doc: third-party auth

C'est pas la branche la plus appropriée, mais ça gène mon debug de devoir scroller plus longtemps dans l'html des réponses à cause de la place que prennent les notifs.

api/admin.py

@@ -17,6 +17,15 @@ class ApiClientAdmin(admin.ModelAdmin):
         "owner__nick_name",
     )
     autocomplete_fields = ("owner", "groups", "client_permissions")
+    readonly_fields = ("hmac_key",)
+    actions = ("reset_hmac_key",)
+
+    @admin.action(permissions=["change"], description=_("Reset HMAC key"))
+    def reset_hmac_key(self, _request: HttpRequest, queryset: QuerySet[ApiClient]):
+        objs = list(queryset)
+        for obj in objs:
+            obj.reset_hmac(commit=False)
+        ApiClient.objects.bulk_update(objs, fields=["hmac_key"])
 
 
 @admin.register(ApiKey)

api/api.py

@@ -0,0 +1,16 @@
+from ninja_extra import ControllerBase, api_controller, route
+
+from api.auth import ApiKeyAuth
+from api.schemas import ApiClientSchema
+
+
+@api_controller("/client")
+class ApiClientController(ControllerBase):
+    @route.get(
+        "/me",
+        auth=[ApiKeyAuth()],
+        response=ApiClientSchema,
+        url_name="api-client-infos",
+    )
+    def get_client_info(self):
+        return self.context.request.auth

api/forms.py

@@ -0,0 +1,35 @@
+from django import forms
+from django.forms import HiddenInput
+from django.utils.translation import gettext_lazy as _
+
+
+class ThirdPartyAuthForm(forms.Form):
+    """Form to complete to authenticate on the sith from a third-party app.
+
+    For the form to be valid, the user approve the EULA (french: CGU)
+    and give its username from the third-party app.
+    """
+
+    cgu_accepted = forms.BooleanField(
+        required=True,
+        label=_("I have read and I accept the terms and conditions of use"),
+        error_messages={
+            "required": _("You must approve the terms and conditions of use.")
+        },
+    )
+    is_username_valid = forms.BooleanField(
+        required=True,
+        error_messages={"required": _("You must confirm that this is your username.")},
+    )
+    client_id = forms.IntegerField(widget=HiddenInput())
+    third_party_app = forms.CharField(widget=HiddenInput())
+    privacy_link = forms.URLField(widget=HiddenInput())
+    username = forms.CharField(widget=HiddenInput())
+    callback_url = forms.URLField(widget=HiddenInput())
+    signature = forms.CharField(widget=HiddenInput())
+
+    def __init__(self, *args, label_suffix: str = "", initial, **kwargs):
+        super().__init__(*args, label_suffix=label_suffix, initial=initial, **kwargs)
+        self.fields["is_username_valid"].label = _(
+            "I confirm that %(username)s is my username on %(app)s"
+        ) % {"username": initial.get("username"), "app": initial.get("third_party_app")}

api/migrations/0002_apiclient_hmac_key.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.3 on 2025-10-26 10:15
+
+from django.db import migrations, models
+
+import api.models
+
+
+class Migration(migrations.Migration):
+    dependencies = [("api", "0001_initial")]
+
+    operations = [
+        migrations.AddField(
+            model_name="apiclient",
+            name="hmac_key",
+            field=models.CharField(
+                default=api.models.get_hmac_key, max_length=128, verbose_name="HMAC Key"
+            ),
+        ),
+    ]

api/models.py

@@ -1,13 +1,20 @@
+import secrets
 from typing import Iterable
 
 from django.contrib.auth.models import Permission
 from django.db import models
+from django.db.models import Q
+from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import pgettext_lazy
 
 from core.models import Group, User
 
 
+def get_hmac_key():
+    return secrets.token_hex(64)
+
+
 class ApiClient(models.Model):
     name = models.CharField(_("name"), max_length=64)
     owner = models.ForeignKey(
@@ -26,11 +33,10 @@ class ApiClient(models.Model):
         help_text=_("Specific permissions for this api client."),
         related_name="clients",
     )
+    hmac_key = models.CharField(_("HMAC Key"), max_length=128, default=get_hmac_key)
     created_at = models.DateTimeField(auto_now_add=True)
     updated_at = models.DateTimeField(auto_now=True)
 
-    _perm_cache: set[str] | None = None
-
     class Meta:
         verbose_name = _("api client")
         verbose_name_plural = _("api clients")
@@ -38,33 +44,38 @@ class ApiClient(models.Model):
     def __str__(self):
         return self.name
 
+    @cached_property
+    def all_permissions(self) -> set[str]:
+        permissions = (
+            Permission.objects.filter(
+                Q(group__group__in=self.groups.all()) | Q(clients=self)
+            )
+            .values_list("content_type__app_label", "codename")
+            .order_by()
+        )
+        return {f"{content_type}.{name}" for content_type, name in permissions}
+
     def has_perm(self, perm: str):
         """Return True if the client has the specified permission."""
+        return perm in self.all_permissions
 
-        if self._perm_cache is None:
-            group_permissions = (
-                Permission.objects.filter(group__group__in=self.groups.all())
-                .values_list("content_type__app_label", "codename")
-                .order_by()
-            )
-            client_permissions = self.client_permissions.values_list(
-                "content_type__app_label", "codename"
-            ).order_by()
-            self._perm_cache = {
-                f"{content_type}.{name}"
-                for content_type, name in (*group_permissions, *client_permissions)
-            }
-        return perm in self._perm_cache
-
-    def has_perms(self, perm_list):
-        """
-        Return True if the client has each of the specified permissions. If
-        object is passed, check if the client has all required perms for it.
-        """
+    def has_perms(self, perm_list: Iterable[str]) -> bool:
+        """Return True if the client has each of the specified permissions."""
         if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
             raise ValueError("perm_list must be an iterable of permissions.")
         return all(self.has_perm(perm) for perm in perm_list)
 
+    def reset_hmac(self, *, commit: bool = True) -> str:
+        """Reset and return the HMAC key for this client.
+
+        Args:
+            commit: if True (the default), persist the new hmac in db.
+        """
+        self.hmac_key = get_hmac_key()
+        if commit:
+            self.save()
+        return self.hmac_key
+
 
 class ApiKey(models.Model):
     PREFIX_LENGTH = 5

api/schemas.py

@@ -0,0 +1,23 @@
+from ninja import ModelSchema, Schema
+from pydantic import Field, HttpUrl
+
+from api.models import ApiClient
+from core.schemas import SimpleUserSchema
+
+
+class ApiClientSchema(ModelSchema):
+    class Meta:
+        model = ApiClient
+        fields = ["id", "name"]
+
+    owner: SimpleUserSchema
+    permissions: list[str] = Field(alias="all_permissions")
+
+
+class ThirdPartyAuthParamsSchema(Schema):
+    client_id: int
+    third_party_app: str
+    privacy_link: HttpUrl
+    username: str
+    callback_url: HttpUrl
+    signature: str

api/templates/api/third_party/auth.jinja

@@ -0,0 +1,32 @@
+{% extends "core/base.jinja" %}
+
+{% block content %}
+  <form method="post">
+    {% csrf_token %}
+    <h3>{% trans %}Confidentiality{% endtrans %}</h3>
+    <p>
+      {% trans trimmed app=third_party_app %}
+        By ticking this box and clicking on the send button, you
+        acknowledge and agree to provide {{ app }} with your
+        first name, last name, nickname and any other information
+        that was the third party app was explicitly authorized to fetch
+        and that it must have acknowledged to you, in a complete and accurate manner.
+      {% endtrans %}
+    </p>
+    <p class="margin-bottom">
+      {% trans trimmed app=third_party_app, privacy_link=third_party_cgu, sith_cgu_link=sith_cgu %}
+        The privacy policies of <a href="{{ privacy_link }}">{{ app }}</a>
+        and of <a href="{{ sith_cgu_link }}">the Students' Association</a>
+        applies as soon as the form is submitted.
+      {% endtrans %}
+    </p>
+    <div class="row">{{ form.cgu_accepted }} {{ form.cgu_accepted.label_tag() }}</div>
+    <br>
+    <h3 class="margin-bottom">{% trans %}Confirmation of identity{% endtrans %}</h3>
+    <div class="row margin-bottom">
+      {{ form.is_username_valid }} {{ form.is_username_valid.label_tag() }}
+    </div>
+    {% for field in form.hidden_fields() %}{{ field }}{% endfor %}
+    <input type="submit" class="btn btn-blue">
+  </form>
+{% endblock %}

api/tests/test_admin.py

@@ -0,0 +1,24 @@
+import pytest
+from django.contrib.admin import AdminSite
+from django.http import HttpRequest
+from model_bakery import baker
+from pytest_django.asserts import assertNumQueries
+
+from api.admin import ApiClientAdmin
+from api.models import ApiClient
+
+
+@pytest.mark.django_db
+def test_reset_hmac_action():
+    client_admin = ApiClientAdmin(ApiClient, AdminSite())
+    api_clients = baker.make(ApiClient, _quantity=4, _bulk_create=True)
+    old_hmac_keys = [c.hmac_key for c in api_clients]
+    with assertNumQueries(2):
+        qs = ApiClient.objects.filter(id__in=[c.id for c in api_clients[2:4]])
+        client_admin.reset_hmac_key(HttpRequest(), qs)
+    for c in api_clients:
+        c.refresh_from_db()
+    assert api_clients[0].hmac_key == old_hmac_keys[0]
+    assert api_clients[1].hmac_key == old_hmac_keys[1]
+    assert api_clients[2].hmac_key != old_hmac_keys[2]
+    assert api_clients[3].hmac_key != old_hmac_keys[3]

api/tests/test_api_client_controller.py

@@ -0,0 +1,18 @@
+import pytest
+from django.test import Client
+from django.urls import reverse
+from model_bakery import baker
+
+from api.hashers import generate_key
+from api.models import ApiClient, ApiKey
+from api.schemas import ApiClientSchema
+
+
+@pytest.mark.django_db
+def test_api_client_controller(client: Client):
+    key, hashed = generate_key()
+    api_client = baker.make(ApiClient)
+    baker.make(ApiKey, client=api_client, hashed_key=hashed)
+    res = client.get(reverse("api:api-client-infos"), headers={"X-APIKey": key})
+    assert res.status_code == 200
+    assert res.json() == ApiClientSchema.from_orm(api_client).model_dump()

api/tests/test_client.py

@@ -0,0 +1,59 @@
+import pytest
+from django.contrib.auth.models import Permission
+from django.test import TestCase
+from model_bakery import baker
+
+from api.models import ApiClient
+from core.models import Group
+
+
+class TestClientPermissions(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.api_client = baker.make(ApiClient)
+        cls.perms = baker.make(Permission, _quantity=10, _bulk_create=True)
+        cls.api_client.groups.set(
+            [
+                baker.make(Group, permissions=cls.perms[0:3]),
+                baker.make(Group, permissions=cls.perms[3:5]),
+            ]
+        )
+        cls.api_client.client_permissions.set(
+            [cls.perms[3], cls.perms[5], cls.perms[6], cls.perms[7]]
+        )
+
+    def test_all_permissions(self):
+        assert self.api_client.all_permissions == {
+            f"{p.content_type.app_label}.{p.codename}" for p in self.perms[0:8]
+        }
+
+    def test_has_perm(self):
+        assert self.api_client.has_perm(
+            f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}"
+        )
+        assert not self.api_client.has_perm(
+            f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}"
+        )
+
+    def test_has_perms(self):
+        assert self.api_client.has_perms(
+            [
+                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
+                f"{self.perms[2].content_type.app_label}.{self.perms[2].codename}",
+            ]
+        )
+        assert not self.api_client.has_perms(
+            [
+                f"{self.perms[1].content_type.app_label}.{self.perms[1].codename}",
+                f"{self.perms[9].content_type.app_label}.{self.perms[9].codename}",
+            ],
+        )
+
+
+@pytest.mark.django_db
+def test_reset_hmac_key():
+    client = baker.make(ApiClient)
+    original_key = client.hmac_key
+    client.reset_hmac(commit=True)
+    assert len(client.hmac_key) == len(original_key)
+    assert client.hmac_key != original_key

api/tests/test_third_party_auth.py

@@ -0,0 +1,114 @@
+from unittest import mock
+from unittest.mock import Mock
+
+from django.db.models import Max
+from django.test import TestCase
+from django.urls import reverse
+from model_bakery import baker
+from pytest_django.asserts import assertRedirects
+
+from api.models import ApiClient, get_hmac_key
+from core.baker_recipes import subscriber_user
+from core.schemas import UserProfileSchema
+from core.utils import hmac_hexdigest
+
+
+def mocked_post(*, ok: bool):
+    class MockedResponse(Mock):
+        @property
+        def ok(self):
+            return ok
+
+    def mocked():
+        return MockedResponse()
+
+    return mocked
+
+
+class TestThirdPartyAuth(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.user = subscriber_user.make()
+        cls.api_client = baker.make(ApiClient)
+
+    def setUp(self):
+        self.query = {
+            "client_id": self.api_client.id,
+            "third_party_app": "app",
+            "privacy_link": "https://foobar.fr/",
+            "username": "bibou",
+            "callback_url": "https://callback.fr/",
+        }
+        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
+        self.callback_data = {
+            "user": UserProfileSchema.from_orm(self.user).model_dump()
+        }
+        self.callback_data["signature"] = hmac_hexdigest(
+            self.api_client.hmac_key, self.callback_data["user"]
+        )
+
+    def test_auth_ok(self):
+        self.client.force_login(self.user)
+        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        assert res.status_code == 200
+        with mock.patch("requests.post", new_callable=mocked_post(ok=True)) as mocked:
+            res = self.client.post(
+                reverse("api-link:third-party-auth"),
+                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
+            )
+            mocked.assert_called_once_with(
+                self.query["callback_url"], json=self.callback_data
+            )
+        assertRedirects(
+            res,
+            reverse("api-link:third-party-auth-result", kwargs={"result": "success"}),
+        )
+
+    def test_callback_error(self):
+        """Test that the user see the failure page if the callback request failed."""
+        self.client.force_login(self.user)
+        with mock.patch("requests.post", new_callable=mocked_post(ok=False)) as mocked:
+            res = self.client.post(
+                reverse("api-link:third-party-auth"),
+                data={"cgu_accepted": True, "is_username_valid": True, **self.query},
+            )
+            mocked.assert_called_once_with(
+                self.query["callback_url"], json=self.callback_data
+            )
+        assertRedirects(
+            res,
+            reverse("api-link:third-party-auth-result", kwargs={"result": "failure"}),
+        )
+
+    def test_wrong_signature(self):
+        """Test that a 403 is raised if the signature of the query is wrong."""
+        self.client.force_login(subscriber_user.make())
+        new_key = get_hmac_key()
+        del self.query["signature"]
+        self.query["signature"] = hmac_hexdigest(new_key, self.query)
+        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        assert res.status_code == 403
+
+    def test_cgu_not_accepted(self):
+        self.client.force_login(self.user)
+        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        assert res.status_code == 200
+        res = self.client.post(reverse("api-link:third-party-auth"), data=self.query)
+        assert res.status_code == 200  # no redirect means invalid form
+        res = self.client.post(
+            reverse("api-link:third-party-auth"),
+            data={"cgu_accepted": False, "is_username_valid": False, **self.query},
+        )
+        assert res.status_code == 200
+
+    def test_invalid_client(self):
+        self.query["client_id"] = ApiClient.objects.aggregate(res=Max("id"))["res"] + 1
+        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        assert res.status_code == 403
+
+    def test_missing_parameter(self):
+        """Test that a 403 is raised if there is a missing parameter."""
+        del self.query["username"]
+        self.query["signature"] = hmac_hexdigest(self.api_client.hmac_key, self.query)
+        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        assert res.status_code == 403

api/urls.py

@@ -1,6 +1,10 @@
+from django.urls import path, register_converter
 from ninja.security import SessionAuth
 from ninja_extra import NinjaExtraAPI
 
+from api.views import ThirdPartyAuthResultView, ThirdPartyAuthView
+from core.converters import ResultConverter
+
 api = NinjaExtraAPI(
     title="PICON",
     description="Portail Interactif de Communication avec les Outils Numériques",
@@ -9,3 +13,14 @@ api = NinjaExtraAPI(
     auth=[SessionAuth()],
 )
 api.auto_discover_controllers()
+
+register_converter(ResultConverter, "res")
+
+urlpatterns = [
+    path("auth/", ThirdPartyAuthView.as_view(), name="third-party-auth"),
+    path(
+        "auth/<res:result>/",
+        ThirdPartyAuthResultView.as_view(),
+        name="third-party-auth-result",
+    ),
+]

api/views.py

@@ -0,0 +1,119 @@
+import hmac
+from urllib.parse import unquote
+
+import pydantic
+import requests
+from django.conf import settings
+from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.core.exceptions import PermissionDenied
+from django.urls import reverse, reverse_lazy
+from django.utils.translation import gettext as _
+from django.views.generic import FormView, TemplateView
+from ninja_extra.shortcuts import get_object_or_none
+
+from api.forms import ThirdPartyAuthForm
+from api.models import ApiClient
+from api.schemas import ThirdPartyAuthParamsSchema
+from core.models import SithFile
+from core.schemas import UserProfileSchema
+from core.utils import hmac_hexdigest
+
+
+class ThirdPartyAuthView(LoginRequiredMixin, FormView):
+    form_class = ThirdPartyAuthForm
+    template_name = "api/third_party/auth.jinja"
+    success_url = reverse_lazy("core:index")
+
+    def parse_params(self) -> ThirdPartyAuthParamsSchema:
+        """Parse and check the authentication parameters.
+
+        Raises:
+            PermissionDenied: if the verification failed.
+        """
+        # This is here rather than in ThirdPartyAuthForm because
+        # the given parameters and their signature are checked during both
+        # POST (for obvious reasons) and GET (in order not to make
+        # the user fill a form just to get an error he won't understand)
+        params = self.request.GET or self.request.POST
+        params = {key: unquote(val) for key, val in params.items()}
+        try:
+            params = ThirdPartyAuthParamsSchema(**params)
+        except pydantic.ValidationError as e:
+            raise PermissionDenied("Wrong data format") from e
+        client: ApiClient = get_object_or_none(ApiClient, id=params.client_id)
+        if not client:
+            raise PermissionDenied
+        if not hmac.compare_digest(
+            hmac_hexdigest(client.hmac_key, params.model_dump(exclude={"signature"})),
+            params.signature,
+        ):
+            raise PermissionDenied("Bad signature")
+        return params
+
+    def dispatch(self, request, *args, **kwargs):
+        self.params = self.parse_params()
+        return super().dispatch(request, *args, **kwargs)
+
+    def get(self, *args, **kwargs):
+        messages.warning(
+            self.request,
+            _(
+                "You are going to link your AE account and your %(app)s account. "
+                "Continue only if this page was opened from %(app)s."
+            )
+            % {"app": self.params.third_party_app},
+        )
+        return super().get(*args, **kwargs)
+
+    def get_initial(self):
+        return self.params.model_dump()
+
+    def form_valid(self, form):
+        client = ApiClient.objects.get(id=form.cleaned_data["client_id"])
+        user = UserProfileSchema.from_orm(self.request.user).model_dump()
+        data = {"user": user, "signature": hmac_hexdigest(client.hmac_key, user)}
+        response = requests.post(form.cleaned_data["callback_url"], json=data)
+        self.success_url = reverse(
+            "api-link:third-party-auth-result",
+            kwargs={"result": "success" if response.ok else "failure"},
+        )
+        return super().form_valid(form)
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {
+            "third_party_app": self.params.third_party_app,
+            "third_party_cgu": self.params.privacy_link,
+            "sith_cgu": SithFile.objects.get(id=settings.SITH_CGU_FILE_ID),
+        }
+
+
+class ThirdPartyAuthResultView(LoginRequiredMixin, TemplateView):
+    """View that the user will see if its authentication on sith was successful.
+
+    This can show either a success or a failure message :
+    - success : everything is good, the user is successfully authenticated
+      and can close the page
+    - failure : the authentication has been processed on the sith side,
+      but the request to the callback url received an error.
+      In such a case, there is nothing much we can do but to advice
+      the user to contact the developers of the third-party app.
+    """
+
+    template_name = "core/base.jinja"
+    success_message = _(
+        "You have been successfully authenticated. You can now close this page."
+    )
+    error_message = _(
+        "Your authentication on the AE website was successful, "
+        "but an error happened during the interaction "
+        "with the third-party application. "
+        "Please contact the managers of the latter."
+    )
+
+    def get(self, request, *args, **kwargs):
+        if self.kwargs.get("result") == "success":
+            messages.success(request, self.success_message)
+        else:
+            messages.error(request, self.error_message)
+        return super().get(request, *args, **kwargs)

club/api.py

@@ -6,9 +6,15 @@ from ninja_extra.pagination import PageNumberPaginationExtra
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.auth import ApiKeyAuth
-from api.permissions import CanAccessLookup, HasPerm
+from api.permissions import CanAccessLookup, CanView, HasPerm
 from club.models import Club, Membership
-from club.schemas import ClubSchema, ClubSearchFilterSchema, SimpleClubSchema
+from club.schemas import (
+    ClubSchema,
+    ClubSearchFilterSchema,
+    SimpleClubSchema,
+    UserMembershipSchema,
+)
+from core.models import User
 
 
 @api_controller("/club")
@@ -38,3 +44,22 @@ class ClubController(ControllerBase):
         return self.get_object_or_exception(
             Club.objects.prefetch_related(prefetch), id=club_id
         )
+
+
+@api_controller("/user/{int:user_id}/club")
+class UserClubController(ControllerBase):
+    @route.get(
+        "",
+        response=list[UserMembershipSchema],
+        auth=[ApiKeyAuth(), SessionAuth()],
+        permissions=[CanView],
+        url_name="fetch_user_clubs",
+    )
+    def fetch_user_clubs(self, user_id: int):
+        """Get all the active memberships of the given user."""
+        user = self.get_object_or_exception(User, id=user_id)
+        return (
+            Membership.objects.ongoing()
+            .filter(user=user)
+            .select_related("club", "user")
+        )

club/schemas.py

@@ -40,6 +40,8 @@ class ClubProfileSchema(ModelSchema):
 
 
 class ClubMemberSchema(ModelSchema):
+    """A schema to represent all memberships in a club."""
+
     class Meta:
         model = Membership
         fields = ["start_date", "end_date", "role", "description"]
@@ -53,3 +55,13 @@ class ClubSchema(ModelSchema):
         fields = ["id", "name", "logo", "is_active", "short_description", "address"]
 
     members: list[ClubMemberSchema]
+
+
+class UserMembershipSchema(ModelSchema):
+    """A schema to represent the active club memberships of a user."""
+
+    class Meta:
+        model = Membership
+        fields = ["id", "start_date", "role", "description"]
+
+    club: SimpleClubSchema

club/templates/club/club_tools.jinja

@@ -1,63 +1,25 @@
 {% extends "core/base.jinja" %}
-{% from "reservation/macros.jinja" import room_detail %}
-
-{% block additional_css %}
-  <link rel="stylesheet" href="{{ static("core/components/card.scss") }}">
-{% endblock %}
 
 {% block content %}
-  <h3>{% trans %}Club tools{% endtrans %} ({{ club.name }})</h3>
+  <h3>{% trans %}Club tools{% endtrans %}</h3>
   <div>
     <h4>{% trans %}Communication:{% endtrans %}</h4>
     <ul>
-      <li>
-        <a href="{{ url('com:news_new') }}?club={{ object.id }}">
-          {% trans %}Create a news{% endtrans %}
-        </a>
-      </li>
-      <li>
-        <a href="{{ url('com:weekmail_article') }}?club={{ object.id }}">
-          {% trans %}Post in the Weekmail{% endtrans %}
-        </a>
-      </li>
+      <li> <a href="{{ url('com:news_new') }}?club={{ object.id }}">{% trans %}Create a news{% endtrans %}</a></li>
+      <li> <a href="{{ url('com:weekmail_article') }}?club={{ object.id }}">{% trans %}Post in the Weekmail{% endtrans %}</a></li>
       {% if object.trombi %}
-        <li>
-          <a href="{{ url('trombi:detail', trombi_id=object.trombi.id) }}">
-            {% trans %}Edit Trombi{% endtrans %}</a>
-        </li>
+        <li> <a href="{{ url('trombi:detail', trombi_id=object.trombi.id) }}">{% trans %}Edit Trombi{% endtrans %}</a></li>
       {% else %}
-        <li><a href="{{ url('trombi:create', club_id=object.id) }}">{% trans %}New Trombi{% endtrans %}</a></li>
-        <li><a href="{{ url('club:poster_list', club_id=object.id) }}">{% trans %}Posters{% endtrans %}</a></li>
+        <li> <a href="{{ url('trombi:create', club_id=object.id) }}">{% trans %}New Trombi{% endtrans %}</a></li>
+        <li> <a href="{{ url('club:poster_list', club_id=object.id) }}">{% trans %}Posters{% endtrans %}</a></li>
       {% endif %}
     </ul>
-    <h4>{% trans %}Reservable rooms{% endtrans %}</h4>
-    <a
-      href="{{ url("reservation:room_create") }}?club={{ object.id }}"
-      class="btn btn-blue"
-    >
-      {% trans %}Add a room{% endtrans %}
-    </a>
-    {%- if reservable_rooms|length > 0 -%}
-      <ul class="card-group">
-        {%- for room in reservable_rooms -%}
-          {{ room_detail(
-          room,
-          can_edit=user.can_edit(room),
-          can_delete=request.user.has_perm("reservation.delete_room")
-          ) }}
-        {%- endfor -%}
-      </ul>
-    {%- else -%}
-      <p>
-        {% trans %}This club manages no reservable room{% endtrans %}
-      </p>
-    {%- endif -%}
     <h4>{% trans %}Counters:{% endtrans %}</h4>
     <ul>
-      {% for counter in counters %}
-        <li>{{ counter }}:
-          <a href="{{ url('counter:details', counter_id=counter.id) }}">View</a>
-          <a href="{{ url('counter:admin', counter_id=counter.id) }}">Edit</a>
+      {% for c in object.counters.filter(type="OFFICE") %}
+        <li>{{ c }}:
+          <a href="{{ url('counter:details', counter_id=c.id) }}">View</a>
+          <a href="{{ url('counter:admin', counter_id=c.id) }}">Edit</a>
         </li>
       {% endfor %}
     </ul>

club/tests/test_user_club_controller.py

@@ -0,0 +1,50 @@
+from datetime import timedelta
+
+from django.test import TestCase
+from django.urls import reverse
+from django.utils.timezone import localdate
+from model_bakery import baker
+from model_bakery.recipe import Recipe
+
+from club.models import Club, Membership
+from club.schemas import UserMembershipSchema
+from core.baker_recipes import subscriber_user
+from core.models import Page
+
+
+class TestFetchClub(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.user = subscriber_user.make()
+        pages = baker.make(Page, _quantity=3, _bulk_create=True)
+        clubs = baker.make(Club, page=iter(pages), _quantity=3, _bulk_create=True)
+        recipe = Recipe(
+            Membership, user=cls.user, start_date=localdate() - timedelta(days=2)
+        )
+        cls.members = Membership.objects.bulk_create(
+            [
+                recipe.prepare(club=clubs[0]),
+                recipe.prepare(club=clubs[1], end_date=localdate() - timedelta(days=1)),
+                recipe.prepare(club=clubs[1]),
+            ]
+        )
+
+    def test_fetch_memberships(self):
+        self.client.force_login(subscriber_user.make())
+        res = self.client.get(
+            reverse("api:fetch_user_clubs", kwargs={"user_id": self.user.id})
+        )
+        assert res.status_code == 200
+        assert [UserMembershipSchema.model_validate(m) for m in res.json()] == [
+            UserMembershipSchema.from_orm(m) for m in (self.members[0], self.members[2])
+        ]
+
+    def test_fetch_club_nb_queries(self):
+        self.client.force_login(subscriber_user.make())
+        with self.assertNumQueries(6):
+            # - 5 queries for authentication
+            # - 1 query for the actual data
+            res = self.client.get(
+                reverse("api:fetch_user_clubs", kwargs={"user_id": self.user.id})
+            )
+            assert res.status_code == 200

club/views.py

@@ -260,12 +260,6 @@ class ClubToolsView(ClubTabsMixin, CanEditMixin, DetailView):
     template_name = "club/club_tools.jinja"
     current_tab = "tools"
 
-    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
-            "reservable_rooms": list(self.object.reservable_rooms.all()),
-            "counters": list(self.object.counters.filter(type="OFFICE")),
-        }
-
 
 class ClubAddMembersFragment(
     FragmentMixin, PermissionRequiredMixin, SuccessMessageMixin, CreateView

com/static/com/components/ics-calendar.scss

@@ -16,76 +16,16 @@
   --event-details-padding: 20px;
   --event-details-border: 1px solid #EEEEEE;
   --event-details-border-radius: 4px;
-  --event-details-box-shadow: 0 6px 20px 4px rgb(0 0 0 / 16%);
+  --event-details-box-shadow: 0px 6px 20px 4px rgb(0 0 0 / 16%);
   --event-details-max-width: 600px;
   --event-recurring-internal-color: #6f69cd;
   --event-recurring-unpublished-color: orange;
 }
 
-ics-calendar,
-room-scheduler {
+ics-calendar {
   border: none;
   box-shadow: none;
 
-  a.fc-col-header-cell-cushion,
-  a.fc-col-header-cell-cushion:hover {
-    color: black;
-  }
-
-  a.fc-daygrid-day-number,
-  a.fc-daygrid-day-number:hover {
-    color: rgb(34, 34, 34);
-  }
-
-  td {
-    overflow: visible; // Show events on multiple days
-  }
-
-  td, th {
-    text-align: unset;
-  }
-
-  //Reset from style.scss
-  table {
-    box-shadow: none;
-    border-radius: 0;
-    -moz-border-radius: 0;
-    margin: 0;
-  }
-
-  // Reset from style.scss
-  thead {
-    background-color: white;
-    color: black;
-  }
-
-  // Reset from style.scss
-  tbody > tr {
-    &:nth-child(even):not(.highlight) {
-      background: white;
-    }
-  }
-
-  .fc .fc-toolbar.fc-footer-toolbar {
-    margin-bottom: 0.5em;
-  }
-
-  button.text-copy,
-  button.text-copy:focus,
-  button.text-copy:hover {
-    background-color: #67AE6E !important;
-    transition: 500ms ease-in;
-  }
-
-  button.text-copied,
-  button.text-copied:focus,
-  button.text-copied:hover {
-    transition: 500ms ease-out;
-  }
-
-}
-
-ics-calendar {
   #event-details {
     z-index: 10;
     max-width: 1151px;
@@ -122,60 +62,82 @@ ics-calendar {
       align-items: start;
       flex-direction: row;
       background-color: var(--event-details-background-color);
-      margin-top: 0;
+      margin-top: 0px;
       margin-bottom: 4px;
     }
   }
-}
 
-// Reset from style.scss
-thead {
-  background-color: white;
-  color: black;
-}
-
-// Reset from style.scss
-tbody > tr {
-  &:nth-child(even):not(.highlight) {
-    background: white;
+  a.fc-col-header-cell-cushion,
+  a.fc-col-header-cell-cushion:hover {
+    color: black;
   }
-}
 
-.fc .fc-toolbar.fc-footer-toolbar {
-  margin-bottom: 0.5em;
-}
+  a.fc-daygrid-day-number,
+  a.fc-daygrid-day-number:hover {
+    color: rgb(34, 34, 34);
+  }
 
-button.text-copy,
-button.text-copy:focus,
-button.text-copy:hover {
-  background-color: #67AE6E !important;
-  transition: 500ms ease-in;
-}
+  td {
+    overflow: visible; // Show events on multiple days
+  }
 
-button.text-copied,
-button.text-copied:focus,
-button.text-copied:hover {
-  transition: 500ms ease-out;
-}
+  //Reset from style.scss
+  table {
+    box-shadow: none;
+    border-radius: 0px;
+    -moz-border-radius: 0px;
+    margin: 0px;
+  }
 
-.fc .fc-getCalendarLink-button {
-  margin-right: 0.5rem;
-}
+  // Reset from style.scss
+  thead {
+    background-color: white;
+    color: black;
+  }
 
-.fc .fc-helpButton-button {
-  border-radius: 70%;
-  padding-left: 0.5rem;
-  padding-right: 0.5rem;
-  background-color: rgba(0, 0, 0, 0.8);
-  transition: 100ms ease-out;
-  width: 30px;
-  height: 30px;
-  font-size: 11px;
-}
+  // Reset from style.scss
+  tbody>tr {
+    &:nth-child(even):not(.highlight) {
+      background: white;
+    }
+  }
+
+  .fc .fc-toolbar.fc-footer-toolbar {
+    margin-bottom: 0.5em;
+  }
+
+  button.text-copy,
+  button.text-copy:focus,
+  button.text-copy:hover {
+    background-color: #67AE6E !important;
+    transition: 500ms ease-in;
+  }
+
+  button.text-copied,
+  button.text-copied:focus,
+  button.text-copied:hover {
+    transition: 500ms ease-out;
+  }
+
+  .fc .fc-getCalendarLink-button {
+    margin-right: 0.5rem;
+  }
+
+  .fc .fc-helpButton-button {
+    border-radius: 70%;
+    padding-left: 0.5rem;
+    padding-right: 0.5rem;
+    background-color: rgba(0, 0, 0, 0.8);
+    transition: 100ms ease-out;
+    width: 30px;
+    height: 30px;
+    font-size: 11px;
+  }
 
 
-.fc .fc-helpButton-button:hover {
-  background-color: rgba(20, 20, 20, 0.6);
+  .fc .fc-helpButton-button:hover {
+    background-color: rgba(20, 20, 20, 0.6);
+  }
 }
 
 .tooltip.calendar-copy-tooltip {

com/static/com/css/news-list.scss

@@ -81,6 +81,7 @@
     }
 
     #links_content {
+      overflow: auto;
       box-shadow: $shadow-color 1px 1px 1px;
       min-height: 20em;
       padding-bottom: 1em;

com/templates/com/news_list.jinja

@@ -1,11 +1,9 @@
 {% extends "core/base.jinja" %}
 {% from "com/macros.jinja" import news_moderation_alert %}
 
-{% block title %}AE UTBM{% endblock %}
-
 {% block additional_css %}
   <link rel="stylesheet" href="{{ static('com/css/news-list.scss') }}">
-  <link rel="stylesheet" href="{{ static('core/components/calendar.scss') }}">
+  <link rel="stylesheet" href="{{ static('com/components/ics-calendar.scss') }}">
 
   {# Atom feed discovery, not really css but also goes there #}
   <link rel="alternate" type="application/rss+xml" title="{% trans %}News feed{% endtrans %}" href="{{ url("com:news_feed") }}">
@@ -215,12 +213,6 @@
               <i class="fa-solid fa-magnifying-glass fa-xl"></i>
               <a href="{{ url("matmat:search") }}">{% trans %}Matmatronch{% endtrans %}</a>
             </li>
-            {% if user.has_perm("reservation.view_reservationslot") %}
-              <li>
-                <i class="fa-solid fa-thumbtack fa-xl"></i>
-                <a href="{{ url("reservation:main") }}">{% trans %}Room reservation{% endtrans %}</a>
-              </li>
-            {% endif %}
             <li>
               <i class="fa-solid fa-check-to-slot fa-xl"></i>
               <a href="{{ url("election:list") }}">{% trans %}Elections{% endtrans %}</a>

core/auth/mixins.py

@@ -307,6 +307,7 @@ class PermissionOrClubBoardRequiredMixin(PermissionRequiredMixin):
             return False
         if super().has_permission():
             return True
-        return self.club is not None and any(
-            g.id == self.club.board_group_id for g in self.request.user.cached_groups
+        return (
+            self.club is not None
+            and self.club.board_group_id in self.request.user.all_groups
         )

core/converters.py

@@ -1,19 +1,16 @@
-class FourDigitYearConverter:
-    regex = "[0-9]{4}"
+from django.urls.converters import IntConverter, StringConverter
 
-    def to_python(self, value):
-        return int(value)
+
+class FourDigitYearConverter(IntConverter):
+    regex = "[0-9]{4}"
 
     def to_url(self, value):
         return str(value).zfill(4)
 
 
-class TwoDigitMonthConverter:
+class TwoDigitMonthConverter(IntConverter):
     regex = "[0-9]{2}"
 
-    def to_python(self, value):
-        return int(value)
-
     def to_url(self, value):
         return str(value).zfill(2)
 
@@ -28,3 +25,9 @@ class BooleanStringConverter:
 
     def to_url(self, value):
         return str(value)
+
+
+class ResultConverter(StringConverter):
+    """Converter whose regex match either "success" or "failure"."""
+
+    regex = "(success|failure)"

core/management/commands/populate.py

@@ -28,6 +28,7 @@ from typing import ClassVar, NamedTuple
 from django.conf import settings
 from django.contrib.auth.models import Permission
 from django.contrib.sites.models import Site
+from django.core.files.base import ContentFile
 from django.core.management import call_command
 from django.core.management.base import BaseCommand
 from django.db import connection
@@ -104,13 +105,21 @@ class Command(BaseCommand):
         )
         self.profiles_root = SithFile.objects.create(name="profiles", owner=root)
         home_root = SithFile.objects.create(name="users", owner=root)
+        club_root = SithFile.objects.create(name="clubs", owner=root)
+        sas = SithFile.objects.create(name="SAS", owner=root)
+        SithFile.objects.create(
+            name="CGU",
+            is_folder=False,
+            file=ContentFile(
+                content="Conditions générales d'utilisation", name="cgu.txt"
+            ),
+            owner=root,
+        )
 
         # Page needed for club creation
         p = Page(name=settings.SITH_CLUB_ROOT_PAGE)
         p.save(force_lock=True)
 
-        club_root = SithFile.objects.create(name="clubs", owner=root)
-        sas = SithFile.objects.create(name="SAS", owner=root)
         main_club = Club.objects.create(
             id=1, name="AE", address="6 Boulevard Anatole France, 90000 Belfort"
         )
@@ -790,11 +799,7 @@ class Command(BaseCommand):
 
         subscribers = Group.objects.create(name="Cotisants")
         subscribers.permissions.add(
-            *list(
-                perms.filter(
-                    codename__in=["add_news", "add_uecomment", "view_reservationslot"]
-                )
-            )
+            *list(perms.filter(codename__in=["add_news", "add_uecomment"]))
         )
         old_subscribers = Group.objects.create(name="Anciens cotisants")
         old_subscribers.permissions.add(

core/management/commands/populate_more.py

@@ -1,7 +1,7 @@
+import math
 import random
 from datetime import date, timedelta
 from datetime import timezone as tz
-from math import ceil
 from typing import Iterator
 
 from dateutil.relativedelta import relativedelta
@@ -25,7 +25,6 @@ from counter.models import (
 )
 from forum.models import Forum, ForumMessage, ForumTopic
 from pedagogy.models import UE
-from reservation.models import ReservationSlot, Room
 from subscription.models import Subscription
 
 
@@ -36,27 +35,57 @@ class Command(BaseCommand):
         super().__init__(*args, **kwargs)
         self.faker = Faker("fr_FR")
 
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "-n", "--nb-users", help="Number of users to create", type=int, default=600
+        )
+
     def handle(self, *args, **options):
         if not settings.DEBUG:
             raise Exception("Never call this command in prod. Never.")
 
         self.stdout.write("Creating users...")
-        users = self.create_users()
+        users = self.create_users(options["nb_users"])
         self.create_bans(random.sample(users, k=len(users) // 200))  # 0.5% of users
-        # len(subscribers) is approximately 480
         subscribers = random.sample(users, k=int(0.8 * len(users)))
         self.stdout.write("Creating subscriptions...")
         self.create_subscriptions(subscribers)
         self.stdout.write("Creating club memberships...")
-        self.create_club_memberships(subscribers)
-        self.stdout.write("Creating rooms and reservation...")
-        self.create_resources_and_reservations(random.sample(subscribers, k=40))
+        users_qs = User.objects.filter(id__in=[s.id for s in subscribers])
+        subscribers_now = list(
+            users_qs.annotate(
+                filter=Exists(
+                    Subscription.objects.filter(
+                        member_id=OuterRef("pk"), subscription_end__gte=now()
+                    )
+                )
+            )
+        )
+        old_subscribers = list(
+            users_qs.annotate(
+                filter=Exists(
+                    Subscription.objects.filter(
+                        member_id=OuterRef("pk"), subscription_end__lt=now()
+                    )
+                )
+            )
+        )
+        self.make_club(
+            Club.objects.get(id=settings.SITH_MAIN_CLUB_ID),
+            random.sample(subscribers_now, k=min(30, len(subscribers_now))),
+            random.sample(old_subscribers, k=min(60, len(old_subscribers))),
+        )
+        self.make_club(
+            Club.objects.get(name="Troll Penché"),
+            random.sample(subscribers_now, k=min(20, len(subscribers_now))),
+            random.sample(old_subscribers, k=min(80, len(old_subscribers))),
+        )
         self.stdout.write("Creating uvs...")
         self.create_ues()
         self.stdout.write("Creating products...")
         self.create_products()
         self.stdout.write("Creating sales and refills...")
-        sellers = list(User.objects.order_by("?")[:100])
+        sellers = random.sample(users, len(users) // 10)
         self.create_sales(sellers)
         self.stdout.write("Creating permanences...")
         self.create_permanences(sellers)
@@ -65,7 +94,7 @@ class Command(BaseCommand):
 
         self.stdout.write("Done")
 
-    def create_users(self) -> list[User]:
+    def create_users(self, nb_users: int = 600) -> list[User]:
         # Create a single password hash for all users to make it faster.
         # It's insecure as hell, but it's ok since it's only for dev purposes.
         password = make_password("plop")
@@ -84,7 +113,7 @@ class Command(BaseCommand):
                 address=self.faker.address(),
                 password=password,
             )
-            for _ in range(600)
+            for _ in range(nb_users)
         ]
         # there may a duplicate or two
         # Not a problem, we will just have 599 users instead of 600
@@ -191,97 +220,6 @@ class Command(BaseCommand):
         memberships = Membership.objects.bulk_create(memberships)
         Membership._add_club_groups(memberships)
 
-    def create_club_memberships(self, users: list[User]):
-        users_qs = User.objects.filter(id__in=[s.id for s in users])
-        subscribers_now = list(
-            users_qs.annotate(
-                filter=Exists(
-                    Subscription.objects.filter(
-                        member_id=OuterRef("pk"), subscription_end__gte=now()
-                    )
-                )
-            )
-        )
-        old_subscribers = list(
-            users_qs.annotate(
-                filter=Exists(
-                    Subscription.objects.filter(
-                        member_id=OuterRef("pk"), subscription_end__lt=now()
-                    )
-                )
-            )
-        )
-        self.make_club(
-            Club.objects.get(id=settings.SITH_MAIN_CLUB_ID),
-            random.sample(subscribers_now, k=min(30, len(subscribers_now))),
-            random.sample(old_subscribers, k=min(60, len(old_subscribers))),
-        )
-        self.make_club(
-            Club.objects.get(name="Troll Penché"),
-            random.sample(subscribers_now, k=min(20, len(subscribers_now))),
-            random.sample(old_subscribers, k=min(80, len(old_subscribers))),
-        )
-
-    def create_resources_and_reservations(self, users: list[User]):
-        """Generate reservable rooms and reservations slots for those rooms.
-
-        Contrary to the other data generator,
-        this one generates more data than what is expected on the real db.
-        """
-        ae = Club.objects.get(id=settings.SITH_MAIN_CLUB_ID)
-        pdf = Club.objects.get(id=settings.SITH_PDF_CLUB_ID)
-        troll = Club.objects.get(name="Troll Penché")
-        rooms = [
-            Room(
-                name=name,
-                club=club,
-                location=location,
-                description=self.faker.text(100),
-            )
-            for name, club, location in [
-                ("Champi", ae, "BELFORT"),
-                ("Muzik", ae, "BELFORT"),
-                ("Pôle Tech", ae, "BELFORT"),
-                ("Jolly", troll, "BELFORT"),
-                ("Cookut", pdf, "BELFORT"),
-                ("Lucky", pdf, "BELFORT"),
-                ("Potards", pdf, "SEVENANS"),
-                ("Bureau AE", ae, "SEVENANS"),
-            ]
-        ]
-        rooms = Room.objects.bulk_create(rooms)
-        reservations = []
-        for room in rooms:
-            # how much people use this room.
-            # The higher the number, the more reservations exist,
-            # the smaller the interval between two slot is,
-            # and the more future reservations have already been made ahead of time
-            affluence = random.randint(2, 6)
-            slot_start = make_aware(self.faker.past_datetime("-5y").replace(minute=0))
-            generate_until = make_aware(
-                self.faker.future_datetime(timedelta(days=1) * affluence**2)
-            )
-            while slot_start < generate_until:
-                if slot_start.hour < 8:
-                    # if a reservation would start in the middle of the night
-                    # make it start the next morning instead
-                    slot_start += timedelta(hours=10 - slot_start.hour)
-                duration = timedelta(minutes=15) * (1 + int(random.gammavariate(3, 2)))
-                reservations.append(
-                    ReservationSlot(
-                        room=room,
-                        author=random.choice(users),
-                        start_at=slot_start,
-                        end_at=slot_start + duration,
-                        created_at=slot_start - self.faker.time_delta("+7d"),
-                    )
-                )
-                slot_start += duration + (
-                    timedelta(minutes=15) * ceil(random.expovariate(affluence / 192))
-                )
-        reservations.sort(key=lambda slot: slot.created_at)
-        ReservationSlot.objects.bulk_create(reservations)
-
     def create_ues(self):
         root = User.objects.get(username="root")
         categories = ["CS", "TM", "OM", "QC", "EC"]
@@ -478,8 +416,9 @@ class Command(BaseCommand):
         Permanency.objects.bulk_create(perms)
 
     def create_forums(self):
-        forumers = list(User.objects.order_by("?")[:100])
-        most_actives = random.sample(forumers, 10)
+        users = list(User.objects.all())
+        forumers = random.sample(users, math.ceil(len(users) / 10))
+        most_actives = random.sample(forumers, math.ceil(len(forumers) / 6))
         categories = list(Forum.objects.filter(is_category=True))
         new_forums = [
             Forum(name=self.faker.text(20), parent=random.choice(categories))
@@ -496,7 +435,7 @@ class Command(BaseCommand):
             for _ in range(100)
         ]
         ForumTopic.objects.bulk_create(new_topics)
-        topics = list(ForumTopic.objects.values_list("id", flat=True))
+        topics = list(ForumTopic.objects.all())
 
         def get_author():
             if random.random() > 0.5:
@@ -504,7 +443,7 @@ class Command(BaseCommand):
             return random.choice(forumers)
 
         messages = []
-        for topic_id in topics:
+        for t in topics:
             nb_messages = max(1, int(random.normalvariate(mu=90, sigma=50)))
             dates = sorted(
                 [
@@ -516,7 +455,7 @@ class Command(BaseCommand):
             messages.extend(
                 [
                     ForumMessage(
-                        topic_id=topic_id,
+                        topic=t,
                         author=get_author(),
                         date=d,
                         message="\n\n".join(

core/models.py

@@ -356,23 +356,27 @@ class User(AbstractUser):
         )
         if group_id is None:
             return False
-        if group_id == settings.SITH_GROUP_SUBSCRIBERS_ID:
-            return self.is_subscribed
-        if group_id == settings.SITH_GROUP_ROOT_ID:
-            return self.is_root
-        return any(g.id == group_id for g in self.cached_groups)
+        return group_id in self.all_groups
 
     @cached_property
-    def cached_groups(self) -> list[Group]:
+    def all_groups(self) -> dict[int, Group]:
         """Get the list of groups this user is in."""
-        return list(self.groups.all())
+        additional_groups = []
+        if self.is_subscribed:
+            additional_groups.append(settings.SITH_GROUP_SUBSCRIBERS_ID)
+        if self.is_superuser:
+            additional_groups.append(settings.SITH_GROUP_ROOT_ID)
+        qs = self.groups.all()
+        if additional_groups:
+            # This is somewhat counter-intuitive, but this query runs way faster with
+            # a UNION rather than a OR (in average, 0.25ms vs 14ms).
+            # For the why, cf. https://dba.stackexchange.com/questions/293836/why-is-an-or-statement-slower-than-union
+            qs = qs.union(Group.objects.filter(id__in=additional_groups))
+        return {g.id: g for g in qs}
 
     @cached_property
     def is_root(self) -> bool:
-        if self.is_superuser:
-            return True
-        root_id = settings.SITH_GROUP_ROOT_ID
-        return any(g.id == root_id for g in self.cached_groups)
+        return self.is_superuser or settings.SITH_GROUP_ROOT_ID in self.all_groups
 
     @cached_property
     def is_board_member(self) -> bool:
@@ -1099,10 +1103,7 @@ class PageQuerySet(models.QuerySet):
             return self.filter(view_groups=settings.SITH_GROUP_PUBLIC_ID)
         if user.has_perm("core.view_page"):
             return self.all()
-        groups_ids = [g.id for g in user.cached_groups]
-        if user.is_subscribed:
-            groups_ids.append(settings.SITH_GROUP_SUBSCRIBERS_ID)
-        return self.filter(view_groups__in=groups_ids)
+        return self.filter(view_groups__in=user.all_groups)
 
 
 # This function prevents generating migration upon settings change
@@ -1376,7 +1377,7 @@ class PageRev(models.Model):
         return self.page.can_be_edited_by(user)
 
     def is_owned_by(self, user: User) -> bool:
-        return any(g.id == self.page.owner_group_id for g in user.cached_groups)
+        return self.page.owner_group_id in user.all_groups
 
     def similarity_ratio(self, text: str) -> float:
         """Similarity ratio between this revision's content and the given text.

core/static/bundled/alpine-index.js

@@ -1,10 +1,9 @@
-import { morph } from "@alpinejs/morph";
 import sort from "@alpinejs/sort";
 import Alpine from "alpinejs";
 import { limitedChoices } from "#core:alpine/limited-choices.ts";
 import { alpinePlugin as notificationPlugin } from "#core:utils/notifications.ts";
 
-Alpine.plugin([sort, morph, limitedChoices]);
+Alpine.plugin([sort, limitedChoices]);
 Alpine.magic("notifications", notificationPlugin);
 window.Alpine = Alpine;
 

core/static/bundled/core/dynamic-formset-index.ts

@@ -0,0 +1,77 @@
+interface Config {
+  /**
+   * The prefix of the formset, in case it has been changed.
+   * See https://docs.djangoproject.com/fr/stable/topics/forms/formsets/#customizing-a-formset-s-prefix
+   */
+  prefix?: string;
+}
+
+// biome-ignore lint/style/useNamingConvention: It's the DOM API naming
+type HTMLFormInputElement = HTMLInputElement | HTMLSelectElement | HTMLTextAreaElement;
+
+document.addEventListener("alpine:init", () => {
+  /**
+   * Alpine data element to allow the dynamic addition of forms to a formset.
+   *
+   * To use this, you need :
+   * - an HTML element containing the existing forms, noted by `x-ref="formContainer"`
+   * - a template containing the empty form
+   *   (that you can obtain jinja-side with `{{ formset.empty_form }}`),
+   *   noted by `x-ref="formTemplate"`
+   * - a button with `@click="addForm"`
+   * - you may also have one or more buttons with `@click="removeForm(element)"`,
+   *   where `element` is the HTML element containing the form.
+   *
+   * For an example of how this is used, you can have a look to
+   * `counter/templates/counter/product_form.jinja`
+   */
+  Alpine.data("dynamicFormSet", (config?: Config) => ({
+    init() {
+      this.formContainer = this.$refs.formContainer as HTMLElement;
+      this.nbForms = this.formContainer.children.length as number;
+      this.template = this.$refs.formTemplate as HTMLTemplateElement;
+      const prefix = config?.prefix ?? "form";
+      this.$root
+        .querySelector(`#id_${prefix}-TOTAL_FORMS`)
+        .setAttribute(":value", "nbForms");
+    },
+
+    addForm() {
+      this.formContainer.appendChild(document.importNode(this.template.content, true));
+      const newForm = this.formContainer.lastElementChild;
+      const inputs: NodeListOf<HTMLFormInputElement> = newForm.querySelectorAll(
+        "input, select, textarea",
+      );
+      for (const el of inputs) {
+        el.name = el.name.replace("__prefix__", this.nbForms.toString());
+        el.id = el.id.replace("__prefix__", this.nbForms.toString());
+      }
+      const labels: NodeListOf<HTMLLabelElement> = newForm.querySelectorAll("label");
+      for (const el of labels) {
+        el.htmlFor = el.htmlFor.replace("__prefix__", this.nbForms.toString());
+      }
+      inputs[0].focus();
+      this.nbForms += 1;
+    },
+
+    removeForm(container: HTMLDivElement) {
+      container.remove();
+      this.nbForms -= 1;
+      // adjust the id of remaining forms
+      for (let i = 0; i < this.nbForms; i++) {
+        const form: HTMLDivElement = this.formContainer.children[i];
+        const inputs: NodeListOf<HTMLFormInputElement> = form.querySelectorAll(
+          "input, select, textarea",
+        );
+        for (const el of inputs) {
+          el.name = el.name.replace(/\d+/, i.toString());
+          el.id = el.id.replace(/\d+/, i.toString());
+        }
+        const labels: NodeListOf<HTMLLabelElement> = form.querySelectorAll("label");
+        for (const el of labels) {
+          el.htmlFor = el.htmlFor.replace(/\d+/, i.toString());
+        }
+      }
+    },
+  }));
+});

core/static/bundled/htmx-index.js

@@ -1,5 +1,4 @@
 import htmx from "htmx.org";
-import "htmx-ext-alpine-morph";
 
 document.body.addEventListener("htmx:beforeRequest", (event) => {
   event.detail.target.ariaBusy = true;

core/static/core/components/card.scss

@@ -16,13 +16,6 @@
   }
 }
 
-.card-group {
-  display: flex;
-  gap: 15px;
-  margin-bottom: 30px;
-  flex-wrap: wrap;
-}
-
 .card {
   background-color: $primary-neutral-light-color;
   border-radius: 5px;
@@ -99,23 +92,13 @@
   }
 
   @media screen and (max-width: 765px) {
-    @include row-layout;
+    @include row-layout
   }
 
   // When combined with card, card-row display the card in a row layout,
   // whatever the size of the screen.
   &.card-row {
-    @include row-layout;
-
-    &.card-row-m {
-      //width: 50%;
-      max-width: 50%;
-    }
-
-    &.card-row-s {
-      //width: 33%;
-      max-width: 33%;
-    }
+    @include row-layout
   }
 }
 

core/static/core/forms.scss

@@ -141,7 +141,6 @@ form {
   display: block;
   margin: calc(var(--nf-input-size) * 1.5) auto 10px;
   line-height: 1;
-  white-space: nowrap;
 
   .fields-centered {
     padding: 10px 10px 0;

core/static/core/tooltips.scss

@@ -10,9 +10,10 @@
   border-radius: 5px;
   padding: 5px 10px;
   position: absolute;
+  white-space: nowrap;
   opacity: 0;
   transition: opacity 500ms ease-out;
-  width: max-content;
+
   white-space: normal;
 
   left: 0;

core/templates/core/base.jinja

@@ -35,8 +35,8 @@
       <noscript><link rel="stylesheet" href="{{ static('bundled/fontawesome-index.css') }}"></noscript>
 
       <script src="{{ url('javascript-catalog') }}"></script>
-      <script type="module" src={{ static("bundled/core/navbar-index.ts") }}></script>
-      <script type="module" src={{ static("bundled/core/components/include-index.ts") }}></script>
+      <script type="module" src="{{ static("bundled/core/navbar-index.ts") }}"></script>
+      <script type="module" src="{{ static("bundled/core/components/include-index.ts") }}"></script>
       <script type="module" src="{{ static('bundled/alpine-index.js') }}"></script>
       <script type="module" src="{{ static('bundled/htmx-index.js') }}"></script>
       <script type="module" src="{{ static('bundled/country-flags-index.ts') }}"></script>

core/templates/core/base/notifications.jinja

@@ -1,14 +1,11 @@
 <div id="quick-notifications"
      x-data="{
              messages: [
-             {% if messages %}
-               {% for message in messages %}
-                 {
-                 tag: '{{ message.tags }}',
-                 text: '{{ message }}',
-                 },
-               {% endfor %}
-             {% endif %}
+             {%- if messages -%}
+               {%- for message in messages -%}
+                 { tag: '{{ message.tags }}', text: '{{ message }}' },
+               {%- endfor -%}
+             {%- endif -%}
              ]
              }"
      @quick-notification-add="(e) => messages.push(e?.detail)"

core/tests/test_commands.py

@@ -0,0 +1,13 @@
+import contextlib
+import os
+
+import pytest
+from django.core.management import call_command
+
+
+@pytest.mark.django_db
+def test_populate_more(settings):
+    """Just check that populate more doesn't crash"""
+    settings.DEBUG = True
+    with open(os.devnull, "w") as devnull, contextlib.redirect_stdout(devnull):
+        call_command("populate_more", "--nb-users", "50")

core/tests/test_core.py

@@ -418,16 +418,16 @@ class TestUserIsInGroup(TestCase):
         group_in = baker.make(Group)
         self.public_user.groups.add(group_in)
 
-        # clear the cached property `User.cached_groups`
-        self.public_user.__dict__.pop("cached_groups", None)
+        # clear the cached property `User.all_groups`
+        self.public_user.__dict__.pop("all_groups", None)
         # Test when the user is in the group
-        with self.assertNumQueries(1):
+        with self.assertNumQueries(2):
             self.public_user.is_in_group(pk=group_in.id)
         with self.assertNumQueries(0):
             self.public_user.is_in_group(pk=group_in.id)
 
         group_not_in = baker.make(Group)
-        self.public_user.__dict__.pop("cached_groups", None)
+        self.public_user.__dict__.pop("all_groups", None)
         # Test when the user is not in the group
         with self.assertNumQueries(1):
             self.public_user.is_in_group(pk=group_not_in.id)

core/utils.py

@@ -12,22 +12,32 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
+from __future__ import annotations
 
+import hmac
 from datetime import date, timedelta
 
 # Image utils
 from io import BytesIO
-from typing import Final
+from typing import TYPE_CHECKING
+from urllib.parse import urlencode
 
 import PIL
 from django.conf import settings
 from django.core.files.base import ContentFile
-from django.core.files.uploadedfile import UploadedFile
-from django.http import HttpRequest
 from django.utils.timezone import localdate
 from PIL import ExifTags
 from PIL.Image import Image, Resampling
 
+if TYPE_CHECKING:
+    from _hashlib import HASH
+    from collections.abc import Buffer, Mapping, Sequence
+    from typing import Any, Callable, Final
+
+    from django.core.files.uploadedfile import UploadedFile
+    from django.http import HttpRequest
+
+
 RED_PIXEL_PNG: Final[bytes] = (
     b"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52"
     b"\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90\x77\x53"
@@ -205,3 +215,30 @@ def get_client_ip(request: HttpRequest) -> str | None:
             return ip
 
     return None
+
+
+def hmac_hexdigest(
+    key: str | bytes,
+    data: Mapping[str, Any] | Sequence[tuple[str, Any]],
+    digest: str | Callable[[Buffer], HASH] = "sha512",
+) -> str:
+    """Return the hexdigest of the signature of the given data.
+
+    Args:
+        key: the HMAC key used for the signature
+        data: the data to sign
+        digest: a PEP247 hashing algorithm (by default, sha512)
+
+    Examples:
+        ```python
+        data = {
+            "foo": 5,
+            "bar": "somevalue",
+        }
+        hmac_key = secrets.token_hex(64)
+        signature = hmac_hexdigest(hmac_key, data, "sha256")
+        ```
+    """
+    if isinstance(key, str):
+        key = key.encode()
+    return hmac.digest(key, urlencode(data).encode(), digest).hex()

core/views/forms.py

@@ -40,8 +40,9 @@ from django.forms import (
     DateInput,
     DateTimeInput,
     TextInput,
+    Widget,
 )
-from django.utils.timezone import localtime, now
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from phonenumber_field.widgets import RegionalPhoneNumberWidget
 from PIL import Image
@@ -99,8 +100,8 @@ class FutureDateTimeField(forms.DateTimeField):
 
     default_validators = [validate_future_timestamp]
 
-    def widget_attrs(self, widget: forms.Widget) -> dict[str, str]:
-        return {"min": widget.format_value(localtime())}
+    def widget_attrs(self, widget: Widget) -> dict[str, str]:
+        return {"min": widget.format_value(now())}
 
 
 # Forms

core/views/mixins.py

@@ -78,7 +78,7 @@ class FragmentMixin(TemplateResponseMixin, ContextMixin):
             return render(
                 request,
                 "app/template.jinja",
-                context={"fragment": fragment(request)}
+                context={"fragment": fragment(request)
             }
 
         # in urls.py

counter/forms.py

@@ -291,7 +291,8 @@ ScheduledProductActionFormSet = forms.modelformset_factory(
     absolute_max=None,
     can_delete=True,
     can_delete_extra=False,
-    extra=2,
+    extra=0,
+    min_num=1,
 )
 
 

counter/templates/counter/product_form.jinja

@@ -1,5 +1,44 @@
 {% extends "core/base.jinja" %}
 
+{% block additional_js %}
+  <script type="module" src="{{ static("bundled/core/dynamic-formset-index.ts") }}"></script>
+{% endblock %}
+
+
+{% macro action_form(form) %}
+  <fieldset x-data="{action: '{{ form.task.initial }}'}">
+    {{ form.non_field_errors() }}
+    <div class="row gap-2x margin-bottom">
+      <div>
+        {{ form.task.errors }}
+        {{ form.task.label_tag() }}
+        {{ form.task|add_attr("x-model=action") }}
+      </div>
+      <div>{{ form.trigger_at.as_field_group() }}</div>
+    </div>
+    <div x-show="action==='counter.tasks.change_counters'" class="margin-bottom">
+      {{ form.counters.as_field_group() }}
+    </div>
+    {%- if form.DELETE -%}
+      <div class="row gap">
+        {{ form.DELETE.as_field_group() }}
+      </div>
+    {%- else -%}
+      <button
+        class="btn btn-grey"
+        @click.prevent="removeForm($event.target.closest('fieldset'))"
+      >
+        <i class="fa fa-minus"></i>{% trans %}Remove this action{% endtrans %}
+      </button>
+    {%- endif -%}
+    {%- for field in form.hidden_fields() -%}
+      {{ field }}
+    {%- endfor -%}
+    <hr />
+  </fieldset>
+{% endmacro %}
+
+
 {% block content %}
   {% if object %}
     <h2>{% trans name=object %}Edit product {{ name }}{% endtrans %}</h2>
@@ -25,34 +64,20 @@
       </em>
     </p>
 
-    {{ form.action_formset.management_form }}
-    {%- for action_form in form.action_formset.forms -%}
-      <fieldset x-data="{action: '{{ action_form.task.initial }}'}">
-        {{ action_form.non_field_errors() }}
-        <div class="row gap-2x margin-bottom">
-          <div>
-            {{ action_form.task.errors }}
-            {{ action_form.task.label_tag() }}
-            {{ action_form.task|add_attr("x-model=action") }}
-          </div>
-          <div>{{ action_form.trigger_at.as_field_group() }}</div>
-        </div>
-        <div x-show="action==='counter.tasks.change_counters'" class="margin-bottom">
-          {{ action_form.counters.as_field_group() }}
-        </div>
-        {%- if action_form.DELETE -%}
-          <div class="row gap">
-            {{ action_form.DELETE.as_field_group() }}
-          </div>
-        {%- endif -%}
-        {%- for field in action_form.hidden_fields() -%}
-          {{ field }}
+    <div x-data="dynamicFormSet" class="margin-bottom">
+      {{ form.action_formset.management_form }}
+      <div x-ref="formContainer">
+        {%- for f in form.action_formset.forms -%}
+          {{ action_form(f) }}
         {%- endfor -%}
-      </fieldset>
-      {%- if not loop.last -%}
-        <hr class="margin-bottom">
-      {%- endif -%}
-    {%- endfor -%}
-    <p><input type="submit" value="{% trans %}Save{% endtrans %}" /></p>
+      </div>
+      <template x-ref="formTemplate">
+        {{ action_form(form.action_formset.empty_form) }}
+      </template>
+      <button @click.prevent="addForm()" class="btn btn-grey">
+        <i class="fa fa-plus"></i>{% trans %}Add action{% endtrans %}
+      </button>
+    </div>
+    <p><input class="btn btn-blue" type="submit" value="{% trans %}Save{% endtrans %}" /></p>
   </form>
 {% endblock %}

docs/reference/api/schemas.md

@@ -0,0 +1 @@
+::: api.schemas

docs/reference/api/views.md

@@ -0,0 +1 @@
+::: api.views

docs/tutorial/api/account-link.md

@@ -0,0 +1,353 @@
+Le site AE offre des mécanismes permettant aux applications tierces
+de récupérer les informations sur un utilisateur du site AE.
+De cette manière, il devient possible de synchroniser les informations
+qu possède l'application tierce sur l'utilisateur, directement depuis
+le site AE.
+
+## Fonctionnement général
+
+Pour authentifier vos utilisateurs, vous aurez besoin d'un serveur web
+et d'un client d'API (celui auquel est liée votre
+[clef d'API](./connect.md#obtenir-une-clef-dapi)).
+Deux informations vous sont nécessaires, en plus de votre clef d'API :
+
+- l'id du client : vous pouvez l'obtenir soit en le demandant à l'équipe info,
+  soit en appelant la route `GET /client/me` avec votre clef d'API
+  renseignée dans le header [X-APIKey](./connect.md#x-apikey)
+- la clef HMAC du client : vous devez la demander à l'équipe info.
+
+Grâce à ces informations, vous allez pouvoir fournir le contexte nécessaire
+au site AE pour qu'il authentifie vos utilisateurs.
+
+En effet, la démarche d'authentification s'effectue presque entièrement
+sur le site : le travail de l'application tierce consiste uniquement
+à fournir à l'utilisateur une url avec les bons paramètres, puis
+à recevoir la réponse du serveur si tout s'est bien passé.
+
+Comme un dessin vaut parfois mieux que mille mots,
+voici les diagrammes décrivant le processus.
+L'un montre l'entièreté de la démarche ;
+l'autre dans un souci de simplicité, ne montre que ce qui est visible
+directement par l'application tierce.
+
+=== "Intégralité du processus"
+
+    ```mermaid
+    sequenceDiagram
+        actor User
+        participant App
+        User->>+App: Authentifie-moi, stp
+        App-->>-User: url de connexion<br/>avec signature
+        User->>+Sith: GET url
+        opt Utilisateur non-connecté
+            Sith->>+User: Formulaire de connexion
+            User-->>-Sith: Connexion
+        end
+        Sith->>Sith: vérification de la signature
+        Sith->>+User: Formulaire<br/>des conditions<br/>d'utilisation
+        User-->>-Sith: Validation
+        Sith->>+App: URL de retour<br/>avec données utilisateur
+        App->>App: Traitement des <br/>données utilisateur
+        App-->>-Sith: 204 OK, No content
+        Sith-->>-User: Message de succès
+        App--)User: Message de succès
+    ```
+
+=== "Point de vue de l'application tierce"
+
+    ```mermaid
+    sequenceDiagram
+        actor User
+        participant App
+        User->>+App: Authentifie-moi, stp
+        App-->>-User: url de connexion<br/>avec signature
+        opt
+            Sith->>+App: URL de retour<br/>avec données utilisateur
+            App->>App: Traitement des <br/>données utilisateur
+            App-->>-Sith: 204 OK, No content
+            App--)User: Message de succès
+        end
+    ```
+
+## Données attendues
+
+### URL de connexion
+
+L'URL de connexion que vous allez fournir à l'utilisateur doit
+être `https://ae.utbm.fr/api-link/auth/`
+et doit contenir les données décrites dans
+[`ThirdPartyAuthParamsSchema`][api.schemas.ThirdPartyAuthParamsSchema] :
+
+- `client_id` (integer) : l'id de votre client, que vous pouvez obtenir
+  de la manière décrite plus haut
+- `third_party_app`(string) : le nom de la plateforme pour laquelle
+  l'authentification va être réalisée (si votre application est un bot
+  discord, mettez la valeur "discord")
+- `privacy_link`(URL) : l'URL vers la page de politique de confidentialité
+  qui s'appliquera dans le cadre de l'application
+  (s'il s'agit d'un bot discord, donnez le lien vers celles de Discord)
+- `username`(string) : le pseudonyme que l'utilisateur possède sur
+  votre application
+- `callback_url`(URL) : l'URL que le site AE appellera si l'authentification
+  réussit
+- `signature`(string) : la signature des données de la requête.
+
+Ces données doivent être url-encodées et passées dans les paramètres GET.
+
+!!!tip "URL de retour"
+
+    Notre système n'impose aucune contrainte quant à la manière
+    de construire votre URL (hormis le fait que ce doit être une URL HTTPS valide),
+    mais il est tout de même conseillé d'utiliser l'identifiant de votre
+    utilisateur comme paramètre dans l'URL 
+    (par exemple `GET /callback/{int:user_id}/`).
+
+???Example
+
+    Supposons que votre client d'API soit utilisé dans le cadre d'un bot Discord,
+    avec les données suivantes :
+    
+    - l'id du client est 15
+    - sa clef HMAC est "beb99dd53"
+      (c'est pour l'exemple, une vraie clef sera beaucoup plus longue)
+    - le pseudonyme discord de votre utilisateur est Brian
+    - son id sur discord est 123456789
+    - votre route de callback est `GET /callback/{int:user_id}/`,
+      accessible au domaine `https://bot.ae.utbm.fr`
+    
+    Alors les paramètres de votre URL seront :
+    
+    | Paramètre       | valeur                                                                |
+    |-----------------|-----------------------------------------------------------------------|
+    | client_id       | 15                                                                    |
+    | third_party_app | discord                                                               |
+    | privacy_link    | `https://discord.com/privacy`                                         |
+    | username        | Brian                                                                 |
+    | callback_url    | `https://bot.ae.utbm.fr/callback/123456789/`                          |
+    | signature       | 1a383c51060be64f07772aa42e07<br/>18ae096b8f21f2cdb4061c0834a416d12101 |
+    
+    Et l'url fournie à l'utilisateur sera :
+    
+    `https://ae.utbm.fr/api-link/auth/?client_id=15&third_party_app=discord
+    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy&username=Brian
+    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F
+    &signature=1a383c51060be64f07772aa42e0718ae096b8f21f2cdb4061c0834a416d12101`
+
+### Données de retour
+
+Si l'authentification réussit, le site AE enverra une requête HTTP POST
+à l'URL de retour fournie dans l'URL de connexion.
+
+Le corps de la requête de callback et au format JSON 
+et contient deux paires clef-valeur :
+
+- `user` : les données utilisateur, telles que décrites
+  par [UserProfileSchema][core.schemas.UserProfileSchema]
+- `signature` : la signature des données utilisateur
+
+???Example
+
+    En reprenant les mêmes paramètres que dans l'exemple précédent,
+    le site AE pourra renvoyer à l'application la requête suivante :
+
+    ```http
+    POST https://bot.ae.utbm.fr/callback/123456789/
+    content-type: application/json
+    body: {
+        "user": {
+            "id": 144131,
+            "nick_name": "inzekitchen",
+            "first_name": "Brian",
+            ...
+        },
+        "signature": "f16955bab6b805f6e1abbb98a86dfee53fed0bf812aa6513ca46cfd461b70020"
+    }
+    ```
+
+L'application doit répondre avec un des codes HTTP suivants :
+
+| Code | Raison                                                                         |
+|------|--------------------------------------------------------------------------------|
+| 204  | Tout s'est bien passé                                                          |
+| 403  | Les données de retour ne sont <br>pas signées ou sont mal signées              |
+| 404  | L'URL de retour ne permet pas <br>d'identifier un utilisateur de l'application |
+
+!!!note "Code d'erreur par défaut"
+
+    Si l'appel de la route fait face à plusieurs problèmes en même temps 
+    (par exemple, l'URL ne permet pas de retrouver votre utilisateur, 
+    et en plus les données sont mal signées),
+    le 403 prime et doit être retourné par défaut.
+
+## Signature des données
+
+Les données de l'URL de connexion doivent être signées,
+et la signature de l'URL de retour doit être vérifiée.
+
+Dans le deux cas, la signature est le digest HMAC-SHA512
+des données url-encodées, en utilisant la clef HMAC du client d'API.
+
+???Example "Signature de l'URL de connexion"
+
+    En reprenant le même exemple que les fois précédentes,
+    l'url-encodage des données est :
+
+    `client_id=15&third_party_app=discord
+    &privacy_link=https%3A%2F%2Fdiscord.com%2Fprivacy%2F&username=Brian
+    &callback_url=https%3A%2F%2Fbot.ae.utbm.fr%2Fcallback%2F123456789%2F`
+
+    Notez que la signature n'est pas (encore) dedans.
+    Cette dernière peut-être obtenue avec le code suivant :
+
+    === ":simple-python: Python"
+    
+        Dépendances :
+    
+        - `environs` (>=14.1)
+    
+        ```python
+        import hmac
+        from urllib.parse import urlencode
+        
+        from environs import Env
+        
+        env = Env()
+        env.read_env()
+        
+        key = env.str("HMAC_KEY").encode()
+        data = {
+            "client_id": 15,
+            "third_party_app": "discord",
+            "privacy_link": "https://discord.com/privacy/",
+            "username": "Brian",
+            "callback_url": "https://bot.ae.utbm.fr/callback/123456789/",
+        }
+        urlencoded = urlencode(data)
+        data["signature"] = hmac.digest(key, urlencoded.encode(), "sha512").hex()
+        
+        # URL a fournir à l'utilisateur pour son authentification
+        user_url = f"https://ae.ubtm.fr/api-link/auth/?{urlencode(data)}"
+        ```    
+    
+    === ":simple-rust: Rust"
+    
+        Dépendances :
+        
+        - `hmac` (>=0.12.1)
+        - `url` (>=2.5.7, features `serde`)
+        - `serde` (>=1.0.228, features `derive`)
+        - `serde_urlencoded` (>="0.7.1)
+        - `sha2` (>=0.10.9)
+        - `dotenvy` (>= 0.15)
+    
+        ```rust
+        use hmac::{Mac, SimpleHmac};
+        use serde::Serialize;
+        use sha2::Sha512;
+        use url::Url;
+        
+        #[derive(Serialize, Debug)]
+        struct UrlData<'a> {
+            client_id: u32,
+            third_party_app: &'a str,
+            privacy_link: Url,
+            username: &'a str,
+            callback_url: Url,
+        }
+        
+        impl<'a> UrlData<'a> {
+            pub fn signature(&self, key: &[u8]) -> CtOutput<SimpleHmac<Sha512>> {
+                let urlencoded = serde_urlencoded::to_string(self).unwrap();
+                SimpleHmac::<Sha512>::new_from_slice(key)
+                    .unwrap()
+                    .chain_update(urlencoded.as_bytes())
+                    .finalize()
+            }
+        }
+        
+        impl Into<Url> for UrlData<'_> {
+            fn into(self) -> Url {
+                let key = std::env::var("HMAC_KEY").unwrap();
+                let mut url = Url::parse("http://ae.utbm.fr/api-link/auth/").unwrap();
+                url.set_query(Some(
+                    format!(
+                        "{}&signature={:x}",
+                        serde_urlencoded::to_string(&self).unwrap(),
+                        self.signature(key.as_bytes()).into_bytes()
+                    )
+                    .as_str(),
+                ));
+                url
+            }
+        }
+        
+        fn main() {
+            dotenvy::dotenv().expect("Couldn't load env");
+            let data = UrlData {
+                client_id: 1,
+                third_party_app: "discord",
+                privacy_link: "https://discord.com/privacy/".parse().unwrap(),
+                username: "Brian",
+                callback_url: "https://bot.ae.utbm.fr/callback/123456789/"
+                    .parse()
+                    .unwrap(),
+            };
+            let url: Url = data.into();
+            println!("{:?}", url);
+        }
+        ```
+
+???Example "Vérification de la signature de la réponse"
+
+    Les données utilisateur peuvent ressembler à :
+
+    ```json
+    {
+        "user": {
+            "display_name": "Matthieu Vincent",
+            "profile_url": "/user/380/",
+            "profile_pict": "/static/core/img/unknown.jpg",
+            "id": 380,
+            "nick_name": None,
+            "first_name": "Matthieu",
+            "last_name": "Vincent",
+        },
+        "signature": "3802a280fbb01bd9fetc."
+    }
+    ```
+
+    Vous pouvez vérifier la signature ainsi :
+
+    ```python
+        import hmac
+        from urllib.parse import urlencode
+        
+        from environs import Env
+        
+        env = Env()
+        env.read_env()
+        
+        def is_signature_valid(user_data: dict, signature: str) -> bool:
+            key = env.str("HMAC_KEY").encode()
+            urlencoded = urlencode(user_data)
+            return hmac.compare_digest(
+                hmac.digest(key, urlencoded.encode(), "sha512").hex(),
+                signature,
+            )
+        
+        
+        post_data = <récupération des données POST>
+        print(
+            "signature valide :", 
+            is_signature_valid(post_data["user"], post_data["signature"]
+        )
+    ```
+
+!!!Warning
+
+    Vous devez impérativement vérifier la signature 
+    des données de la requête de callback !
+
+    Si l'équipe informatique se rend compte que vous ne le faites pas,
+    elle se réserve le droit de suspendre votre application,
+    immédiatement et sans préavis.

docs/tutorial/api/connect.md

@@ -112,7 +112,7 @@ cf. [HTTP persistant connection (wikipedia)](https://en.wikipedia.org/wiki/HTTP_
 
 Voici quelques exemples : 
 
-=== "Python (requests)"
+=== ":simple-python: Python (requests)"
 
     Dépendances :
 
@@ -132,7 +132,7 @@ Voici quelques exemples :
         print(response.json())
     ```
 
-=== "Python (aiohttp)"
+=== ":simple-python: Python (aiohttp)"
 
     Dépendances :
 
@@ -158,7 +158,7 @@ Voici quelques exemples :
     asyncio.run(main())
     ```
 
-=== "Javascript (axios)"
+=== ":simple-javascript: Javascript (axios)"
 
     Dépendances :
 
@@ -178,7 +178,7 @@ Voici quelques exemples :
     console.log(await instance.get("club/1").json());
     ```
 
-=== "Rust (reqwest)"
+=== ":simple-rust: Rust (reqwest)"
 
     Dépendances :
     

eboutic/converters.py

@@ -1,37 +0,0 @@
-#
-# Copyright 2022
-# - Maréchal <thgirod@hotmail.com
-#
-# Ce fichier fait partie du site de l'Association des Étudiants de l'UTBM,
-# http://ae.utbm.fr.
-#
-# This program is free software; you can redistribute it and/or modify it under
-# the terms of the GNU General Public License a published by the Free Software
-# Foundation; either version 3 of the License, or (at your option) any later
-# version.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-# FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
-# details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Sofware Foundation, Inc., 59 Temple
-# Place - Suite 330, Boston, MA 02111-1307, USA.
-
-
-class PaymentResultConverter:
-    """Converter used for url mapping of the `eboutic.views.payment_result` view.
-
-    It's meant to build an url that can match
-    either `/eboutic/pay/success/` or `/eboutic/pay/failure/`
-    but nothing else.
-    """
-
-    regex = "(success|failure)"
-
-    def to_python(self, value):
-        return str(value)
-
-    def to_url(self, value):
-        return str(value)

eboutic/urls.py

@@ -24,7 +24,7 @@
 
 from django.urls import path, register_converter
 
-from eboutic.converters import PaymentResultConverter
+from core.converters import ResultConverter
 from eboutic.views import (
     BillingInfoFormFragment,
     EbouticCheckout,
@@ -34,7 +34,7 @@ from eboutic.views import (
     payment_result,
 )
 
-register_converter(PaymentResultConverter, "res")
+register_converter(ResultConverter, "res")
 
 urlpatterns = [
     # Subscription views

election/views.py

@@ -1,7 +1,6 @@
 from typing import TYPE_CHECKING
 
 from cryptography.utils import cached_property
-from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.mixins import (
     LoginRequiredMixin,
@@ -115,16 +114,9 @@ class VoteFormView(LoginRequiredMixin, UserPassesTestMixin, FormView):
     def test_func(self):
         if not self.election.can_vote(self.request.user):
             return False
-
-        groups = set(self.election.vote_groups.values_list("id", flat=True))
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+        return self.election.vote_groups.filter(
+            id__in=self.request.user.all_groups
+        ).exists()
 
     def vote(self, election_data):
         with transaction.atomic():
@@ -238,15 +230,9 @@ class RoleCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
             return False
         if self.request.user.has_perm("election.add_role"):
             return True
-        groups = set(self.election.edit_groups.values_list("id", flat=True))
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+        return self.election.edit_groups.filter(
+            id__in=self.request.user.all_groups
+        ).exists()
 
     def get_initial(self):
         return {"election": self.election}
@@ -279,14 +265,7 @@ class ElectionListCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView
             .union(self.election.edit_groups.values("id"))
             .values_list("id", flat=True)
         )
-        if (
-            settings.SITH_GROUP_SUBSCRIBERS_ID in groups
-            and self.request.user.is_subscribed
-        ):
-            # the subscriber group isn't truly attached to users,
-            # so it must be dealt with separately
-            return True
-        return self.request.user.groups.filter(id__in=groups).exists()
+        return not groups.isdisjoint(self.request.user.all_groups.keys())
 
     def get_initial(self):
         return {"election": self.election}

locale/fr/LC_MESSAGES/django.po

@@ -35,6 +35,10 @@ msgstr ""
 "True si gardé à jour par le biais d'un fournisseur externe de domains "
 "toxics, False sinon"
 
+#: api/admin.py
+msgid "Reset HMAC key"
+msgstr "Réinitialiser la clef HMAC"
+
 #: api/admin.py
 #, python-format
 msgid ""
@@ -48,6 +52,23 @@ msgstr ""
 msgid "Revoke selected API keys"
 msgstr "Révoquer les clefs d'API sélectionnées"
 
+#: api/forms.py
+msgid "I have read and I accept the terms and conditions of use"
+msgstr "J'ai lu et j'accepte les conditions générales d'utilisation."
+
+#: api/forms.py
+msgid "You must approve the terms and conditions of use."
+msgstr "Vous devez approuver les conditions générales d'utilisation."
+
+#: api/forms.py
+msgid "You must confirm that this is your username."
+msgstr "Vous devez confirmer que c'est bien votre nom d'utilisateur."
+
+#: api/forms.py
+#, python-format
+msgid "I confirm that %(username)s is my username on %(app)s"
+msgstr "Je confirme que %(username)s est mon nom d'utilisateur sur %(app)s"
+
 #: api/models.py club/models.py com/models.py counter/models.py forum/models.py
 msgid "name"
 msgstr "nom"
@@ -68,6 +89,10 @@ msgstr "permissions du client"
 msgid "Specific permissions for this api client."
 msgstr "Permissions spécifiques pour ce client d'API"
 
+#: api/models.py
+msgid "HMAC Key"
+msgstr "Clef HMAC"
+
 #: api/models.py
 msgid "api client"
 msgstr "client d'api"
@@ -97,6 +122,63 @@ msgstr "clef d'api"
 msgid "api keys"
 msgstr "clefs d'api"
 
+#: api/templates/api/third_party/auth.jinja
+msgid "Confidentiality"
+msgstr "Confidentialité"
+
+#: api/templates/api/third_party/auth.jinja
+#, python-format
+msgid ""
+"By ticking this box and clicking on the send button, you acknowledge and "
+"agree to provide %(app)s with your first name, last name, nickname and any "
+"other information that was the third party app was explicitly authorized to "
+"fetch and that it must have acknowledged to you, in a complete and accurate "
+"manner."
+msgstr ""
+"En cochant cette case et en cliquant sur le bouton « Envoyer », vous "
+"reconnaissez et acceptez de fournir à %(app)s votre prénom, nom, pseudonyme "
+"et toute autre information que l'application tierce a été explicitement "
+"autorisée à récupérer et qu'elle doit vous avoir communiqué de manière "
+"complète et exacte."
+
+#: api/templates/api/third_party/auth.jinja
+#, python-format
+msgid ""
+"The privacy policies of <a href=\"%(privacy_link)s\">%(app)s</a> and of <a "
+"href=\"%(sith_cgu_link)s\">the Students' Association</a> applies as soon as "
+"the form is submitted."
+msgstr ""
+"Les politiques de confidentialité de <a href=\"%(privacy_link)s\">%(app)s</a> et de <a "
+"href=\"%(sith_cgu_link)s\">l'Association des Etudiants</a> s'appliquent dès la soumission "
+"du formulaire."
+
+#: api/templates/api/third_party/auth.jinja
+msgid "Confirmation of identity"
+msgstr "Confirmation d'identité"
+
+#: api/views.py
+#, python-format
+msgid ""
+"You are going to link your AE account and your %(app)s account. Continue "
+"only if this page was opened from %(app)s."
+msgstr ""
+"Vous allez lier votre compte AE et votre compte %(app)s. Poursuivez "
+"uniquement si cette page a été ouverte depuis %(app)s."
+
+#: api/views.py
+msgid "You have been successfully authenticated. You can now close this page."
+msgstr "Vous avez été authentifié avec succès. Vous pouvez maintenant fermer cette page."
+
+#: api/views.py
+msgid ""
+"Your authentication on the AE website was successful, but an error happened "
+"during the interaction with the third-party application. Please contact the "
+"managers of the latter."
+msgstr ""
+"Votre authentification sur le site AE a fonctionné, mais une erreur est arrivée "
+"durant l'interaction avec l'application tierce. Veuillez contacter les responsables "
+"de cette dernière."
+
 #: club/forms.py
 msgid "Users to add"
 msgstr "Utilisateurs à ajouter"
@@ -239,7 +321,7 @@ msgid "role"
 msgstr "rôle"
 
 #: club/models.py core/models.py counter/models.py election/models.py
-#: forum/models.py reservation/models.py
+#: forum/models.py
 msgid "description"
 msgstr "description"
 
@@ -514,18 +596,6 @@ msgstr "Nouveau Trombi"
 msgid "Posters"
 msgstr "Affiches"
 
-#: club/templates/club/club_tools.jinja
-msgid "Reservable rooms"
-msgstr "Salles réservables"
-
-#: club/templates/club/club_tools.jinja
-msgid "Add a room"
-msgstr "Ajouter une salle"
-
-#: club/templates/club/club_tools.jinja
-msgid "This club manages no reservable room"
-msgstr "Ce club ne gère pas de salle réservable"
-
 #: club/templates/club/club_tools.jinja
 msgid "Counters:"
 msgstr "Comptoirs : "
@@ -804,7 +874,7 @@ msgstr "Une description plus détaillée et exhaustive de l'évènement."
 msgid "The club which organizes the event."
 msgstr "Le club qui organise l'évènement."
 
-#: com/models.py pedagogy/models.py reservation/models.py trombi/models.py
+#: com/models.py pedagogy/models.py trombi/models.py
 msgid "author"
 msgstr "auteur"
 
@@ -1101,11 +1171,6 @@ msgstr "Emploi du temps"
 msgid "Matmatronch"
 msgstr "Matmatronch"
 
-#: com/templates/com/news_list.jinja
-#: reservation/templates/reservation/schedule.jinja
-msgid "Room reservation"
-msgstr "Réservation de salle"
-
 #: com/templates/com/news_list.jinja core/templates/core/base/navbar.jinja
 #: core/templates/core/user_tools.jinja
 msgid "Elections"
@@ -1966,7 +2031,6 @@ msgstr "Confirmation"
 #: core/templates/core/file_delete_confirm.jinja
 #: counter/templates/counter/counter_click.jinja
 #: counter/templates/counter/fragments/delete_student_card.jinja
-#: reservation/templates/reservation/fragments/create_reservation.jinja
 #: sas/templates/sas/ask_picture_removal.jinja
 msgid "Cancel"
 msgstr "Annuler"
@@ -3111,7 +3175,7 @@ msgstr "Mettre à True si le mail a reçu une erreur"
 msgid "The operation that emptied the account."
 msgstr "L'opération qui a vidé le compte."
 
-#: counter/models.py pedagogy/models.py reservation/models.py
+#: counter/models.py pedagogy/models.py
 msgid "comment"
 msgstr "commentaire"
 
@@ -3775,6 +3839,10 @@ msgstr ""
 "votre cotisation. Si vous ne renouvelez pas votre cotisation, il n'y aura "
 "aucune conséquence autre que le retrait de l'argent de votre compte."
 
+#: counter/templates/counter/product_form.jinja
+msgid "Remove this action"
+msgstr "Retirer cette action"
+
 #: counter/templates/counter/product_form.jinja
 #, python-format
 msgid "Edit product %(name)s"
@@ -3802,6 +3870,10 @@ msgstr ""
 "Les actions automatiques vous permettent de planifier des modifications du "
 "produit à l'avance."
 
+#: counter/templates/counter/product_form.jinja
+msgid "Add action"
+msgstr "Ajouter une action"
+
 #: counter/templates/counter/product_list.jinja
 msgid "Product list"
 msgstr "Liste des produits"
@@ -4824,73 +4896,6 @@ msgstr "Signaler ce commentaire"
 msgid "Edit UE"
 msgstr "Éditer l'UE"
 
-#: reservation/forms.py
-msgid "The start must be set before the end"
-msgstr "Le début doit être placé avant la fin"
-
-#: reservation/models.py
-msgid "room name"
-msgstr "Nom de la salle"
-
-#: reservation/models.py
-msgid "room owner"
-msgstr "propriétaire de la salle"
-
-#: reservation/models.py
-msgid "The club which manages this room"
-msgstr "Le club qui gère cette salle"
-
-#: reservation/models.py
-msgid "site"
-msgstr "site"
-
-#: reservation/models.py
-msgid "reservable room"
-msgstr "salle réservable"
-
-#: reservation/models.py
-msgid "reservable rooms"
-msgstr "salles réservables"
-
-#: reservation/models.py
-msgid "reserved room"
-msgstr "salle réservée"
-
-#: reservation/models.py
-msgid "slot start"
-msgstr "début du créneau"
-
-#: reservation/models.py
-msgid "slot end"
-msgstr "fin du créneau"
-
-#: reservation/models.py
-msgid "reservation slot"
-msgstr "créneau de réservation"
-
-#: reservation/models.py
-msgid "reservation slots"
-msgstr "créneaux de réservation"
-
-#: reservation/models.py
-msgid "There is already a reservation on this slot."
-msgstr "Il y a déjà une réservation sur ce créneau."
-
-#: reservation/templates/reservation/fragments/create_reservation.jinja
-msgid "Book a room"
-msgstr "Réserver une salle"
-
-#: reservation/templates/reservation/schedule.jinja
-msgid "You can book a room by selecting a free slot in the calendar."
-msgstr ""
-"Vous pouvez réserver une salle en sélectionnant un emplacement libre dans le "
-"calendrier."
-
-#: reservation/views.py
-#, python-format
-msgid "%(name)s was updated successfully"
-msgstr "%(name)s a été mis à jour avec succès"
-
 #: rootplace/forms.py
 msgid "User that will be kept"
 msgstr "Utilisateur qui sera conservé"

locale/fr/LC_MESSAGES/djangojs.po

@@ -255,14 +255,6 @@ msgstr "Types de produits réordonnés !"
 msgid "Product type reorganisation failed with status code : %d"
 msgstr "La réorganisation des types de produit a échoué avec le code : %d"
 
-#: reservation/static/bundled/reservation/components/room-scheduler-index.ts
-msgid "Rooms"
-msgstr "Salles"
-
-#: reservation/static/bundled/reservation/slot-reservation-index.ts
-msgid "This slot has been successfully moved"
-msgstr "Ce créneau a été bougé avec succès"
-
 #: sas/static/bundled/sas/pictures-download-index.ts
 msgid "pictures.%(extension)s"
 msgstr "photos.%(extension)s"

mkdocs.yml

@@ -69,6 +69,7 @@ nav:
     - API:
       - Développement: tutorial/api/dev.md
       - Connexion à l'API: tutorial/api/connect.md
+      - Liaison avec le compte AE: tutorial/api/account-link.md
     - Etransactions: tutorial/etransaction.md
   - How-to:
     - L'ORM de Django: howto/querysets.md
@@ -91,6 +92,8 @@ nav:
       - reference/api/hashers.md
       - reference/api/models.md
       - reference/api/perms.md
+      - reference/api/schemas.md
+      - reference/api/views.md
     - club:
       - reference/club/models.md
       - reference/club/views.md

package-lock.json

@@ -9,7 +9,6 @@
       "version": "3",
       "license": "GPL-3.0-only",
       "dependencies": {
-        "@alpinejs/morph": "^3.14.9",
         "@alpinejs/sort": "^3.15.8",
         "@arendjr/text-clipper": "npm:@jsr/arendjr__text-clipper@^3.0.0",
         "@floating-ui/dom": "^1.7.5",
@@ -17,10 +16,7 @@
         "@fullcalendar/core": "^6.1.20",
         "@fullcalendar/daygrid": "^6.1.20",
         "@fullcalendar/icalendar": "^6.1.20",
-        "@fullcalendar/interaction": "^6.1.19",
-        "@fullcalendar/list": "^6.1.19",
-        "@fullcalendar/resource": "^6.1.19",
-        "@fullcalendar/resource-timeline": "^6.1.20",
+        "@fullcalendar/list": "^6.1.20",
         "@sentry/browser": "^10.38.0",
         "@zip.js/zip.js": "^2.8.20",
         "3d-force-graph": "^1.79.1",
@@ -34,7 +30,6 @@
         "easymde": "^2.20.0",
         "glob": "^13.0.2",
         "html2canvas": "^1.4.1",
-        "htmx-ext-alpine-morph": "^2.0.1",
         "htmx.org": "^2.0.8",
         "js-cookie": "^3.0.5",
         "lit-html": "^3.3.2",
@@ -59,12 +54,6 @@
         "vite-plugin-static-copy": "^3.2.0"
       }
     },
-    "node_modules/@alpinejs/morph": {
-      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/@alpinejs/morph/-/morph-3.15.2.tgz",
-      "integrity": "sha512-dt2uAgqRhGbExdVUJ/R4TIIOkzQfOFqGkl6kv6rGxURoFAmMU1iAUNYL4ajA2NCsUWA3KDmk96HrIRA3pv8WWw==",
-      "license": "MIT"
-    },
     "node_modules/@alpinejs/sort": {
       "version": "3.15.8",
       "resolved": "https://registry.npmjs.org/@alpinejs/sort/-/sort-3.15.8.tgz",
@@ -2267,15 +2256,6 @@
         "ical.js": "^1.4.0"
       }
     },
-    "node_modules/@fullcalendar/interaction": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/interaction/-/interaction-6.1.19.tgz",
-      "integrity": "sha512-GOciy79xe8JMVp+1evAU3ytdwN/7tv35t5i1vFkifiuWcQMLC/JnLg/RA2s4sYmQwoYhTw/p4GLcP0gO5B3X5w==",
-      "license": "MIT",
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19"
-      }
-    },
     "node_modules/@fullcalendar/list": {
       "version": "6.1.20",
       "resolved": "https://registry.npmjs.org/@fullcalendar/list/-/list-6.1.20.tgz",
@@ -2307,67 +2287,6 @@
         "typescript": ">=5.5.3"
       }
     },
-    "node_modules/@fullcalendar/premium-common": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/premium-common/-/premium-common-6.1.19.tgz",
-      "integrity": "sha512-bOWHm1u1dUy6M4fQ0hNK7qEI7SrVWrN1ovv/z4/FE/ybfM19ukz7SFs907Ur7KUBWLNKTQYXBtdrY/ginwWraw==",
-      "license": "SEE LICENSE IN LICENSE.md",
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19"
-      }
-    },
-    "node_modules/@fullcalendar/resource": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/resource/-/resource-6.1.19.tgz",
-      "integrity": "sha512-br1ylX/aIOfd8m7Tzl2LpJBSI+N9Q6aS1qw7K9qnQjYXWQyHBlfLG6ZcPmmkjfaqTUJc8ARRbtNWj1ts5qOZgQ==",
-      "license": "SEE LICENSE IN LICENSE.md",
-      "dependencies": {
-        "@fullcalendar/premium-common": "~6.1.19"
-      },
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19"
-      }
-    },
-    "node_modules/@fullcalendar/resource-timeline": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/resource-timeline/-/resource-timeline-6.1.19.tgz",
-      "integrity": "sha512-oC3aVR++dLqJNeBwmLHq9sDgRDFfIG0qSteV7bgBekvNlqEMqXx8wPjUxnELrq8rrhMmK4iV3wO7AB/48IVgyg==",
-      "license": "SEE LICENSE IN LICENSE.md",
-      "dependencies": {
-        "@fullcalendar/premium-common": "~6.1.19",
-        "@fullcalendar/scrollgrid": "~6.1.19",
-        "@fullcalendar/timeline": "~6.1.19"
-      },
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19",
-        "@fullcalendar/resource": "~6.1.19"
-      }
-    },
-    "node_modules/@fullcalendar/scrollgrid": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/scrollgrid/-/scrollgrid-6.1.19.tgz",
-      "integrity": "sha512-S1pbiYHvmV0ep6z5sWXJQfgW4Y/jrS5iLIAqSagDFPK0jr327nBxl7Ryi3Zb5UdMIP0/O4GXs8jwZabQPd8SOg==",
-      "license": "SEE LICENSE IN LICENSE.md",
-      "dependencies": {
-        "@fullcalendar/premium-common": "~6.1.19"
-      },
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19"
-      }
-    },
-    "node_modules/@fullcalendar/timeline": {
-      "version": "6.1.19",
-      "resolved": "https://registry.npmjs.org/@fullcalendar/timeline/-/timeline-6.1.19.tgz",
-      "integrity": "sha512-d2P961mnUTXtJeWNmIq1neoDmZcrPUaK7nGFoc+jQAlnmG3aNSVWQmD1ia694AMqLWtcWkwipW9MuaJgx2QvrA==",
-      "license": "SEE LICENSE IN LICENSE.md",
-      "dependencies": {
-        "@fullcalendar/premium-common": "~6.1.19",
-        "@fullcalendar/scrollgrid": "~6.1.19"
-      },
-      "peerDependencies": {
-        "@fullcalendar/core": "~6.1.19"
-      }
-    },
     "node_modules/@hey-api/json-schema-ref-parser": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@hey-api/json-schema-ref-parser/-/json-schema-ref-parser-1.3.0.tgz",
@@ -2608,9 +2527,9 @@
       }
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.53.3.tgz",
-      "integrity": "sha512-mRSi+4cBjrRLoaal2PnqH82Wqyb+d3HsPUN/W+WslCXsZsyHa9ZeQQX/pQsZaVIWDkPcpV6jJ+3KLbTbgnwv8w==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.5.tgz",
+      "integrity": "sha512-8c1vW4ocv3UOMp9K+gToY5zL2XiiVw3k7f1ksf4yO1FlDFQ1C2u72iACFnSOceJFsWskc2WZNqeRhFRPzv+wtQ==",
       "cpu": [
         "arm"
       ],
@@ -2622,9 +2541,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.53.3.tgz",
-      "integrity": "sha512-CbDGaMpdE9sh7sCmTrTUyllhrg65t6SwhjlMJsLr+J8YjFuPmCEjbBSx4Z/e4SmDyH3aB5hGaJUP2ltV/vcs4w==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.52.5.tgz",
+      "integrity": "sha512-mQGfsIEFcu21mvqkEKKu2dYmtuSZOBMmAl5CFlPGLY94Vlcm+zWApK7F/eocsNzp8tKmbeBP8yXyAbx0XHsFNA==",
       "cpu": [
         "arm64"
       ],
@@ -2636,9 +2555,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.53.3.tgz",
-      "integrity": "sha512-Nr7SlQeqIBpOV6BHHGZgYBuSdanCXuw09hon14MGOLGmXAFYjx1wNvquVPmpZnl0tLjg25dEdr4IQ6GgyToCUA==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.52.5.tgz",
+      "integrity": "sha512-takF3CR71mCAGA+v794QUZ0b6ZSrgJkArC+gUiG6LB6TQty9T0Mqh3m2ImRBOxS2IeYBo4lKWIieSvnEk2OQWA==",
       "cpu": [
         "arm64"
       ],
@@ -2650,9 +2569,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.53.3.tgz",
-      "integrity": "sha512-DZ8N4CSNfl965CmPktJ8oBnfYr3F8dTTNBQkRlffnUarJ2ohudQD17sZBa097J8xhQ26AwhHJ5mvUyQW8ddTsQ==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.52.5.tgz",
+      "integrity": "sha512-W901Pla8Ya95WpxDn//VF9K9u2JbocwV/v75TE0YIHNTbhqUTv9w4VuQ9MaWlNOkkEfFwkdNhXgcLqPSmHy0fA==",
       "cpu": [
         "x64"
       ],
@@ -2664,9 +2583,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.53.3.tgz",
-      "integrity": "sha512-yMTrCrK92aGyi7GuDNtGn2sNW+Gdb4vErx4t3Gv/Tr+1zRb8ax4z8GWVRfr3Jw8zJWvpGHNpss3vVlbF58DZ4w==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.52.5.tgz",
+      "integrity": "sha512-QofO7i7JycsYOWxe0GFqhLmF6l1TqBswJMvICnRUjqCx8b47MTo46W8AoeQwiokAx3zVryVnxtBMcGcnX12LvA==",
       "cpu": [
         "arm64"
       ],
@@ -2678,9 +2597,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.53.3.tgz",
-      "integrity": "sha512-lMfF8X7QhdQzseM6XaX0vbno2m3hlyZFhwcndRMw8fbAGUGL3WFMBdK0hbUBIUYcEcMhVLr1SIamDeuLBnXS+Q==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.52.5.tgz",
+      "integrity": "sha512-jr21b/99ew8ujZubPo9skbrItHEIE50WdV86cdSoRkKtmWa+DDr6fu2c/xyRT0F/WazZpam6kk7IHBerSL7LDQ==",
       "cpu": [
         "x64"
       ],
@@ -2692,9 +2611,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.53.3.tgz",
-      "integrity": "sha512-k9oD15soC/Ln6d2Wv/JOFPzZXIAIFLp6B+i14KhxAfnq76ajt0EhYc5YPeX6W1xJkAdItcVT+JhKl1QZh44/qw==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.52.5.tgz",
+      "integrity": "sha512-PsNAbcyv9CcecAUagQefwX8fQn9LQ4nZkpDboBOttmyffnInRy8R8dSg6hxxl2Re5QhHBf6FYIDhIj5v982ATQ==",
       "cpu": [
         "arm"
       ],
@@ -2706,9 +2625,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.53.3.tgz",
-      "integrity": "sha512-vTNlKq+N6CK/8UktsrFuc+/7NlEYVxgaEgRXVUVK258Z5ymho29skzW1sutgYjqNnquGwVUObAaxae8rZ6YMhg==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.52.5.tgz",
+      "integrity": "sha512-Fw4tysRutyQc/wwkmcyoqFtJhh0u31K+Q6jYjeicsGJJ7bbEq8LwPWV/w0cnzOqR2m694/Af6hpFayLJZkG2VQ==",
       "cpu": [
         "arm"
       ],
@@ -2720,9 +2639,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.53.3.tgz",
-      "integrity": "sha512-RGrFLWgMhSxRs/EWJMIFM1O5Mzuz3Xy3/mnxJp/5cVhZ2XoCAxJnmNsEyeMJtpK+wu0FJFWz+QF4mjCA7AUQ3w==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.52.5.tgz",
+      "integrity": "sha512-a+3wVnAYdQClOTlyapKmyI6BLPAFYs0JM8HRpgYZQO02rMR09ZcV9LbQB+NL6sljzG38869YqThrRnfPMCDtZg==",
       "cpu": [
         "arm64"
       ],
@@ -2734,9 +2653,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.53.3.tgz",
-      "integrity": "sha512-kASyvfBEWYPEwe0Qv4nfu6pNkITLTb32p4yTgzFCocHnJLAHs+9LjUu9ONIhvfT/5lv4YS5muBHyuV84epBo/A==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.52.5.tgz",
+      "integrity": "sha512-AvttBOMwO9Pcuuf7m9PkC1PUIKsfaAJ4AYhy944qeTJgQOqJYJ9oVl2nYgY7Rk0mkbsuOpCAYSs6wLYB2Xiw0Q==",
       "cpu": [
         "arm64"
       ],
@@ -2748,9 +2667,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.53.3.tgz",
-      "integrity": "sha512-JiuKcp2teLJwQ7vkJ95EwESWkNRFJD7TQgYmCnrPtlu50b4XvT5MOmurWNrCj3IFdyjBQ5p9vnrX4JM6I8OE7g==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.52.5.tgz",
+      "integrity": "sha512-DkDk8pmXQV2wVrF6oq5tONK6UHLz/XcEVow4JTTerdeV1uqPeHxwcg7aFsfnSm9L+OO8WJsWotKM2JJPMWrQtA==",
       "cpu": [
         "loong64"
       ],
@@ -2762,9 +2681,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.53.3.tgz",
-      "integrity": "sha512-EoGSa8nd6d3T7zLuqdojxC20oBfNT8nexBbB/rkxgKj5T5vhpAQKKnD+h3UkoMuTyXkP5jTjK/ccNRmQrPNDuw==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.52.5.tgz",
+      "integrity": "sha512-W/b9ZN/U9+hPQVvlGwjzi+Wy4xdoH2I8EjaCkMvzpI7wJUs8sWJ03Rq96jRnHkSrcHTpQe8h5Tg3ZzUPGauvAw==",
       "cpu": [
         "ppc64"
       ],
@@ -2776,9 +2695,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.53.3.tgz",
-      "integrity": "sha512-4s+Wped2IHXHPnAEbIB0YWBv7SDohqxobiiPA1FIWZpX+w9o2i4LezzH/NkFUl8LRci/8udci6cLq+jJQlh+0g==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.52.5.tgz",
+      "integrity": "sha512-sjQLr9BW7R/ZiXnQiWPkErNfLMkkWIoCz7YMn27HldKsADEKa5WYdobaa1hmN6slu9oWQbB6/jFpJ+P2IkVrmw==",
       "cpu": [
         "riscv64"
       ],
@@ -2790,9 +2709,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.53.3.tgz",
-      "integrity": "sha512-68k2g7+0vs2u9CxDt5ktXTngsxOQkSEV/xBbwlqYcUrAVh6P9EgMZvFsnHy4SEiUl46Xf0IObWVbMvPrr2gw8A==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.52.5.tgz",
+      "integrity": "sha512-hq3jU/kGyjXWTvAh2awn8oHroCbrPm8JqM7RUpKjalIRWWXE01CQOf/tUNWNHjmbMHg/hmNCwc/Pz3k1T/j/Lg==",
       "cpu": [
         "riscv64"
       ],
@@ -2804,9 +2723,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.53.3.tgz",
-      "integrity": "sha512-VYsFMpULAz87ZW6BVYw3I6sWesGpsP9OPcyKe8ofdg9LHxSbRMd7zrVrr5xi/3kMZtpWL/wC+UIJWJYVX5uTKg==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.52.5.tgz",
+      "integrity": "sha512-gn8kHOrku8D4NGHMK1Y7NA7INQTRdVOntt1OCYypZPRt6skGbddska44K8iocdpxHTMMNui5oH4elPH4QOLrFQ==",
       "cpu": [
         "s390x"
       ],
@@ -2818,9 +2737,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.53.3.tgz",
-      "integrity": "sha512-3EhFi1FU6YL8HTUJZ51imGJWEX//ajQPfqWLI3BQq4TlvHy4X0MOr5q3D2Zof/ka0d5FNdPwZXm3Yyib/UEd+w==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.5.tgz",
+      "integrity": "sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q==",
       "cpu": [
         "x64"
       ],
@@ -2832,9 +2751,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.53.3.tgz",
-      "integrity": "sha512-eoROhjcc6HbZCJr+tvVT8X4fW3/5g/WkGvvmwz/88sDtSJzO7r/blvoBDgISDiCjDRZmHpwud7h+6Q9JxFwq1Q==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.52.5.tgz",
+      "integrity": "sha512-arCGIcuNKjBoKAXD+y7XomR9gY6Mw7HnFBv5Rw7wQRvwYLR7gBAgV7Mb2QTyjXfTveBNFAtPt46/36vV9STLNg==",
       "cpu": [
         "x64"
       ],
@@ -2846,9 +2765,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.53.3.tgz",
-      "integrity": "sha512-OueLAWgrNSPGAdUdIjSWXw+u/02BRTcnfw9PN41D2vq/JSEPnJnVuBgw18VkN8wcd4fjUs+jFHVM4t9+kBSNLw==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.52.5.tgz",
+      "integrity": "sha512-QoFqB6+/9Rly/RiPjaomPLmR/13cgkIGfA40LHly9zcH1S0bN2HVFYk3a1eAyHQyjs3ZJYlXvIGtcCs5tko9Cw==",
       "cpu": [
         "arm64"
       ],
@@ -2860,9 +2779,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.53.3.tgz",
-      "integrity": "sha512-GOFuKpsxR/whszbF/bzydebLiXIHSgsEUp6M0JI8dWvi+fFa1TD6YQa4aSZHtpmh2/uAlj/Dy+nmby3TJ3pkTw==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.52.5.tgz",
+      "integrity": "sha512-w0cDWVR6MlTstla1cIfOGyl8+qb93FlAVutcor14Gf5Md5ap5ySfQ7R9S/NjNaMLSFdUnKGEasmVnu3lCMqB7w==",
       "cpu": [
         "arm64"
       ],
@@ -2874,9 +2793,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.53.3.tgz",
-      "integrity": "sha512-iah+THLcBJdpfZ1TstDFbKNznlzoxa8fmnFYK4V67HvmuNYkVdAywJSoteUszvBQ9/HqN2+9AZghbajMsFT+oA==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.52.5.tgz",
+      "integrity": "sha512-Aufdpzp7DpOTULJCuvzqcItSGDH73pF3ko/f+ckJhxQyHtp67rHw3HMNxoIdDMUITJESNE6a8uh4Lo4SLouOUg==",
       "cpu": [
         "ia32"
       ],
@@ -2888,9 +2807,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.53.3.tgz",
-      "integrity": "sha512-J9QDiOIZlZLdcot5NXEepDkstocktoVjkaKUtqzgzpt2yWjGlbYiKyp05rWwk4nypbYUNoFAztEgixoLaSETkg==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.52.5.tgz",
+      "integrity": "sha512-UGBUGPFp1vkj6p8wCRraqNhqwX/4kNQPS57BCFc8wYh0g94iVIW33wJtQAx3G7vrjjNtRaxiMUylM0ktp/TRSQ==",
       "cpu": [
         "x64"
       ],
@@ -2902,9 +2821,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.53.3.tgz",
-      "integrity": "sha512-UhTd8u31dXadv0MopwGgNOBpUVROFKWVQgAg5N1ESyCz8AuBcMqm4AuTjrwgQKGDfoFuz02EuMRHQIw/frmYKQ==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.52.5.tgz",
+      "integrity": "sha512-TAcgQh2sSkykPRWLrdyy2AiceMckNf5loITqXxFI5VuQjS5tSuw3WlwdN8qv8vzjLAUTvYaH/mVjSFpbkFbpTg==",
       "cpu": [
         "x64"
       ],
@@ -4156,14 +4075,6 @@
         "node": ">=8.0.0"
       }
     },
-    "node_modules/htmx-ext-alpine-morph": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/htmx-ext-alpine-morph/-/htmx-ext-alpine-morph-2.0.2.tgz",
-      "integrity": "sha512-9pZSSQd0CU0R4/4PhF2/kUbfCcQ+gcxyOMeVwy5fmzfpxOUquVuXWYMoB7EpdMeANzLJ1ceXaakEQwmDj9c9fg==",
-      "dependencies": {
-        "htmx.org": "^2.0.2"
-      }
-    },
     "node_modules/htmx.org": {
       "version": "2.0.8",
       "resolved": "https://registry.npmjs.org/htmx.org/-/htmx.org-2.0.8.tgz",
@@ -4979,9 +4890,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.53.3",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.53.3.tgz",
-      "integrity": "sha512-w8GmOxZfBmKknvdXU1sdM9NHcoQejwF/4mNgj2JuEEdRaHwwF12K7e9eXn1nLZ07ad+du76mkVsyeb2rKGllsA==",
+      "version": "4.52.5",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.52.5.tgz",
+      "integrity": "sha512-3GuObel8h7Kqdjt0gxkEzaifHTqLVW56Y/bjN7PSQtkKr0w3V/QYSdt6QWYtd7A1xUtYQigtdUfgj1RvWVtorw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4995,28 +4906,28 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.53.3",
-        "@rollup/rollup-android-arm64": "4.53.3",
-        "@rollup/rollup-darwin-arm64": "4.53.3",
-        "@rollup/rollup-darwin-x64": "4.53.3",
-        "@rollup/rollup-freebsd-arm64": "4.53.3",
-        "@rollup/rollup-freebsd-x64": "4.53.3",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.53.3",
-        "@rollup/rollup-linux-arm-musleabihf": "4.53.3",
-        "@rollup/rollup-linux-arm64-gnu": "4.53.3",
-        "@rollup/rollup-linux-arm64-musl": "4.53.3",
-        "@rollup/rollup-linux-loong64-gnu": "4.53.3",
-        "@rollup/rollup-linux-ppc64-gnu": "4.53.3",
-        "@rollup/rollup-linux-riscv64-gnu": "4.53.3",
-        "@rollup/rollup-linux-riscv64-musl": "4.53.3",
-        "@rollup/rollup-linux-s390x-gnu": "4.53.3",
-        "@rollup/rollup-linux-x64-gnu": "4.53.3",
-        "@rollup/rollup-linux-x64-musl": "4.53.3",
-        "@rollup/rollup-openharmony-arm64": "4.53.3",
-        "@rollup/rollup-win32-arm64-msvc": "4.53.3",
-        "@rollup/rollup-win32-ia32-msvc": "4.53.3",
-        "@rollup/rollup-win32-x64-gnu": "4.53.3",
-        "@rollup/rollup-win32-x64-msvc": "4.53.3",
+        "@rollup/rollup-android-arm-eabi": "4.52.5",
+        "@rollup/rollup-android-arm64": "4.52.5",
+        "@rollup/rollup-darwin-arm64": "4.52.5",
+        "@rollup/rollup-darwin-x64": "4.52.5",
+        "@rollup/rollup-freebsd-arm64": "4.52.5",
+        "@rollup/rollup-freebsd-x64": "4.52.5",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.52.5",
+        "@rollup/rollup-linux-arm-musleabihf": "4.52.5",
+        "@rollup/rollup-linux-arm64-gnu": "4.52.5",
+        "@rollup/rollup-linux-arm64-musl": "4.52.5",
+        "@rollup/rollup-linux-loong64-gnu": "4.52.5",
+        "@rollup/rollup-linux-ppc64-gnu": "4.52.5",
+        "@rollup/rollup-linux-riscv64-gnu": "4.52.5",
+        "@rollup/rollup-linux-riscv64-musl": "4.52.5",
+        "@rollup/rollup-linux-s390x-gnu": "4.52.5",
+        "@rollup/rollup-linux-x64-gnu": "4.52.5",
+        "@rollup/rollup-linux-x64-musl": "4.52.5",
+        "@rollup/rollup-openharmony-arm64": "4.52.5",
+        "@rollup/rollup-win32-arm64-msvc": "4.52.5",
+        "@rollup/rollup-win32-ia32-msvc": "4.52.5",
+        "@rollup/rollup-win32-x64-gnu": "4.52.5",
+        "@rollup/rollup-win32-x64-msvc": "4.52.5",
         "fsevents": "~2.3.2"
       }
     },

package.json

@@ -23,8 +23,7 @@
     "#core:*": "./core/static/bundled/*",
     "#pedagogy:*": "./pedagogy/static/bundled/*",
     "#counter:*": "./counter/static/bundled/*",
-    "#com:*": "./com/static/bundled/*",
-    "#reservation:*": "./reservation/static/bundled/*"
+    "#com:*": "./com/static/bundled/*"
   },
   "devDependencies": {
     "@babel/core": "^7.29.0",
@@ -42,7 +41,6 @@
     "vite-plugin-static-copy": "^3.2.0"
   },
   "dependencies": {
-    "@alpinejs/morph": "^3.14.9",
     "@alpinejs/sort": "^3.15.8",
     "@arendjr/text-clipper": "npm:@jsr/arendjr__text-clipper@^3.0.0",
     "@floating-ui/dom": "^1.7.5",
@@ -50,10 +48,7 @@
     "@fullcalendar/core": "^6.1.20",
     "@fullcalendar/daygrid": "^6.1.20",
     "@fullcalendar/icalendar": "^6.1.20",
-    "@fullcalendar/interaction": "^6.1.19",
     "@fullcalendar/list": "^6.1.20",
-    "@fullcalendar/resource": "^6.1.19",
-    "@fullcalendar/resource-timeline": "^6.1.19",
     "@sentry/browser": "^10.38.0",
     "@zip.js/zip.js": "^2.8.20",
     "3d-force-graph": "^1.79.1",
@@ -67,7 +62,6 @@
     "easymde": "^2.20.0",
     "glob": "^13.0.2",
     "html2canvas": "^1.4.1",
-    "htmx-ext-alpine-morph": "^2.0.1",
     "htmx.org": "^2.0.8",
     "js-cookie": "^3.0.5",
     "lit-html": "^3.3.2",

reservation/admin.py

@@ -1,19 +0,0 @@
-from django.contrib import admin
-
-from reservation.models import ReservationSlot, Room
-
-
-@admin.register(Room)
-class RoomAdmin(admin.ModelAdmin):
-    list_display = ("name", "club")
-    list_filter = (("club", admin.RelatedOnlyFieldListFilter), "location")
-    autocomplete_fields = ("club",)
-    search_fields = ("name",)
-
-
-@admin.register(ReservationSlot)
-class ReservationSlotAdmin(admin.ModelAdmin):
-    list_display = ("room", "start_at", "end_at", "author")
-    autocomplete_fields = ("author",)
-    list_filter = ("room",)
-    date_hierarchy = "start_at"

reservation/api.py

@@ -1,64 +0,0 @@
-from typing import Any, Literal
-
-from django.core.exceptions import ValidationError
-from ninja import Query
-from ninja_extra import ControllerBase, api_controller, paginate, route
-from ninja_extra.pagination import PageNumberPaginationExtra
-from ninja_extra.schemas import PaginatedResponseSchema
-
-from api.permissions import HasPerm
-from reservation.models import ReservationSlot, Room
-from reservation.schemas import (
-    RoomFilterSchema,
-    RoomSchema,
-    SlotFilterSchema,
-    SlotSchema,
-    UpdateReservationSlotSchema,
-)
-
-
-@api_controller("/reservation/room")
-class ReservableRoomController(ControllerBase):
-    @route.get(
-        "",
-        response=list[RoomSchema],
-        permissions=[HasPerm("reservation.view_room")],
-        url_name="fetch_reservable_rooms",
-    )
-    def fetch_rooms(self, filters: Query[RoomFilterSchema]):
-        return filters.filter(Room.objects.select_related("club"))
-
-
-@api_controller("/reservation/slot")
-class ReservationSlotController(ControllerBase):
-    @route.get(
-        "",
-        response=PaginatedResponseSchema[SlotSchema],
-        permissions=[HasPerm("reservation.view_reservationslot")],
-        url_name="fetch_reservation_slots",
-    )
-    @paginate(PageNumberPaginationExtra)
-    def fetch_slots(self, filters: Query[SlotFilterSchema]):
-        return filters.filter(
-            ReservationSlot.objects.select_related("author").order_by("start_at")
-        )
-
-    @route.patch(
-        "/reservation/slot/{int:slot_id}",
-        permissions=[HasPerm("reservation.change_reservationslot")],
-        response={
-            200: None,
-            409: dict[Literal["detail"], dict[str, list[str]]],
-            422: dict[Literal["detail"], list[dict[str, Any]]],
-        },
-        url_name="change_reservation_slot",
-    )
-    def update_slot(self, slot_id: int, params: UpdateReservationSlotSchema):
-        slot = self.get_object_or_exception(ReservationSlot, id=slot_id)
-        slot.start_at = params.start_at
-        slot.end_at = params.end_at
-        try:
-            slot.full_clean()
-            slot.save()
-        except ValidationError as e:
-            return self.create_response({"detail": dict(e)}, status_code=409)

reservation/apps.py

@@ -1,6 +0,0 @@
-from django.apps import AppConfig
-
-
-class ReservationConfig(AppConfig):
-    default_auto_field = "django.db.models.BigAutoField"
-    name = "reservation"

reservation/forms.py

@@ -1,60 +0,0 @@
-from django import forms
-from django.core.exceptions import NON_FIELD_ERRORS
-from django.utils.translation import gettext_lazy as _
-
-from club.widgets.ajax_select import AutoCompleteSelectClub
-from core.models import User
-from core.views.forms import FutureDateTimeField, SelectDateTime
-from reservation.models import ReservationSlot, Room
-
-
-class RoomCreateForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = Room
-        fields = ["name", "club", "location", "description"]
-        widgets = {"club": AutoCompleteSelectClub}
-
-
-class RoomUpdateForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = Room
-        fields = ["name", "club", "location", "description"]
-        widgets = {"club": AutoCompleteSelectClub}
-
-    def __init__(self, *args, request_user: User, **kwargs):
-        super().__init__(*args, **kwargs)
-        if not request_user.has_perm("reservation.change_room"):
-            # if the user doesn't have the global edition permission
-            # (i.e. it's a club board member, but not a sith admin)
-            # some fields aren't editable
-            del self.fields["club"]
-
-
-class ReservationForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = ReservationSlot
-        fields = ["room", "start_at", "end_at", "comment"]
-        field_classes = {"start_at": FutureDateTimeField, "end_at": FutureDateTimeField}
-        widgets = {"start_at": SelectDateTime(), "end_at": SelectDateTime()}
-        error_messages = {
-            NON_FIELD_ERRORS: {
-                "start_after_end": _("The start must be set before the end")
-            }
-        }
-
-    def __init__(self, *args, author: User, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.author = author
-
-    def save(self, commit: bool = True):  # noqa FBT001
-        self.instance.author = self.author
-        return super().save(commit)

reservation/migrations/0001_initial.py

@@ -1,117 +0,0 @@
-# Generated by Django 5.2.1 on 2025-06-05 10:44
-
-import django.core.validators
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    initial = True
-
-    dependencies = [
-        ("club", "0014_alter_club_options_rename_unix_name_club_slug_name_and_more"),
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Room",
-            fields=[
-                (
-                    "id",
-                    models.BigAutoField(
-                        auto_created=True,
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="ID",
-                    ),
-                ),
-                ("name", models.CharField(max_length=100, verbose_name="room name")),
-                (
-                    "description",
-                    models.TextField(
-                        blank=True, default="", verbose_name="description"
-                    ),
-                ),
-                (
-                    "location",
-                    models.CharField(
-                        blank=True,
-                        choices=[
-                            ("BELFORT", "Belfort"),
-                            ("SEVENANS", "Sévenans"),
-                            ("MONTBELIARD", "Montbéliard"),
-                        ],
-                        verbose_name="site",
-                    ),
-                ),
-                (
-                    "club",
-                    models.ForeignKey(
-                        help_text="The club which manages this room",
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="reservable_rooms",
-                        to="club.club",
-                        verbose_name="room owner",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "reservable room",
-                "verbose_name_plural": "reservable rooms",
-            },
-        ),
-        migrations.CreateModel(
-            name="ReservationSlot",
-            fields=[
-                (
-                    "id",
-                    models.BigAutoField(
-                        auto_created=True,
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="ID",
-                    ),
-                ),
-                (
-                    "comment",
-                    models.TextField(blank=True, default="", verbose_name="comment"),
-                ),
-                (
-                    "start_at",
-                    models.DateTimeField(db_index=True, verbose_name="slot start"),
-                ),
-                ("end_at", models.DateTimeField(verbose_name="slot end")),
-                ("created_at", models.DateTimeField(auto_now_add=True)),
-                (
-                    "author",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="author",
-                    ),
-                ),
-                (
-                    "room",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="slots",
-                        to="reservation.room",
-                        verbose_name="reserved room",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "reservation slot",
-                "verbose_name_plural": "reservation slots",
-                "constraints": [
-                    models.CheckConstraint(
-                        condition=models.Q(("end_at__gt", models.F("start_at"))),
-                        name="reservation_slot_end_after_start",
-                        violation_error_code="start_after_end",
-                    )
-                ],
-            },
-        ),
-    ]

reservation/models.py

@@ -1,100 +0,0 @@
-from __future__ import annotations
-
-from typing import Self
-
-from django.core.exceptions import ValidationError
-from django.db import models
-from django.db.models import F, Q
-from django.utils.translation import gettext_lazy as _
-
-from club.models import Club
-from core.models import User
-
-
-class Room(models.Model):
-    name = models.CharField(_("room name"), max_length=100)
-    description = models.TextField(_("description"), blank=True, default="")
-    club = models.ForeignKey(
-        Club,
-        on_delete=models.CASCADE,
-        related_name="reservable_rooms",
-        verbose_name=_("room owner"),
-        help_text=_("The club which manages this room"),
-    )
-    location = models.CharField(
-        _("site"),
-        blank=True,
-        choices=[
-            ("BELFORT", "Belfort"),
-            ("SEVENANS", "Sévenans"),
-            ("MONTBELIARD", "Montbéliard"),
-        ],
-    )
-
-    class Meta:
-        verbose_name = _("reservable room")
-        verbose_name_plural = _("reservable rooms")
-
-    def __str__(self):
-        return self.name
-
-    def can_be_edited_by(self, user: User) -> bool:
-        # a user may edit a room if it has the global perm
-        # or is in the owner club board
-        return user.has_perm("reservation.change_room") or self.club.board_group_id in [
-            g.id for g in user.cached_groups
-        ]
-
-
-class ReservationSlotQuerySet(models.QuerySet):
-    def overlapping_with(self, slot: ReservationSlot) -> Self:
-        return self.filter(
-            Q(start_at__lt=slot.start_at, end_at__gt=slot.start_at)
-            | Q(start_at__lt=slot.end_at, end_at__gt=slot.end_at)
-        )
-
-
-class ReservationSlot(models.Model):
-    room = models.ForeignKey(
-        Room,
-        on_delete=models.CASCADE,
-        related_name="slots",
-        verbose_name=_("reserved room"),
-    )
-    author = models.ForeignKey(User, on_delete=models.CASCADE, verbose_name=_("author"))
-    comment = models.TextField(_("comment"), blank=True, default="")
-    start_at = models.DateTimeField(_("slot start"), db_index=True)
-    end_at = models.DateTimeField(_("slot end"))
-    created_at = models.DateTimeField(auto_now_add=True)
-
-    objects = ReservationSlotQuerySet.as_manager()
-
-    class Meta:
-        verbose_name = _("reservation slot")
-        verbose_name_plural = _("reservation slots")
-        constraints = [
-            models.CheckConstraint(
-                condition=Q(end_at__gt=F("start_at")),
-                name="reservation_slot_end_after_start",
-                violation_error_code="start_after_end",
-            )
-        ]
-
-    def __str__(self):
-        return f"{self.room.name} : {self.start_at} - {self.end_at}"
-
-    def clean(self):
-        super().clean()
-        if self.end_at is None or self.start_at is None:
-            # if there is no start or no end, then there is no
-            # point to check if this perm overlap with another,
-            # so in this case, don't do the overlap check and let
-            # Django manage the non-null constraint error.
-            return
-        overlapping = ReservationSlot.objects.overlapping_with(self).filter(
-            room_id=self.room_id
-        )
-        if self.id is not None:
-            overlapping = overlapping.exclude(id=self.id)
-        if overlapping.exists():
-            raise ValidationError(_("There is already a reservation on this slot."))

reservation/schemas.py

@@ -1,46 +0,0 @@
-from datetime import datetime
-
-from ninja import FilterSchema, ModelSchema, Schema
-from pydantic import Field, FutureDatetime
-
-from club.schemas import SimpleClubSchema
-from core.schemas import SimpleUserSchema
-from reservation.models import ReservationSlot, Room
-
-
-class RoomFilterSchema(FilterSchema):
-    club: set[int] | None = Field(None, q="club_id__in")
-
-
-class RoomSchema(ModelSchema):
-    class Meta:
-        model = Room
-        fields = ["id", "name", "description", "location"]
-
-    club: SimpleClubSchema
-
-    @staticmethod
-    def resolve_location(obj: Room):
-        return obj.get_location_display()
-
-
-class SlotFilterSchema(FilterSchema):
-    after: datetime = Field(default=None, q="end_at__gt")
-    before: datetime = Field(default=None, q="start_at__lt")
-    room: set[int] | None = None
-    club: set[int] | None = None
-
-
-class SlotSchema(ModelSchema):
-    class Meta:
-        model = ReservationSlot
-        fields = ["id", "room", "comment"]
-
-    start: datetime = Field(alias="start_at")
-    end: datetime = Field(alias="end_at")
-    author: SimpleUserSchema
-
-
-class UpdateReservationSlotSchema(Schema):
-    start_at: FutureDatetime
-    end_at: FutureDatetime

reservation/static/bundled/reservation/components/room-scheduler-index.ts

@@ -1,136 +0,0 @@
-import {
-  Calendar,
-  type DateSelectArg,
-  type EventDropArg,
-  type EventSourceFuncArg,
-} from "@fullcalendar/core";
-import enLocale from "@fullcalendar/core/locales/en-gb";
-import frLocale from "@fullcalendar/core/locales/fr";
-import interactionPlugin, { type EventResizeDoneArg } from "@fullcalendar/interaction";
-import resourceTimelinePlugin from "@fullcalendar/resource-timeline";
-import { paginated } from "#core:utils/api";
-import { inheritHtmlElement, registerComponent } from "#core:utils/web-components";
-import {
-  type ReservationslotFetchSlotsData,
-  reservableroomFetchRooms,
-  reservationslotFetchSlots,
-  reservationslotUpdateSlot,
-  type SlotSchema,
-} from "#openapi";
-import type { SlotSelectedEventArg } from "#reservation:reservation/types";
-
-@registerComponent("room-scheduler")
-export class RoomScheduler extends inheritHtmlElement("div") {
-  static observedAttributes = ["locale", "can_edit_slot", "can_create_slot"];
-  private scheduler: Calendar;
-  private locale = "en";
-  private canEditSlot = false;
-  private canBookSlot = false;
-  private canDeleteSlot = false;
-
-  attributeChangedCallback(name: string, _oldValue?: string, newValue?: string) {
-    if (name === "locale") {
-      this.locale = newValue;
-    }
-    if (name === "can_edit_slot") {
-      this.canEditSlot = newValue.toLowerCase() === "true";
-    }
-    if (name === "can_create_slot") {
-      this.canBookSlot = newValue.toLowerCase() === "true";
-    }
-    if (name === "can_delete_slot") {
-      this.canDeleteSlot = newValue.toLowerCase() === "true";
-    }
-  }
-
-  /**
-   * Fetch the events displayed in the timeline.
-   * cf https://fullcalendar.io/docs/events-function
-   */
-  async fetchEvents(fetchInfo: EventSourceFuncArg) {
-    const res: SlotSchema[] = await paginated(reservationslotFetchSlots, {
-      query: { after: fetchInfo.startStr, before: fetchInfo.endStr },
-    } as ReservationslotFetchSlotsData);
-    return res.map((i) =>
-      Object.assign(i, {
-        title: `${i.author.first_name} ${i.author.last_name}`,
-        resourceId: i.room,
-        editable: new Date(i.start) > new Date(),
-      }),
-    );
-  }
-
-  /**
-   * Fetch the resources which events are associated with.
-   * cf https://fullcalendar.io/docs/resources-function
-   */
-  async fetchResources() {
-    const res = await reservableroomFetchRooms();
-    return res.data.map((i) => Object.assign(i, { title: i.name, group: i.location }));
-  }
-
-  /**
-   * Send a request to the API to change
-   * the start and the duration of a reservation slot
-   */
-  async changeReservation(args: EventDropArg | EventResizeDoneArg) {
-    const response = await reservationslotUpdateSlot({
-      // biome-ignore lint/style/useNamingConvention: api is snake_case
-      path: { slot_id: Number.parseInt(args.event.id) },
-      // biome-ignore lint/style/useNamingConvention: api is snake_case
-      body: { start_at: args.event.startStr, end_at: args.event.endStr },
-    });
-    if (response.response.ok) {
-      document.dispatchEvent(new CustomEvent("reservationSlotChanged"));
-      this.scheduler.refetchEvents();
-    }
-  }
-
-  selectFreeSlot(infos: DateSelectArg) {
-    document.dispatchEvent(
-      new CustomEvent<SlotSelectedEventArg>("timeSlotSelected", {
-        detail: {
-          ressource: Number.parseInt(infos.resource.id),
-          start: infos.startStr,
-          end: infos.endStr,
-        },
-      }),
-    );
-  }
-
-  connectedCallback() {
-    super.connectedCallback();
-    this.scheduler = new Calendar(this.node, {
-      schedulerLicenseKey: "GPL-My-Project-Is-Open-Source",
-      initialView: "resourceTimelineDay",
-      headerToolbar: {
-        left: "prev,next today",
-        center: "title",
-        right: "resourceTimelineDay,resourceTimelineWeek",
-      },
-      plugins: [resourceTimelinePlugin, interactionPlugin],
-      locales: [frLocale, enLocale],
-      height: "auto",
-      locale: this.locale,
-      resourceGroupField: "group",
-      resourceAreaHeaderContent: gettext("Rooms"),
-      editable: this.canEditSlot,
-      snapDuration: "00:15",
-      eventConstraint: { start: new Date() }, // forbid edition of past events
-      eventOverlap: false,
-      eventResourceEditable: false,
-      refetchResourcesOnNavigate: true,
-      resourceAreaWidth: "20%",
-      resources: this.fetchResources,
-      events: this.fetchEvents,
-      select: this.selectFreeSlot,
-      selectOverlap: false,
-      selectable: this.canBookSlot,
-      selectConstraint: { start: new Date() },
-      nowIndicator: true,
-      eventDrop: this.changeReservation,
-      eventResize: this.changeReservation,
-    });
-    this.scheduler.render();
-  }
-}

reservation/static/bundled/reservation/slot-reservation-index.ts

@@ -1,39 +0,0 @@
-import { AlertMessage } from "#core:utils/alert-message";
-import type { SlotSelectedEventArg } from "#reservation:reservation/types";
-
-document.addEventListener("alpine:init", () => {
-  Alpine.data("slotReservation", () => ({
-    start: null as string,
-    end: null as string,
-    room: null as number,
-    showForm: false,
-
-    init() {
-      document.addEventListener(
-        "timeSlotSelected",
-        (event: CustomEvent<SlotSelectedEventArg>) => {
-          this.start = event.detail.start.split("+")[0];
-          this.end = event.detail.end.split("+")[0];
-          this.room = event.detail.ressource;
-          this.showForm = true;
-          this.$nextTick(() => this.$el.scrollIntoView({ behavior: "smooth" })).then();
-        },
-      );
-    },
-  }));
-
-  /**
-   * Component that will catch events sent from the scheduler
-   * to display success messages accordingly.
-   */
-  Alpine.data("scheduleMessages", () => ({
-    alertMessage: new AlertMessage({ defaultDuration: 2000 }),
-    init() {
-      document.addEventListener("reservationSlotChanged", (_event: CustomEvent) => {
-        this.alertMessage.display(gettext("This slot has been successfully moved"), {
-          success: true,
-        });
-      });
-    },
-  }));
-});

reservation/static/bundled/reservation/types.d.ts

@@ -1,5 +0,0 @@
-export interface SlotSelectedEventArg {
-  start: string;
-  end: string;
-  ressource: number;
-}

reservation/static/reservation/reservation.scss

@@ -1,39 +0,0 @@
-#slot-reservation {
-  margin-top: 3em;
-
-  display: flex;
-  flex-direction: column;
-  justify-content: center;
-
-  h3 {
-    display: block;
-    margin: auto;
-    text-align: left;
-  }
-
-  .alert, .error {
-    display: block;
-    margin: 1em auto auto;
-    max-width: 400px;
-    word-wrap: break-word;
-    text-wrap: wrap;
-  }
-
-  form {
-    display: flex;
-    flex-direction: column;
-    gap: .5em;
-    justify-content: center;
-
-    .buttons-row {
-      input[type="submit"], button {
-        margin: 0;
-      }
-    }
-    textarea {
-      max-width: unset;
-      width: 100%;
-      margin-top: unset;
-    }
-  }
-}

reservation/templates/reservation/fragments/create_reservation.jinja

@@ -1,51 +0,0 @@
-<section
-  id="slot-reservation"
-  x-data="slotReservation"
-  x-show="showForm"
-  hx-target="this"
-  hx-ext="alpine-morph"
-  hx-swap="morph"
->
-  <h3>{% trans %}Book a room{% endtrans %}</h3>
-  {% set non_field_errors = form.non_field_errors() %}
-  {% if non_field_errors %}
-    <div class="alert alert-red">
-      {% for error in non_field_errors %}
-        <span>{{ error }}</span>
-      {% endfor %}
-    </div>
-  {% endif %}
-  <form
-    id="slot-reservation-form"
-    hx-post="{{ url("reservation:make_reservation") }}"
-    hx-disabled-elt="find input[type='submit']"
-  >
-    {% csrf_token %}
-    <div class="form-group">
-      {{ form.room.errors }}
-      {{ form.room.label_tag() }}
-      {{ form.room|add_attr("x-model=room") }}
-    </div>
-    <div class="form-group">
-      {{ form.start_at.errors }}
-      {{ form.start_at.label_tag() }}
-      {{ form.start_at|add_attr("x-model=start") }}
-    </div>
-    <div class="form-group">
-      {{ form.end_at.errors }}
-      {{ form.end_at.label_tag() }}
-      {{ form.end_at|add_attr("x-model=end") }}
-    </div>
-    <div class="form-group">
-      {{ form.comment.errors }}
-      {{ form.comment.label_tag() }}
-      {{ form.comment }}
-    </div>
-    <div class="row gap buttons-row">
-      <button class="btn btn-grey grow" @click.prevent="showForm = false">
-        {% trans %}Cancel{% endtrans %}
-      </button>
-      <input class="btn btn-blue grow" type="submit">
-    </div>
-  </form>
-</section>

reservation/templates/reservation/macros.jinja

@@ -1,27 +0,0 @@
-{% macro room_detail(room, can_edit, can_delete) %}
-  <div class="card card-row card-row-m">
-    <div class="card-content">
-      <strong class="card-title">{{ room.name }}</strong>
-      <em>{{ room.get_location_display() }}</em>
-      <p>{{ room.description|truncate(250) }}</p>
-    </div>
-    <div class="card-top-left">
-      {% if can_edit %}
-        <a
-          class="btn btn-grey btn-no-text"
-          href="{{ url("reservation:room_edit", room_id=room.id) }}"
-        >
-          <i class="fa fa-edit"></i>
-        </a>
-      {% endif %}
-      {% if can_delete %}
-        <a
-          class="btn btn-red btn-no-text"
-          href="{{ url("reservation:room_delete", room_id=room.id) }}"
-        >
-          <i class="fa fa-trash"></i>
-        </a>
-      {% endif %}
-    </div>
-  </div>
-{% endmacro %}

reservation/templates/reservation/schedule.jinja

@@ -1,33 +0,0 @@
-{% extends "core/base.jinja" %}
-
-{% block additional_js %}
-  <script type="module" src="{{ static("bundled/reservation/components/room-scheduler-index.ts") }}"></script>
-  <script type="module" src="{{ static("bundled/reservation/slot-reservation-index.ts") }}"></script>
-{% endblock %}
-
-{% block additional_css %}
-  <link rel="stylesheet" href="{{ static('core/components/calendar.scss') }}">
-  <link rel="stylesheet" href="{{ static('reservation/reservation.scss') }}">
-{% endblock %}
-
-
-{% block content %}
-  <h2 class="margin-bottom">{% trans %}Room reservation{% endtrans %}</h2>
-  <p
-    x-data="scheduleMessages"
-    class="alert snackbar"
-    :class="alertMessage.success ? 'alert-green' : 'alert-red'"
-    x-show="alertMessage.open"
-    x-transition.duration.500ms
-    x-text="alertMessage.content"
-  ></p>
-  <room-scheduler
-    locale="{{ LANGUAGE_CODE }}"
-    can_edit_slot="{{ user.has_perm("reservation.change_reservationslot") }}"
-    can_create_slot="{{ user.has_perm("reservation.add_reservationslot") }}"
-  ></room-scheduler>
-  {% if user.has_perm("reservation.add_reservationslot") %}
-    <p><em>{% trans %}You can book a room by selecting a free slot in the calendar.{% endtrans %}</em></p>
-    {{ add_slot_fragment }}
-  {% endif %}
-{% endblock %}

reservation/tests/test_room.py

@@ -1,113 +0,0 @@
-import pytest
-from django.contrib.auth.models import Permission
-from django.test import Client
-from django.urls import reverse
-from model_bakery import baker
-from pytest_django.asserts import assertNumQueries, assertRedirects
-
-from club.models import Club
-from core.models import User
-from reservation.forms import RoomUpdateForm
-from reservation.models import Room
-
-
-@pytest.mark.django_db
-class TestFetchRoom:
-    @pytest.fixture
-    def user(self):
-        return baker.make(
-            User,
-            user_permissions=[Permission.objects.get(codename="view_room")],
-        )
-
-    def test_fetch_simple(self, client: Client, user: User):
-        rooms = baker.make(Room, _quantity=3, _bulk_create=True)
-        client.force_login(user)
-        response = client.get(reverse("api:fetch_reservable_rooms"))
-        assert response.status_code == 200
-        assert response.json() == [
-            {
-                "id": room.id,
-                "name": room.name,
-                "description": room.description,
-                "location": room.location,
-                "club": {"id": room.club.id, "name": room.club.name},
-            }
-            for room in rooms
-        ]
-
-    def test_nb_queries(self, client: Client, user: User):
-        client.force_login(user)
-        with assertNumQueries(5):
-            # 4 for authentication
-            # 1 to fetch the actual data
-            client.get(reverse("api:fetch_reservable_rooms"))
-
-
-@pytest.mark.django_db
-class TestCreateRoom:
-    def test_ok(self, client: Client):
-        perm = Permission.objects.get(codename="add_room")
-        club = baker.make(Club)
-        client.force_login(
-            baker.make(User, user_permissions=[perm], groups=[club.board_group])
-        )
-        response = client.post(
-            reverse("reservation:room_create"),
-            data={"club": club.id, "name": "test", "location": "BELFORT"},
-        )
-        assertRedirects(response, reverse("club:tools", kwargs={"club_id": club.id}))
-        room = Room.objects.last()
-        assert room is not None
-        assert room.club == club
-        assert room.name == "test"
-        assert room.location == "BELFORT"
-
-    def test_permission_denied(self, client: Client):
-        club = baker.make(Club)
-        client.force_login(baker.make(User))
-        response = client.get(reverse("reservation:room_create"))
-        assert response.status_code == 403
-        response = client.post(
-            reverse("reservation:room_create"),
-            data={"club": club.id, "name": "test", "location": "BELFORT"},
-        )
-        assert response.status_code == 403
-
-
-@pytest.mark.django_db
-class TestUpdateRoom:
-    def test_ok(self, client: Client):
-        club = baker.make(Club)
-        room = baker.make(Room, club=club)
-        client.force_login(baker.make(User, groups=[club.board_group]))
-        url = reverse("reservation:room_edit", kwargs={"room_id": room.id})
-        response = client.post(url, data={"name": "test", "location": "BELFORT"})
-        assertRedirects(response, url)
-        room.refresh_from_db()
-        assert room.club == club
-        assert room.name == "test"
-        assert room.location == "BELFORT"
-
-    def test_permission_denied(self, client: Client):
-        club = baker.make(Club)
-        room = baker.make(Room, club=club)
-        client.force_login(baker.make(User))
-        url = reverse("reservation:room_edit", kwargs={"room_id": room.id})
-        response = client.get(url)
-        assert response.status_code == 403
-        response = client.post(url, data={"name": "test", "location": "BELFORT"})
-        assert response.status_code == 403
-
-
-@pytest.mark.django_db
-class TestUpdateRoomForm:
-    def test_form_club_edition_rights(self):
-        """The club field should appear only if the request user can edit it."""
-        room = baker.make(Room)
-        perm = Permission.objects.get(codename="change_room")
-        user_authorized = baker.make(User, user_permissions=[perm])
-        assert "club" in RoomUpdateForm(request_user=user_authorized).fields
-
-        user_forbidden = baker.make(User, groups=[room.club.board_group])
-        assert "club" not in RoomUpdateForm(request_user=user_forbidden).fields

reservation/tests/test_slot.py

@@ -1,207 +0,0 @@
-from datetime import timedelta
-
-import pytest
-from django.contrib.auth.models import Permission
-from django.test import Client
-from django.urls import reverse
-from django.utils.timezone import now
-from model_bakery import baker
-from pytest_django.asserts import assertNumQueries
-
-from core.models import User
-from reservation.forms import ReservationForm
-from reservation.models import ReservationSlot, Room
-
-
-@pytest.mark.django_db
-class TestFetchReservationSlotsApi:
-    @pytest.fixture
-    def user(self):
-        perm = Permission.objects.get(codename="view_reservationslot")
-        return baker.make(User, user_permissions=[perm])
-
-    def test_fetch_simple(self, client: Client, user: User):
-        slots = baker.make(ReservationSlot, _quantity=5, _bulk_create=True)
-        client.force_login(user)
-        response = client.get(reverse("api:fetch_reservation_slots"))
-        assert response.json()["results"] == [
-            {
-                "id": slot.id,
-                "room": slot.room_id,
-                "comment": slot.comment,
-                "start": slot.start_at.isoformat(timespec="milliseconds").replace(
-                    "+00:00", "Z"
-                ),
-                "end": slot.end_at.isoformat(timespec="milliseconds").replace(
-                    "+00:00", "Z"
-                ),
-                "author": {
-                    "id": slot.author.id,
-                    "first_name": slot.author.first_name,
-                    "last_name": slot.author.last_name,
-                    "nick_name": slot.author.nick_name,
-                },
-            }
-            for slot in slots
-        ]
-
-    def test_nb_queries(self, client: Client, user: User):
-        client.force_login(user)
-        with assertNumQueries(5):
-            # 4 for authentication
-            # 1 to fetch the actual data
-            client.get(reverse("api:fetch_reservation_slots"))
-
-
-@pytest.mark.django_db
-class TestUpdateReservationSlotApi:
-    @pytest.fixture
-    def user(self):
-        perm = Permission.objects.get(codename="change_reservationslot")
-        return baker.make(User, user_permissions=[perm])
-
-    @pytest.fixture
-    def slot(self):
-        return baker.make(
-            ReservationSlot,
-            start_at=now() + timedelta(hours=2),
-            end_at=now() + timedelta(hours=4),
-        )
-
-    def test_ok(self, client: Client, user: User, slot: ReservationSlot):
-        client.force_login(user)
-        new_start = (slot.start_at + timedelta(hours=1)).replace(microsecond=0)
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {"start_at": new_start, "end_at": new_start + timedelta(hours=2)},
-            content_type="application/json",
-        )
-        assert response.status_code == 200
-        slot.refresh_from_db()
-        assert slot.start_at.replace(microsecond=0) == new_start
-        assert slot.end_at.replace(microsecond=0) == new_start + timedelta(hours=2)
-
-    def test_change_past_event(self, client, user: User, slot: ReservationSlot):
-        """Test that moving a slot that already began is impossible."""
-        client.force_login(user)
-        new_start = now() - timedelta(hours=1)
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {"start_at": new_start, "end_at": new_start + timedelta(hours=2)},
-            content_type="application/json",
-        )
-
-        assert response.status_code == 422
-
-    def test_move_event_to_occupied_slot(
-        self, client: Client, user: User, slot: ReservationSlot
-    ):
-        client.force_login(user)
-        other_slot = baker.make(
-            ReservationSlot,
-            room=slot.room,
-            start_at=slot.end_at + timedelta(hours=1),
-            end_at=slot.end_at + timedelta(hours=3),
-        )
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {
-                "start_at": other_slot.start_at - timedelta(hours=1),
-                "end_at": other_slot.start_at + timedelta(hours=1),
-            },
-            content_type="application/json",
-        )
-        assert response.status_code == 409
-
-
-@pytest.mark.django_db
-class TestReservationForm:
-    def test_ok(self):
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        form = ReservationForm(
-            author=baker.make(User),
-            data={"room": baker.make(Room), "start_at": start, "end_at": end},
-        )
-        assert form.is_valid()
-
-    @pytest.mark.parametrize(
-        ("start_date", "end_date", "errors"),
-        [
-            (
-                now() - timedelta(hours=2),
-                now() + timedelta(hours=2),
-                {"start_at": ["Assurez-vous que cet horodatage est dans le futur"]},
-            ),
-            (
-                now() + timedelta(hours=3),
-                now() + timedelta(hours=2),
-                {"__all__": ["Le début doit être placé avant la fin"]},
-            ),
-        ],
-    )
-    def test_invalid_timedates(self, start_date, end_date, errors):
-        form = ReservationForm(
-            author=baker.make(User),
-            data={"room": baker.make(Room), "start_at": start_date, "end_at": end_date},
-        )
-        assert not form.is_valid()
-        assert form.errors == errors
-
-    def test_unavailable_room(self):
-        room = baker.make(Room)
-        baker.make(
-            ReservationSlot,
-            room=room,
-            start_at=now() + timedelta(hours=2),
-            end_at=now() + timedelta(hours=4),
-        )
-        form = ReservationForm(
-            author=baker.make(User),
-            data={
-                "room": room,
-                "start_at": now() + timedelta(hours=1),
-                "end_at": now() + timedelta(hours=3),
-            },
-        )
-        assert not form.is_valid()
-        assert form.errors == {
-            "__all__": ["Il y a déjà une réservation sur ce créneau."]
-        }
-
-
-@pytest.mark.django_db
-class TestCreateReservationSlot:
-    @pytest.fixture
-    def user(self):
-        perms = Permission.objects.filter(
-            codename__in=["add_reservationslot", "view_reservationslot"]
-        )
-        return baker.make(User, user_permissions=list(perms))
-
-    def test_ok(self, client: Client, user: User):
-        client.force_login(user)
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        room = baker.make(Room)
-        response = client.post(
-            reverse("reservation:make_reservation"),
-            {"room": room.id, "start_at": start, "end_at": end},
-        )
-        assert response.status_code == 200
-        assert response.headers.get("HX-Redirect", "") == reverse("reservation:main")
-        slot = ReservationSlot.objects.filter(room=room).last()
-        assert slot is not None
-        assert slot.start_at == start
-        assert slot.end_at == end
-        assert slot.author == user
-
-    def test_permissions_denied(self, client: Client):
-        client.force_login(baker.make(User))
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        response = client.post(
-            reverse("reservation:make_reservation"),
-            {"room": baker.make(Room), "start_at": start, "end_at": end},
-        )
-        assert response.status_code == 403

reservation/urls.py

@@ -1,19 +0,0 @@
-from django.urls import path
-
-from reservation.views import (
-    ReservationFragment,
-    ReservationScheduleView,
-    RoomCreateView,
-    RoomDeleteView,
-    RoomUpdateView,
-)
-
-urlpatterns = [
-    path("", ReservationScheduleView.as_view(), name="main"),
-    path("room/create/", RoomCreateView.as_view(), name="room_create"),
-    path("room/<int:room_id>/edit", RoomUpdateView.as_view(), name="room_edit"),
-    path("room/<int:room_id>/delete", RoomDeleteView.as_view(), name="room_delete"),
-    path(
-        "fragment/reservation", ReservationFragment.as_view(), name="make_reservation"
-    ),
-]

reservation/views.py

@@ -1,72 +0,0 @@
-# Create your views here.
-
-from django.contrib.auth.mixins import PermissionRequiredMixin
-from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse, reverse_lazy
-from django.utils.translation import gettext_lazy as _
-from django.views.generic import CreateView, DeleteView, TemplateView, UpdateView
-
-from club.models import Club
-from core.auth.mixins import CanEditMixin
-from core.views import UseFragmentsMixin
-from core.views.mixins import FragmentMixin
-from reservation.forms import ReservationForm, RoomCreateForm, RoomUpdateForm
-from reservation.models import ReservationSlot, Room
-
-
-class ReservationFragment(PermissionRequiredMixin, FragmentMixin, CreateView):
-    model = ReservationSlot
-    form_class = ReservationForm
-    permission_required = "reservation.add_reservationslot"
-    template_name = "reservation/fragments/create_reservation.jinja"
-    success_url = reverse_lazy("reservation:main")
-    reload_on_redirect = True
-    object = None
-
-    def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"author": self.request.user}
-
-
-class ReservationScheduleView(PermissionRequiredMixin, UseFragmentsMixin, TemplateView):
-    template_name = "reservation/schedule.jinja"
-    permission_required = "reservation.view_reservationslot"
-    fragments = {"add_slot_fragment": ReservationFragment}
-
-
-class RoomCreateView(PermissionRequiredMixin, CreateView):
-    form_class = RoomCreateForm
-    template_name = "core/create.jinja"
-    permission_required = "reservation.add_room"
-
-    def get_initial(self):
-        init = super().get_initial()
-        if "club" in self.request.GET:
-            club_id = self.request.GET["club"]
-            if club_id.isdigit() and int(club_id) > 0:
-                init["club"] = Club.objects.filter(id=int(club_id)).first()
-        return init
-
-    def get_success_url(self):
-        return reverse("club:tools", kwargs={"club_id": self.object.club_id})
-
-
-class RoomUpdateView(SuccessMessageMixin, CanEditMixin, UpdateView):
-    model = Room
-    pk_url_kwarg = "room_id"
-    form_class = RoomUpdateForm
-    template_name = "core/edit.jinja"
-    success_message = _("%(name)s was updated successfully")
-
-    def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"request_user": self.request.user}
-
-    def get_success_url(self):
-        return self.request.path
-
-
-class RoomDeleteView(PermissionRequiredMixin, DeleteView):
-    model = Room
-    pk_url_kwarg = "room_id"
-    template_name = "core/delete_confirm.jinja"
-    success_url = reverse_lazy("reservation:room_list")
-    permission_required = "reservation.delete_room"

sas/static/bundled/sas/viewer-index.ts

@@ -109,232 +109,225 @@ interface ViewerConfig {
   /** id of the first picture to load on the page */
   firstPictureId: number;
   /** if the user is sas admin */
-  userIsSasAdmin: boolean;
+  userCanModerate: boolean;
 }
 
 /**
  * Load user picture page with a nice download bar
  **/
-exportToHtml("loadViewer", (config: ViewerConfig) => {
-  document.addEventListener("alpine:init", () => {
-    Alpine.data("picture_viewer", () => ({
-      /**
-       * All the pictures that can be displayed on this picture viewer
-       **/
-      pictures: [] as PictureWithIdentifications[],
-      /**
-       * The currently displayed picture
-       * Default dummy data are pre-loaded to avoid javascript error
-       * when loading the page at the beginning
-       * @type PictureWithIdentifications
-       **/
-      currentPicture: {
-        // biome-ignore lint/style/useNamingConvention: api is in snake_case
-        is_moderated: true,
-        id: null as number,
-        name: "",
-        // biome-ignore lint/style/useNamingConvention: api is in snake_case
-        display_name: "",
-        // biome-ignore lint/style/useNamingConvention: api is in snake_case
-        compressed_url: "",
-        // biome-ignore lint/style/useNamingConvention: api is in snake_case
-        profile_url: "",
-        // biome-ignore lint/style/useNamingConvention: api is in snake_case
-        full_size_url: "",
-        owner: "",
-        date: new Date(),
-        identifications: [] as IdentifiedUserSchema[],
-      },
-      /**
-       * The picture which will be displayed next if the user press the "next" button
-       **/
-      nextPicture: null as PictureWithIdentifications,
-      /**
-       * The picture which will be displayed next if the user press the "previous" button
-       **/
-      previousPicture: null as PictureWithIdentifications,
-      /**
-       * The select2 component used to identify users
-       **/
-      selector: undefined as UserAjaxSelect,
-      /**
-       * Error message when a moderation operation fails
-       **/
-      moderationError: "",
-      /**
-       * Method of pushing new url to the browser history
-       * Used by popstate event and always reset to it's default value when used
-       **/
-      pushstate: History.Push,
+document.addEventListener("alpine:init", () => {
+  Alpine.data("picture_viewer", (config: ViewerConfig) => ({
+    /**
+     * All the pictures that can be displayed on this picture viewer
+     **/
+    pictures: [] as PictureWithIdentifications[],
+    /**
+     * The currently displayed picture
+     * Default dummy data are pre-loaded to avoid javascript error
+     * when loading the page at the beginning
+     * @type PictureWithIdentifications
+     **/
+    currentPicture: {
+      // biome-ignore lint/style/useNamingConvention: api is in snake_case
+      is_moderated: true,
+      id: null as number,
+      name: "",
+      // biome-ignore lint/style/useNamingConvention: api is in snake_case
+      display_name: "",
+      // biome-ignore lint/style/useNamingConvention: api is in snake_case
+      compressed_url: "",
+      // biome-ignore lint/style/useNamingConvention: api is in snake_case
+      profile_url: "",
+      // biome-ignore lint/style/useNamingConvention: api is in snake_case
+      full_size_url: "",
+      owner: "",
+      date: new Date(),
+      identifications: [] as IdentifiedUserSchema[],
+    },
+    /**
+     * The picture which will be displayed next if the user press the "next" button
+     **/
+    nextPicture: null as PictureWithIdentifications,
+    /**
+     * The picture which will be displayed next if the user press the "previous" button
+     **/
+    previousPicture: null as PictureWithIdentifications,
+    /**
+     * The select2 component used to identify users
+     **/
+    selector: undefined as UserAjaxSelect,
+    /**
+     * Error message when a moderation operation fails
+     **/
+    moderationError: "",
+    /**
+     * Method of pushing new url to the browser history
+     * Used by popstate event and always reset to it's default value when used
+     **/
+    pushstate: History.Push,
 
-      async init() {
-        this.pictures = (
-          await paginated(picturesFetchPictures, {
-            // biome-ignore lint/style/useNamingConvention: api is in snake_case
-            query: { album_id: config.albumId },
-          } as PicturesFetchPicturesData)
-        ).map(PictureWithIdentifications.fromPicture);
-        this.selector = this.$refs.search;
-        this.selector.setFilter((users: UserProfileSchema[]) => {
-          const resp: UserProfileSchema[] = [];
-          const ids = [
-            ...(this.currentPicture.identifications || []).map(
-              (i: IdentifiedUserSchema) => i.user.id,
-            ),
-          ];
-          for (const user of users) {
-            if (!ids.includes(user.id)) {
-              resp.push(user);
-            }
+    async init() {
+      this.pictures = (
+        await paginated(picturesFetchPictures, {
+          // biome-ignore lint/style/useNamingConvention: api is in snake_case
+          query: { album_id: config.albumId },
+        } as PicturesFetchPicturesData)
+      ).map(PictureWithIdentifications.fromPicture);
+      this.selector = this.$refs.search;
+      this.selector.setFilter((users: UserProfileSchema[]) => {
+        const resp: UserProfileSchema[] = [];
+        const ids = [
+          ...(this.currentPicture.identifications || []).map(
+            (i: IdentifiedUserSchema) => i.user.id,
+          ),
+        ];
+        for (const user of users) {
+          if (!ids.includes(user.id)) {
+            resp.push(user);
           }
-          return resp;
-        });
-        this.currentPicture = this.pictures.find(
-          (i: PictureSchema) => i.id === config.firstPictureId,
-        );
-        this.$watch(
-          "currentPicture",
-          (current: PictureSchema, previous: PictureSchema) => {
-            if (current === previous) {
-              /* Avoid recursive updates */
-              return;
-            }
-            this.updatePicture();
-          },
-        );
-        window.addEventListener("popstate", async (event) => {
-          if (!event.state || event.state.sasPictureId === undefined) {
+        }
+        return resp;
+      });
+      this.currentPicture = this.pictures.find(
+        (i: PictureSchema) => i.id === config.firstPictureId,
+      );
+      this.$watch(
+        "currentPicture",
+        (current: PictureSchema, previous: PictureSchema) => {
+          if (current === previous) {
+            /* Avoid recursive updates */
             return;
           }
-          this.pushstate = History.Replace;
-          this.currentPicture = this.pictures.find(
-            (i: PictureSchema) =>
-              i.id === Number.parseInt(event.state.sasPictureId, 10),
-          );
-        });
-        this.pushstate = History.Replace; /* Avoid first url push */
-        await this.updatePicture();
-      },
-
-      /**
-       * Update the page.
-       * Called when the `currentPicture` property changes.
-       *
-       * The url is modified without reloading the page,
-       * and the previous picture, the next picture and
-       * the list of identified users are updated.
-       */
-      async updatePicture(): Promise<void> {
-        const updateArgs = {
-          data: { sasPictureId: this.currentPicture.id },
-          unused: "",
-          url: this.currentPicture.sas_url,
-        };
-        if (this.pushstate === History.Replace) {
-          window.history.replaceState(
-            updateArgs.data,
-            updateArgs.unused,
-            updateArgs.url,
-          );
-          this.pushstate = History.Push;
-        } else {
-          window.history.pushState(updateArgs.data, updateArgs.unused, updateArgs.url);
-        }
-
-        this.moderationError = "";
-        const index: number = this.pictures.indexOf(this.currentPicture);
-        this.previousPicture = this.pictures[index - 1] || null;
-        this.nextPicture = this.pictures[index + 1] || null;
-        this.$refs.mainPicture?.addEventListener("load", () => {
-          // once the current picture is loaded,
-          // start preloading the next and previous pictures
-          this.nextPicture?.preload();
-          this.previousPicture?.preload();
-        });
-        if (this.currentPicture.asked_for_removal && config.userIsSasAdmin) {
-          await Promise.all([
-            this.currentPicture.loadIdentifications(),
-            this.currentPicture.loadModeration(),
-          ]);
-        } else {
-          await this.currentPicture.loadIdentifications();
-        }
-      },
-
-      async moderatePicture() {
-        const res = await picturesModeratePicture({
-          // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          path: { picture_id: this.currentPicture.id },
-        });
-        if (res.error) {
-          this.moderationError = `${gettext("Couldn't moderate picture")} : ${(res.error as { detail: string }).detail}`;
+          this.updatePicture();
+        },
+      );
+      window.addEventListener("popstate", async (event) => {
+        if (!event.state || event.state.sasPictureId === undefined) {
           return;
         }
-        this.currentPicture.is_moderated = true;
-        this.currentPicture.asked_for_removal = false;
-      },
+        this.pushstate = History.Replace;
+        this.currentPicture = this.pictures.find(
+          (i: PictureSchema) => i.id === Number.parseInt(event.state.sasPictureId, 10),
+        );
+      });
+      this.pushstate = History.Replace; /* Avoid first url push */
+      await this.updatePicture();
+    },
 
-      async deletePicture() {
-        const res = await picturesDeletePicture({
+    /**
+     * Update the page.
+     * Called when the `currentPicture` property changes.
+     *
+     * The url is modified without reloading the page,
+     * and the previous picture, the next picture and
+     * the list of identified users are updated.
+     */
+    async updatePicture(): Promise<void> {
+      const updateArgs = {
+        data: { sasPictureId: this.currentPicture.id },
+        unused: "",
+        url: this.currentPicture.sas_url,
+      };
+      if (this.pushstate === History.Replace) {
+        window.history.replaceState(updateArgs.data, updateArgs.unused, updateArgs.url);
+        this.pushstate = History.Push;
+      } else {
+        window.history.pushState(updateArgs.data, updateArgs.unused, updateArgs.url);
+      }
+
+      this.moderationError = "";
+      const index: number = this.pictures.indexOf(this.currentPicture);
+      this.previousPicture = this.pictures[index - 1] || null;
+      this.nextPicture = this.pictures[index + 1] || null;
+      this.$refs.mainPicture?.addEventListener("load", () => {
+        // once the current picture is loaded,
+        // start preloading the next and previous pictures
+        this.nextPicture?.preload();
+        this.previousPicture?.preload();
+      });
+      if (this.currentPicture.asked_for_removal && config.userCanModerate) {
+        await Promise.all([
+          this.currentPicture.loadIdentifications(),
+          this.currentPicture.loadModeration(),
+        ]);
+      } else {
+        await this.currentPicture.loadIdentifications();
+      }
+    },
+
+    async moderatePicture() {
+      const res = await picturesModeratePicture({
+        // biome-ignore lint/style/useNamingConvention: api is in snake_case
+        path: { picture_id: this.currentPicture.id },
+      });
+      if (res.error) {
+        this.moderationError = `${gettext("Couldn't moderate picture")} : ${(res.error as { detail: string }).detail}`;
+        return;
+      }
+      this.currentPicture.is_moderated = true;
+      this.currentPicture.asked_for_removal = false;
+    },
+
+    async deletePicture() {
+      const res = await picturesDeletePicture({
+        // biome-ignore lint/style/useNamingConvention: api is in snake_case
+        path: { picture_id: this.currentPicture.id },
+      });
+      if (res.error) {
+        this.moderationError = `${gettext("Couldn't delete picture")} : ${(res.error as { detail: string }).detail}`;
+        return;
+      }
+      this.pictures.splice(this.pictures.indexOf(this.currentPicture), 1);
+      if (this.pictures.length === 0) {
+        // The deleted picture was the only one in the list.
+        // As the album is now empty, go back to the parent page
+        document.location.href = config.albumUrl;
+      }
+      this.currentPicture = this.nextPicture || this.previousPicture;
+    },
+
+    /**
+     * Send the identification request and update the list of identified users.
+     */
+    async submitIdentification(): Promise<void> {
+      const widget: TomSelect = this.selector.widget;
+      await picturesIdentifyUsers({
+        path: {
           // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          path: { picture_id: this.currentPicture.id },
-        });
-        if (res.error) {
-          this.moderationError = `${gettext("Couldn't delete picture")} : ${(res.error as { detail: string }).detail}`;
-          return;
-        }
-        this.pictures.splice(this.pictures.indexOf(this.currentPicture), 1);
-        if (this.pictures.length === 0) {
-          // The deleted picture was the only one in the list.
-          // As the album is now empty, go back to the parent page
-          document.location.href = config.albumUrl;
-        }
-        this.currentPicture = this.nextPicture || this.previousPicture;
-      },
+          picture_id: this.currentPicture.id,
+        },
+        body: widget.items.map((i: string) => Number.parseInt(i, 10)),
+      });
+      // refresh the identified users list
+      await this.currentPicture.loadIdentifications({ forceReload: true });
 
-      /**
-       * Send the identification request and update the list of identified users.
-       */
-      async submitIdentification(): Promise<void> {
-        const widget: TomSelect = this.selector.widget;
-        await picturesIdentifyUsers({
-          path: {
-            // biome-ignore lint/style/useNamingConvention: api is in snake_case
-            picture_id: this.currentPicture.id,
-          },
-          body: widget.items.map((i: string) => Number.parseInt(i, 10)),
-        });
-        // refresh the identified users list
-        await this.currentPicture.loadIdentifications({ forceReload: true });
+      // Clear selection and cache of retrieved user so they can be filtered again
+      widget.clear(false);
+      widget.clearOptions();
+      widget.setTextboxValue("");
+    },
 
-        // Clear selection and cache of retrieved user so they can be filtered again
-        widget.clear(false);
-        widget.clearOptions();
-        widget.setTextboxValue("");
-      },
+    /**
+     * Check if an identification can be removed by the currently logged user
+     */
+    canBeRemoved(identification: IdentifiedUserSchema): boolean {
+      return config.userCanModerate || identification.user.id === config.userId;
+    },
 
-      /**
-       * Check if an identification can be removed by the currently logged user
-       */
-      canBeRemoved(identification: IdentifiedUserSchema): boolean {
-        return config.userIsSasAdmin || identification.user.id === config.userId;
-      },
-
-      /**
-       * Untag a user from the current picture
-       */
-      async removeIdentification(identification: IdentifiedUserSchema): Promise<void> {
-        const res = await usersidentifiedDeleteRelation({
-          // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          path: { relation_id: identification.id },
-        });
-        if (!res.error && Array.isArray(this.currentPicture.identifications)) {
-          this.currentPicture.identifications =
-            this.currentPicture.identifications.filter(
-              (i: IdentifiedUserSchema) => i.id !== identification.id,
-            );
-        }
-      },
-    }));
-  });
+    /**
+     * Untag a user from the current picture
+     */
+    async removeIdentification(identification: IdentifiedUserSchema): Promise<void> {
+      const res = await usersidentifiedDeleteRelation({
+        // biome-ignore lint/style/useNamingConvention: api is in snake_case
+        path: { relation_id: identification.id },
+      });
+      if (!res.error && Array.isArray(this.currentPicture.identifications)) {
+        this.currentPicture.identifications =
+          this.currentPicture.identifications.filter(
+            (i: IdentifiedUserSchema) => i.id !== identification.id,
+          );
+      }
+    },
+  }));
 });

sas/templates/sas/picture.jinja

@@ -17,10 +17,8 @@
 
 {% from "sas/macros.jinja" import print_path %}
 
-{% set user_is_sas_admin = user.is_root or user.is_in_group(pk = settings.SITH_GROUP_SAS_ADMIN_ID) %}
-
 {% block content %}
-  <main x-data="picture_viewer">
+  <main x-data="picture_viewer(config)">
     <code>
       <a href="{{ url('sas:main') }}">SAS</a> / {{ print_path(album) }} <span x-text="currentPicture.name"></span>
     </code>
@@ -50,15 +48,13 @@
               It will be hidden to other users until it has been moderated.
             {% endtrans %}
           </p>
-          {% if user_is_sas_admin %}
+          {% if user.has_perm("sas.moderate_sasfile") %}
             <template x-if="currentPicture.asked_for_removal">
               <div>
                 <h5>{% trans %}The following issues have been raised:{% endtrans %}</h5>
                 <template x-for="req in (currentPicture.moderationRequests ?? [])" :key="req.id">
                   <div>
-                    <h6
-                      x-text="`${req.author.first_name} ${req.author.last_name}`"
-                    ></h6>
+                    <h6 x-text="`${req.author.first_name} ${req.author.last_name}`"></h6>
                     <i x-text="Intl.DateTimeFormat(
                                '{{ LANGUAGE_CODE }}',
                                {dateStyle: 'long', timeStyle: 'short'}
@@ -70,7 +66,7 @@
             </template>
           {% endif %}
         </div>
-        {% if user_is_sas_admin %}
+        {% if user.has_perm("sas.moderate_sasfile") %}
           <div class="alert-aside">
             <button class="btn btn-blue" @click="moderatePicture()">
               {% trans %}Moderate{% endtrans %}
@@ -204,16 +200,13 @@
 {% endblock %}
 
 {% block script %}
-  {{ super() }}
   <script>
-    window.addEventListener("DOMContentLoaded", () => {
-      loadViewer({
-        albumId: {{ album.id }} ,
-        albumUrl: "{{ album.get_absolute_url() }}",
-        firstPictureId: {{ picture.id }},  {# id of the first picture to show after page load #}
-        userId: {{ user.id }},
-        userIsSasAdmin: {{ user_is_sas_admin|tojson }}
-      });
-    })
+    const config = {
+      albumId: {{ album.id }},
+      albumUrl: "{{ album.get_absolute_url() }}",
+      firstPictureId: {{ picture.id }},  {# id of the first picture to show after page load #}
+      userId: {{ user.id }},
+      userCanModerate: {{ user.has_perm("sas.moderate_sasfile")|tojson }}
+    }
   </script>
 {% endblock %}

sas/tests/test_views.py

@@ -161,16 +161,22 @@ class TestSasModeration(TestCase):
         assert len(res.context_data["pictures"]) == 1
         assert res.context_data["pictures"][0] == self.to_moderate
 
-        res = self.client.post(
-            reverse("sas:moderation"),
-            data={"album_id": self.to_moderate.id, "picture_id": self.to_moderate.id},
-        )
-
     def test_moderation_page_forbidden(self):
         self.client.force_login(self.simple_user)
         res = self.client.get(reverse("sas:moderation"))
         assert res.status_code == 403
 
+    def test_moderate_album(self):
+        self.client.force_login(self.moderator)
+        url = reverse("sas:moderation")
+        album = baker.make(
+            Album, is_moderated=False, parent_id=settings.SITH_SAS_ROOT_DIR_ID
+        )
+        res = self.client.post(url, data={"album_id": album.id, "moderate": ""})
+        assertRedirects(res, url)
+        album.refresh_from_db()
+        assert album.is_moderated
+
     def test_moderate_picture(self):
         self.client.force_login(self.moderator)
         res = self.client.get(

sas/views.py

@@ -15,10 +15,10 @@
 from typing import Any
 
 from django.conf import settings
-from django.core.exceptions import PermissionDenied
+from django.contrib.auth.mixins import PermissionRequiredMixin
 from django.db.models import Count, OuterRef, Subquery
 from django.http import Http404, HttpResponseRedirect
-from django.shortcuts import get_object_or_404
+from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
 from django.utils.safestring import SafeString
 from django.views.generic import CreateView, DetailView, TemplateView
@@ -191,26 +191,21 @@ class UserPicturesView(UserTabsMixin, CanViewMixin, DetailView):
 # Admin views
 
 
-class ModerationView(TemplateView):
+class ModerationView(PermissionRequiredMixin, TemplateView):
     template_name = "sas/moderation.jinja"
-
-    def get(self, request, *args, **kwargs):
-        if request.user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
-            return super().get(request, *args, **kwargs)
-        raise PermissionDenied
+    permission_required = "sas.moderate_sasfile"
 
     def post(self, request, *args, **kwargs):
         if "album_id" not in request.POST:
             raise Http404
-        if request.user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID):
-            album = get_object_or_404(Album, pk=request.POST["album_id"])
-            if "moderate" in request.POST:
-                album.moderator = request.user
-                album.is_moderated = True
-                album.save()
-            elif "delete" in request.POST:
-                album.delete()
-        return super().get(request, *args, **kwargs)
+        album = get_object_or_404(Album, pk=request.POST["album_id"])
+        if "moderate" in request.POST:
+            album.moderator = request.user
+            album.is_moderated = True
+            album.save()
+        elif "delete" in request.POST:
+            album.delete()
+        return redirect(self.request.path)
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)

sith/settings.py

@@ -123,7 +123,6 @@ INSTALLED_APPS = (
     "trombi",
     "matmat",
     "pedagogy",
-    "reservation",
     "galaxy",
     "antispam",
     "timetable",
@@ -275,7 +274,7 @@ LOGGING = {
 # Internationalization
 # https://docs.djangoproject.com/en/1.8/topics/i18n/
 
-LANGUAGE_CODE = "fr"
+LANGUAGE_CODE = "fr-FR"
 
 LANGUAGES = [("en", _("English")), ("fr", _("French"))]
 
@@ -406,6 +405,8 @@ SITH_FORUM_PAGE_LENGTH = 30
 SITH_SAS_ROOT_DIR_ID = env.int("SITH_SAS_ROOT_DIR_ID", default=4)
 SITH_SAS_IMAGES_PER_PAGE = 60
 
+SITH_CGU_FILE_ID = env.int("SITH_CGU_FILE_ID", default=5)
+
 SITH_PROFILE_DEPARTMENTS = [
     ("TC", _("TC")),
     ("IMSI", _("IMSI")),
@@ -552,27 +553,27 @@ SITH_SUBSCRIPTIONS = {
     # Discount subscriptions
     "un-semestre-reduction": {
         "name": _("One semester (-20%)"),
-        "price": 12,
+        "price": 16,
         "duration": 1,
     },
     "deux-semestres-reduction": {
         "name": _("Two semesters (-20%)"),
-        "price": 22,
+        "price": 28,
         "duration": 2,
     },
     "cursus-tronc-commun-reduction": {
         "name": _("Common core cursus (-20%)"),
-        "price": 36,
+        "price": 48,
         "duration": 4,
     },
     "cursus-branche-reduction": {
         "name": _("Branch cursus (-20%)"),
-        "price": 36,
+        "price": 48,
         "duration": 6,
     },
     "cursus-alternant-reduction": {
         "name": _("Alternating cursus (-20%)"),
-        "price": 24,
+        "price": 28,
         "duration": 6,
     },
     # CA special offer

sith/urls.py

@@ -34,6 +34,7 @@ urlpatterns = [
     path("", include(("core.urls", "core"), namespace="core")),
     path("sitemap.xml", cache_page(86400)(sitemap), {"sitemaps": sitemaps}),
     path("api/", api.urls),
+    path("api-link/", include(("api.urls", "api-link"), namespace="api-link")),
     path("rootplace/", include(("rootplace.urls", "rootplace"), namespace="rootplace")),
     path(
         "subscription/",
@@ -49,10 +50,6 @@ urlpatterns = [
     path("trombi/", include(("trombi.urls", "trombi"), namespace="trombi")),
     path("matmatronch/", include(("matmat.urls", "matmat"), namespace="matmat")),
     path("pedagogy/", include(("pedagogy.urls", "pedagogy"), namespace="pedagogy")),
-    path(
-        "reservation/",
-        include(("reservation.urls", "reservation"), namespace="reservation"),
-    ),
     path("admin/", admin.site.urls),
     path("i18n/", include("django.conf.urls.i18n")),
     path("jsi18n/", JavaScriptCatalog.as_view(), name="javascript-catalog"),

tsconfig.json

@@ -18,8 +18,7 @@
       "#core:*": ["./core/static/bundled/*"],
       "#pedagogy:*": ["./pedagogy/static/bundled/*"],
       "#counter:*": ["./counter/static/bundled/*"],
-      "#com:*": ["./com/static/bundled/*"],
-      "#reservation:*": ["./reservation/static/bundled/*"]
+      "#com:*": ["./com/static/bundled/*"]
     }
   }
 }