubEditForm.Meta.fields]
 class MailingForm(forms.Form):
    """Form handling mailing lists right."""
    ACTION_NEW_MAILING = 1
    ACTION_NEW_SUBSCRIPTION = 2
    ACTION_REMOVE_SUBSCRIPTION = 3
    subscription_users = forms.ModelMultipleChoiceField(
        label=_("Users to add"),
        help_text=_("Search users to add (one or more)."),
        required=False,
        widget=AutoCompleteSelectMultipleUser,
        queryset=User.objects.all(),
    )
    def __init__(self, club_id, user_id, mailings, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.fields["action"] = forms.TypedChoiceField(
            choices=(
                (self.ACTION_NEW_MAILING, _("New Mailing")),
                (self.ACTION_NEW_SUBSCRIPTION, _("Subscribe")),
                (self.ACTION_REMOVE_SUBSCRIPTION, _("Remove")),
            ),
            coerce=int,
            label=_("Action"),
            initial=1,
            required=True,
            widget=forms.HiddenInput(),
        )
        # Generate bulk removal forms, they are never required
        for mailing in mailings:
            self.fields["removal_" + str(mailing.id)] = forms.ModelMultipleChoiceField(
                mailing.subscriptions.all(),
                label=_("Remove"),
                required=False,
                widget=forms.CheckboxSelectMultiple,
            )
        # Include fields for handling mailing creation
        mailing_fields = ("email",)
        self.fields.update(forms.fields_for_model(Mailing, fields=mailing_fields))
        for field in mailing_fields:
            self.fields["mailing_" + field] = self.fields.pop(field)
            self.fields["mailing_" + field].required = False
        # Include fields for handling subscription creation
        subscription_fields = ("mailing", "email")
        self.fields.update(
            forms.fields_for_model(MailingSubscription, fields=subscription_fields)
        )
        for field in subscription_fields:
            self.fields["subscription_" + field] = self.fields.pop(field)
            self.fields["subscription_" + field].required = False
        self.fields["subscription_mailing"].queryset = Mailing.objects.filter(
            club__id=club_id, is_moderated=True
        )
    def check_required(self, cleaned_data, field):
        """If the given field doesn't exist or has no value, add a required error on it."""
        if not cleaned_data.get(field, None):
            self.add_error(field, _("This field is required"))
    def clean_subscription_users(self):
        """Convert given users into real users and check their validity."""
        cleaned_data = super().clean()
        users = []
        for user in cleaned_data["subscription_users"]:
            if not user.email:
                raise forms.ValidationError(
                    _("One of the selected users doesn't have an email address"),
                    code="invalid",
                )
            users.append(user)
        return users
    def clean(self):
        cleaned_data = super().clean()
        if "action" not in cleaned_data:
            # If there is no action provided, we can stop here
            raise forms.ValidationError(_("An action is required"), code="invalid")
        if cleaned_data["action"] == self.ACTION_NEW_MAILING:
            self.check_required(cleaned_data, "mailing_email")
        if cleaned_data["action"] == self.ACTION_NEW_SUBSCRIPTION:
            self.check_required(cleaned_data, "subscription_mailing")
            if not cleaned_data.get(
                "subscription_users", None
            ) and not cleaned_data.get("subscription_email", None):
                raise forms.ValidationError(
                    _("You must specify at least an user or an email address"),
                    code="invalid",
                )
        return cleaned_data
 class SellingsForm(forms.Form):
    begin_date = forms.DateTimeField(
        label=_("Begin date"), widget=SelectDateTime, required=False
@@ -1,16 +0,0 @@
 # Generated by Django 5.2.17 on 2026-10-15 13:13
 from django.db import migrations
 class Migration(migrations.Migration):
    dependencies = [("club", "0018_clubrole_linked_groups")]
    operations = [
        migrations.AlterUniqueTogether(
            name="mailingsubscription", unique_together=None
        ),
        migrations.RemoveField(model_name="mailingsubscription", name="user"),
        migrations.DeleteModel(name="Mailing"),
        migrations.DeleteModel(name="MailingSubscription"),
    ]
@@ -28,7 +28,8 @@ from functools import reduce
 from typing import Iterable, Self
 from django.conf import settings
-from django.core.exceptions import ValidationError
+from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import RegexValidator, validate_email
 from django.db import ProgrammingError, models, transaction
 from django.db.models import Exists, F, OuterRef, Q
 from django.urls import reverse
@@ -40,7 +41,7 @@ from django.utils.translation import gettext_lazy as _
 from ordered_model.models import OrderedModel
 from core.fields import ResizedImageField
-from core.models import Group, Page, SithFile, User
+from core.models import Group, Notification, Page, SithFile, User
 class ClubQuerySet(models.QuerySet):
@@ -632,6 +633,169 @@ class Membership(models.Model):
        return User.groups.through.objects.bulk_create(groups, ignore_conflicts=True)
 class Mailing(models.Model):
    """A Mailing list for a club.
    Warning:
        Remember that mailing lists should be validated by UTBM.
    """
    club = models.ForeignKey(
        Club,
        verbose_name=_("Club"),
        related_name="mailings",
        null=False,
        blank=False,
        on_delete=models.CASCADE,
    )
    email = models.CharField(
        _("Email address"),
        unique=True,
        null=False,
        blank=False,
        max_length=256,
        validators=[
            RegexValidator(
                validate_email.user_regex,
                _("Enter a valid address. Only the root of the address is needed."),
            )
        ],
    )
    is_moderated = models.BooleanField(_("is moderated"), default=False)
    moderator = models.ForeignKey(
        User,
        related_name="moderated_mailings",
        verbose_name=_("moderator"),
        null=True,
        on_delete=models.CASCADE,
    )
    def __str__(self):
        return "%s - %s" % (self.club, self.email_full)
    def save(self, *args, **kwargs):
        if not self.is_moderated:
            unread_notif_subquery = Notification.objects.filter(
                user=OuterRef("pk"), type="MAILING_MODERATION", viewed=False
            )
            for user in User.objects.filter(
                ~Exists(unread_notif_subquery),
                groups__id__in=[settings.SITH_GROUP_COM_ADMIN_ID],
            ):
                Notification(
                    user=user,
                    url=reverse("com:mailing_admin"),
                    type="MAILING_MODERATION",
                ).save(*args, **kwargs)
        super().save(*args, **kwargs)
    def clean(self):
        if Mailing.objects.filter(email=self.email).exists():
            raise ValidationError(_("This mailing list already exists."))
        if self.can_moderate(self.moderator):
            self.is_moderated = True
        else:
            self.moderator = None
        super().clean()
    @property
    def email_full(self):
        return self.email + "@" + settings.SITH_MAILING_DOMAIN
    def can_moderate(self, user):
        return user.is_root or user.is_com_admin
    def is_owned_by(self, user):
        if user.is_anonymous:
            return False
        return user.is_root or user.is_com_admin
    def can_view(self, user):
        return self.club.has_rights_in_club(user)
    def can_be_edited_by(self, user):
        return self.club.has_rights_in_club(user)
    def delete(self, *args, **kwargs):
        self.subscriptions.all().delete()
        super().delete()
    def fetch_format(self):
        destination = "".join(s.fetch_format() for s in self.subscriptions.all())
        return f"{self.email}: {destination}"
 class MailingSubscription(models.Model):
    """Link between user and mailing list."""
    mailing = models.ForeignKey(
        Mailing,
        verbose_name=_("Mailing"),
        related_name="subscriptions",
        null=False,
        blank=False,
        on_delete=models.CASCADE,
    )
    user = models.ForeignKey(
        User,
        verbose_name=_("User"),
        related_name="mailing_subscriptions",
        null=True,
        blank=True,
        on_delete=models.CASCADE,
    )
    email = models.EmailField(_("Email address"), blank=False, null=False)
    class Meta:
        unique_together = (("user", "email", "mailing"),)
    def __str__(self):
        return "(%s) - %s : %s" % (self.mailing, self.get_username, self.email)
    def clean(self):
        if not self.user and not self.email:
            raise ValidationError(_("At least user or email is required"))
        try:
            if self.user and not self.email:
                self.email = self.user.email
                if MailingSubscription.objects.filter(
                    mailing=self.mailing, email=self.email
                ).exists():
                    raise ValidationError(
                        _("This email is already suscribed in this mailing")
                    )
        except ObjectDoesNotExist:
            pass
        super().clean()
    def is_owned_by(self, user):
        if user.is_anonymous:
            return False
        return (
            self.mailing.club.has_rights_in_club(user)
            or user.is_root
            or self.user.is_com_admin
        )
    def can_be_edited_by(self, user):
        return self.user is not None and user.id == self.user.id
    @cached_property
    def get_email(self):
        if self.user and not self.email:
            return self.user.email
        return self.email
    @cached_property
    def get_username(self):
        if self.user:
            return str(self.user)
        return _("Unregistered user")
    def fetch_format(self):
        return self.get_email + " "
 class LinkType(models.Model):
    """A link type, in order to group links and give them icons.
@@ -15,6 +15,9 @@
          {% trans %}Post in the Weekmail{% endtrans %}
        </a>
      </li>
      {% if object.can_roles_be_edited_by(user) %}
        <li><a href="{{ url("club:club_roles", club_id=object.id) }}"></a></li>
      {% endif %}
      {% if object.trombi %}
        <li> <a href="{{ url('trombi:detail', trombi_id=object.trombi.id) }}">{% trans %}Edit Trombi{% endtrans %}</a></li>
      {% else %}
@@ -0,0 +1,108 @@
 {% extends "core/base.jinja" %}
 {% from 'core/macros.jinja' import select_all_checkbox %}
 {% block title %}
  {% trans %}Mailing lists{% endtrans %}
 {% endblock %}
 {% block content %}
  <b>{% trans %}Remember : mailing lists need to be moderated, if your new created list is not shown wait until moderation takes action{% endtrans %}</b>
  {% if mailings_not_moderated %}
    <p>{% trans %}Mailing lists waiting for moderation{% endtrans %}</p>
    <ul>
      {% for mailing in mailings_not_moderated %}
        <li>{{ mailing.email_full }}<a href="{{ url('club:mailing_delete', mailing_id=mailing.id) }}"> - {% trans %}Delete{% endtrans %}</a></li>
      {% endfor %}
    </ul>
  {% endif %}
  {% if mailings_moderated %}
    {% for mailing in mailings_moderated %}
      <h2>{% trans %}Mailing{% endtrans %} {{ mailing.email_full }}
        {%- if user.is_owner(mailing) -%}
          <a href="{{ url('club:mailing_delete', mailing_id=mailing.id) }}"> - {% trans %}Delete{% endtrans %}</a>
        {%- endif -%}
      </h2>
      <form method="GET" action="{{ url('club:mailing_generate', mailing_id=mailing.id) }}" style="display:inline-block;">
        <input type="submit" name="generateMalingList" value="{% trans %}Generate mailing list{% endtrans %}">
      </form>
      {% set form_mailing_removal = form["removal_" + mailing.id|string] %}
      {% if form_mailing_removal.field.choices %}
        {% set ms = dict(mailing.subscriptions.all() | groupby('id')) %}
        <form action="{{ url('club:mailing', club_id=club.id) }}" id="{{ form_mailing_removal.auto_id }}" method="post" enctype="multipart/form-data">
          <p style="margin-bottom: 1em;">{{ select_all_checkbox(form_mailing_removal.auto_id) }}</p>
          {% csrf_token %}
          <input hidden type="number" name="{{ form.action.name }}" value="{{ form_actions.REMOVE_SUBSCRIPTION }}" />
          <table>
            <thead>
              <tr>
                <td>{% trans %}User{% endtrans %}</td>
                <td>{% trans %}Email{% endtrans %}</td>
                <td>{% trans %}Delete{% endtrans %}</td>
              </tr>
            </thead>
            <tbody>
              {% for widget in form_mailing_removal.subwidgets %}
                {% set user = ms[widget.data.value.value][0] %}
                <tr>
                  <td>{{ user.get_username }}</td>
                  <td>{{ user.get_email }}</td>
                  <td>{{ widget.tag() }}</td>
                </tr>
              {% endfor %}
            </tbody>
          </table>
          {{ form_mailing_removal.errors }}
          <p><input type="submit" value="{% trans %}Remove from mailing list{% endtrans %}" /></p>
        </form>
      {% else %}
        <p><b>{% trans %}There is no subscriber for this mailing list{% endtrans %}</b></p>
      {% endif %}
    {% endfor %}
  {% else %}
    <p>{% trans %}No mailing list existing for this club{% endtrans %}</p>
  {% endif %}
  <p>{{ form.non_field_errors() }}</p>
  {% if mailings_moderated %}
    <h2>{% trans %}New member{% endtrans %}</h2>
    <form action="{{ url('club:mailing', club_id=club.id) }}" method="post" enctype="multipart/form-data">
      {% csrf_token %}
      <p>
        {{ form.subscription_mailing.errors }}
        <label for="{{ form.subscription_mailing.id_for_label }}">{{ form.subscription_mailing.label }}</label>
        {{ form.subscription_mailing }}
      </p>
      <p>
        {{ form.subscription_users.errors }}
        <label for="{{ form.subscription_users.id_for_label }}">{{ form.subscription_users.label }}</label>
        {{ form.subscription_users }}
        <span class="helptext">{{ form.subscription_users.help_text }}</span>
      </p>
      <p>
        {{ form.subscription_email.errors }}
        <label for="{{ form.subscription_email.id_for_label }}">{{ form.subscription_email.label }}</label>
        {{ form.subscription_email }}
      </p>
      <input hidden type="number" name="{{ form.action.name }}" value="{{ form_actions.NEW_SUBSCRIPTION }}" />
      <p><input type="submit" value="{% trans %}Add to mailing list{% endtrans %}" /></p>
    </form>
  {% endif %}
  <h2>{% trans %}New mailing{% endtrans %}</h2>
  <form action="{{ url('club:mailing', club_id=club.id) }}" method="post" enctype="multipart/form-data">
    {% csrf_token %}
    <p>
      {{ form.mailing_email.errors }}
      <label for="{{ form.mailing_email.id_for_label }}">{{ form.mailing_email.label }}</label>
      {{ form.mailing_email }}
    </p>
    <input hidden type="number" name="{{ form.action.name }}" value="{{ form_actions.NEW_MALING }}" />
    <p><input type="submit" value="{% trans %}Create mailing list{% endtrans %}" /></p>
  </form>
 {% endblock %}
@@ -0,0 +1,328 @@
 from django.conf import settings
 from django.test import TestCase
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.translation import gettext as _
 from model_bakery import baker
 from club.forms import MailingForm
 from club.models import Club, ClubRole, Mailing, Membership
 from core.models import User
 class TestMailingForm(TestCase):
    """Perform validation tests for MailingForm."""
    @classmethod
    def setUpTestData(cls):
        cls.skia = User.objects.get(username="skia")
        cls.rbatsbak = User.objects.get(username="rbatsbak")
        cls.krophil = User.objects.get(username="krophil")
        cls.comunity = User.objects.get(username="comunity")
        cls.root = User.objects.get(username="root")
        cls.club = Club.objects.get(id=settings.SITH_PDF_CLUB_ID)
        cls.mail_url = reverse("club:mailing", kwargs={"club_id": cls.club.id})
        Membership(
            user=cls.rbatsbak,
            club=cls.club,
            start_date=timezone.now(),
            role=baker.make(ClubRole, club=cls.club, is_board=True),
        ).save()
    def test_mailing_list_add_no_moderation(self):
        # Test with Communication admin
        self.client.force_login(self.comunity)
        response = self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "foyer"},
        )
        self.assertRedirects(response, self.mail_url)
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        assert "Liste de diffusion foyer@utbm.fr" in response.text
        # Test with Root
        self.client.force_login(self.root)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        assert "Liste de diffusion mde@utbm.fr" in response.text
    def test_mailing_list_add_moderation(self):
        self.client.force_login(self.rbatsbak)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "Liste de diffusion mde@utbm.fr" not in content
        assert "<p>Listes de diffusions en attente de modération</p>" in content
        assert "<li>mde@utbm.fr" in content
    def test_mailing_list_forbidden(self):
        # With anonymous user
        response = self.client.get(self.mail_url)
        self.assertContains(response, "", status_code=403)
        # With user not in club
        self.client.force_login(self.krophil)
        response = self.client.get(self.mail_url)
        assert response.status_code == 403
    def test_add_new_subscription_fail_not_moderated(self):
        self.client.force_login(self.rbatsbak)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.skia.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        assert "skia@git.an" not in response.text
    def test_add_new_subscription_success(self):
        # Prepare mailing list
        self.client.force_login(self.comunity)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        # Add single user
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.skia.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        assert "skia@git.an" in response.text
        # Add multiple users
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": (self.comunity.id, self.rbatsbak.id),
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "richard@git.an" in content
        assert "comunity@git.an" in content
        assert "skia@git.an" in content
        # Add arbitrary email
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_email": "arbitrary@git.an",
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "richard@git.an" in content
        assert "comunity@git.an" in content
        assert "skia@git.an" in content
        assert "arbitrary@git.an" in content
        # Add user and arbitrary email
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_email": "more.arbitrary@git.an",
                "subscription_users": self.krophil.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "richard@git.an" in content
        assert "comunity@git.an" in content
        assert "skia@git.an" in content
        assert "arbitrary@git.an" in content
        assert "more.arbitrary@git.an" in content
        assert "krophil@git.an" in content
    def test_add_new_subscription_fail_form_errors(self):
        # Prepare mailing list
        self.client.force_login(self.comunity)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        # Neither email or email is specified
        response = self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        assert response.status_code
        self.assertInHTML(
            _("You must specify at least an user or an email address"),
            response.text,
        )
        # No mailing specified
        response = self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.krophil.id,
            },
        )
        assert response.status_code == 200
        assert _("This field is required") in response.text
        # One of the selected users doesn't exist
        response = self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": [789],
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        assert response.status_code == 200
        self.assertInHTML(
            _("You must specify at least an user or an email address"),
            response.text,
        )
        # An user has no email address
        self.krophil.email = ""
        self.krophil.save()
        response = self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.krophil.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        assert response.status_code == 200
        self.assertInHTML(
            _("One of the selected users doesn't have an email address"),
            response.text,
        )
        self.krophil.email = "krophil@git.an"
        self.krophil.save()
        # An user is added twice
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.krophil.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        response = self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": self.krophil.id,
                "subscription_mailing": Mailing.objects.get(email="mde").id,
            },
        )
        assert response.status_code == 200
        self.assertInHTML(
            _("This email is already suscribed in this mailing"),
            response.text,
        )
    def test_remove_subscription_success(self):
        # Prepare mailing list
        self.client.force_login(self.comunity)
        self.client.post(
            self.mail_url,
            {"action": MailingForm.ACTION_NEW_MAILING, "mailing_email": "mde"},
        )
        mde = Mailing.objects.get(email="mde")
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_NEW_SUBSCRIPTION,
                "subscription_users": (
                    self.comunity.id,
                    self.rbatsbak.id,
                    self.krophil.id,
                ),
                "subscription_mailing": mde.id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "comunity@git.an" in content
        assert "richard@git.an" in content
        assert "krophil@git.an" in content
        # Delete one user
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_REMOVE_SUBSCRIPTION,
                "removal_%d" % mde.id: mde.subscriptions.get(user=self.krophil).id,
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "comunity@git.an" in content
        assert "richard@git.an" in content
        assert "krophil@git.an" not in content
        # Delete multiple users
        self.client.post(
            self.mail_url,
            {
                "action": MailingForm.ACTION_REMOVE_SUBSCRIPTION,
                "removal_%d" % mde.id: [
                    user.id
                    for user in mde.subscriptions.filter(
                        user__in=[self.rbatsbak, self.comunity]
                    ).all()
                ],
            },
        )
        response = self.client.get(self.mail_url)
        assert response.status_code == 200
        content = response.text
        assert "comunity@git.an" not in content
        assert "richard@git.an" not in content
        assert "krophil@git.an" not in content
@@ -29,6 +29,7 @@ from club.views import (
    ClubCreateView,
    ClubEditView,
    ClubListView,
    ClubMailingView,
    ClubMembersView,
    ClubOldMembersView,
    ClubPageEditView,
@@ -42,6 +43,9 @@ from club.views import (
    ClubSellingView,
    ClubToolsView,
    ClubView,
    MailingAutoGenerationView,
    MailingDeleteView,
    MailingSubscriptionDeleteView,
    MembershipDeleteView,
    MembershipSetOldView,
    PosterCreateView,
@@ -92,6 +96,22 @@ urlpatterns = [
        "<int:club_id>/sellings/csv/", ClubSellingCSVView.as_view(), name="sellings_csv"
    ),
    path("<int:club_id>/tools/", ClubToolsView.as_view(), name="tools"),
    path("<int:club_id>/mailing/", ClubMailingView.as_view(), name="mailing"),
    path(
        "<int:mailing_id>/mailing/generate/",
        MailingAutoGenerationView.as_view(),
        name="mailing_generate",
    ),
    path(
        "<int:mailing_id>/mailing/delete/",
        MailingDeleteView.as_view(),
        name="mailing_delete",
    ),
    path(
        "<int:mailing_subscription_id>/mailing/delete/subscription/",
        MailingSubscriptionDeleteView.as_view(),
        name="mailing_subscription_delete",
    ),
    path(
        "membership/<int:membership_id>/set_old/",
        MembershipSetOldView.as_view(),
@@ -34,6 +34,7 @@ from django.contrib.auth.mixins import (
    UserPassesTestMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import NON_FIELD_ERRORS, PermissionDenied, ValidationError
 from django.core.paginator import InvalidPage, Paginator
 from django.db.models import F, Prefetch, Q, Sum
 from django.db.models.functions import Length
@@ -58,6 +59,7 @@ from club.forms import (
    ClubRoleFormSet,
    ClubSearchForm,
    JoinClubForm,
    MailingForm,
    SellingsForm,
 )
 from club.models import (
@@ -65,6 +67,8 @@ from club.models import (
    ClubLink,
    ClubRole,
    LinkType,
    Mailing,
    MailingSubscription,
    Membership,
 )
 from com.models import Poster
@@ -177,6 +181,13 @@ class ClubTabsMixin(TabedViewMixin):
                        "slug": "sellings",
                        "name": _("Sellings"),
                    },
                    {
                        "url": reverse(
                            "club:mailing", kwargs={"club_id": self.object.id}
                        ),
                        "slug": "mailing",
                        "name": _("Mailing list"),
                    },
                    {
                        "url": reverse(
                            "club:poster_list", kwargs={"club_id": self.object.id}
@@ -731,6 +742,166 @@ class MembershipDeleteView(PermissionRequiredMixin, DeleteView):
        return reverse_lazy("core:user_clubs", kwargs={"user_id": self.object.user_id})
 class ClubMailingView(ClubTabsMixin, CanEditMixin, DetailFormView):
    """A list of mailing for a given club."""
    model = Club
    form_class = MailingForm
    pk_url_kwarg = "club_id"
    template_name = "club/mailing.jinja"
    current_tab = "mailing"
    def get_form_kwargs(self):
        kwargs = super().get_form_kwargs()
        kwargs["club_id"] = self.object.id
        kwargs["user_id"] = self.request.user.id
        kwargs["mailings"] = self.object.mailings.all()
        return kwargs
    def get_context_data(self, **kwargs):
        kwargs = super().get_context_data(**kwargs)
        mailings = list(self.object.mailings.all())
        kwargs["club"] = self.object
        kwargs["user"] = self.request.user
        kwargs["mailings"] = mailings
        kwargs["mailings_moderated"] = [m for m in mailings if m.is_moderated]
        kwargs["mailings_not_moderated"] = [m for m in mailings if not m.is_moderated]
        kwargs["form_actions"] = {
            "NEW_MALING": self.form_class.ACTION_NEW_MAILING,
            "NEW_SUBSCRIPTION": self.form_class.ACTION_NEW_SUBSCRIPTION,
            "REMOVE_SUBSCRIPTION": self.form_class.ACTION_REMOVE_SUBSCRIPTION,
        }
        return kwargs
    def add_new_mailing(self, cleaned_data) -> ValidationError | None:
        """Create a new mailing list from the form."""
        mailing = Mailing(
            club=self.object,
            email=cleaned_data["mailing_email"],
            moderator=self.request.user,
            is_moderated=False,
        )
        try:
            mailing.clean()
        except ValidationError as validation_error:
            return validation_error
        mailing.save()
        return None
    def add_new_subscription(self, cleaned_data) -> ValidationError | None:
        """Add mailing subscriptions for each user given and/or for the specified email in form."""
        users_to_save = []
        for user in cleaned_data["subscription_users"]:
            sub = MailingSubscription(
                mailing=cleaned_data["subscription_mailing"], user=user
            )
            try:
                sub.clean()
            except ValidationError as validation_error:
                return validation_error
            sub.save()
            users_to_save.append(sub)
        if cleaned_data["subscription_email"]:
            sub = MailingSubscription(
                mailing=cleaned_data["subscription_mailing"],
                email=cleaned_data["subscription_email"],
            )
        try:
            sub.clean()
        except ValidationError as validation_error:
            return validation_error
        sub.save()
        # Save users after we are sure there is no error
        for user in users_to_save:
            user.save()
        return None
    def remove_subscription(self, cleaned_data):
        """Remove specified users from a mailing list."""
        fields = [
            val for key, val in cleaned_data.items() if key.startswith("removal_")
        ]
        for field in fields:
            for sub in field:
                sub.delete()
    def form_valid(self, form):
        resp = super().form_valid(form)
        cleaned_data = form.clean()
        error = None
        if cleaned_data["action"] == self.form_class.ACTION_NEW_MAILING:
            error = self.add_new_mailing(cleaned_data)
        if cleaned_data["action"] == self.form_class.ACTION_NEW_SUBSCRIPTION:
            error = self.add_new_subscription(cleaned_data)
        if cleaned_data["action"] == self.form_class.ACTION_REMOVE_SUBSCRIPTION:
            self.remove_subscription(cleaned_data)
        if error:
            form.add_error(NON_FIELD_ERRORS, error)
            return self.form_invalid(form)
        return resp
    def get_success_url(self, **kwargs):
        return reverse("club:mailing", kwargs={"club_id": self.object.id})
 class MailingDeleteView(CanEditMixin, DeleteView):
    model = Mailing
    template_name = "core/delete_confirm.jinja"
    pk_url_kwarg = "mailing_id"
    redirect_page = None
    def dispatch(self, request, *args, **kwargs):
        self.club_id = self.get_object().club.id
        return super().dispatch(request, *args, **kwargs)
    def get_success_url(self, **kwargs):
        if self.redirect_page:
            return reverse_lazy(self.redirect_page)
        else:
            return reverse_lazy("club:mailing", kwargs={"club_id": self.club_id})
 class MailingSubscriptionDeleteView(CanEditMixin, DeleteView):
    model = MailingSubscription
    template_name = "core/delete_confirm.jinja"
    pk_url_kwarg = "mailing_subscription_id"
    def dispatch(self, request, *args, **kwargs):
        self.club_id = self.get_object().mailing.club.id
        return super().dispatch(request, *args, **kwargs)
    def get_success_url(self, **kwargs):
        return reverse_lazy("club:mailing", kwargs={"club_id": self.club_id})
 class MailingAutoGenerationView(View):
    def dispatch(self, request, *args, **kwargs):
        self.mailing = get_object_or_404(Mailing, pk=kwargs["mailing_id"])
        if not request.user.can_edit(self.mailing):
            raise PermissionDenied
        return super().dispatch(request, *args, **kwargs)
    def get(self, request, *args, **kwargs):
        club = self.mailing.club
        self.mailing.subscriptions.all().delete()
        members = club.members.ongoing().filter(role__is_board=True)
        for member in members.all():
            MailingSubscription(user=member.user, mailing=self.mailing).save()
        return redirect("club:mailing", club_id=club.id)
 class PosterListView(
    PermissionOrClubBoardRequiredMixin, ClubTabsMixin, PosterListBaseView
 ):
@@ -259,7 +259,10 @@ class Weekmail(models.Model):
        return f"Weekmail {self.id} (sent: {self.sent}) - {self.title}"
    def send(self):
-        """Send the weekmail to all users with the receive weekmail option opt-in."""
+        """Send the weekmail to all users with the receive weekmail option opt-in.
        Also send the weekmail to the mailing list in settings.SITH_COM_EMAIL.
        """
        dest = [
            i[0]
            for i in Preferences.objects.filter(receive_weekmail=True).values_list(
@@ -0,0 +1,45 @@
 {% extends "core/base.jinja" %}
 {% block title %}
  {% trans %}Mailing lists administration{% endtrans %}
 {% endblock %}
 {% macro display_mailings(list) %}
  <table>
    <tr>
      <th>{% trans %}Email{% endtrans %}</th>
      <th>{% trans %}Club{%endtrans%}</th>
      <th>{% trans %}Actions{% endtrans %}</th>
    </tr>
    {% for mailing in list %}
      <tr>
        <td>{{ mailing.email_full }}</td>
        <td><a href="{{ url('club:mailing', club_id=mailing.club.id) }}">{{ mailing.club }}</a></td>
        <td>
          <a href="{{ url('com:mailing_delete', mailing_id=mailing.id) }}">{% trans %}Delete{% endtrans %}</a> - {% if not mailing.is_moderated %}<a href="{{ url('com:mailing_moderate', mailing_id=mailing.id) }}">{% trans %}Moderate{% endtrans %}</a>{% else %}{% trans user=mailing.moderator %}Moderated by {{ user }}{% endtrans %}{% endif %}
        </td>
      </tr>
    {% endfor %}
  </table>
 {% endmacro %}
 {% block content %}
  <h1>{% trans %}This page lists all mailing lists{% endtrans %}</h1>
  {% if has_unmoderated %}
    <h2>{% trans %}Not moderated mailing lists{% endtrans %}</h2>
    {{ display_mailings(unmoderated) }}
  {% endif %}
  <h2>{% trans %}Moderated mailing lists{% endtrans %}</h2>
  {% if has_moderated %}
    {{ display_mailings(moderated) }}
  {% else %}
    <p>{% trans %}No mailing list existing{% endtrans %}</p>
  {% endif %}
 {% endblock %}
@@ -39,18 +39,12 @@
        <a href="{{ news.club.get_absolute_url() }}">{{ news.club }}</a>
      </div>
      <h4>{{ news.title }}</h4>
      {% if date %}
      <p class="date">
-          <time datetime="{{ date.start_date.isoformat(timespec="seconds") }}">
+        <time datetime="{{ date.start_date.isoformat(timespec="seconds") }}">{{ date.start_date|localtime|date(DATETIME_FORMAT) }}
-            {{ date.start_date|localtime|date(DATETIME_FORMAT) }}
+          {{ date.start_date|localtime|time(DATETIME_FORMAT) }}</time> -
-            {{ date.start_date|localtime|time(DATETIME_FORMAT) }}
+        <time datetime="{{ date.end_date.isoformat(timespec="seconds") }}">{{ date.end_date|localtime|date(DATETIME_FORMAT) }}
-          </time> -
+          {{ date.end_date|localtime|time(DATETIME_FORMAT) }}</time>
          <time datetime="{{ date.end_date.isoformat(timespec="seconds") }}">
            {{ date.end_date|localtime|date(DATETIME_FORMAT) }}
            {{ date.end_date|localtime|time(DATETIME_FORMAT) }}
          </time>
      </p>
      {% endif %}
      <div class="news_content">
        <div><em>{{ news.summary|markdown }}</em></div>
        <br/>
@@ -26,7 +26,6 @@ from django.utils import html
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
 from model_bakery import baker
 from model_bakery.recipe import Recipe
 from pytest_django.asserts import assertNumQueries, assertRedirects
 from club.models import Club, ClubRole, Membership
@@ -363,37 +362,3 @@ def test_moderate_poster(client: Client, referer: str | None):
    poster.refresh_from_db()
    assert poster.is_moderated
    assert poster.moderator == user
 class TestNewsDetail(TestCase):
    @classmethod
    def setUpTestData(cls) -> None:
        cls.news = baker.make(News, is_published=True)
        cls.user = subscriber_user.make()
        cls.url = reverse("com:news_detail", kwargs={"news_id": cls.news.id})
    def test_page_ok(self):
        self.client.force_login(self.user)
        res = self.client.get(self.url)
        assert res.status_code == 200
    def test_displayed_date(self):
        self.client.force_login(self.user)
        n = now()
        date_recipe = Recipe(NewsDate, news=self.news)
        date_recipe.make(
            start_date=n - timedelta(days=1, hours=6), end_date=n - timedelta(days=1)
        )
        date_recipe.make(
            start_date=n - timedelta(hours=6), end_date=n + timedelta(hours=1)
        )
        expected = date_recipe.make(  # we expect the next happening date.
            start_date=n + timedelta(days=1), end_date=n + timedelta(days=1, hours=1)
        )
        date_recipe.make(
            start_date=n + timedelta(days=2), end_date=n + timedelta(days=2, hours=1)
        )
        self.client.force_login(self.user)
        res = self.client.get(self.url)
        assert res.status_code == 200
        assert res.context_data["date"] == expected
@@ -15,9 +15,12 @@
 from django.urls import path
 from club.views import MailingDeleteView
 from com.views import (
    AlertMsgEditView,
    InfoMsgEditView,
    MailingListAdminView,
    MailingModerateView,
    NewsAdminListView,
    NewsCreateView,
    NewsDeleteView,
@@ -79,6 +82,17 @@ urlpatterns = [
        "news/<int:news_id>/moderate/", NewsModerateView.as_view(), name="news_moderate"
    ),
    path("news/<int:news_id>/", NewsDetailView.as_view(), name="news_detail"),
    path("mailings/", MailingListAdminView.as_view(), name="mailing_admin"),
    path(
        "mailings/<int:mailing_id>/moderate/",
        MailingModerateView.as_view(),
        name="mailing_moderate",
    ),
    path(
        "mailings/<int:mailing_id>/delete/",
        MailingDeleteView.as_view(redirect_page="com:mailing_admin"),
        name="mailing_delete",
    ),
    path("poster/", PosterListView.as_view(), name="poster_list"),
    path("poster/create/", PosterCreateView.as_view(), name="poster_create"),
    path("poster/<int:poster_id>/edit/", PosterEditView.as_view(), name="poster_edit"),
@@ -30,9 +30,11 @@ from urllib.parse import urlparse
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
 from django.contrib import messages
-from django.contrib.auth.mixins import PermissionRequiredMixin
+from django.contrib.auth.mixins import (
    PermissionRequiredMixin,
 )
 from django.contrib.syndication.views import Feed
-from django.core.exceptions import ValidationError
+from django.core.exceptions import PermissionDenied, ValidationError
 from django.db.models import Exists, Max, OuterRef, Value
 from django.forms.models import modelform_factory
 from django.http import HttpResponseRedirect
@@ -44,7 +46,7 @@ from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView, TemplateView, View
 from django.views.generic.edit import CreateView, DeleteView, UpdateView
-from club.models import Club, Membership
+from club.models import Club, Mailing, Membership
 from com.forms import NewsDateForm, NewsForm, PosterForm
 from com.ics_calendar import IcsCalendar
 from com.models import News, NewsDate, Poster, Screen, Sith, Weekmail, WeekmailArticle
@@ -84,6 +86,11 @@ class ComTabsMixin(TabedViewMixin):
                "slug": "alert",
                "name": _("Alert message"),
            },
            {
                "url": reverse("com:mailing_admin"),
                "slug": "mailings",
                "name": _("Mailing lists administration"),
            },
            {
                "url": reverse("com:poster_list"),
                "slug": "posters",
@@ -294,9 +301,7 @@ class NewsDetailView(CanViewMixin, DetailView):
    queryset = News.objects.select_related("club", "author", "moderator")
    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
+        return super().get_context_data(**kwargs) | {"date": self.object.dates.first()}
            "date": self.object.dates.filter(start_date__gt=now()).first()
        }
 class NewsFeed(Feed):
@@ -526,6 +531,37 @@ class WeekmailArticleDeleteView(CanEditPropMixin, DeleteView):
    pk_url_kwarg = "article_id"
 class MailingListAdminView(ComTabsMixin, ListView):
    template_name = "com/mailing_admin.jinja"
    model = Mailing
    current_tab = "mailings"
    def dispatch(self, request, *args, **kwargs):
        if not (request.user.is_com_admin or request.user.is_root):
            raise PermissionDenied
        return super().dispatch(request, *args, **kwargs)
    def get_context_data(self, **kwargs):
        kwargs = super().get_context_data(**kwargs)
        kwargs["moderated"] = self.get_queryset().filter(is_moderated=True).all()
        kwargs["unmoderated"] = self.get_queryset().filter(is_moderated=False).all()
        kwargs["has_moderated"] = len(kwargs["moderated"]) > 0
        kwargs["has_unmoderated"] = len(kwargs["unmoderated"]) > 0
        return kwargs
 class MailingModerateView(View):
    def get(self, request, *args, **kwargs):
        mailing = get_object_or_404(Mailing, pk=kwargs["mailing_id"])
        if mailing.can_moderate(request.user):
            mailing.is_moderated = True
            mailing.moderator = request.user
            mailing.save()
            return redirect("com:mailing_admin")
        raise PermissionDenied
 class PosterListBaseView(ListView):
    """List communication posters."""
@@ -1,15 +1,18 @@
 from typing import Annotated, Literal
 from annotated_types import Ge, Le, MinLen
 from django.conf import settings
 from django.db.models import F
 from ninja import File, Query
 from ninja.security import SessionAuth
 from ninja_extra import ControllerBase, api_controller, paginate, route
 from ninja_extra.exceptions import PermissionDenied
 from ninja_extra.pagination import PageNumberPaginationExtra
 from ninja_extra.schemas import PaginatedResponseSchema
 from api.auth import ApiKeyAuth
 from api.permissions import CanAccessLookup, CanView, HasPerm
 from club.models import Mailing
 from core.models import Group, QuickUploadImage, SithFile, User
 from core.schemas import (
    FamilyGodfatherSchema,
@@ -45,6 +48,19 @@ class UploadController(ControllerBase):
        return image
@api_controller("/mailings")
 class MailingListController(ControllerBase):
    @route.get("", response=str)
    def fetch_mailing_lists(self, key: str):
        if key != settings.SITH_MAILING_FETCH_KEY:
            raise PermissionDenied
        mailings = Mailing.objects.filter(
            is_moderated=True, club__is_active=True
        ).prefetch_related("subscriptions")
        data = "\n".join(m.fetch_format() for m in mailings)
        return data
@api_controller("/user")
 class UserController(ControllerBase):
    @route.get("", response=list[UserProfileSchema])
@@ -1,16 +1,19 @@
-from django.urls.converters import IntConverter, StringConverter
+class FourDigitYearConverter:
 class FourDigitYearConverter(IntConverter):
    regex = "[0-9]{4}"
    def to_python(self, value):
        return int(value)
    def to_url(self, value):
        return str(value).zfill(4)
-class TwoDigitMonthConverter(IntConverter):
+class TwoDigitMonthConverter:
    regex = "[0-9]{2}"
    def to_python(self, value):
        return int(value)
    def to_url(self, value):
        return str(value).zfill(2)
@@ -25,9 +28,3 @@ class BooleanStringConverter:
    def to_url(self, value):
        return str(value)
 class ResultConverter(StringConverter):
    """Converter whose regex match either "success" or "failure"."""
    regex = "(success|failure)"
@@ -20,7 +20,6 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
 import itertools
 from datetime import date, datetime, timedelta
 from io import StringIO
 from pathlib import Path
@@ -121,6 +120,11 @@ class Command(BaseCommand):
        )
        self.profiles_root = SithFile.objects.create(name="profiles", owner=root)
        home_root = SithFile.objects.create(name="users", owner=root)
        # Page needed for club creation
        p = Page(name=settings.SITH_CLUB_ROOT_PAGE)
        p.save(force_lock=True)
        club_root = SithFile.objects.create(name="clubs", owner=root)
        sas = SithFile.objects.create(
            name="SAS", owner=root, id=settings.SITH_SAS_ROOT_DIR_ID
@@ -252,7 +256,6 @@ class Command(BaseCommand):
            date_of_birth="1942-06-12",
            password="plop",
        )
        User.objects.all().update(cgu_approved_at=now())
        User.groups.through.objects.bulk_create(
            [
                User.groups.through(group=groups.counter_admin, user=counter),
@@ -276,7 +279,34 @@ class Command(BaseCommand):
            ]
        )
-        self._create_pages(groups)
+        # Adding syntax help page
        syntax_page = Page(name="Aide_sur_la_syntaxe")
        syntax_page.save(force_lock=True)
        PageRev.objects.create(
            page=syntax_page,
            title="Aide sur la syntaxe",
            author=skia,
            content=(self.ROOT_PATH / "core" / "fixtures" / "SYNTAX.md").read_text(),
        )
        services_page = Page(name="Services")
        services_page.save(force_lock=True)
        PageRev.objects.create(
            page=services_page,
            title="Services",
            author=skia,
            content="- [Eboutic](/eboutic)\n- Matmat\n- SAS\n- Weekmail\n- Forum",
        )
        index_page = Page(name="Index")
        index_page.save(force_lock=True)
        PageRev.objects.create(
            page=index_page,
            title="Wiki index",
            author=root,
            content="Welcome to the wiki page!",
        )
        groups.public.viewable_page.set([syntax_page, services_page, index_page])
        self._create_subscription(root)
        self._create_subscription(skia)
@@ -547,48 +577,6 @@ class Command(BaseCommand):
            ]
        )
    def _create_pages(self, groups: PopulatedGroups):
        pages = Page.objects.bulk_create(
            [Page(name=s, _full_name=s) for s in settings.SITH_CGU_PAGE.split("/")]
        )
        for parent, son in itertools.pairwise(pages):
            son.parent = parent
            son.save(force_lock=True)
        cgu_page = pages[-1]
        syntax_page = Page(name="Aide_sur_la_syntaxe")
        syntax_page.save(force_lock=True)
        services_page = Page(name="Services")
        services_page.save(force_lock=True)
        index_page = Page(name="Index")
        index_page.save(force_lock=True)
        page_revs = [
            PageRev(page=cgu_page, title="Règlement informatique", content=""),
            PageRev(
                page=syntax_page,
                title="Aide sur la syntaxe",
                content=(
                    self.ROOT_PATH / "core" / "fixtures" / "SYNTAX.md"
                ).read_text(),
            ),
            PageRev(
                page=services_page,
                title="Services",
                content="- [Eboutic](/eboutic)\n- Matmat\n- SAS\n- Weekmail\n- Forum",
            ),
            PageRev(
                page=index_page, title="Wiki index", content="Welcome to the wiki page!"
            ),
        ]
        for rev in page_revs:
            rev.author_id = settings.SITH_ROOT_USER_ID
            rev.revision = 1
        PageRev.objects.bulk_create(page_revs)
        groups.public.viewable_page.set(
            [syntax_page, services_page, index_page, cgu_page]
        )
    def _create_products(self, groups: PopulatedGroups, clubs: PopulatedClubs):
        beers_type, cotis_type, refill_type, verre_type = (
            ProductType.objects.bulk_create(
@@ -749,10 +737,6 @@ class Command(BaseCommand):
        s.save()
    def _create_clubs(self) -> PopulatedClubs:
        # Page needed for club creation
        p = Page(name=settings.SITH_CLUB_ROOT_PAGE)
        p.save(force_lock=True)
        ae = Club.objects.create(
            id=1, name="AE", address="6 Boulevard Anatole France, 90000 Belfort"
        )
@@ -1,4 +1,3 @@
 import math
 import random
 from datetime import date, timedelta
 from datetime import timezone as tz
@@ -36,17 +35,12 @@ class Command(BaseCommand):
        super().__init__(*args, **kwargs)
        self.faker = Faker("fr_FR")
    def add_arguments(self, parser):
        parser.add_argument(
            "-n", "--nb-users", help="Number of users to create", type=int, default=600
        )
    def handle(self, *args, **options):
        if not settings.DEBUG:
            raise Exception("Never call this command in prod. Never.")
        self.stdout.write("Creating users...")
-        users = self.create_users(options["nb_users"])
+        users = self.create_users()
        self.create_bans(random.sample(users, k=len(users) // 200))  # 0.5% of users
        subscribers = random.sample(users, k=int(0.8 * len(users)))
        self.stdout.write("Creating subscriptions...")
@@ -86,7 +80,7 @@ class Command(BaseCommand):
        self.stdout.write("Creating products...")
        self.create_products()
        self.stdout.write("Creating sales and refills...")
-        sellers = random.sample(users, len(users) // 10)
+        sellers = random.sample(list(User.objects.all()), 100)
        self.create_sales(sellers)
        self.stdout.write("Creating permanences...")
        self.create_permanences(sellers)
@@ -95,7 +89,7 @@ class Command(BaseCommand):
        self.stdout.write("Done")
-    def create_users(self, nb_users: int = 600) -> list[User]:
+    def create_users(self) -> list[User]:
        # Create a single password hash for all users to make it faster.
        # It's insecure as hell, but it's ok since it's only for dev purposes.
        password = make_password("plop")
@@ -114,7 +108,7 @@ class Command(BaseCommand):
                address=self.faker.address(),
                password=password,
            )
-            for _ in range(nb_users)
+            for _ in range(600)
        ]
        # there may a duplicate or two
        # Not a problem, we will just have 599 users instead of 600
@@ -144,22 +138,10 @@ class Command(BaseCommand):
        )
    def create_subscriptions(self, users: list[User]):
        subscription_types = [
            "un-semestre",
            "deux-semestres",
            "cursus-tronc-commun",
            "cursus-branche",
        ]
        def prepare_subscription(_user: User, start_date: date) -> Subscription:
            payment_method = random.choice(settings.SITH_SUBSCRIPTION_PAYMENT_METHOD)[0]
-            subscription_type = random.choice(subscription_types)
+            duration = random.randint(1, 4)
-            s = Subscription(
+            s = Subscription(member=_user, payment_method=payment_method)
                member=_user,
                payment_method=payment_method,
                subscription_type=subscription_type,
            )
            duration = settings.SITH_SUBSCRIPTIONS[subscription_type]["duration"]
            s.subscription_start = s.compute_start(d=start_date, duration=duration)
            s.subscription_end = s.compute_end(duration)
            return s
@@ -433,9 +415,8 @@ class Command(BaseCommand):
        Permanency.objects.bulk_create(perms)
    def create_forums(self):
-        users = list(User.objects.all())
+        forumers = random.sample(list(User.objects.all()), 100)
-        forumers = random.sample(users, math.ceil(len(users) / 10))
+        most_actives = random.sample(forumers, 10)
        most_actives = random.sample(forumers, math.ceil(len(forumers) / 6))
        categories = list(Forum.objects.filter(is_category=True))
        new_forums = [
            Forum(name=self.faker.text(20), parent=random.choice(categories))
@@ -1,15 +0,0 @@
 # Generated by Django 5.2.17 on 2026-09-25 12:26
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [("core", "0050_alter_sithfile_moderator")]
    operations = [
        migrations.AddField(
            model_name="user",
            name="cgu_approved_at",
            field=models.DateTimeField(null=True, verbose_name="ToS approved at"),
        ),
    ]
@@ -44,7 +44,6 @@ from django.core.files.base import ContentFile
 from django.core.mail import send_mail
 from django.db import models, transaction
 from django.db.models import Exists, F, OuterRef, Q
 from django.db.models.aggregates import Max
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.functional import cached_property
@@ -292,7 +291,6 @@ class User(AbstractUser):
        ),
        blank=True,
    )
    cgu_approved_at = models.DateTimeField(_("ToS approved at"), null=True, blank=False)
    godfathers = models.ManyToManyField("User", related_name="godchildren", blank=True)
    objects = CustomUserManager()
@@ -420,14 +418,6 @@ class User(AbstractUser):
        )
        return age
    @cached_property
    def approved_current_cgu(self) -> bool:
        qs = PageRev.objects.filter(page___full_name=settings.SITH_CGU_PAGE)
        return (
            self.cgu_approved_at is not None
            and self.cgu_approved_at > qs.aggregate(date=Max("date"))["date"]
        )
    def make_home(self):
        if self.home is None:
            home_root = SithFile.objects.filter(parent=None, name="users").first()
@@ -1243,8 +1233,9 @@ class Page(models.Model):
            raise NotLocked("The page is not locked and thus can not be saved")
        self.full_clean()
        if not self.id:
-            # Save a first time to correctly set _full_name
+            super().save(
-            super().save(*args, **kwargs)
+                *args, **kwargs
            )  # Save a first time to correctly set _full_name
        # This reset the _full_name just before saving to maintain a coherent field quicker for queries than the
        # recursive method
        # It also update all the children to maintain correct names
@@ -1263,6 +1254,7 @@ class Page(models.Model):
        return Page.objects.filter(_full_name=name).first()
    def clean(self):
        """Cleans up only the name for the moment, but this can be used to make any treatment before saving the object."""
        if "/" in self.name:
            self.name = self.name.split("/")[-1]
        if (
@@ -37,7 +37,8 @@ body {
      margin: 0;
    }
-    form {
+    >div,
    >form {
      box-sizing: border-box;
      display: flex;
      flex-direction: column;
@@ -48,33 +49,67 @@ body {
      max-width: 500px;
      margin-top: 20px;
-      input[type="submit"] {
+      >p,
      >div {
        display: flex;
        flex-direction: column;
        justify-content: center;
        align-items: center;
        width: 100%;
-        max-width: 300px;
+        margin: 0;
-        margin-top: 1em;
+
        >label {
          width: 100%;
          @media (min-width: 500px) {
            width: 300px;
          }
        }
      }
-      .errorlist {
+      >input,
      >p>input,
      >div>input {
        box-sizing: border-box;
        width: 100%;
        max-width: 500px;
        @media (min-width: 500px) {
          max-width: 300px;
        }
      }
      >.errorlist {
        color: red;
        text-align: center;
        margin: 10px 0 0 0;
        list-style-type: none;
      }
-      div, fieldset {
+      >.required>.helptext {
-        max-width: 300px;
+        text-align: center;
        font-style: italic;
      }
      .captcha {
        box-sizing: border-box;
-        fieldset {
+      >.required:last-of-type {
-          margin-bottom: unset
+        box-sizing: border-box;
        max-width: 300px;
        flex-direction: row;
        flex-wrap: wrap;
        justify-content: space-between;
        >label {
          width: 100%;
        }
        >img {
          width: 70px;
          object-fit: contain;
        }
        >input {
          width: 200px;
        }
      }
    }
  }
@@ -1,39 +0,0 @@
 {% extends "core/base.jinja" %}
 {%- block additional_css -%}
  <link rel="stylesheet" href="{{ static('user/login.scss') }}">
 {%- endblock -%}
 {% block title %}
  {% trans %}Login{% endtrans %}
 {% endblock %}
 {% block info_boxes %}
 {% endblock %}
 {% block nav %}
 {% endblock %}
 {% block content %}
  <h1 class="title">{% trans %}Terms of Service{% endtrans %}</h1>
  <form method="post" id="login-form">
    {% csrf_token %}
    <div class="alert alert-yellow">
      {% trans trimmed %}
        To continue using our services,
        please read and approve the AE website's terms of service
      {% endtrans %}
    </div>
    <div class="form-group">
      {{ form.cgu_approved_at.errors }}
      {{ form.cgu_approved_at }}
      {{ form.cgu_approved_at.label_tag() }}
    </div>
    <input type="hidden" name="next" value="{{ next }}">
    <input type="submit" class="btn btn-blue">
  </form>
 {% endblock %}
@@ -35,17 +35,28 @@
    {% csrf_token %}
-    {{ form }}
+    <div>
      <label for="{{ form.username.name }}">{{ form.username.label }}</label>
      {{ form.username }}
      {{ form.username.errors }}
    </div>
    <div>
      <label for="{{ form.password.name }}">{{ form.password.label }}</label>
      {{ form.password }}
      {{ form.password.errors }}
    </div>
    <input type="hidden" name="next" value="{{ next }}">
-    <input type="submit" class="btn btn-blue" value="{% trans %}Login{% endtrans %}">
+    <input type="submit" value="{% trans %}Login{% endtrans %}">
-    <div>
+
-      <a href="{{ url("core:password_reset") }}">{% trans %}Lost password?{% endtrans %}</a>
+        {# Assumes you setup the password_reset view in your URLconf #}
-    </div>
+    <p>
-    <div>
+      <a href="{{ url('core:password_reset') }}">{% trans %}Lost password?{% endtrans %}</a>
-      <a href="{{ url("core:register") }}">{% trans %}Create account{% endtrans %}</a>
+      &nbsp;&nbsp;
-    </div>
+      <a href="{{ url('core:register') }}">{% trans %}Create account{% endtrans %}</a>
    </p>
  </form>
 {% endblock %}
@@ -18,17 +18,7 @@
  <form action="{{ url('core:register') }}" method="post">
    {% csrf_token %}
    {% render_honeypot_field %}
-    {% for field in form %}
+    {{ form.as_p() }}
-      {% if field.name not in ["cgu_approved_at", "captcha"] %}
+    <input type="submit" value="{% trans %}Register{% endtrans %}" />
        <div>{{ field.as_field_group() }}</div>
      {% endif %}
    {% endfor %}
    <div class="captcha">{{ form.captcha.as_field_group() }}</div>
    <div class="form-group">
      {{ form.cgu_approved_at.errors }}
      {{ form.cgu_approved_at }}
      {{ form.cgu_approved_at.label_tag() }}
    </div>
    <input type="submit" class="btn btn-blue" value="{% trans %}Register{% endtrans %}" />
  </form>
 {% endblock %}
@@ -79,5 +79,15 @@
      {% endfor %}
    </tbody>
  </table>
  {% if
  profile.mailing_subscriptions.exists()
  and (profile.id == user.id or user.is_root or user.is_com_admin)
  %}
  <h4>{% trans %}Subscribed mailing lists{% endtrans %}</h4>
  {% for sub in profile.mailing_subscriptions.all() %}
    <p>{{ sub.mailing.email }} <a href="{{ url('club:mailing_subscription_delete', mailing_subscription_id=sub.id) }}">{% trans %}Unsubscribe{% endtrans %}</a></p>
  {% endfor %}
 {% endif %}
 {% endblock %}
@@ -133,6 +133,7 @@
              <li><a href="{{ url('com:alert_edit') }}">{% trans %}Edit alert message{% endtrans %}</a></li>
              <li><a href="{{ url('com:info_edit') }}">{% trans %}Edit information message{% endtrans %}</a></li>
              <li><a href="{{ url('core:file_moderation') }}">{% trans %}Moderate files{% endtrans %}</a></li>
              <li><a href="{{ url('com:mailing_admin') }}">{% trans %}Mailing lists administration{% endtrans %}</a></li>
              <li><a href="{{ url('com:poster_list') }}">{% trans %}Posters{% endtrans %}</a></li>
              <li><a href="{{ url('com:screen_list') }}">{% trans %}Screens{% endtrans %}</a></li>
            {% endif %}
@@ -1,13 +0,0 @@
 import contextlib
 import os
 import pytest
 from django.core.management import call_command
@pytest.mark.django_db
 def test_populate_more(settings):
    """Just check that populate more doesn't crash"""
    settings.DEBUG = True
    with open(os.devnull, "w") as devnull, contextlib.redirect_stdout(devnull):
        call_command("populate_more", "--nb-users", "50")
@@ -27,7 +27,6 @@ from django.core.exceptions import ValidationError
 from django.core.mail import EmailMessage
 from django.test import Client, RequestFactory, TestCase
 from django.urls import reverse
 from django.utils.timezone import now
 from django.views.generic import View
 from django.views.generic.base import ContextMixin
 from model_bakery import baker
@@ -56,7 +55,6 @@ class TestUserRegistration:
            "password2": "plop",
            "captcha_0": "dummy-value",
            "captcha_1": "PASSED",
            "cgu_approved_at": now(),
        }
    @pytest.fixture()
@@ -94,10 +92,6 @@ class TestUserRegistration:
            ({"first_name": ""}, "Ce champ est obligatoire."),
            ({"last_name": ""}, "Ce champ est obligatoire."),
            ({"captcha_1": "WRONG_CAPTCHA"}, "CAPTCHA invalide"),
            (
                {"cgu_approved_at": False},
                "Vous devez approuver les conditions générales d'utilisation",
            ),
        ],
    )
    def test_register_user_form_fail(
@@ -156,7 +150,7 @@ class TestUserRegistration:
 class TestUserLogin:
    @pytest.fixture()
    def user(self) -> User:
-        return baker.make(User, password=make_password("plop"), cgu_approved_at=now())
+        return baker.make(User, password=make_password("plop"))
    @pytest.mark.parametrize(
        "identifier_getter",
@@ -197,40 +191,10 @@ class TestUserLogin:
            reverse("core:login"),
            {"username": identifier_getter(user), "password": "plop"},
        )
-        assertRedirects(response, settings.LOGIN_REDIRECT_URL)
+        assertRedirects(response, reverse("core:index"))
        assert response.wsgi_request.user == user
@pytest.mark.django_db
 class TestCGU:
    def test_cgu_approval(self, client: Client):
        user = baker.make(User, password=make_password("plop"), cgu_approved_at=None)
        user_url = user.get_absolute_url()
        res = client.post(
            reverse("core:login"),
            {"username": user.username, "password": "plop", "next": user_url},
        )
        assertRedirects(res, reverse("core:approve_cgu", query={"next": user_url}))
        res = client.post(
            reverse("core:approve_cgu"), {"cgu_approved_at": now(), "next": user_url}
        )
        assertRedirects(res, user_url)
        user.refresh_from_db()
        assert user.cgu_approved_at is not None
    def test_access_cgu_when_already_approved(self, client: Client):
        url = reverse("core:approve_cgu")
        res = client.get(url)
        assertRedirects(res, reverse("core:login"))
        client.force_login(baker.make(User, cgu_approved_at=now()))
        res = client.get(url)
        assertRedirects(res, settings.LOGIN_REDIRECT_URL)
        res = client.post(url, {"cgu_approved_at": now()})
        assertRedirects(res, settings.LOGIN_REDIRECT_URL)
@pytest.mark.parametrize(
    ("md", "html"),
    [
@@ -31,7 +31,6 @@ from core.converters import (
    TwoDigitMonthConverter,
 )
 from core.views import (
    CGUApprovalView,
    FileDeleteView,
    FileEditPropView,
    FileEditView,
@@ -126,7 +125,6 @@ urlpatterns = [
        name="password_reset_complete",
    ),
    path("register/", UserCreationView.as_view(), name="register"),
    path("cgu/", CGUApprovalView.as_view(), name="approve_cgu"),
    # Group handling
    path("group/", GroupListView.as_view(), name="group_list"),
    path("group/new/", GroupCreateView.as_view(), name="group_new"),
@@ -12,15 +12,12 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
 from __future__ import annotations
 import hmac
 from datetime import date, timedelta
 # Image utils
 from io import BytesIO
 from typing import TYPE_CHECKING, Final
 from urllib.parse import urlencode
 import PIL
 from django.conf import settings
@@ -28,15 +25,6 @@ from django.core.files.base import ContentFile
 from django.utils.timezone import localdate
 from PIL.Image import Image, Resampling
 if TYPE_CHECKING:
    from _hashlib import HASH
    from collections.abc import Buffer, Mapping, Sequence
    from typing import Any, Callable, Final
    from django.core.files.uploadedfile import UploadedFile
    from django.http import HttpRequest
 if TYPE_CHECKING:
    from django.core.files.uploadedfile import UploadedFile
    from django.http import HttpRequest
@@ -202,30 +190,3 @@ def get_client_ip(request: HttpRequest) -> str | None:
            return ip
    return None
 def hmac_hexdigest(
    key: str | bytes,
    data: Mapping[str, Any] | Sequence[tuple[str, Any]],
    digest: str | Callable[[Buffer], HASH] = "sha512",
 ) -> str:
    """Return the hexdigest of the signature of the given data.
    Args:
        key: the HMAC key used for the signature
        data: the data to sign
        digest: a PEP247 hashing algorithm (by default, sha512)
    Examples:
        ```python
        data = {
            "foo": 5,
            "bar": "somevalue",
        }
        hmac_key = secrets.token_hex(64)
        signature = hmac_hexdigest(hmac_key, data, "sha256")
        ```
    """
    if isinstance(key, str):
        key = key.encode()
    return hmac.digest(key, urlencode(data).encode(), digest).hex()
@@ -30,7 +30,9 @@ from django import forms
 from django.conf import settings
 from django.contrib.auth.forms import AuthenticationForm, UserCreationForm
 from django.contrib.auth.models import Permission
-from django.contrib.staticfiles.storage import staticfiles_storage
+from django.contrib.staticfiles.management.commands.collectstatic import (
    staticfiles_storage,
 )
 from django.core.exceptions import ValidationError
 from django.db import transaction
 from django.forms import (
@@ -40,9 +42,6 @@ from django.forms import (
    TextInput,
    Widget,
 )
 from django.urls import reverse
 from django.utils.functional import lazy
 from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from phonenumber_field.widgets import RegionalPhoneNumberWidget
@@ -109,43 +108,6 @@ class FutureDateTimeField(forms.DateTimeField):
        return {"min": widget.format_value(now())}
 class CGUApprovalField(forms.BooleanField):
    """Form field with a checkbox to approve the CGUs.
    The checkbox must be checked to be valid.
    If valid, then the value of the field is the current timestamp.
    """
    default_error_messages = {"required": _("You must approve the terms of service.")}
    __label = None
    def __init__(self, *, label_suffix: str | None = "", **kwargs):
        # Because the core app of the sith is so huge,
        # and because we require a url from the latter,
        # putting the reverse into the __init__ will result in it
        # being evaluated at server startup time (even with reverse_lazy).
        # This will result in a circular import.
        # Thus, we must keep the label in its own property and force it to be lazy.
        kwargs["label"] = lazy(self.get_label, str)
        kwargs["required"] = True
        super().__init__(label_suffix=label_suffix, **kwargs)
    def to_python(self, value):
        return now() if super().to_python(value) else None
    def get_label(self):
        if not self.__label:
            url = reverse("core:page", kwargs={"page_name": settings.SITH_CGU_PAGE})
            self.__label = mark_safe(
                _(
                    "I have read and I approve the "
                    '<a href="%(url)s" target="_blank">Terms of Service</a>'
                )
                % {"url": url}
            )
        return self.__label
 # Forms
@@ -184,28 +146,8 @@ class RegisteringForm(UserCreationForm):
    class Meta:
        model = User
-        fields = ("first_name", "last_name", "email", "cgu_approved_at")
+        fields = ("first_name", "last_name", "email")
-        field_classes = {
+        field_classes = {"email": AntiSpamEmailField}
            "email": AntiSpamEmailField,
            "cgu_approved_at": CGUApprovalField,
        }
 class CGUApprovalForm(forms.ModelForm):
    class Meta:
        model = User
        fields = ["cgu_approved_at"]
        field_classes = {"cgu_approved_at": CGUApprovalField}
    def __init__(self, *args, instance: User | None = None, **kwargs):
        if instance:
            # If this form is displayed,
            # then we want the user to explicitly check the button.
            # So we pretend cgu were never approved (even if they were).
            # If we didn't do that, the button would be initially checked,
            # even if the approval was done before the last CGU version.
            instance.cgu_approved_at = False
        super().__init__(*args, instance=instance, **kwargs)
 class UserProfileForm(forms.ModelForm):
@@ -27,12 +27,12 @@ from datetime import timedelta
 # This file contains all the views that concern the user model
 from operator import itemgetter
 from smtplib import SMTPException
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING
 from django.contrib import messages
 from django.contrib.auth import login, views
 from django.contrib.auth.decorators import login_required
-from django.contrib.auth.forms import SetPasswordForm
+from django.contrib.auth.forms import PasswordChangeForm, SetPasswordForm
 from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import PermissionDenied
@@ -60,7 +60,6 @@ from honeypot.decorators import check_honeypot
 from core.auth.mixins import CanEditMixin, CanEditPropMixin, CanViewMixin
 from core.models import Gift, Preferences, User
 from core.views.forms import (
    CGUApprovalForm,
    GiftForm,
    LoginForm,
    RegisteringForm,
@@ -72,7 +71,6 @@ from core.views.forms import (
 from core.views.mixins import FragmentMixin, TabedViewMixin, UseFragmentsMixin
 from counter.models import Refilling, Selling
 from eboutic.models import Invoice
 from sith import settings
 from trombi.views import UserTrombiForm
 if TYPE_CHECKING:
@@ -84,16 +82,9 @@ class SithLoginView(views.LoginView):
    template_name = "core/login.jinja"
    authentication_form = LoginForm
    form_class = PasswordChangeForm
    redirect_authenticated_user = True
    def get_success_url(self) -> str:
        redirect_to = self.get_redirect_url()
        default_url = self.get_default_redirect_url()
        if not self.request.user.approved_current_cgu:
            query = {"next": redirect_to} if redirect_to else {}
            return reverse("core:approve_cgu", query=query)
        return redirect_to or default_url
 class SithPasswordChangeView(views.PasswordChangeView):
    """Allows a user to change its password."""
@@ -197,27 +188,6 @@ class UserCreationView(FormView):
        return super().form_valid(form)
 class CGUApprovalView(views.RedirectURLMixin, UpdateView):
    form_class = CGUApprovalForm
    next_page = settings.LOGIN_REDIRECT_URL
    template_name = "core/cgu_approve.jinja"
    def dispatch(self, request, *args, **kwargs):
        if self.request.user.is_anonymous:
            return redirect("core:login")
        if self.request.user.approved_current_cgu:
            return redirect(self.get_success_url())
        return super().dispatch(request, *args, **kwargs)
    def get_object(self, *args, **kwargs):
        return self.request.user
    def get_context_data(self, **kwargs) -> dict[str, Any]:
        return super().get_context_data(**kwargs) | {
            self.redirect_field_name: self.get_redirect_url()
        }
 class UserMeRedirect(LoginRequiredMixin, RedirectView):
    def get_redirect_url(self, *args, **kwargs):
        if remaining := kwargs.get("remaining_path"):
@@ -83,17 +83,8 @@
 {% endmacro %}
 {% block content %}
  <div class="alert alert-yellow">
    <div class="alert-main">
      {%- trans trimmed -%}
        You can see product details.
        However, you cannot edit it, thus you won't be able
        to submit this form.
      {%- endtrans -%}
    </div>
  </div>
  {% if object %}
-    <h2>{{ object }}</h2>
+    <h2>{% trans name=object %}Edit product {{ name }}{% endtrans %}</h2>
    <p><i>{% trans %}Creation date{% endtrans %} : {{ object.created_at|date }}</i></p>
    <p><i>{% trans %}Last update{% endtrans %} : {{ object.updated_at|date }}</i></p>
  {% else %}
@@ -136,17 +127,19 @@
      {{ form.price_formset.management_form }}
      <div x-ref="formContainer">
        {%- for form in form.price_formset.forms -%}
-          <div>{{ price_form(form) }}</div>
+          <div>
            {{ price_form(form) }}
          </div>
        {%- endfor -%}
      </div>
      <template x-ref="formTemplate">
-        <div>{{ price_form(form.price_formset.empty_form) }}</div>
+        <div>
          {{ price_form(form.price_formset.empty_form) }}
        </div>
      </template>
      {% if user.has_perm("counter.change_product") %}
      <button class="btn btn-grey" @click.prevent="addForm()">
        <i class="fa fa-plus"></i> {% trans %}Add a price{% endtrans %}
      </button>
      {% endif %}
    </div>
    <br />
@@ -172,16 +165,11 @@
      <template x-ref="formTemplate">
        {{ action_form(form.action_formset.empty_form) }}
      </template>
      {% if user.has_perm("counter.change_product") %}
      <button @click.prevent="addForm()" class="btn btn-grey">
        <i class="fa fa-plus"></i>{% trans %}Add action{% endtrans %}
      </button>
      {% endif %}
    </div>
    <div class="row gap margin-bottom">{{ form.archived.as_field_group() }}</div>
    {% if user.has_perm("counter.change_product") %}
    <p><input class="btn btn-blue" type="submit" value="{% trans %}Save{% endtrans %}" /></p>
    {% endif %}
  </form>
 {% endblock %}
@@ -80,11 +80,9 @@
    <h3 class="margin-bottom">{% trans %}Product list{% endtrans %}</h3>
    <div class="row margin-bottom">
      {% if user.has_perm("counter.add_product") %}
      <a href="{{ url('counter:new_product') }}" class="btn btn-blue">
        {% trans %}New product{% endtrans %} <i class="fa fa-plus"></i>
      </a>
      {% endif %}
      <button
        class="btn btn-blue"
        @click="downloadCsv()"
@@ -13,12 +13,12 @@
 {% endblock %}
 {% block content %}
-  {% if user.has_perm("counter.add_producttype") %}
+  <p>
-    <a href="{{ url('counter:new_product_type') }}" class="btn btn-blue margin-bottom">
+    <a href="{{ url('counter:new_product_type') }}" class="btn btn-blue">
      {% trans %}New product type{% endtrans %}
      <i class="fa fa-plus"></i>
    </a>
-  {% endif %}
+  </p>
  {% if product_types %}
    <aside>
      <p>
@@ -48,7 +48,7 @@ from counter.models import (
    Selling,
 )
 from counter.utils import is_logged_in_counter
-from counter.views.mixins import CounterAdminTabsMixin
+from counter.views.mixins import CounterAdminMixin, CounterAdminTabsMixin
 class CounterListView(CounterAdminTabsMixin, CanViewMixin, ListView):
@@ -84,18 +84,17 @@ class CounterEditView(
        return reverse_lazy("counter:admin", kwargs={"counter_id": self.object.id})
-class CounterEditPropView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView):
+class CounterEditPropView(CounterAdminTabsMixin, CounterAdminMixin, UpdateView):
-    """Edit a counter's main infos."""
+    """Edit a counter's main informations (for the counter's admin)."""
    model = Counter
    form_class = modelform_factory(Counter, fields=["name", "club", "type"])
    pk_url_kwarg = "counter_id"
    template_name = "core/edit.jinja"
    current_tab = "counters"
    permission_required = "counter.change_counter"
-class CounterCreateView(CounterAdminTabsMixin, PermissionRequiredMixin, CreateView):
+class CounterCreateView(CounterAdminTabsMixin, CounterAdminMixin, CreateView):
    """Create a counter (for the admins)."""
    model = Counter
@@ -106,10 +105,9 @@ class CounterCreateView(CounterAdminTabsMixin, PermissionRequiredMixin, CreateVi
    )
    template_name = "core/create.jinja"
    current_tab = "counters"
    permission_required = "counter.add_counter"
-class CounterDeleteView(CounterAdminTabsMixin, PermissionRequiredMixin, DeleteView):
+class CounterDeleteView(CounterAdminTabsMixin, CounterAdminMixin, DeleteView):
    """Delete a counter (for the admins)."""
    model = Counter
@@ -117,33 +115,30 @@ class CounterDeleteView(CounterAdminTabsMixin, PermissionRequiredMixin, DeleteVi
    template_name = "core/delete_confirm.jinja"
    success_url = reverse_lazy("counter:admin_list")
    current_tab = "counters"
    permission_required = "counter.delete_counter"
 # Product management
-class ProductTypeListView(CounterAdminTabsMixin, PermissionRequiredMixin, ListView):
+class ProductTypeListView(CounterAdminTabsMixin, CounterAdminMixin, ListView):
    """A list view for the admins."""
    model = ProductType
    template_name = "counter/product_type_list.jinja"
    current_tab = "product_types"
    context_object_name = "product_types"
    permission_required = "counter.view_producttype"
-class ProductTypeCreateView(CounterAdminTabsMixin, PermissionRequiredMixin, CreateView):
+class ProductTypeCreateView(CounterAdminTabsMixin, CounterAdminMixin, CreateView):
    """A create view for the admins."""
    model = ProductType
    fields = ["name", "description", "comment", "icon"]
    template_name = "core/create.jinja"
    current_tab = "products"
    permission_required = "counter.add_producttype"
-class ProductTypeEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView):
+class ProductTypeEditView(CounterAdminTabsMixin, CounterAdminMixin, UpdateView):
    """An edit view for the admins."""
    model = ProductType
@@ -151,26 +146,23 @@ class ProductTypeEditView(CounterAdminTabsMixin, PermissionRequiredMixin, Update
    fields = ["name", "description", "comment", "icon"]
    pk_url_kwarg = "type_id"
    current_tab = "products"
    permission_required = "counter.change_producttype"
-class ProductListView(CounterAdminTabsMixin, PermissionRequiredMixin, TemplateView):
+class ProductListView(CounterAdminTabsMixin, CounterAdminMixin, TemplateView):
    current_tab = "products"
    template_name = "counter/product_list.jinja"
    permission_required = "counter.view_product"
-class ProductCreateView(CounterAdminTabsMixin, PermissionRequiredMixin, CreateView):
+class ProductCreateView(CounterAdminTabsMixin, CounterAdminMixin, CreateView):
    """A create view for the admins."""
    model = Product
    form_class = ProductForm
    template_name = "counter/product_form.jinja"
    current_tab = "products"
    permission_required = "counter.add_product"
-class ProductEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView):
+class ProductEditView(CounterAdminTabsMixin, CounterAdminMixin, UpdateView):
    """An edit view for the admins."""
    model = Product
@@ -178,13 +170,6 @@ class ProductEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView
    pk_url_kwarg = "product_id"
    template_name = "counter/product_form.jinja"
    current_tab = "products"
    permission_required = "counter.change_product"
    def has_permission(self):
        return self.request.user.has_perm("counter.change_product") or (
            self.request.method == "GET"
            and self.request.user.has_perm("counter.view_product")
        )
 class ProductFormulaListView(CounterAdminTabsMixin, PermissionRequiredMixin, ListView):
@@ -314,6 +299,7 @@ class RefillingDeleteView(DeleteView):
    template_name = "core/delete_confirm.jinja"
    def dispatch(self, request, *args, **kwargs):
        """We have here a very particular right handling, we can't inherit from CanEditPropMixin."""
        self.object = self.get_object()
        if timezone.now() - self.object.date <= timedelta(
            minutes=settings.SITH_LAST_OPERATIONS_LIMIT
@@ -338,6 +324,7 @@ class SellingDeleteView(DeleteView):
    template_name = "core/delete_confirm.jinja"
    def dispatch(self, request, *args, **kwargs):
        """We have here a very particular right handling, we can't inherit from CanEditPropMixin."""
        self.object = self.get_object()
        if timezone.now() - self.object.date <= timedelta(
            minutes=settings.SITH_LAST_OPERATIONS_LIMIT
@@ -389,23 +376,23 @@ class CounterStatView(PermissionRequiredMixin, DetailView):
        return kwargs
-class CounterRefillingListView(
+class CounterRefillingListView(CounterAdminTabsMixin, CounterAdminMixin, ListView):
    CounterAdminTabsMixin, PermissionRequiredMixin, ListView
 ):
    """List of refillings on a counter."""
    model = Refilling
    template_name = "counter/refilling_list.jinja"
    current_tab = "counters"
    paginate_by = 30
    permission_required = "counter.view_refilling"
-    def get_queryset(self):
+    def dispatch(self, request, *args, **kwargs):
-        self.counter = get_object_or_404(Counter, pk=self.kwargs["counter_id"])
+        self.counter = get_object_or_404(Counter, pk=kwargs["counter_id"])
-        return Refilling.objects.filter(counter=self.counter).order_by("-date")
+        self.queryset = Refilling.objects.filter(counter__id=self.counter.id)
        return super().dispatch(request, *args, **kwargs)
    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {"counter": self.counter}
+        kwargs = super().get_context_data(**kwargs)
        kwargs["counter"] = self.counter
        return kwargs
 class RefoundAccountView(UserPassesTestMixin, FormView):
@@ -12,7 +12,7 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
-from django.contrib.auth.mixins import PermissionRequiredMixin
+
 from django.http import Http404, HttpResponse
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, ListView
@@ -21,30 +21,28 @@ from django.views.generic.edit import CreateView, UpdateView
 from core.auth.mixins import CanViewMixin
 from counter.forms import EticketForm
 from counter.models import Eticket, Selling
-from counter.views.mixins import CounterAdminTabsMixin
+from counter.views.mixins import CounterAdminMixin, CounterAdminTabsMixin
-class EticketListView(CounterAdminTabsMixin, PermissionRequiredMixin, ListView):
+class EticketListView(CounterAdminTabsMixin, CounterAdminMixin, ListView):
    """A list view for the admins."""
    model = Eticket
    template_name = "counter/eticket_list.jinja"
    ordering = ["id"]
    current_tab = "etickets"
    permission_required = "counter.view_eticket"
-class EticketCreateView(CounterAdminTabsMixin, PermissionRequiredMixin, CreateView):
+class EticketCreateView(CounterAdminTabsMixin, CounterAdminMixin, CreateView):
    """Create an eticket."""
    model = Eticket
    template_name = "core/create.jinja"
    form_class = EticketForm
    current_tab = "etickets"
    permission_required = "counter.add_eticket"
-class EticketEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView):
+class EticketEditView(CounterAdminTabsMixin, CounterAdminMixin, UpdateView):
    """Edit an eticket."""
    model = Eticket
@@ -52,7 +50,6 @@ class EticketEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView
    form_class = EticketForm
    pk_url_kwarg = "eticket_id"
    current_tab = "etickets"
    permission_required = "counter.change_eticket"
 class EticketPDFView(CanViewMixin, DetailView):
@@ -13,13 +13,38 @@
 #
 #
 from django.conf import settings
 from django.core.exceptions import PermissionDenied
 from django.urls import reverse, reverse_lazy
 from django.utils.translation import gettext_lazy as _
 from django.views.generic.base import View
 from core.views.mixins import TabedViewMixin
 from counter.utils import is_logged_in_counter
 class CounterAdminMixin(View):
    """Protect counter admin section."""
    edit_group = [settings.SITH_GROUP_COUNTER_ADMIN_ID]
    edit_club = []
    def _test_group(self, user):
        return any(user.is_in_group(pk=grp_id) for grp_id in self.edit_group)
    def _test_club(self, user):
        return any(c.can_be_edited_by(user) for c in self.edit_club)
    def dispatch(self, request, *args, **kwargs):
        if not (
            request.user.is_root
            or self._test_group(request.user)
            or self._test_club(request.user)
        ):
            raise PermissionDenied
        return super().dispatch(request, *args, **kwargs)
 class CounterTabsMixin(TabedViewMixin):
    def get_tabs_title(self):
        return self.object
@@ -64,70 +89,45 @@ class CounterTabsMixin(TabedViewMixin):
 class CounterAdminTabsMixin(TabedViewMixin):
    tabs_title = _("Counter administration")
-
+    list_of_tabs = [
    def get_list_of_tabs(self):
        user = self.request.user
        res = [
        {
            "url": reverse_lazy("counter:admin_list"),
            "slug": "counters",
            "name": _("Counters"),
-            }
+        },
        ]
        if user.has_perm("counter.view_product"):
            res.append(
        {
            "url": reverse_lazy("counter:product_list"),
            "slug": "products",
            "name": _("Products"),
-                }
+        },
            )
        if user.has_perm("counter.view_productformula"):
            res.append(
        {
            "url": reverse_lazy("counter:product_formula_list"),
            "slug": "formulas",
            "name": _("Formulas"),
-                }
+        },
            )
        if user.has_perm("counter.view_producttype"):
            res.append(
        {
            "url": reverse_lazy("counter:product_type_list"),
            "slug": "product_types",
            "name": _("Product types"),
-                }
+        },
            )
        if user.has_perm("counter.view_returnableproduct"):
            res.append(
        {
            "url": reverse_lazy("counter:returnable_list"),
            "slug": "returnable_products",
            "name": _("Returnable products"),
-                }
+        },
            )
        if user.has_perm("counter.view_cashregistersummary"):
            res.append(
        {
            "url": reverse_lazy("counter:cash_summary_list"),
            "slug": "cash_summary",
            "name": _("Cash register summaries"),
-                }
+        },
            )
        if user.has_perm("counter.view_invoicecall"):
            res.append(
        {
            "url": reverse_lazy("counter:invoices_call"),
            "slug": "invoices_call",
            "name": _("Invoices call"),
-                }
+        },
            )
        if user.has_perm("counter.view_eticket"):
            res.append(
        {
            "url": reverse_lazy("counter:eticket_list"),
            "slug": "etickets",
            "name": _("Etickets"),
-                }
+        },
-            )
+    ]
        return res
@@ -48,7 +48,7 @@ des scripts complets mais qui restent lisibles,
    ```
    Ok, c'est de la triche, on installe un package externe.
    Mais bon, ça marche, et l'équivalent pur bash
-    serait un pur enfer.
+    serait carrément plus moche.
 === "nu"
@@ -59,18 +59,20 @@ des scripts complets mais qui restent lisibles,
    Nombre de lignes total :
    ```nu
-    ls **/*.py | par-each { open $in.name | lines | length } | math sum
+    ls **/*.py | insert linecount { get name | open | lines | length } | math sum
    ```
    Vous pouvez aussi exlure les lignes vides
    et les les lignes de commentaire :
    ```nu
    ls **/*.py |
-    par-each {
+    insert linecount {
-        open $in.name |
+        get name |
        open |
        lines |
        each { str trim } |
-        where { |l| ($l | str length) > 0 and not ($l | str starts-with "#") } |
+        filter { |l| not ($l | str starts-with "#") } |  # commentaires
        filter { |l| ($l | str length) > 0 } |  # lignes vides
        length
    } |
    math sum
@@ -1 +0,0 @@
 ::: api.schemas
@@ -1 +0,0 @@
 ::: api.views
@@ -1,378 +0,0 @@
 Le site AE offre des mécanismes permettant aux applications tierces
 de récupérer les informations sur un utilisateur du site AE.
 De cette manière, il devient possible de synchroniser les informations
 qu possède l'application tierce sur l'utilisateur, directement depuis
 le site AE.
 ## Fonctionnement général
 Pour authentifier vos utilisateurs, vous aurez besoin d'un serveur web
 et d'un client d'API (celui auquel est liée votre
 [clef d'API](./connect.md#obtenir-une-clef-dapi)).
 Deux informations vous sont nécessaires, en plus de votre clef d'API :
 - l'id du client : vous pouvez l'obtenir soit en le demandant à l'équipe info,
  soit en appelant la route `GET /api/client/me` avec votre clef d'API
  renseignée dans le header [X-APIKey](./connect.md#x-apikey)
 - la clef HMAC du client : vous devez la demander à l'équipe info.
 Ces deux éléments ont une fonction différente : l'id du client permet
 de dire au serveur quelle est l'application qui s'adresse à lui,
 tandis que la [clef HMAC](https://fr.wikipedia.org/wiki/HMAC)
 servira à créer une signature unique permettant de s'assurer
 que les données transmises n'ont pas été falsifiées.
 Grâce à ces informations, vous allez pouvoir fournir le contexte nécessaire
 au site AE pour qu'il authentifie vos utilisateurs.
 En effet, la démarche d'authentification s'effectue presque entièrement
 sur le site : le travail de l'application tierce consiste uniquement
 à fournir à l'utilisateur une url avec les bons paramètres, puis
 à recevoir la réponse du serveur si tout s'est bien passé.
 Comme un dessin vaut parfois mieux que mille mots,
 voici les diagrammes décrivant le processus.
 L'un montre l'entièreté de la démarche ;
 l'autre dans un souci de simplicité, ne montre que ce qui est visible
 directement par l'application tierce.
 === "Intégralité du processus"
    ```mermaid
    sequenceDiagram
        actor User
        participant App
        User->>+App: Authentifie-moi, stp
        App-->>-User: url de connexion<br/>avec signature
        User->>+Sith: GET url
        opt Utilisateur non-connecté
            Sith->>+User: Formulaire de connexion
            User-->>-Sith: Connexion
        end
        Sith->>Sith: vérification de la signature
        Sith->>+User: Formulaire<br/>des conditions<br/>d'utilisation
        User-->>-Sith: Validation
        Sith->>+App: URL de retour<br/>avec données utilisateur
        App->>App: Traitement des <br/>données utilisateur
        App-->>-Sith: 204 OK, No content
        Sith-->>-User: Message de succès
        App--)User: Message de succès
    ```
 === "Point de vue de l'application tierce"
    ```mermaid
    sequenceDiagram
        actor User
        participant App
        User->>+App: Authentifie-moi, stp
        App-->>-User: url de connexion<br/>avec signature
        opt
            Sith->>+App: URL de retour<br/>avec données utilisateur
            App->>App: Traitement des <br/>données utilisateur
            App-->>-Sith: 204 OK, No content
            App--)User: Message de succès
        end
    ```
 ## Données attendues
 ### URL de connexion
 L'URL de connexion que vous allez fournir à l'utilisateur doit
 être `https://ae.utbm.fr/api-link/auth/`
 et doit contenir les données décrites dans
 [`ThirdPartyAuthParamsSchema`][api.schemas.ThirdPartyAuthParamsSchema] :
 - `client_id` (integer) : l'id de votre client, que vous pouvez obtenir
  de la manière décrite plus haut
 - `third_party_app`(string) : le nom de la plateforme pour laquelle
  l'authentification va être réalisée (si votre application est un bot
  discord, mettez la valeur "discord")
 - `privacy_link`(URL) : l'URL vers la page de politique de confidentialité
  qui s'appliquera dans le cadre de l'application
  (s'il s'agit d'un bot discord, donnez le lien vers celles de Discord)
 - `username`(string) : le pseudonyme que l'utilisateur possède sur
  votre application
 - `callback_url`(URL) : l'URL que le site AE appellera si l'authentification
  réussit
 - `signature`(string) : la signature des données de la requête.
  Il s'agit d'une signature par clef HMAC dont le fonctionnement 
  est détaillé plus bas.
 Ces données doivent être url-encodées et passées dans les paramètres GET.
 !!!warning "URL de retour"
    Les URLs fournies doivent être des URLs HTTP valides.
    En outre, elles doivent obligatoirement inclure la barre oblique finale.
    === "URL correcte ✔️"
        `https://exemple.ae.utbm.fr/foo/`
    === "URL incorrecte ❌"
        `https://exemple.ae.utbm.fr/foo`
 !!!tip
    Inclure l'id de votre utilisateur dans l'URL de retour
    peut être un bon moyen de l'identifier lors du callback.
    Par exemple : `GET /callback/{int:user_id}/`.
 ???Example
    Supposons que votre client d'API soit utilisé dans le cadre d'un bot Discord,
    avec les données suivantes :
    - l'id du client est 15
    - sa clef HMAC est "beb99dd53"
      (c'est pour l'exemple, une vraie clef sera beaucoup plus longue)
    - le pseudonyme discord de votre utilisateur est Brian
    - son id sur discord est 123456789
    - votre route de callback est `GET /callback/{int:user_id}/`,
      accessible au domaine `https://bot.ae.utbm.fr`
    Alors les paramètres de votre URL seront :
    | Paramètre       | valeur                                                                |
    |-----------------|-----------------------------------------------------------------------|
    | client_id       | 15                                                                    |
    | third_party_app | discord                                                               |
    | privacy_link    | `https://discord.com/privacy`                                         |
    | username        | Brian                                                                 |
    | callback_url    | `https://bot.ae.utbm.fr/callback/123456789/`                          |
    | signature       | 1a383c51060be64f07772aa42e07<br/>18ae096b8f21f2cdb4061c0834a416d12101 |
    Et l'url fournie à l'utilisateur sera :
    `https://ae.utbm.fr/api-link/auth/?client_id=15&third_party_app=discord
    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy&username=Brian
    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F
    &signature=1a383c51060be64f07772aa42e0718ae096b8f21f2cdb4061c0834a416d12101`
 ### Données de retour
 Si l'authentification réussit, le site AE enverra une requête HTTP POST
 à l'URL de retour fournie dans l'URL de connexion.
 Le corps de la requête de callback et au format JSON 
 et contient deux paires clef-valeur :
 - `user` : les données utilisateur, telles que décrites
  par [UserProfileSchema][core.schemas.UserProfileSchema]
 - `signature` : la signature des données utilisateur
 ???Example
    En reprenant les mêmes paramètres que dans l'exemple précédent,
    le site AE pourra renvoyer à l'application la requête suivante :
    ```http
    POST https://bot.ae.utbm.fr/callback/123456789/
    content-type: application/json
    body: {
        "user": {
            "id": 144131,
            "nick_name": "inzekitchen",
            "first_name": "Brian",
            ...
        },
        "signature": "f16955bab6b805f6e1abbb98a86dfee53fed0bf812aa6513ca46cfd461b70020"
    }
    ```
 L'application doit répondre avec un des codes HTTP suivants :
 | Code | Raison                                                                         |
 |------|--------------------------------------------------------------------------------|
 | 204  | Tout s'est bien passé                                                          |
 | 403  | Les données de retour ne sont <br>pas signées ou sont mal signées              |
 | 404  | L'URL de retour ne permet pas <br>d'identifier un utilisateur de l'application |
 !!!note "Code d'erreur par défaut"
    Si l'appel de la route fait face à plusieurs problèmes en même temps 
    (par exemple, l'URL ne permet pas de retrouver votre utilisateur, 
    et en plus les données sont mal signées),
    le 403 prime et doit être retourné par défaut.
 ## Signature des données
 Les données de l'URL de connexion doivent être signées,
 et la signature de l'URL de retour doit être vérifiée.
 Dans le deux cas, la signature est le digest HMAC-SHA512
 des données url-encodées, en utilisant la clef HMAC du client d'API.
 L'ordre dans lequel ces données sont placées dans l'encodage URL
 doit être strictement le même que celui donné plus haut.
 ???Example "Signature de l'URL de connexion"
    En reprenant le même exemple que les fois précédentes,
    l'url-encodage des données est :
    `client_id=15&third_party_app=discord
    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy%2F&username=Brian
    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F`
    Notez que la signature n'est pas (encore) dedans.
    Cette dernière peut-être obtenue avec le code suivant :
    === ":simple-python: Python"
        Dépendances :
        - `environs` (>=14.1)
        ```python
        import hmac
        from urllib.parse import urlencode
        from environs import Env
        env = Env()
        env.read_env()
        key = env.str("HMAC_KEY").encode()
        data = {
            "client_id": 15,
            "third_party_app": "discord",
            "privacy_link": "https://discord.com/privacy/",
            "username": "Brian",
            "callback_url": "https://bot.ae.utbm.fr/callback/123456789/",
        }
        urlencoded = urlencode(data)
        data["signature"] = hmac.digest(key, urlencoded.encode(), "sha512").hex()
        # URL a fournir à l'utilisateur pour son authentification
        user_url = f"https://ae.ubtm.fr/api-link/auth/?{urlencode(data)}"
        ```    
    === ":simple-rust: Rust"
        Dépendances :
        - `hmac` (>=0.12.1)
        - `url` (>=2.5.7, features `serde`)
        - `serde` (>=1.0.228, features `derive`)
        - `serde_urlencoded` (>=0.7.1)
        - `sha2` (>=0.10.9)
        - `dotenvy` (>= 0.15)
        ```rust
        use hmac::{Mac, SimpleHmac};
        use serde::Serialize;
        use sha2::Sha512;
        use url::Url;
        #[derive(Serialize, Debug)]
        struct UrlData<'a> {
            client_id: u32,
            third_party_app: &'a str,
            privacy_link: Url,
            username: &'a str,
            callback_url: Url,
        }
        impl<'a> UrlData<'a> {
            pub fn signature(&self, key: &[u8]) -> CtOutput<SimpleHmac<Sha512>> {
                let urlencoded = serde_urlencoded::to_string(self).unwrap();
                SimpleHmac::<Sha512>::new_from_slice(key)
                    .unwrap()
                    .chain_update(urlencoded.as_bytes())
                    .finalize()
            }
        }
        impl Into<Url> for UrlData<'_> {
            fn into(self) -> Url {
                let key = std::env::var("HMAC_KEY").unwrap();
                let mut url = Url::parse("http://ae.utbm.fr/api-link/auth/").unwrap();
                url.set_query(Some(
                    format!(
                        "{}&signature={:x}",
                        serde_urlencoded::to_string(&self).unwrap(),
                        self.signature(key.as_bytes()).into_bytes()
                    )
                    .as_str(),
                ));
                url
            }
        }
        fn main() {
            dotenvy::dotenv().expect("Couldn't load env");
            let data = UrlData {
                client_id: 1,
                third_party_app: "discord",
                privacy_link: "https://discord.com/privacy/".parse().unwrap(),
                username: "Brian",
                callback_url: "https://bot.ae.utbm.fr/callback/123456789/"
                    .parse()
                    .unwrap(),
            };
            let url: Url = data.into();
            println!("{:?}", url);
        }
        ```
 ???Example "Vérification de la signature de la réponse"
    Les données utilisateur peuvent ressembler à :
    ```json
    {
        "user": {
            "display_name": "Matthieu Vincent",
            "profile_url": "/user/380/",
            "profile_pict": "/static/core/img/unknown.jpg",
            "id": 380,
            "nick_name": None,
            "first_name": "Matthieu",
            "last_name": "Vincent",
        },
        "signature": "3802a280fbb01bd9fetc."
    }
    ```
    Vous pouvez vérifier la signature ainsi :
    ```python
        import hmac
        from urllib.parse import urlencode
        from environs import Env
        env = Env()
        env.read_env()
        def is_signature_valid(user_data: dict, signature: str) -> bool:
            key = env.str("HMAC_KEY").encode()
            urlencoded = urlencode(user_data)
            return hmac.compare_digest(
                hmac.digest(key, urlencoded.encode(), "sha512").hex(),
                signature,
            )
        post_data = <récupération des données POST>
        print(
            "signature valide :", 
            is_signature_valid(post_data["user"], post_data["signature"])
        )
    ```
 !!!Warning
    Vous devez impérativement vérifier la signature 
    des données de la requête de callback !
    Ne pas vérifier la signature permet à n'importe quel acteur 
    tierce malveillant de vous appeler sur votre callback. 
    Ce serait une faille de sécurité majeure de votre côté.
    Si l'équipe informatique se rend compte que vous ne le faites pas,
    elle se réserve le droit de suspendre votre application,
    immédiatement et sans préavis.
@@ -112,7 +112,7 @@ cf. [HTTP persistant connection (wikipedia)](https://en.wikipedia.org/wiki/HTTP_
 Voici quelques exemples : 
-=== ":simple-python: Python (requests)"
+=== "Python (requests)"
    Dépendances :
@@ -132,7 +132,7 @@ Voici quelques exemples :
        print(response.json())
    ```
-=== ":simple-python: Python (aiohttp)"
+=== "Python (aiohttp)"
    Dépendances :
@@ -159,7 +159,7 @@ Voici quelques exemples :
    asyncio.run(main())
    ```
-=== ":simple-javascript: Javascript (axios)"
+=== "Javascript (axios)"
    Dépendances :
@@ -179,7 +179,7 @@ Voici quelques exemples :
    console.log(await instance.get("club/1").json());
    ```
-=== ":simple-rust: Rust (reqwest)"
+=== "Rust (reqwest)"
    Dépendances :
@@ -18,8 +18,7 @@ il n'est pas possible de développer le site sur ce système d'exploitation.
 Heureusement, il existe une alternative qui ne requiert pas de désinstaller votre
 OS ni de mettre un dual boot sur votre ordinateur : `WSL`.
- **Prérequis:** vous devez être sur Windows 10 version 2004 ou ultérieure (build 19041 & versions ultérieures) ou
+- **Prérequis:** vous devez être sur Windows 10 version 2004 ou ultérieure (build 19041 & versions ultérieures) ou Windows 11.
  Windows 11.
 - **Plus d'info:** [docs.microsoft.com](https://docs.microsoft.com/fr-fr/windows/wsl/install)
 ```shell
@@ -44,7 +43,7 @@ il suffit d'utiliser la commande suivante :
 cd /mnt/<la_lettre_du_disque>/vos/fichiers/comme/dhab
 ```
-!!!success
+!!!note
    À ce stade, si vous avez réussi votre installation de `WSL` ou bien qu'il
    était déjà installé, vous pouvez effectuer la mise en place du projet en suivant
@@ -102,10 +101,10 @@ cd /mnt/<la_lettre_du_disque>/vos/fichiers/comme/dhab
        ln -s /usr/bin/valkey-server /usr/bin/redis-server
        ```
 === "macOS"
-    Pour installer les dépendances, il est fortement recommandé 
+    Pour installer les dépendances, il est fortement recommandé d'installer le gestionnaire de paquets `homebrew <https://brew.sh/index_fr>`_.  
    d'installer le gestionnaire de paquets `homebrew <https://brew.sh/index_fr>`_.  
    Il est également nécessaire d'avoir installé xcode
    ```bash    
@@ -117,15 +116,12 @@ cd /mnt/<la_lettre_du_disque>/vos/fichiers/comme/dhab
    !!!note
-        Si vous rencontrez des erreurs lors de votre configuration, 
+        Si vous rencontrez des erreurs lors de votre configuration, n'hésitez pas à vérifier l'état de votre installation homebrew avec :code:`brew doctor`
        n'hésitez pas à vérifier l'état de votre installation homebrew 
        avec :code:`brew doctor`
 !!!note
    Python ne fait pas parti des dépendances puisqu'il est automatiquement
-    installé par uv. Il est cependant parfois nécessaire d'installer 
+    installé par uv. Il est cependant parfois nécessaire d'installer les headers Python nécessaire à la compilation de certains paquets.
    les headers Python nécessaire à la compilation de certains paquets.
 ## Finaliser l'installation
@@ -149,6 +145,7 @@ uv run ./manage.py install_xapian
    de texte à l'écran.
    C'est normal, il ne faut pas avoir peur.
 La modification de la configuration passe par la modification de variables
 d'environnement.
 Ces variables sont stockées dans un fichier `.env`.
@@ -186,32 +183,11 @@ Il suffit ensuite d'utiliser cette commande :
 uv run ./manage.py runserver
 ```
-Le serveur est alors accessible à l'adresse
+!!!note
 [http://localhost:8000](http://localhost:8000) 
 ou bien [http://127.0.0.1:8000/](http://127.0.0.1:8000/).
-Pour vous connecter, vous pouvez utiliser un des comptes utilisateur
+    Le serveur est alors accessible à l'adresse
-créés durant l'installation :
+    [http://localhost:8000](http://localhost:8000) 
-
+    ou bien [http://127.0.0.1:8000/](http://127.0.0.1:8000/).
 | username         | description                                                                |
 |------------------|----------------------------------------------------------------------------|
 | `root`           | super-utilisateur<br/>il peut tout faire et tout voir                      |
 | `subscriber`     | simple cotisant                                                            |
 | `old_subscriber` | ancien cotisant                                                            |
 | `public`         | non-cotisant                                                               |
 | `krophil`        | cotisant<br/>barman Foyer<br/>président du Troll Penché                    |
 | `sli`            | cotisant<br/>VP Troll                                                      |
 | `skia`           | cotisant<br/>barman MDE<br/>membre du bureau AE<br/>ancien membre du Troll |
 | `comunity`       | cotisant<br/>membre du bureau PdF<br/>admin communication                  |
 | `counter`        | cotisant<br/>admin comptoirs                                               |
 | `comptable`      | cotisant<br/>admin comptabilité                                            |
 | `rbatsbak`       | cotisant<br/>membre du Troll                                               |
 En plus de ces dernier, quelques centaines d'utilisateurs
 supplémentaires sont générés procéduralement,
 afin de rajouter un peu de volume de données.
 Tous les utilisateurs ont le mot de passe `plop`.
 !!!note
@@ -0,0 +1,37 @@
 #
 # Copyright 2022
 # - Maréchal <thgirod@hotmail.com
 #
 # Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
 # http://ae.utbm.fr.
 #
 # This program is free software; you can redistribute it and/or modify it under
 # the terms of the GNU General Public License a published by the Free Software
 # Foundation; either version 3 of the License, or (at your option) any later
 # version.
 #
 # This program is distributed in the hope that it will be useful, but WITHOUT
 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 # FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
 # details.
 #
 # You should have received a copy of the GNU General Public License along with
 # this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 class PaymentResultConverter:
    """Converter used for url mapping of the `eboutic.views.payment_result` view.
    It's meant to build an url that can match
    either `/eboutic/pay/success/` or `/eboutic/pay/failure/`
    but nothing else.
    """
    regex = "(success|failure)"
    def to_python(self, value):
        return str(value)
    def to_url(self, value):
        return str(value)
@@ -24,7 +24,7 @@
 from django.urls import path, register_converter
-from core.converters import ResultConverter
+from eboutic.converters import PaymentResultConverter
 from eboutic.views import (
    BillingInfoFormFragment,
    EbouticCheckout,
@@ -34,7 +34,7 @@ from eboutic.views import (
    payment_result,
 )
-register_converter(ResultConverter, "res")
+register_converter(PaymentResultConverter, "res")
 urlpatterns = [
    # Subscription views
@@ -346,16 +346,13 @@ class ForumTopicDetailView(CanViewMixin, DetailView):
        return kwargs
-class ForumMessageView(SingleObjectMixin, UserPassesTestMixin, RedirectView):
+class ForumMessageView(SingleObjectMixin, RedirectView):
    model = ForumMessage
    pk_url_kwarg = "message_id"
    permanent = False
    def test_func(self) -> bool:
        self.object = self.get_object()
        return self.request.user.can_view(self.object)
    def get_redirect_url(self, *args, **kwargs):
        self.object = self.get_object()
        return self.object.get_url()
@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-10-15 15:20+0200\n"
+"POT-Creation-Date: 2026-09-14 11:48+0200\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -35,10 +35,6 @@ msgstr ""
 "True si gardé à jour par le biais d'un fournisseur externe de domains "
 "toxics, False sinon"
 #: api/admin.py
 msgid "Reset HMAC key"
 msgstr "Réinitialiser la clef HMAC"
 #: api/admin.py
 #, python-format
 msgid ""
@@ -52,23 +48,6 @@ msgstr ""
 msgid "Revoke selected API keys"
 msgstr "Révoquer les clefs d'API sélectionnées"
 #: api/forms.py
 msgid "I have read and I accept the terms and conditions of use"
 msgstr "J'ai lu et j'accepte les conditions générales d'utilisation."
 #: api/forms.py
 msgid "You must approve the terms and conditions of use."
 msgstr "Vous devez approuver les conditions générales d'utilisation."
 #: api/forms.py
 msgid "You must confirm that this is your username."
 msgstr "Vous devez confirmer que c'est bien votre nom d'utilisateur."
 #: api/forms.py
 #, python-format
 msgid "I confirm that %(username)s is my username on %(app)s"
 msgstr "Je confirme que %(username)s est mon nom d'utilisateur sur %(app)s"
 #: api/models.py club/models.py com/models.py counter/models.py forum/models.py
 msgid "name"
 msgstr "nom"
@@ -89,10 +68,6 @@ msgstr "permissions du client"
 msgid "Specific permissions for this api client."
 msgstr "Permissions spécifiques pour ce client d'API"
 #: api/models.py
 msgid "HMAC Key"
 msgstr "Clef HMAC"
 #: api/models.py
 msgid "api client"
 msgstr "client d'api"
@@ -122,81 +97,51 @@ msgstr "clef d'api"
 msgid "api keys"
 msgstr "clefs d'api"
-#: api/templates/api/third_party/auth.jinja
+#: club/forms.py
-msgid "Confidentiality"
+msgid "Users to add"
-msgstr "Confidentialité"
+msgstr "Utilisateurs à ajouter"
-#: api/templates/api/third_party/auth.jinja
+#: club/forms.py core/views/group.py
-#, python-format
+msgid "Search users to add (one or more)."
-msgid ""
+msgstr "Recherche les utilisateurs à ajouter (un ou plus)."
 "By ticking this box and clicking on the send button, you acknowledge and "
 "agree to provide %(app)s with your first name, last name, nickname and any "
 "other information that was the third party app was explicitly authorized to "
 "fetch and that it must have acknowledged to you, in a complete and accurate "
 "manner."
 msgstr ""
 "En cochant cette case et en cliquant sur le bouton « Envoyer », vous "
 "reconnaissez et acceptez de fournir à %(app)s votre prénom, nom, pseudonyme "
 "et toute autre information que l'application tierce a été explicitement "
 "autorisée à récupérer et qu'elle doit vous avoir communiqué de manière "
 "complète et exacte."
-#: api/templates/api/third_party/auth.jinja
+#: club/forms.py
-#, python-format
+msgid "New Mailing"
-msgid ""
+msgstr "Nouvelle mailing liste"
 "The privacy policies of <a href=\"%(privacy_link)s\">%(app)s</a> and of <a "
 "href=\"%(sith_cgu_link)s\">the Students' Association</a> applies as soon as "
 "the form is submitted."
 msgstr ""
 "Les politiques de confidentialité de <a href=\"%(privacy_link)s\">%(app)s</"
 "a> et de <a href=\"%(sith_cgu_link)s\">l'Association des Etudiants</a> "
 "s'appliquent dès la soumission du formulaire."
-#: api/templates/api/third_party/auth.jinja
+#: club/forms.py
-msgid "Confirmation of identity"
+msgid "Subscribe"
-msgstr "Confirmation d'identité"
+msgstr "S'abonner"
-#: api/views.py
+#: club/forms.py
-msgid "The data provided for authentication is incorrect"
+msgid "Remove"
-msgstr "Les données fournies pour l'authentification sont incorrectes."
+msgstr "Retirer"
-#: api/views.py
+#: club/forms.py counter/forms.py pedagogy/templates/pedagogy/moderation.jinja
-msgid ""
+msgid "Action"
-"The signature is incorrect. We cannot ensure the provenance of the request."
+msgstr "Action"
 msgstr ""
 "La signature est incorrecte. Nous ne pouvons pas garantir l'authenticité de "
 "la requête."
-#: api/views.py
+#: club/forms.py club/tests/test_mailing.py
-#, python-format
+msgid "This field is required"
-msgid ""
+msgstr "Ce champ est obligatoire"
 "You are going to link your AE account and your %(app)s account. Continue "
 "only if this page was opened from %(app)s."
 msgstr ""
 "Vous allez lier votre compte AE et votre compte %(app)s. Poursuivez "
 "uniquement si cette page a été ouverte depuis %(app)s."
-#: api/views.py
+#: club/forms.py club/tests/test_mailing.py
-msgid "You have been successfully authenticated. You can now close this page."
+msgid "One of the selected users doesn't have an email address"
-msgstr ""
+msgstr "Un des utilisateurs sélectionnés n'a pas d'adresse email"
 "Vous avez été authentifié avec succès. Vous pouvez maintenant fermer cette "
 "page."
-#: api/views.py
+#: club/forms.py
-msgid ""
+msgid "An action is required"
-"Your authentication on the AE website was successful, but an error happened "
+msgstr "Une action est requise"
-"during the interaction with the third-party application. Please contact the "
+
-"managers of the latter."
+#: club/forms.py club/tests/test_mailing.py
-msgstr ""
+msgid "You must specify at least an user or an email address"
-"Votre authentification sur le site AE a fonctionné, mais une erreur est "
+msgstr "vous devez spécifier au moins un utilisateur ou une adresse email"
 "arrivée durant l'interaction avec l'application tierce. Veuillez contacter "
 "les responsables de cette dernière."
 #: club/forms.py counter/forms.py
 msgid "Begin date"
 msgstr "Date de début"
-#: club/forms.py com/forms.py counter/forms.py
+#: club/forms.py com/forms.py counter/forms.py subscription/forms.py
 msgid "End date"
 msgstr "Date de fin"
@@ -374,6 +319,60 @@ msgstr "rôle"
 msgid "past member"
 msgstr "ancien membre"
 #: club/models.py com/templates/com/mailing_admin.jinja
 #: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
 #: core/templates/core/user_clubs.jinja
 #: counter/templates/counter/invoices_call.jinja
 #: trombi/templates/trombi/edit_profile.jinja
 #: trombi/templates/trombi/export.jinja
 #: trombi/templates/trombi/user_profile.jinja
 msgid "Club"
 msgstr "Club"
 #: club/models.py
 msgid "Email address"
 msgstr "Adresse email"
 #: club/models.py
 msgid "Enter a valid address. Only the root of the address is needed."
 msgstr ""
 "Entrez une adresse valide. Seule la racine de l'adresse est nécessaire."
 #: club/models.py com/models.py core/models.py
 msgid "is moderated"
 msgstr "est modéré"
 #: club/models.py com/models.py
 msgid "moderator"
 msgstr "modérateur"
 #: club/models.py
 msgid "This mailing list already exists."
 msgstr "Cette liste de diffusion existe déjà."
 #: club/models.py club/templates/club/mailing.jinja
 msgid "Mailing"
 msgstr "Liste de diffusion"
 #: club/models.py club/templates/club/club_members.jinja
 #: club/templates/club/club_old_members.jinja club/templates/club/mailing.jinja
 #: counter/templates/counter/cash_summary_list.jinja
 #: counter/templates/counter/stats.jinja
 msgid "User"
 msgstr "Utilisateur"
 #: club/models.py
 msgid "At least user or email is required"
 msgstr "Au moins un utilisateur ou un email est nécessaire"
 #: club/models.py club/tests/test_mailing.py
 msgid "This email is already suscribed in this mailing"
 msgstr "Cet email est déjà abonné à cette mailing"
 #: club/models.py
 msgid "Unregistered user"
 msgstr "Utilisateur non enregistré"
 #: club/models.py
 msgid "The base url that links with this type must respect"
 msgstr "L'url de base que tous les liens de ce type doivent respecter"
@@ -460,13 +459,6 @@ msgstr "Membres du club"
 msgid "Manage roles"
 msgstr "Gérer les rôles"
 #: club/templates/club/club_members.jinja
 #: club/templates/club/club_old_members.jinja
 #: counter/templates/counter/cash_summary_list.jinja
 #: counter/templates/counter/stats.jinja
 msgid "User"
 msgstr "Utilisateur"
 #: club/templates/club/club_members.jinja
 #: club/templates/club/club_old_members.jinja
 #: core/templates/core/user_clubs.jinja
@@ -730,7 +722,8 @@ msgstr "Total"
 msgid "Payment method"
 msgstr "Méthode de paiement"
-#: club/templates/club/club_sellings.jinja com/templates/com/macros.jinja
+#: club/templates/club/club_sellings.jinja club/templates/club/mailing.jinja
 #: com/templates/com/macros.jinja com/templates/com/mailing_admin.jinja
 #: com/templates/com/news_admin_list.jinja com/templates/com/poster_edit.jinja
 #: com/templates/com/screen_edit.jinja com/templates/com/weekmail.jinja
 #: core/templates/core/file_detail.jinja
@@ -856,6 +849,60 @@ msgstr "Ajouter"
 msgid "Join"
 msgstr "Rejoindre"
 #: club/templates/club/mailing.jinja
 msgid "Mailing lists"
 msgstr "Mailing listes"
 #: club/templates/club/mailing.jinja
 msgid ""
 "Remember : mailing lists need to be moderated, if your new created list is "
 "not shown wait until moderation takes action"
 msgstr ""
 "Rappelez vous : les mailing listes doivent être modérées, si votre liste "
 "nouvellement créée n'est pas affichée, attendez jusqu'à ce qu'un modérateur "
 "prenne une décision"
 #: club/templates/club/mailing.jinja
 msgid "Mailing lists waiting for moderation"
 msgstr "Listes de diffusions en attente de modération"
 #: club/templates/club/mailing.jinja
 msgid "Generate mailing list"
 msgstr "Générer la liste de diffusion"
 #: club/templates/club/mailing.jinja com/templates/com/mailing_admin.jinja
 msgid "Email"
 msgstr "Email"
 #: club/templates/club/mailing.jinja
 msgid "Remove from mailing list"
 msgstr "Supprimer de la liste de diffusion"
 #: club/templates/club/mailing.jinja
 msgid "There is no subscriber for this mailing list"
 msgstr "Il n'y a pas d'abonnés dans cette liste de diffusion"
 #: club/templates/club/mailing.jinja
 msgid "No mailing list existing for this club"
 msgstr "Aucune mailing liste n'existe pour ce club"
 #: club/templates/club/mailing.jinja
 #: subscription/templates/subscription/subscription.jinja
 msgid "New member"
 msgstr "Nouveau membre"
 #: club/templates/club/mailing.jinja
 msgid "Add to mailing list"
 msgstr "Ajouter à la mailing liste"
 #: club/templates/club/mailing.jinja
 msgid "New mailing"
 msgstr "Nouvelle liste de diffusion"
 #: club/templates/club/mailing.jinja
 msgid "Create mailing list"
 msgstr "Créer une liste de diffusion"
 #: club/templates/club/pagerev_edit.jinja core/templates/core/page/edit.jinja
 msgid "Edit page"
 msgstr "Éditer la page"
@@ -901,6 +948,10 @@ msgstr "Éditer la page de club"
 msgid "Sellings"
 msgstr "Vente"
 #: club/views.py
 msgid "Mailing list"
 msgstr "Listes de diffusion"
 #: club/views.py
 msgid "You are now a member of this club."
 msgstr "Vous êtes maintenant membre de ce club."
@@ -947,7 +998,7 @@ msgstr "Prix d'achat"
 msgid "Format: 16:9 | Resolution: 1920x1080"
 msgstr "Format : 16:9 | Résolution : 1920x1080"
-#: com/forms.py
+#: com/forms.py subscription/forms.py
 msgid "Start date"
 msgstr "Date de début"
@@ -1031,10 +1082,6 @@ msgstr "auteur"
 msgid "is published"
 msgstr "est publié"
 #: com/models.py
 msgid "moderator"
 msgstr "modérateur"
 #: com/models.py
 msgid "news"
 msgstr "nouvelle"
@@ -1095,10 +1142,6 @@ msgstr "fichier"
 msgid "display time"
 msgstr "temps d'affichage"
 #: com/models.py core/models.py
 msgid "is moderated"
 msgstr "est modéré"
 #: com/models.py
 msgid "Begin date should be before end date"
 msgstr "La date de début doit être avant celle de fin"
@@ -1134,6 +1177,46 @@ msgstr "Nouvelle publiée"
 msgid "News deleted"
 msgstr "Nouvelle supprimée"
 #: com/templates/com/mailing_admin.jinja com/views.py
 #: core/templates/core/user_tools.jinja
 msgid "Mailing lists administration"
 msgstr "Administration des mailing listes"
 #: com/templates/com/mailing_admin.jinja
 #: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
 #: counter/templates/counter/refilling_list.jinja
 msgid "Actions"
 msgstr "Actions"
 #: com/templates/com/mailing_admin.jinja com/templates/com/poster_list.jinja
 #: core/templates/core/file_detail.jinja
 #: core/templates/core/file_moderation.jinja
 #: pedagogy/templates/pedagogy/fragments/ue_detail/comments.jinja
 #: sas/templates/sas/moderation.jinja sas/templates/sas/picture.jinja
 msgid "Moderate"
 msgstr "Modérer"
 #: com/templates/com/mailing_admin.jinja
 #, python-format
 msgid "Moderated by %(user)s"
 msgstr "Modéré par %(user)s"
 #: com/templates/com/mailing_admin.jinja
 msgid "This page lists all mailing lists"
 msgstr "Cette page liste toutes les listes de diffusion"
 #: com/templates/com/mailing_admin.jinja
 msgid "Not moderated mailing lists"
 msgstr "Listes de diffusion non modérées"
 #: com/templates/com/mailing_admin.jinja
 msgid "Moderated mailing lists"
 msgstr "Modérer les listes de diffusion"
 #: com/templates/com/mailing_admin.jinja
 msgid "No mailing list existing"
 msgstr "Aucune liste de diffusion existante"
 #: com/templates/com/news_admin_list.jinja
 msgid "News admin"
 msgstr "Administration des nouvelles"
@@ -1166,15 +1249,6 @@ msgstr "Titre"
 msgid "Summary"
 msgstr "Résumé"
 #: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
 #: core/templates/core/user_clubs.jinja
 #: counter/templates/counter/invoices_call.jinja
 #: trombi/templates/trombi/edit_profile.jinja
 #: trombi/templates/trombi/export.jinja
 #: trombi/templates/trombi/user_profile.jinja
 msgid "Club"
 msgstr "Club"
 #: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
 #: forum/templates/forum/forum.jinja sas/models.py
 msgid "Author"
@@ -1189,11 +1263,6 @@ msgstr "Modérateur"
 msgid "Dates"
 msgstr "Dates"
 #: com/templates/com/news_admin_list.jinja com/templates/com/weekmail.jinja
 #: counter/templates/counter/refilling_list.jinja
 msgid "Actions"
 msgstr "Actions"
 #: com/templates/com/news_admin_list.jinja core/templates/core/file.jinja
 #: core/templates/core/page/base.jinja
 msgid "View"
@@ -1354,13 +1423,6 @@ msgstr "Créer"
 msgid "Click to expand"
 msgstr "Cliquez pour agrandir"
 #: com/templates/com/poster_list.jinja core/templates/core/file_detail.jinja
 #: core/templates/core/file_moderation.jinja
 #: pedagogy/templates/pedagogy/fragments/ue_detail/comments.jinja
 #: sas/templates/sas/moderation.jinja sas/templates/sas/picture.jinja
 msgid "Moderate"
 msgstr "Modérer"
 #: com/templates/com/poster_list.jinja
 msgid "No posters"
 msgstr "Aucune affiche"
@@ -1775,10 +1837,6 @@ msgstr ""
 "Même si ce profil est caché, les utilisateurs sur cette liste pourront "
 "toujours le voir."
 #: core/models.py
 msgid "ToS approved at"
 msgstr "CGU approuvées le"
 #: core/models.py
 msgid "A user with that username already exists"
 msgstr "Un utilisateur de ce nom d'utilisateur existe déjà"
@@ -2055,8 +2113,7 @@ msgstr "R&D"
 msgid "Site created by the IT Department of the AE"
 msgstr "Site réalisé par le Pôle Informatique de l'AE"
-#: core/templates/core/base/header.jinja core/templates/core/cgu_approve.jinja
+#: core/templates/core/base/header.jinja core/templates/core/login.jinja
 #: core/templates/core/login.jinja
 #: core/templates/core/password_reset_complete.jinja
 msgid "Login"
 msgstr "Connexion"
@@ -2154,18 +2211,6 @@ msgstr "FAQ"
 msgid "Wiki"
 msgstr "Wiki"
 #: core/templates/core/cgu_approve.jinja
 msgid "Terms of Service"
 msgstr "Conditions générales d'utilisation"
 #: core/templates/core/cgu_approve.jinja
 msgid ""
 "To continue using our services, please read and approve the AE website's "
 "terms of service"
 msgstr ""
 "Pour continuer à utiliser nos services, veuillez lire et approuver les "
 "conditions générales d'utilisation du site AE."
 #: core/templates/core/create.jinja
 #, python-format
 msgid "Create %(name)s"
@@ -2671,6 +2716,14 @@ msgstr "Clubs actuels : "
 msgid "Old club(s) :"
 msgstr "Anciens clubs :"
 #: core/templates/core/user_clubs.jinja
 msgid "Subscribed mailing lists"
 msgstr "Mailing listes abonnées"
 #: core/templates/core/user_clubs.jinja
 msgid "Unsubscribe"
 msgstr "Se désabonner"
 #: core/templates/core/user_detail.jinja
 #, python-format
 msgid "%(user_name)s's profile"
@@ -3085,19 +3138,6 @@ msgstr "Appliquer les droits récursivement"
 msgid "Ensure this timestamp is set in the future"
 msgstr "Assurez-vous que cet horodatage est dans le futur"
 #: core/views/forms.py
 msgid "You must approve the terms of service."
 msgstr "Vous devez approuver les conditions générales d'utilisation"
 #: core/views/forms.py
 #, python-format
 msgid ""
 "I have read and I approve the <a href=\"%(url)s\" target=\"_blank\">Terms of "
 "Service</a>"
 msgstr ""
 "J'ai lu et j'approuve les <a href=\"%(url)s\" target=\"_blank\">Conditions "
 "Générales d'utilisation</a>"
 #: core/views/forms.py
 msgid "Username, email, or account number"
 msgstr "Nom d'utilisateur, email, ou numéro de compte AE"
@@ -3152,10 +3192,6 @@ msgstr "%s est déjà votre fillot/fillote"
 msgid "Users to add to group"
 msgstr "Utilisateurs à ajouter au groupe"
 #: core/views/group.py
 msgid "Search users to add (one or more)."
 msgstr "Recherche les utilisateurs à ajouter (un ou plus)."
 #: core/views/group.py
 msgid "Users to remove from group"
 msgstr "Utilisateurs à retirer du groupe"
@@ -3255,10 +3291,6 @@ msgstr ""
 "temps, mais les utilisateurs suivants ont été définis comme les deux : "
 "%(users)s"
 #: counter/forms.py pedagogy/templates/pedagogy/moderation.jinja
 msgid "Action"
 msgstr "Action"
 #: counter/forms.py
 msgid "Date and time of action"
 msgstr "Date et heure de l'action"
@@ -3945,6 +3977,7 @@ msgstr "Nouvelle formule"
 #: counter/templates/counter/fragments/create_student_card.jinja
 #: counter/templates/counter/invoices_call.jinja
 #: sas/templates/sas/picture.jinja
 #: subscription/templates/subscription/stats.jinja
 msgid "Go"
 msgstr "Valider"
@@ -4079,12 +4112,9 @@ msgid "Remove price"
 msgstr "Retirer le prix"
 #: counter/templates/counter/product_form.jinja
-msgid ""
+#, python-format
-"You can see product details. However, you cannot edit it, thus you won't be "
+msgid "Edit product %(name)s"
-"able to submit this form."
+msgstr "Édition du produit %(name)s"
 msgstr ""
 "Vous pouvez voir ce produit. Cependant, vous ne pouvez pas l'éditer ; vous "
 "ne serez donc pas en mesure de soumettre le formulaire."
 #: counter/templates/counter/product_form.jinja
 msgid "Creation date"
@@ -5211,22 +5241,6 @@ msgstr "Catégorie"
 msgid "Credits"
 msgstr "Crédits"
 #: pedagogy/templates/pedagogy/ue_detail.jinja
 msgid "Lectures"
 msgstr "Cours magistraux"
 #: pedagogy/templates/pedagogy/ue_detail.jinja
 msgid "Tutorials"
 msgstr "Travaux dirigés"
 #: pedagogy/templates/pedagogy/ue_detail.jinja
 msgid "Practicals"
 msgstr "Travaux pratiques"
 #: pedagogy/templates/pedagogy/ue_detail.jinja
 msgid "Work without supervision"
 msgstr "Travail hors encadrement"
 #: pedagogy/templates/pedagogy/ue_detail.jinja
 msgid "Availability"
 msgstr "Disponibilité"
@@ -5705,6 +5719,10 @@ msgstr "Cursus alternant (-20%)"
 msgid "A new poster needs to be moderated"
 msgstr "Une nouvelle affiche a besoin d'être modérée"
 #: sith/settings.py
 msgid "A new mailing list needs to be moderated"
 msgstr "Une nouvelle mailing list a besoin d'être modérée"
 #: sith/settings.py
 msgid "A new pedagogy comment has been signaled for moderation"
 msgstr ""
@@ -5826,17 +5844,17 @@ msgid "Create another subscription"
 msgstr "Créer une nouvelle cotisation"
 #: subscription/templates/subscription/stats.jinja
-msgid "All subscriptions"
+msgid "Total subscriptions"
-msgstr "Toutes les cotisations"
+msgstr "Cotisations totales"
 #: subscription/templates/subscription/stats.jinja
 msgid "Subscriptions by type"
 msgstr "Cotisations par type"
 #: subscription/templates/subscription/subscription.jinja
 msgid "Existing member"
 msgstr "Membre existant"
 #: subscription/templates/subscription/subscription.jinja
 msgid "New member"
 msgstr "Nouveau membre"
 #: subscription/views.py
 msgid "the groups that can create subscriptions"
 msgstr "les groupes pouvant créer des cotisations"
@@ -71,7 +71,6 @@ nav:
    - API:
      - Développement: tutorial/api/dev.md
      - Connexion à l'API: tutorial/api/connect.md
      - Liaison avec le compte AE: tutorial/api/account-link.md
    - Markdown AE: tutorial/markdown.md
    - Etransactions: tutorial/etransaction.md
  - How-to:
@@ -96,8 +95,6 @@ nav:
      - reference/api/hashers.md
      - reference/api/models.md
      - reference/api/perms.md
      - reference/api/schemas.md
      - reference/api/views.md
    - club:
      - reference/club/models.md
      - reference/club/views.md
@@ -24,24 +24,24 @@
    "#com:*": "./com/static/bundled/*"
  },
  "devDependencies": {
-    "@babel/core": "^8.0.6",
+    "@babel/core": "^8.0.1",
-    "@babel/preset-env": "^8.0.6",
+    "@babel/preset-env": "^8.0.2",
-    "@biomejs/biome": "^2.5.15",
+    "@biomejs/biome": "^2.5.1",
    "@hey-api/openapi-ts": "^0.99.0",
-    "@types/alpinejs": "^3.17.0",
+    "@types/alpinejs": "^3.13.11",
    "@types/alpinejs__sort": "^3.13.0",
    "@types/cytoscape-cxtmenu": "^3.4.5",
    "@types/cytoscape-klay": "^3.1.5",
    "@types/js-cookie": "^3.0.6",
-    "@types/node": "^26.6.4",
+    "@types/node": "^26.2.0",
    "@typescript/native": "npm:typescript@^7.0.2",
    "rollup-plugin-visualizer": "^7.1.1",
    "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vite": "^8.3.2"
+    "vite": "^8.2.2"
  },
  "dependencies": {
    "@ae_utbm/aemark": "^0.1.3",
-    "@alpinejs/sort": "^3.17.4",
+    "@alpinejs/sort": "^3.16.2",
    "@arendjr/text-clipper": "npm:@jsr/arendjr__text-clipper@^3.0.0",
    "@floating-ui/dom": "^1.8.0",
    "@fortawesome/fontawesome-free": "^7.3.1",
@@ -49,13 +49,13 @@
    "@fullcalendar/daygrid": "^6.1.21",
    "@fullcalendar/icalendar": "^6.1.21",
    "@fullcalendar/list": "^6.1.21",
-    "@sentry/browser": "^11.3.0",
+    "@sentry/browser": "^10.70.0",
-    "@zip.js/zip.js": "^2.22.0",
+    "@zip.js/zip.js": "^2.8.57",
-    "3d-force-graph": "^1.80.1",
+    "3d-force-graph": "^1.80.0",
-    "alpinejs": "^3.17.4",
+    "alpinejs": "^3.16.2",
    "chart.js": "^4.5.1",
    "country-flag-emoji-polyfill": "^0.1.10",
-    "cytoscape": "^3.34.3",
+    "cytoscape": "^3.34.1",
    "cytoscape-cxtmenu": "^3.5.0",
    "cytoscape-klay": "^3.1.4",
    "d3-force-3d": "^3.0.6",
@@ -66,8 +66,8 @@
    "js-cookie": "^3.0.8",
    "lit-html": "^3.3.3",
    "native-file-system-adapter": "^3.0.1",
-    "temporal-polyfill": "^1.0.5",
+    "temporal-polyfill": "^1.0.4",
-    "three": "^0.186.1",
+    "three": "^0.185.1",
    "three-spritetext": "^1.10.0",
    "tom-select": "^2.6.2"
  }
@@ -30,7 +30,7 @@
              {% endfor %}
            {% endif %}
          </div>
-          {% if comment.author_id == user.id or user.has_perm("pedagogy.delete_uecomment") %}
+          {% if user.has_perm("pedagogy.delete_uecomment") %}
            <div class="alert-aside">
              <a
                href="{{ url("pedagogy:comment_delete", comment_id=comment.id) }}"
@@ -66,7 +66,7 @@
          </time>
        </div>
        <div class="comment-options">
-          {% if comment.author_id == user.id or user.has_perm("pedagogy.change_uecomment") %}
+          {% if user.can_edit(comment) %}
            <a
              class="clickable"
              hx-get="{{ url('pedagogy:comment_update', comment_id=comment.id) }}"
@@ -87,7 +87,8 @@
            >
              <i class="fa fa-exclamation delete-action"></i>
            </a>
-            {% if comment.author_id == user.id or user.has_perm("pedagogy.delete_uecomment") %}
+          {% endif %}
          {% if user.has_perm("pedagogy.delete_uecomment") %}
            <a
              href="{{ url("pedagogy:comment_delete", comment_id=comment.id) }}"
              tooltip="{% trans %}Delete{% endtrans %}"
@@ -95,7 +96,6 @@
              <i class="fa fa-trash-can delete-action"></i>
            </a>
          {% endif %}
          {% endif %}
        </div>
      </div>
      <div class="comment-stars">
@@ -27,21 +27,25 @@
          </div>
          <hr>
          <div class="info-container-item">
-            <div>{% trans %}Lectures{% endtrans %}</div>
+            <div>Cours magistraux</div>
            <div>{{ object.hours_CM }}h</div>
          </div>
          <div class="info-container-item">
-            <div>{% trans %}Tutorials{% endtrans %}</div>
+            <div>Travaux dirigés</div>
            <div>{{ object.hours_TD }}h</div>
          </div>
          <div class="info-container-item">
-            <div>{% trans %}Practicals{% endtrans %}</div>
+            <div>Travaux pratiques</div>
            <div>{{ object.hours_TP }}h</div>
          </div>
          <div class="info-container-item">
-            <div>{% trans %}Work without supervision{% endtrans %}</div>
+            <div>Travail hors encadrement</div>
            <div>{{ object.hours_THE }}h</div>
          </div>
          <div class="info-container-item">
            <div>Cours magistraux</div>
            <div>{{ object.hours_TE }}h</div>
          </div>
          <hr>
          <div class="info-container-item">
            <div>{% trans %}Availability{% endtrans %}</div>
@@ -20,14 +20,14 @@ license = { text = "GPL-3.0-only" }
 requires-python = "<4.0,>=3.14"
 dependencies = [
    "django>=5.2.17,<6.0.0",
-    "django-ninja>=1.7.1,<2.0.0",
+    "django-ninja>=1.7.0,<2.0.0",
    "django-ninja-extra>=0.31.7",
    "Pillow>=12.3.0,<13.0.0",
    "aemark>=0.1.1",
    "django-jinja<3.0.0,>=2.11.0",
-    "cryptography>=50.0.2,<51.0.0",
+    "cryptography>=50.0.1,<51.0.0",
    "django-phonenumber-field>=8.5.0,<9.0.0",
-    "phonenumbers>=9.0.40,<10.0.0",
+    "phonenumbers>=9.0.38,<10.0.0",
    "reportlab>=5.0.1,<6.0.0",
    "django-haystack>=3.4.0,<4.0.0",
    "xapian-haystack>=4.0.0,<5.0.0",
@@ -35,21 +35,21 @@ dependencies = [
    "django-ordered-model>=3.7.4,<4.0.0",
    "django-simple-captcha>=0.7.0,<1.0.0",
    "python-dateutil>=2.9.0.post0,<3.0.0",
-    "sentry-sdk>=2.71.0,<3.0.0",
+    "sentry-sdk>=2.68.1,<3.0.0",
    "jinja2>=3.1.6,<4.0.0",
-    "django-countries>=9.1.0,<10.0.0",
+    "django-countries>=9.0.0,<10.0.0",
    "dict2xml>=1.7.8,<2.0.0",
    "Sphinx>=9.1.0,<10", # Used by xapian during installation
    "tomli>=2.4.1,<3.0.0",
    "django-honeypot>=1.3.0,<2",
    "pydantic-extra-types>=2.11.1,<3.0.0",
-    "ical>=14.2.0",
+    "ical>=14.1.1",
-    "redis[hiredis]>=8.1.0,<9",
+    "redis[hiredis]>=6.4.0,<9.0.0",
-    "environs[django]>=15.2.0,<16",
+    "environs[django]>=15.1.0,<16",
    "requests>=2.34.2,<3.0.0",
    "honcho>=2.0.0",
    "psutil>=7.2.2,<8.0.0",
-    "celery[redis]>=5.6.3,<7",
+    "celery[redis]>=5.6.2,<7",
    "django-celery-results>=2.6.0",
    "django-celery-beat>=2.9.0",
 ]
@@ -65,10 +65,10 @@ prod = [
 dev = [
    "django-debug-toolbar>=8.0.0,<9",
    "ipython>=9.17.1,<10.0.0",
-    "pre-commit>=4.6.2,<5.0.0",
+    "pre-commit>=4.6.1,<5.0.0",
-    "ruff>=0.16.10,<1.0.0",
+    "ruff>=0.16.6,<1.0.0",
    "djhtml>=3.0.11,<4.0.0",
-    "faker>=40.40.0,<41.0.0",
+    "faker>=40.38.0,<41.0.0",
    "rjsmin>=1.2.5,<2.0.0",
 ]
 tests = [
@@ -76,7 +76,7 @@ tests = [
    "pytest>=9.1.1,<10.0.0",
    "pytest-cov>=7.1.0,<8.0.0",
    "pytest-django>=4.14.0,<5.0.0",
-    "model-bakery>=1.24.1,<2.0.0",
+    "model-bakery>=1.24.0,<2.0.0",
    "beautifulsoup4>=4.15.0,<5",
    "lxml>=6.1.3,<7",
 ]
@@ -84,7 +84,7 @@ docs = [
    "mkdocs>=1.6.1,<2.0.0",
    "mkdocs-material>=9.7.7,<10.0.0",
    "mkdocstrings>=1.0.6,<2.0.0",
-    "mkdocstrings-python>=2.0.9,<3.0.0",
+    "mkdocstrings-python>=2.0.7,<3.0.0",
    "mkdocs-include-markdown-plugin>=7.3.0,<8.0.0",
 ]
@@ -2,6 +2,7 @@ import type TomSelect from "tom-select";
 import type { TomOption } from "tom-select/src/types";
 import type { UserAjaxSelect } from "#core:core/components/ajax-select-index";
 import { paginated } from "#core:utils/api";
 import { History } from "#core:utils/history";
 import {
  type IdentifiedUserSchema,
  type ModerationRequestSchema,
@@ -227,6 +228,11 @@ document.addEventListener("alpine:init", () => {
     * Error message when a moderation operation fails
     **/
    moderationError: "",
    /**
     * Method of pushing new url to the browser history
     * Used by popstate event and always reset to it's default value when used
     **/
    pushstate: History.Push,
    async init() {
      this.pictures = (
@@ -261,10 +267,12 @@ document.addEventListener("alpine:init", () => {
        if (!event.state || event.state.sasPictureId === undefined) {
          return;
        }
        this.pushstate = History.Replace;
        this.currentPicture = this.pictures.find(
          (i: PictureSchema) => i.id === Number.parseInt(event.state.sasPictureId, 10),
        ) as PictureWithIdentifications;
      });
      this.pushstate = History.Replace; /* Avoid first url push */
      await this.updatePicture();
    },
@@ -277,11 +285,17 @@ document.addEventListener("alpine:init", () => {
     * the list of identified users are updated.
     */
    async updatePicture(): Promise<void> {
-      window.history.replaceState(
+      const updateArgs = {
-        { sasPictureId: this.currentPicture.id },
+        data: { sasPictureId: this.currentPicture.id },
-        "",
+        unused: "",
-        this.currentPicture.sas_url,
+        url: this.currentPicture.sas_url,
-      );
+      };
      if (this.pushstate === History.Replace) {
        window.history.replaceState(updateArgs.data, updateArgs.unused, updateArgs.url);
        this.pushstate = History.Push;
      } else {
        window.history.pushState(updateArgs.data, updateArgs.unused, updateArgs.url);
      }
      this.moderationError = "";
      const index: number = this.pictures.indexOf(this.currentPicture);
@@ -372,9 +372,6 @@ SITH_PDF_CLUB_ID = env.int("SITH_PDF_CLUB_ID", default=2)
 # Main root for club pages
 SITH_CLUB_ROOT_PAGE = "clubs"
 SITH_CGU_PAGE = env.str("SITH_CGU_PAGE", default="legals/ri")
 # Define the date in the year serving as
 # reference for the subscriptions calendar (month, day)
 SITH_SEMESTER_START_AUTUMN = (8, 15)  # 15 August
@@ -621,6 +618,7 @@ with open(
 SITH_NOTIFICATIONS = [
    ("POSTER_MODERATION", _("A new poster needs to be moderated")),
    ("MAILING_MODERATION", _("A new mailing list needs to be moderated")),
    (
        "PEDAGOGY_MODERATION",
        _("A new pedagogy comment has been signaled for moderation"),
@@ -34,7 +34,6 @@ urlpatterns = [
    path("", include(("core.urls", "core"), namespace="core")),
    path("sitemap.xml", cache_page(86400)(sitemap), {"sitemaps": sitemaps}),
    path("api/", api.urls),
    path("api-link/", include(("api.urls", "api-link"), namespace="api-link")),
    path("rootplace/", include(("rootplace.urls", "rootplace"), namespace="rootplace")),
    path(
        "subscription/",
@@ -8,11 +8,22 @@ from django.utils.translation import gettext_lazy as _
 from core.models import User
 from core.utils import get_last_promo
-from core.views.forms import SelectDate
+from core.views.forms import SelectDate, SelectDateTime
 from core.views.widgets.ajax_select import AutoCompleteSelectUser
 from subscription.models import Subscription
 class SelectionDateForm(forms.Form):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.fields["start_date"] = forms.DateTimeField(
            label=_("Start date"), widget=SelectDateTime, required=True
        )
        self.fields["end_date"] = forms.DateTimeField(
            label=_("End date"), widget=SelectDateTime, required=True
        )
 class SubscriptionForm(forms.ModelForm):
    allowed_payment_methods = ["CARD", "CASH", "AE_ACCOUNT"]
@@ -1,13 +1,6 @@
-import {
+import { BarController, BarElement, CategoryScale, Chart, LinearScale } from "chart.js";
  BarController,
  BarElement,
  CategoryScale,
  Chart,
  LinearScale,
  Tooltip,
 } from "chart.js";
-Chart.register(BarController, BarElement, CategoryScale, LinearScale, Tooltip);
+Chart.register(BarController, BarElement, CategoryScale, LinearScale);
 function getRandomColor() {
  const letters = "0123456789ABCDEF";
@@ -11,39 +11,51 @@
 {% block content %}
  <p>
    <form>
      {{ form.start_date.label }}<br>
      {{ form.start_date }}<br><br>
      {{ form.end_date.label }}<br>
      {{ form.end_date }}<br>
      <p><input type="submit" value="{% trans %}Go{% endtrans %}" /></p>
    </form>
  </p>
  <canvas id="statsChart" width="400" height="200"></canvas>
  <p>
    {% trans %}Total subscriptions{% endtrans %} : {{ subscriptions_total.count() }}<br><br>
    {% trans %}Subscriptions by type{% endtrans %}<br><br>
    {% for location in locations %}
      {{ location[1] }} : <i class="nb">{{ subscriptions_total.filter(location=location[0]).count() }}</i><br>
    {% endfor %}
    <p>
      <br>
      <table>
-    <thead>
+        <tr>
          <th>{% trans %}Subscription type{% endtrans %}</th>
          {% for location in locations %}
            <th>{{ location[1] }}</th>
          {% endfor %}
          <th id="graphLabel">{% trans %}Total{% endtrans %}</th>
    </thead>
    <tr>
      <td>{% trans %}All subscriptions{% endtrans %}</td>
      {% for location in locations %}
        <td><i class="nb">{{ total_location[location[0]] }}</i><br></td>
      {% endfor %}
      <td><i class="nb">{{ total_location.values()|sum }}</i></td>
    </tr>
          {% for type in subscriptions_types %}
            <tr>
-        <td><i class="types">{{ subscriptions_types[type]['name'] }}</i></td>
+              <td><i class="types" >{{ subscriptions_types[type]['name'] }}</i></td>
              {% set subscriptions_total_type = subscriptions_total.filter(subscription_type=type) %}
              {% for location in locations %}
                <td>
                  {% set subscriptions_total_type_location = subscriptions_total_type.filter(location=location[0]) %}
                  {% trans %}Total{% endtrans %} : {{ subscriptions_total_type_location.count()}}<br>
                  {% for p_type in payment_types %}
-              {% set subtotal = subscriptions[type][location[0]][p_type[0]] %}
+                    {{ p_type[1] }} : <i class="nb">{{ subscriptions_total_type_location.filter(payment_method=p_type[0]).count()}}</i><br>
              {% if subtotal > 0 %}
                {{ p_type[1] }} : <i class="nb">{{ subtotal }}</i><br>
              {% endif %}
                  {% endfor %}
                </td>
              {% endfor %}
-        <td class="total"><i class="nb">{{ total_type[type] }}</i></td>
+              <td class="total"><i class="nb">{{subscriptions_total_type.count()}}</i>
              </tr>
          {% endfor %}
        </table>
 {% endblock %}
@@ -12,21 +12,21 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
 from collections import defaultdict
 from django.conf import settings
 from django.contrib.auth.forms import PasswordResetForm
 from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.core.exceptions import PermissionDenied
-from django.db.models import Count
+from django.urls import reverse, reverse_lazy
 from django.urls import reverse
 from django.utils.timezone import localdate
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import CreateView, DetailView, TemplateView
 from django.views.generic.edit import FormView
 from core.views import FragmentMixin, UseFragmentsMixin
 from core.views.group import PermissionGroupsUpdateView
 from subscription.forms import (
    SelectionDateForm,
    SubscriptionExistingUserForm,
    SubscriptionNewUserForm,
 )
@@ -93,39 +93,35 @@ class SubscriptionPermissionView(PermissionGroupsUpdateView):
    extra_context = {"object_name": _("the groups that can create subscriptions")}
-class SubscriptionsStatsView(TemplateView):
+class SubscriptionsStatsView(FormView):
    template_name = "subscription/stats.jinja"
    form_class = SelectionDateForm
    success_url = reverse_lazy("subscriptions:stats")
    def dispatch(self, request, *arg, **kwargs):
        self.start_date = localdate()
        self.end_date = self.start_date
        if request.user.is_root or request.user.is_board_member:
            return super().dispatch(request, *arg, **kwargs)
        raise PermissionDenied
    def post(self, request, *args, **kwargs):
        self.form = self.get_form()
        self.start_date = self.form["start_date"]
        self.end_date = self.form["end_date"]
        return super().post(request, *args, **kwargs)
    def get_initial(self):
        return {
            "start_date": self.start_date.strftime("%Y-%m-%d %H:%M:%S"),
            "end_date": self.end_date.strftime("%Y-%m-%d %H:%M:%S"),
        }
    def get_context_data(self, **kwargs):
        kwargs = super().get_context_data(**kwargs)
-        today = localdate()
+        kwargs["subscriptions_total"] = Subscription.objects.filter(
-        qs = Subscription.objects.filter(
+            subscription_end__gte=self.end_date, subscription_start__lte=self.start_date
            subscription_end__gte=today, subscription_start__lte=today
        )
        grouped = qs.values("subscription_type", "location", "payment_method").annotate(
            count=Count("*")
        )
        by_location = qs.values("location").annotate(count=Count("*"))
        by_type = qs.values("subscription_type").annotate(count=Count("*"))
        kwargs["subscriptions"] = defaultdict(
            lambda: defaultdict(lambda: defaultdict(int))
        )
        for sub in grouped:
            kwargs["subscriptions"][sub["subscription_type"]][sub["location"]][
                sub["payment_method"]
            ] = sub["count"]
        kwargs["total_location"] = defaultdict(
            int, {i["location"]: i["count"] for i in by_location}
        )
        kwargs["total_type"] = defaultdict(
            int, {i["subscription_type"]: i["count"] for i in by_type}
        )
        kwargs["subscriptions_types"] = settings.SITH_SUBSCRIPTIONS
        kwargs["payment_types"] = settings.SITH_SUBSCRIPTION_PAYMENT_METHOD
        kwargs["locations"] = settings.SITH_SUBSCRIPTION_LOCATIONS
Author	SHA1	Message	Date
imperosol	3080a9725f	add translations	2026-09-25 15:48:53 +02:00
imperosol	c736a92f6e	style: improve ue comments appearance	2026-09-25 15:48:53 +02:00
imperosol	581d3b9a5f	style: improve ue comment form appearance	2026-09-25 15:48:53 +02:00
imperosol	7caef6d0b5	style: improve ue detail infos appearance	2026-09-25 15:48:53 +02:00