[UPDATE] Update phonenumbers requirement

Updates the requirements on [phonenumbers](https://github.com/daviddrysdale/python-phonenumbers) to permit the latest version.
- [Commits](https://github.com/daviddrysdale/python-phonenumbers/compare/v9.0.41...v9.0.42)

---
updated-dependencies:
- dependency-name: phonenumbers
  dependency-version: 9.0.42
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

antispam/forms.py

@@ -2,7 +2,7 @@ from django import forms
 from django.core.validators import EmailValidator
 from django.utils.translation import gettext_lazy as _
 
-from antispam.models import ToxicDomain
+from antispam.models.models import ToxicDomain
 
 
 class AntiSpamEmailValidator(EmailValidator):
@@ -17,6 +17,6 @@ validate_antispam_email = AntiSpamEmailValidator()
 
 
 class AntiSpamEmailField(forms.EmailField):
-    """An email field that email addresses with a known toxic domain."""
+    """An email field that forbids email addresses with a known toxic domain."""
 
     default_validators = [validate_antispam_email]

antispam/management/commands/update_spam_database.py

@@ -38,22 +38,31 @@ class Command(BaseCommand):
         return domains
 
     def _update_domains(self, domains: set[str]):
-        # Cleanup database
-        ToxicDomain.objects.filter(is_externally_managed=True).delete()
-
-        # Create database
-        ToxicDomain.objects.bulk_create(
-            [
-                ToxicDomain(domain=domain, is_externally_managed=True)
-                for domain in domains
-            ],
-            ignore_conflicts=True,
-        )
+        existing = set(ToxicDomain.objects.values_list("domain", flat=True))
+        if existing == domains:
+            self.stdout.write("Domain database was up to date")
+            return
+        if to_remove := (existing - domains):
+            # Cleanup database
+            ToxicDomain.objects.filter(
+                domain__in=to_remove, is_externally_managed=True
+            ).delete()
+        if to_create := (domains - existing):
+            # Create database
+            ToxicDomain.objects.bulk_create(
+                [
+                    ToxicDomain(domain=domain, is_externally_managed=True)
+                    for domain in to_create
+                ],
+                ignore_conflicts=True,
+            )
         self.stdout.write("Domain database updated")
 
     def handle(self, *args, **options):
         if not self._should_update(force=options["force"]):
-            self.stdout.write("Domain database is up to date")
+            self.stdout.write(
+                "No update required. Use --force if you want to do it anyway."
+            )
             return
         self.stdout.write("Updating domain database")
 

antispam/models/__init__.py

@@ -0,0 +1,4 @@
+from antispam.models.fields import AntiSpamEmailField
+from antispam.models.models import ToxicDomain
+
+__all__ = ["AntiSpamEmailField", "ToxicDomain"]

antispam/models/fields.py

@@ -0,0 +1,21 @@
+from django.conf import settings
+from django.db import models
+
+from antispam import forms
+
+
+class AntiSpamEmailField(models.EmailField):
+    """An email field that forbids email addresses with a known toxic domain."""
+
+    default_validators = [forms.validate_antispam_email]
+
+
+if settings.TESTING:
+    from model_bakery import baker
+
+    baker.generators.add(
+        AntiSpamEmailField, lambda: baker.random_gen.gen_email(max_length=100)
+    )
+else:  # pragma: no cover
+    # baker is only used in tests, so we don't need coverage for this part
+    pass

core/models.py

@@ -55,6 +55,7 @@ from django.utils.translation import gettext_lazy as _
 from phonenumber_field.modelfields import PhoneNumberField
 from PIL import Image, ImageOps
 
+from antispam.models import AntiSpamEmailField
 from core.utils import get_last_promo
 
 if TYPE_CHECKING:
@@ -158,7 +159,7 @@ class User(AbstractUser):
 
     first_name = models.CharField(_("first name"), max_length=64)
     last_name = models.CharField(_("last name"), max_length=64)
-    email = models.EmailField(_("email address"), unique=True)
+    email = AntiSpamEmailField(_("email address"), unique=True)
     date_of_birth = models.DateField(_("date of birth"), blank=True, null=True)
     nick_name = models.CharField(_("nick name"), max_length=64, null=True, blank=True)
     last_update = models.DateTimeField(_("last update"), auto_now=True)
@@ -267,7 +268,7 @@ class User(AbstractUser):
     forum_signature = models.TextField(
         _("forum signature"), max_length=256, blank=True, default=""
     )
-    second_email = models.EmailField(_("second email address"), null=True, blank=True)
+    second_email = AntiSpamEmailField(_("second email address"), null=True, blank=True)
     phone = PhoneNumberField(_("phone"), null=True, blank=True)
     parent_phone = PhoneNumberField(_("parent phone"), null=True, blank=True)
     address = models.CharField(_("address"), max_length=128, blank=True, default="")

core/tests/test_user.py

@@ -472,6 +472,36 @@ def test_user_preferences(client: Client):
     assert user.preferences.notify_on_click is True
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize("can_edit", [True, False])
+def test_user_visibility(client: Client, monkeypatch, can_edit):
+    # The view is a CanView, so just patch User.can_be_edited_by for the test
+    monkeypatch.setattr("core.models.User.can_be_edited_by", lambda *args: can_edit)
+    client.force_login(subscriber_user.make())
+
+    user, other_user = subscriber_user.make(_quantity=2)
+    url = reverse("core:user_visibility_fragment", kwargs={"user_id": user.id})
+    response = client.get(url)
+    assert response.status_code == 200 if can_edit else 403
+    response = client.post(
+        url,
+        {
+            "show_my_stats": False,
+            "is_viewable": False,
+            "whitelisted_users": [other_user.id],
+        },
+    )
+    if not can_edit:
+        assert response.status_code == 403
+        return
+    assertRedirects(response, url)
+    user.refresh_from_db()
+    user.preferences.refresh_from_db()
+    assert user.is_viewable is False
+    assert list(user.whitelisted_users.all()) == [other_user]
+    assert user.preferences.show_my_stats is False
+
+
 @pytest.mark.django_db
 def test_user_stats(client: Client):
     user = subscriber_user.make()

core/views/forms.py

@@ -48,7 +48,6 @@ from django.utils.translation import gettext_lazy as _
 from phonenumber_field.widgets import RegionalPhoneNumberWidget
 from PIL import Image
 
-from antispam.forms import AntiSpamEmailField
 from core.models import Gift, Group, Page, PageRev, Preferences, SithFile, User
 from core.utils import resize_image
 from core.views.widgets.ajax_select import (
@@ -185,10 +184,7 @@ class RegisteringForm(UserCreationForm):
     class Meta:
         model = User
         fields = ("first_name", "last_name", "email", "cgu_approved_at")
-        field_classes = {
-            "email": AntiSpamEmailField,
-            "cgu_approved_at": CGUApprovalField,
-        }
+        field_classes = {"cgu_approved_at": CGUApprovalField}
 
 
 class CGUApprovalForm(forms.ModelForm):

core/views/mixins.py

@@ -94,8 +94,8 @@ class FragmentMixin(TemplateResponseMixin, AllowFragment, ContextMixin):
             return render(
                 request,
                 "app/template.jinja",
-                context={"fragment": fragment(request)
-            }
+                context={"fragment": fragment(request)}
+            )
 
         # in urls.py
         urlpatterns = [

core/views/user.py

@@ -502,7 +502,9 @@ class UserClubView(UserTabsMixin, CanViewMixin, DetailView):
     current_tab = "clubs"
 
 
-class UserVisibilityFormFragment(FragmentMixin, SuccessMessageMixin, UpdateView):
+class UserVisibilityFormFragment(
+    FragmentMixin, SuccessMessageMixin, CanEditMixin, UpdateView
+):
     model = User
     form_class = UserVisibilityForm
     template_name = "core/fragment/user_visibility.jinja"

pyproject.toml

@@ -27,7 +27,7 @@ dependencies = [
     "django-jinja<3.0.0,>=2.11.0",
     "cryptography>=50.0.2,<51.0.0",
     "django-phonenumber-field>=9.0.0,<10",
-    "phonenumbers>=9.0.41,<10.0.0",
+    "phonenumbers>=9.0.42,<10.0.0",
     "reportlab>=5.1.0,<6.0.0",
     "django-haystack>=3.4.0,<4.0.0",
     "xapian-haystack>=4.0.0,<5.0.0",