apply review comments

CGV

api/permissions.py

@@ -46,7 +46,7 @@ from django.http import HttpRequest
 from ninja_extra import ControllerBase
 from ninja_extra.permissions import BasePermission
 
-from counter.models import Counter
+from counter.utils import is_logged_in_counter
 
 
 class IsInGroup(BasePermission):
@@ -186,12 +186,7 @@ class IsLoggedInCounter(BasePermission):
     """Check that a user is logged in a counter."""
 
     def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
-        if "/counter/" not in request.META.get("HTTP_REFERER", ""):
+        return is_logged_in_counter(request)
-            return False
-        token = request.session.get("counter_token")
-        if not token:
-            return False
-        return Counter.objects.filter(token=token).exists()
 
 
 CanAccessLookup = IsLoggedInCounter | HasPerm("core.access_lookup")

club/forms.py

@@ -21,10 +21,13 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
+import itertools
+from operator import attrgetter
 
 from django import forms
 from django.db.models import Exists, OuterRef, Q, QuerySet
 from django.db.models.functions import Lower
+from django.forms.models import ModelChoiceField, ModelChoiceIterator
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 
@@ -46,6 +49,37 @@ from counter.models import Counter, Selling
 from counter.schemas import SaleFilterSchema
 
 
+class ClubRoleChoiceIterator(ModelChoiceIterator):
+    """Custom `ModelChoiceIterator` for `ClubRoleChoiceField`"""
+
+    def __iter__(self):
+        if self.field.empty_label is not None:
+            yield "", self.field.empty_label
+        queryset = self.queryset.select_related("club").order_by("club", "order")
+        groups = [
+            (club, [self.choice(role) for role in roles])
+            for club, roles in itertools.groupby(queryset, key=attrgetter("club"))
+        ]
+        if len(groups) == 1:
+            # there is only one club involved, no need to have optgroups
+            yield from groups[0][1]
+        else:
+            # there are multiple clubs, optgroups are necessary to differentiate
+            # roles having the same name
+            yield from groups
+
+
+class ClubRoleChoiceField(ModelChoiceField):
+    """Custom `ModelChoiceField` for `[ClubRole][club.models.ClubRole]`.
+
+    If only one club is involved, behave like the base `ModelChoiceField`.
+    If dealing with the roles of multiple clubs, group the roles
+    into a different `optgroup` for each club.
+    """
+
+    iterator = ClubRoleChoiceIterator
+
+
 class ClubLinkForm(forms.ModelForm):
     error_css_class = "error"
     required_css_class = "required"
@@ -392,6 +426,30 @@ class ClubRoleForm(forms.ModelForm):
             self.instance.order = cleaned_data["ORDER"] - 1
         return cleaned_data
 
+    def save(self, commit=True):  # noqa: FBT002
+        instance: ClubRole = super().save(commit=commit)
+        if commit and "is_board" in self.changed_data:
+            # if the role was moved from board to simple member,
+            # remove all users with that role from the club board group.
+            # If the role became a board role, add users with
+            # that role to the club board group.
+            group_id = instance.club.board_group_id
+            if self.cleaned_data["is_board"]:
+                User.groups.through.objects.bulk_create(
+                    [
+                        User.groups.through(user_id=u, group_id=group_id)
+                        for u in Membership.objects.ongoing()
+                        .filter(role=instance)
+                        .values_list("user_id", flat=True)
+                    ],
+                    ignore_conflicts=True,
+                )
+            else:
+                User.groups.through.objects.filter(
+                    user__memberships__role=instance, group_id=group_id
+                ).delete()
+        return instance
+
 
 class ClubRoleCreateForm(forms.ModelForm):
     """Form to create a club role.

club/migrations/0017_linktype_clublink.py

@@ -25,8 +25,7 @@ class Migration(migrations.Migration):
                     "url_base",
                     models.URLField(
                         help_text=(
-                            "The base url that links with this type "
+                            "The base url that links with this type must respect"
-                            "must respect (e.g. `https://www.instagram.com`)"
                         ),
                         unique=True,
                         verbose_name="url base",

club/models.py

@@ -793,10 +793,7 @@ class LinkType(models.Model):
     url_base = models.URLField(
         "url base",
         unique=True,
-        help_text=_(
+        help_text=_("The base url that links with this type must respect"),
-            "The base url that links with this type must respect (e.g. `%(url)s`)"
-        )
-        % {"url": "https://www.instagram.com"},
     )
     icon = models.CharField(
         _("icon"),

club/templates/club/club_tools.jinja

@@ -1,12 +1,7 @@
 {% extends "core/base.jinja" %}
-{% from "reservation/macros.jinja" import room_detail %}
-
-{% block additional_css %}
-  <link rel="stylesheet" href="{{ static("core/components/card.scss") }}">
-{% endblock %}
 
 {% block content %}
-  <h3>{% trans %}Club tools{% endtrans %} ({{ club.name }})</h3>
+  <h3>{% trans %}Club tools{% endtrans %}</h3>
   <div>
     <h4>{% trans %}Communication:{% endtrans %}</h4>
     <ul>
@@ -24,43 +19,18 @@
         <li><a href="{{ url("club:club_roles", club_id=object.id) }}"></a></li>
       {% endif %}
       {% if object.trombi %}
-        <li>
+        <li> <a href="{{ url('trombi:detail', trombi_id=object.trombi.id) }}">{% trans %}Edit Trombi{% endtrans %}</a></li>
-          <a href="{{ url('trombi:detail', trombi_id=object.trombi.id) }}">
-            {% trans %}Edit Trombi{% endtrans %}</a>
-        </li>
       {% else %}
-        <li><a href="{{ url('trombi:create', club_id=object.id) }}">{% trans %}New Trombi{% endtrans %}</a></li>
+        <li> <a href="{{ url('trombi:create', club_id=object.id) }}">{% trans %}New Trombi{% endtrans %}</a></li>
-        <li><a href="{{ url('club:poster_list', club_id=object.id) }}">{% trans %}Posters{% endtrans %}</a></li>
+        <li> <a href="{{ url('club:poster_list', club_id=object.id) }}">{% trans %}Posters{% endtrans %}</a></li>
       {% endif %}
     </ul>
-    <h4>{% trans %}Reservable rooms{% endtrans %}</h4>
-    <a
-      href="{{ url("reservation:room_create") }}?club={{ object.id }}"
-      class="btn btn-blue"
-    >
-      {% trans %}Add a room{% endtrans %}
-    </a>
-    {%- if reservable_rooms|length > 0 -%}
-      <ul class="card-group">
-        {%- for room in reservable_rooms -%}
-          {{ room_detail(
-          room,
-          can_edit=user.can_edit(room),
-          can_delete=request.user.has_perm("reservation.delete_room")
-          ) }}
-        {%- endfor -%}
-      </ul>
-    {%- else -%}
-      <p>
-        {% trans %}This club manages no reservable room{% endtrans %}
-      </p>
-    {%- endif -%}
     <h4>{% trans %}Counters:{% endtrans %}</h4>
     <ul>
-      {% for counter in counters %}
+      {% for c in object.counters.filter(type="OFFICE") %}
-        <li>{{ counter }}:
+        <li>{{ c }}:
-          <a href="{{ url('counter:details', counter_id=counter.id) }}">View</a>
+          <a href="{{ url('counter:details', counter_id=c.id) }}">View</a>
-          <a href="{{ url('counter:admin', counter_id=counter.id) }}">Edit</a>
+          <a href="{{ url('counter:admin', counter_id=c.id) }}">Edit</a>
         </li>
       {% endfor %}
     </ul>

club/tests/test_clubrole.py

@@ -4,6 +4,7 @@ import pytest
 from django.contrib.auth.models import Permission
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.timezone import now
 from model_bakery import baker, seq
 from model_bakery.recipe import Recipe
 from pytest_django.asserts import assertRedirects
@@ -239,7 +240,7 @@ class TestClubRoleUpdate(TestCase):
 
     def test_president_moves_itself_out_of_the_presidency(self):
         """Test that if the user moves its own role out of the presidency,
-        then it's redirected to another page and loses access to the update page."""
+        then it loses access to the update page."""
         self.payload["roles-0-is_presidency"] = False
         self.client.force_login(self.user)
         res = self.client.post(self.url, data=self.payload)
@@ -251,3 +252,29 @@ class TestClubRoleUpdate(TestCase):
 
         res = self.client.get(self.url)
         assert res.status_code == 403
+
+    def test_role_stops_being_board(self):
+        """Test that if a role stops being a board role,
+        its users lose the club board group."""
+        self.payload["roles-0-is_board"] = False
+        self.payload["roles-0-is_presidency"] = False
+        self.payload["roles-1-is_board"] = False
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        assert not self.user.groups.contains(self.club.board_group)
+
+    def test_role_becomes_board(self):
+        """Test that if a role becomes a board role,
+        its active users get the club board group"""
+        members = [
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=None),
+            baker.make(Membership, club=self.club, role=self.roles[0], end_date=now()),
+        ]
+        self.payload["roles-2-is_board"] = True
+        formset = ClubRoleFormSet(data=self.payload, instance=self.club)
+        assert formset.is_valid()
+        formset.save()
+        # the second membership is finished, so its user shouldn't get the role
+        assert members[0].user.groups.contains(self.club.board_group)
+        assert not members[1].user.groups.contains(self.club.board_group)

club/views.py

@@ -309,12 +309,6 @@ class ClubToolsView(ClubTabsMixin, CanEditMixin, DetailView):
     template_name = "club/club_tools.jinja"
     current_tab = "tools"
 
-    def get_context_data(self, **kwargs):
-        return super().get_context_data(**kwargs) | {
-            "reservable_rooms": list(self.object.reservable_rooms.all()),
-            "counters": list(self.object.counters.filter(type="OFFICE")),
-        }
-
 
 class ClubAddMembersFragment(
     FragmentMixin, PermissionRequiredMixin, SuccessMessageMixin, CreateView

com/static/com/components/ics-calendar.scss

@@ -16,76 +16,16 @@
   --event-details-padding: 20px;
   --event-details-border: 1px solid #EEEEEE;
   --event-details-border-radius: 4px;
-  --event-details-box-shadow: 0 6px 20px 4px rgb(0 0 0 / 16%);
+  --event-details-box-shadow: 0px 6px 20px 4px rgb(0 0 0 / 16%);
   --event-details-max-width: 600px;
   --event-recurring-internal-color: #6f69cd;
   --event-recurring-unpublished-color: orange;
 }
 
-ics-calendar,
+ics-calendar {
-room-scheduler {
   border: none;
   box-shadow: none;
 
-  a.fc-col-header-cell-cushion,
-  a.fc-col-header-cell-cushion:hover {
-    color: black;
-  }
-
-  a.fc-daygrid-day-number,
-  a.fc-daygrid-day-number:hover {
-    color: rgb(34, 34, 34);
-  }
-
-  td {
-    overflow: visible; // Show events on multiple days
-  }
-
-  td, th {
-    text-align: unset;
-  }
-
-  //Reset from style.scss
-  table {
-    box-shadow: none;
-    border-radius: 0;
-    -moz-border-radius: 0;
-    margin: 0;
-  }
-
-  // Reset from style.scss
-  thead {
-    background-color: white;
-    color: black;
-  }
-
-  // Reset from style.scss
-  tbody > tr {
-    &:nth-child(even):not(.highlight) {
-      background: white;
-    }
-  }
-
-  .fc .fc-toolbar.fc-footer-toolbar {
-    margin-bottom: 0.5em;
-  }
-
-  button.text-copy,
-  button.text-copy:focus,
-  button.text-copy:hover {
-    background-color: #67AE6E !important;
-    transition: 500ms ease-in;
-  }
-
-  button.text-copied,
-  button.text-copied:focus,
-  button.text-copied:hover {
-    transition: 500ms ease-out;
-  }
-
-}
-
-ics-calendar {
   #event-details {
     z-index: 10;
     max-width: 1151px;
@@ -122,60 +62,82 @@ ics-calendar {
       align-items: start;
       flex-direction: row;
       background-color: var(--event-details-background-color);
-      margin-top: 0;
+      margin-top: 0px;
       margin-bottom: 4px;
     }
   }
-}
 
-// Reset from style.scss
+  a.fc-col-header-cell-cushion,
-thead {
+  a.fc-col-header-cell-cushion:hover {
-  background-color: white;
+    color: black;
-  color: black;
-}
-
-// Reset from style.scss
-tbody > tr {
-  &:nth-child(even):not(.highlight) {
-    background: white;
   }
-}
 
-.fc .fc-toolbar.fc-footer-toolbar {
+  a.fc-daygrid-day-number,
-  margin-bottom: 0.5em;
+  a.fc-daygrid-day-number:hover {
-}
+    color: rgb(34, 34, 34);
+  }
 
-button.text-copy,
+  td {
-button.text-copy:focus,
+    overflow: visible; // Show events on multiple days
-button.text-copy:hover {
+  }
-  background-color: #67AE6E !important;
-  transition: 500ms ease-in;
-}
 
-button.text-copied,
+  //Reset from style.scss
-button.text-copied:focus,
+  table {
-button.text-copied:hover {
+    box-shadow: none;
-  transition: 500ms ease-out;
+    border-radius: 0px;
-}
+    -moz-border-radius: 0px;
+    margin: 0px;
+  }
 
-.fc .fc-getCalendarLink-button {
+  // Reset from style.scss
-  margin-right: 0.5rem;
+  thead {
-}
+    background-color: white;
+    color: black;
+  }
 
-.fc .fc-helpButton-button {
+  // Reset from style.scss
-  border-radius: 70%;
+  tbody>tr {
-  padding-left: 0.5rem;
+    &:nth-child(even):not(.highlight) {
-  padding-right: 0.5rem;
+      background: white;
-  background-color: rgba(0, 0, 0, 0.8);
+    }
-  transition: 100ms ease-out;
+  }
-  width: 30px;
+
-  height: 30px;
+  .fc .fc-toolbar.fc-footer-toolbar {
-  font-size: 11px;
+    margin-bottom: 0.5em;
-}
+  }
+
+  button.text-copy,
+  button.text-copy:focus,
+  button.text-copy:hover {
+    background-color: #67AE6E !important;
+    transition: 500ms ease-in;
+  }
+
+  button.text-copied,
+  button.text-copied:focus,
+  button.text-copied:hover {
+    transition: 500ms ease-out;
+  }
+
+  .fc .fc-getCalendarLink-button {
+    margin-right: 0.5rem;
+  }
+
+  .fc .fc-helpButton-button {
+    border-radius: 70%;
+    padding-left: 0.5rem;
+    padding-right: 0.5rem;
+    background-color: rgba(0, 0, 0, 0.8);
+    transition: 100ms ease-out;
+    width: 30px;
+    height: 30px;
+    font-size: 11px;
+  }
 
 
-.fc .fc-helpButton-button:hover {
+  .fc .fc-helpButton-button:hover {
-  background-color: rgba(20, 20, 20, 0.6);
+    background-color: rgba(20, 20, 20, 0.6);
+  }
 }
 
 .tooltip.calendar-copy-tooltip {

com/static/com/css/news-list.scss

@@ -84,6 +84,7 @@
     font-size: 85%;
 
     #links_content {
+      overflow: auto;
       box-shadow: $shadow-color 1px 1px 1px;
       min-height: 20em;
       padding: 1em;

com/templates/com/news_list.jinja

@@ -1,11 +1,9 @@
 {% extends "core/base.jinja" %}
 {% from "com/macros.jinja" import news_moderation_alert %}
 
-{% block title %}AE UTBM{% endblock %}
-
 {% block additional_css %}
   <link rel="stylesheet" href="{{ static('com/css/news-list.scss') }}">
-  <link rel="stylesheet" href="{{ static('core/components/calendar.scss') }}">
+  <link rel="stylesheet" href="{{ static('com/components/ics-calendar.scss') }}">
 
   {# Atom feed discovery, not really css but also goes there #}
   <link rel="alternate" type="application/rss+xml" title="{% trans %}News feed{% endtrans %}" href="{{ url("com:news_feed") }}">
@@ -215,12 +213,6 @@
               <i class="fa-solid fa-magnifying-glass fa-xl"></i>
               <a href="{{ url("matmat:search") }}">{% trans %}Matmatronch{% endtrans %}</a>
             </li>
-            {% if user.has_perm("reservation.view_reservationslot") %}
-              <li>
-                <i class="fa-solid fa-thumbtack fa-xl"></i>
-                <a href="{{ url("reservation:main") }}">{% trans %}Room reservation{% endtrans %}</a>
-              </li>
-            {% endif %}
             <li>
               <i class="fa-solid fa-check-to-slot fa-xl"></i>
               <a href="{{ url("election:list") }}">{% trans %}Elections{% endtrans %}</a>

com/views.py

@@ -170,7 +170,7 @@ class NewsUpdateView(PermissionOrAuthorRequiredMixin, UpdateView):
     form_class = NewsForm
     template_name = "com/news_edit.jinja"
     pk_url_kwarg = "news_id"
-    permission_required = "com.edit_news"
+    permission_required = "com.change_news"
 
     def form_valid(self, form):
         response = super().form_valid(form)  # Does the saving part

core/management/commands/populate.py

@@ -20,7 +20,7 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
-from datetime import date, timedelta
+from datetime import date, datetime, timedelta
 from io import StringIO
 from pathlib import Path
 from typing import ClassVar, NamedTuple
@@ -33,7 +33,8 @@ from django.core.management.base import BaseCommand
 from django.db import connection
 from django.db.models import Q
 from django.utils import timezone
-from django.utils.timezone import localdate
+from django.utils.lorem_ipsum import paragraphs
+from django.utils.timezone import localdate, now
 from PIL import Image
 
 from club.models import Club, ClubLink, ClubRole, LinkType, Membership
@@ -43,13 +44,14 @@ from core.models import BanGroup, Group, Page, PageRev, SithFile, User
 from core.utils import resize_image
 from counter.models import (
     Counter,
+    CounterSellers,
     Price,
     Product,
     ProductType,
     ReturnableProduct,
     StudentCard,
 )
-from election.models import Candidature, Election, ElectionList, Role
+from election.models import Candidature, Election, ElectionList, Role, Vote
 from forum.models import Forum
 from pedagogy.models import UE
 from sas.models import Album, PeoplePictureRelation, Picture
@@ -364,62 +366,15 @@ class Command(BaseCommand):
         Counter.objects.create(name="Carte AE", club=clubs.refound, type="OFFICE")
 
         # Add barman to counter
-        Counter.sellers.through.objects.bulk_create(
+        CounterSellers.objects.bulk_create(
             [
-                Counter.sellers.through(counter_id=1, user=skia),  # MDE
+                CounterSellers(counter_id=1, user=skia, is_regular=True),  # MDE
-                Counter.sellers.through(counter_id=2, user=krophil),  # Foyer
+                CounterSellers(counter_id=2, user=krophil, is_regular=True),  # Foyer
             ]
         )
 
         # Create an election
-        el = Election.objects.create(
+        self._create_elections(groups, clubs, skia, sli, krophil)
-            title="Élection 2017",
-            description="La roue tourne",
-            start_candidature="1942-06-12 10:28:45+01",
-            end_candidature="2042-06-12 10:28:45+01",
-            start_date="1942-06-12 10:28:45+01",
-            end_date="7942-06-12 10:28:45+01",
-        )
-        el.view_groups.add(groups.public)
-        el.edit_groups.add(clubs.ae.board_group)
-        el.candidature_groups.add(groups.subscribers)
-        el.vote_groups.add(groups.subscribers)
-        liste = ElectionList.objects.create(title="Candidature Libre", election=el)
-        listeT = ElectionList.objects.create(title="Troll", election=el)
-        pres = Role.objects.create(
-            election=el, title="Président AE", description="Roi de l'AE"
-        )
-        resp = Role.objects.create(
-            election=el, title="Co Respo Info", max_choice=2, description="Ghetto++"
-        )
-        Candidature.objects.bulk_create(
-            [
-                Candidature(
-                    role=resp,
-                    user=skia,
-                    election_list=liste,
-                    program="Refesons le site AE",
-                ),
-                Candidature(
-                    role=resp,
-                    user=sli,
-                    election_list=liste,
-                    program="Vasy je deviens mon propre adjoint",
-                ),
-                Candidature(
-                    role=resp,
-                    user=krophil,
-                    election_list=listeT,
-                    program="Le Pôle Troll !",
-                ),
-                Candidature(
-                    role=pres,
-                    user=sli,
-                    election_list=listeT,
-                    program="En fait j'aime pas l'info, je voulais faire GMC",
-                ),
-            ]
-        )
 
         # Forum
         room = Forum.objects.create(
@@ -892,11 +847,7 @@ class Command(BaseCommand):
 
         subscribers = Group.objects.create(name="Cotisants")
         subscribers.permissions.add(
-            *list(
+            *list(perms.filter(codename__in=["add_news", "add_uecomment"]))
-                perms.filter(
-                    codename__in=["add_news", "add_uecomment", "view_reservationslot"]
-                )
-            )
         )
         old_subscribers = Group.objects.create(name="Anciens cotisants")
         old_subscribers.permissions.add(
@@ -1014,3 +965,132 @@ class Command(BaseCommand):
         BanGroup.objects.create(name="Banned from buying alcohol", description="")
         BanGroup.objects.create(name="Banned from counters", description="")
         BanGroup.objects.create(name="Banned to subscribe", description="")
+
+    def _create_elections(
+        self,
+        groups: PopulatedGroups,
+        clubs: PopulatedClubs,
+        skia: User,
+        sli: User,
+        krophil: User,
+    ):
+        """Populate elections.
+
+        4 elections are created :
+
+        - one that has not started yet,
+        - one on the candidature period
+        - one on the vote period
+        - one that is finished
+
+        All elections have two lists, are linked to the AE and Troll clubs,
+        and have one role for each board role of thos two clubs, plus
+        an additional role linked to no club roles.
+
+        The ongoing vote and finished elections have candidates.
+
+        The finished election has 10 voters.
+        """
+
+        def election_factory(title: str, start_candidature: datetime):
+            return Election(
+                title=title,
+                description="",
+                start_candidature=start_candidature,
+                end_candidature=start_candidature + timedelta(days=7),
+                start_date=start_candidature + timedelta(days=7),
+                end_date=start_candidature + timedelta(days=14),
+            )
+
+        # create the elections
+        elections = Election.objects.bulk_create(
+            [
+                election_factory("Election terminée", now() - timedelta(days=14)),
+                election_factory("Votes en cours", now() - timedelta(days=7)),
+                election_factory("Candidatures en cours", now()),
+                election_factory("Election à venir", now() + timedelta(days=7)),
+            ]
+        )
+        finished, ongoing_vote, _ongoing_candidature, _not_started = elections
+
+        # set the groups (all elections have the same groups)
+        groups.public.viewable_elections.set(elections)
+        clubs.ae.board_group.editable_elections.set(elections)
+        groups.subscribers.candidate_elections.set(elections)
+        groups.subscribers.votable_elections.set(elections)
+
+        # link elections to clubs (AE and Troll for all elections)
+        Election.clubs.through.objects.bulk_create(
+            [
+                *[Election.clubs.through(club=clubs.ae, election=e) for e in elections],
+                *[
+                    Election.clubs.through(club=clubs.troll, election=e)
+                    for e in elections
+                ],
+            ]
+        )
+
+        # Create lists (all elections have two lists)
+        ElectionList.objects.bulk_create(
+            [
+                *[ElectionList(title="Candidat libre", election=e) for e in elections],
+                *[ElectionList(title="Troll", election=e) for e in elections],
+            ]
+        )
+
+        # Create roles.
+        # Elections have a role for each board club role of AE and Troll,
+        # +an additional role linked to no club role
+        club_roles = list(
+            ClubRole.objects.filter(club__in=[clubs.ae, clubs.troll], is_board=True)
+            .select_related("club")
+            .order_by("club_id", "order")
+        )
+        Role.objects.bulk_create(
+            [
+                *[
+                    Role(election=e, title=f"{r.name} {r.club.name}", club_role=r)
+                    for r in club_roles
+                    for e in elections
+                ],
+                *[Role(election=e, title="Rôle libre") for e in elections],
+            ]
+        )
+
+        # create candidatures for ongoing_vote and finished elections
+        candidatures = []
+        lipsum = "\n\n".join(paragraphs(2))
+        for election in ongoing_vote, finished:
+            lists = list(election.election_lists.order_by("id"))
+            roles = list(election.roles.order_by("order")[:3])
+            candidatures.extend(
+                [
+                    Candidature(
+                        role=roles[0], user=skia, election_list=lists[0], program=lipsum
+                    ),
+                    Candidature(
+                        role=roles[1], user=sli, election_list=lists[0], program=lipsum
+                    ),
+                    Candidature(
+                        role=roles[2], user=krophil, election_list=lists[1], program=""
+                    ),
+                    Candidature(
+                        role=roles[2], user=sli, election_list=lists[0], program=lipsum
+                    ),
+                ]
+            )
+        candidatures = Candidature.objects.bulk_create(candidatures)
+
+        skia, sli_vp, krophil, sli_treso = candidatures[4:]  # candidates of finished
+        votes = Vote.objects.bulk_create(
+            [
+                *[Vote(role=skia.role) for _ in range(6)],
+                *[Vote(role=sli_vp.role) for _ in range(8)],
+                *[Vote(role=krophil.role) for _ in range(9)],
+            ]
+        )
+        skia.votes.set(votes[:6])
+        sli_vp.votes.set(votes[6:14])
+        krophil.votes.set(votes[14:20])
+        sli_treso.votes.set(votes[20:23])
+        finished.voters.set(list(User.objects.all()[:10]))

core/management/commands/populate_more.py

@@ -1,7 +1,6 @@
 import random
 from datetime import date, timedelta
 from datetime import timezone as tz
-from math import ceil
 from typing import Iterator
 
 from dateutil.relativedelta import relativedelta
@@ -26,7 +25,6 @@ from counter.models import (
 )
 from forum.models import Forum, ForumMessage, ForumTopic
 from pedagogy.models import UE
-from reservation.models import ReservationSlot, Room
 from subscription.models import Subscription
 
 
@@ -44,20 +42,45 @@ class Command(BaseCommand):
         self.stdout.write("Creating users...")
         users = self.create_users()
         self.create_bans(random.sample(users, k=len(users) // 200))  # 0.5% of users
-        # len(subscribers) is approximately 480
         subscribers = random.sample(users, k=int(0.8 * len(users)))
         self.stdout.write("Creating subscriptions...")
         self.create_subscriptions(subscribers)
         self.stdout.write("Creating club memberships...")
-        self.create_club_memberships(subscribers)
+        users_qs = User.objects.filter(id__in=[s.id for s in subscribers])
-        self.stdout.write("Creating rooms and reservation...")
+        subscribers_now = list(
-        self.create_resources_and_reservations(random.sample(subscribers, k=40))
+            users_qs.annotate(
+                filter=Exists(
+                    Subscription.objects.filter(
+                        member_id=OuterRef("pk"), subscription_end__gte=now()
+                    )
+                )
+            )
+        )
+        old_subscribers = list(
+            users_qs.annotate(
+                filter=Exists(
+                    Subscription.objects.filter(
+                        member_id=OuterRef("pk"), subscription_end__lt=now()
+                    )
+                )
+            )
+        )
+        self.make_club(
+            Club.objects.get(id=settings.SITH_MAIN_CLUB_ID),
+            random.sample(subscribers_now, k=min(30, len(subscribers_now))),
+            random.sample(old_subscribers, k=min(60, len(old_subscribers))),
+        )
+        self.make_club(
+            Club.objects.get(name="Troll Penché"),
+            random.sample(subscribers_now, k=min(20, len(subscribers_now))),
+            random.sample(old_subscribers, k=min(80, len(old_subscribers))),
+        )
         self.stdout.write("Creating uvs...")
         self.create_ues()
         self.stdout.write("Creating products...")
         self.create_products()
         self.stdout.write("Creating sales and refills...")
-        sellers = list(User.objects.order_by("?")[:100])
+        sellers = random.sample(list(User.objects.all()), 100)
         self.create_sales(sellers)
         self.stdout.write("Creating permanences...")
         self.create_permanences(sellers)
@@ -192,97 +215,6 @@ class Command(BaseCommand):
         memberships = Membership.objects.bulk_create(memberships)
         Membership._add_club_groups(memberships)
 
-    def create_club_memberships(self, users: list[User]):
-        users_qs = User.objects.filter(id__in=[s.id for s in users])
-        subscribers_now = list(
-            users_qs.annotate(
-                filter=Exists(
-                    Subscription.objects.filter(
-                        member_id=OuterRef("pk"), subscription_end__gte=now()
-                    )
-                )
-            )
-        )
-        old_subscribers = list(
-            users_qs.annotate(
-                filter=Exists(
-                    Subscription.objects.filter(
-                        member_id=OuterRef("pk"), subscription_end__lt=now()
-                    )
-                )
-            )
-        )
-        self.make_club(
-            Club.objects.get(id=settings.SITH_MAIN_CLUB_ID),
-            random.sample(subscribers_now, k=min(30, len(subscribers_now))),
-            random.sample(old_subscribers, k=min(60, len(old_subscribers))),
-        )
-        self.make_club(
-            Club.objects.get(name="Troll Penché"),
-            random.sample(subscribers_now, k=min(20, len(subscribers_now))),
-            random.sample(old_subscribers, k=min(80, len(old_subscribers))),
-        )
-
-    def create_resources_and_reservations(self, users: list[User]):
-        """Generate reservable rooms and reservations slots for those rooms.
-
-        Contrary to the other data generator,
-        this one generates more data than what is expected on the real db.
-        """
-        ae = Club.objects.get(id=settings.SITH_MAIN_CLUB_ID)
-        pdf = Club.objects.get(id=settings.SITH_PDF_CLUB_ID)
-        troll = Club.objects.get(name="Troll Penché")
-        rooms = [
-            Room(
-                name=name,
-                club=club,
-                location=location,
-                description=self.faker.text(100),
-            )
-            for name, club, location in [
-                ("Champi", ae, "BELFORT"),
-                ("Muzik", ae, "BELFORT"),
-                ("Pôle Tech", ae, "BELFORT"),
-                ("Jolly", troll, "BELFORT"),
-                ("Cookut", pdf, "BELFORT"),
-                ("Lucky", pdf, "BELFORT"),
-                ("Potards", pdf, "SEVENANS"),
-                ("Bureau AE", ae, "SEVENANS"),
-            ]
-        ]
-        rooms = Room.objects.bulk_create(rooms)
-        reservations = []
-        for room in rooms:
-            # how much people use this room.
-            # The higher the number, the more reservations exist,
-            # the smaller the interval between two slot is,
-            # and the more future reservations have already been made ahead of time
-            affluence = random.randint(2, 6)
-            slot_start = make_aware(self.faker.past_datetime("-5y").replace(minute=0))
-            generate_until = make_aware(
-                self.faker.future_datetime(timedelta(days=1) * affluence**2)
-            )
-            while slot_start < generate_until:
-                if slot_start.hour < 8:
-                    # if a reservation would start in the middle of the night
-                    # make it start the next morning instead
-                    slot_start += timedelta(hours=10 - slot_start.hour)
-                duration = timedelta(minutes=15) * (1 + int(random.gammavariate(3, 2)))
-                reservations.append(
-                    ReservationSlot(
-                        room=room,
-                        author=random.choice(users),
-                        start_at=slot_start,
-                        end_at=slot_start + duration,
-                        created_at=slot_start - self.faker.time_delta("+7d"),
-                    )
-                )
-                slot_start += duration + (
-                    timedelta(minutes=15) * ceil(random.expovariate(affluence / 192))
-                )
-        reservations.sort(key=lambda slot: slot.created_at)
-        ReservationSlot.objects.bulk_create(reservations)
-
     def create_ues(self):
         root = User.objects.get(username="root")
         categories = ["CS", "TM", "OM", "QC", "EC"]
@@ -483,7 +415,7 @@ class Command(BaseCommand):
         Permanency.objects.bulk_create(perms)
 
     def create_forums(self):
-        forumers = list(User.objects.order_by("?")[:100])
+        forumers = random.sample(list(User.objects.all()), 100)
         most_actives = random.sample(forumers, 10)
         categories = list(Forum.objects.filter(is_category=True))
         new_forums = [
@@ -501,7 +433,7 @@ class Command(BaseCommand):
             for _ in range(100)
         ]
         ForumTopic.objects.bulk_create(new_topics)
-        topics = list(ForumTopic.objects.values_list("id", flat=True))
+        topics = list(ForumTopic.objects.all())
 
         def get_author():
             if random.random() > 0.5:
@@ -509,7 +441,7 @@ class Command(BaseCommand):
             return random.choice(forumers)
 
         messages = []
-        for topic_id in topics:
+        for t in topics:
             nb_messages = max(1, int(random.normalvariate(mu=90, sigma=50)))
             dates = sorted(
                 [
@@ -521,7 +453,7 @@ class Command(BaseCommand):
             messages.extend(
                 [
                     ForumMessage(
-                        topic_id=topic_id,
+                        topic=t,
                         author=get_author(),
                         date=d,
                         message="\n\n".join(

core/static/bundled/base-bundle-index.ts

@@ -6,12 +6,10 @@
  * for more efficient tree-shaking and gzip compression.
  */
 
-import { morph } from "@alpinejs/morph";
 import sort from "@alpinejs/sort";
 import Alpine from "alpinejs";
 import { polyfillCountryFlagEmojis } from "country-flag-emoji-polyfill";
 import htmx from "htmx.org";
-import "htmx-ext-alpine-morph";
 import { limitedChoices } from "#core:alpine/limited-choices";
 import { expireOldStorage } from "#core:core/localstorage";
 import { default as navbar } from "#core:core/navbar";
@@ -29,7 +27,7 @@ declare module "alpinejs" {
   }
 }
 
-Alpine.plugin([sort, limitedChoices, morph, notifications]);
+Alpine.plugin([sort, limitedChoices, notifications]);
 // biome-ignore lint/style/useNamingConvention: it's how it's named
 Object.assign(window, { Alpine });
 

core/static/core/accordion.scss

@@ -46,6 +46,10 @@ details.accordion>.accordion-content {
   border-bottom-right-radius: 3px;
   border-bottom-left-radius: 3px;
   overflow: hidden;
+
+  @media screen and (max-width: 600px) {
+    padding: .75em 1.5em;
+  }
 }
 
 @mixin animation($selector) {

core/static/core/components/card.scss

@@ -16,13 +16,6 @@
   }
 }
 
-.card-group {
-  display: flex;
-  gap: 15px;
-  margin-bottom: 30px;
-  flex-wrap: wrap;
-}
-
 .card {
   background-color: $primary-neutral-light-color;
   border-radius: 5px;
@@ -36,7 +29,12 @@
   align-items: center;
   gap: 20px;
 
-  &.clickable:hover {
+  &:disabled {
+    background-color: darken($primary-neutral-light-color, 5%);
+    opacity: 65%;
+  }
+
+  &.clickable:not(:disabled):hover {
     background-color: darken($primary-neutral-light-color, 5%);
   }
 
@@ -99,23 +97,13 @@
   }
 
   @media screen and (max-width: 765px) {
-    @include row-layout;
+    @include row-layout
   }
 
   // When combined with card, card-row display the card in a row layout,
   // whatever the size of the screen.
   &.card-row {
-    @include row-layout;
+    @include row-layout
-
-    &.card-row-m {
-      //width: 50%;
-      max-width: 50%;
-    }
-
-    &.card-row-s {
-      //width: 33%;
-      max-width: 33%;
-    }
   }
 }
 

core/static/core/forms.scss

@@ -23,7 +23,7 @@
     border-radius: 5px;
     color: black;
 
-    &:hover {
+    &:not(.link-like):not(:disabled):hover {
       background: hsl(0, 0%, 83%);
     }
   }
@@ -141,7 +141,6 @@ form {
   display: block;
   margin: calc(var(--nf-input-size) * 1.5) auto 10px;
   line-height: 1;
-  white-space: nowrap;
 
   .fields-centered {
     padding: 10px 10px 0;

core/static/core/header.scss

@@ -123,7 +123,7 @@ $background-color-hovered: #283747;
       justify-content: center;
     }
 
-    >.button {
+    a.button {
       box-sizing: border-box;
       height: 35px;
       background-color: transparent;
@@ -139,7 +139,7 @@ $background-color-hovered: #283747;
       font-size: .9em;
       width: 120px;
 
-      &:hover {
+      &:not(.link-like):not(:disabled):hover {
         background-color: $background-color-hovered;
       }
     }

core/static/core/tooltips.scss

@@ -10,9 +10,10 @@
   border-radius: 5px;
   padding: 5px 10px;
   position: absolute;
+  white-space: nowrap;
   opacity: 0;
   transition: opacity 500ms ease-out;
-  width: max-content;
+
   white-space: normal;
 
   left: 0;

core/templates/core/base/header.jinja

@@ -22,14 +22,9 @@
         </form>
         <ul class="bars">
           {% cache 100 "counters_activity" %}
-                      {# The sith has no periodic tasks manager
+            {# It would be cleaner to handle the timeout with django-celery-beat,
-                         and using cron jobs would be way too overkill here.
+               but doing it here is simpler and less error-prone #}
-                         Thus the barmen timeout is handled in the only place that
+            {% do Counter.objects.filter(type="BAR").handle_timeout() %}
-                         is loaded on every page : the header bar.
-                         However, let's be clear : this has nothing to do here.
-                         It's' merely a contrived workaround that should
-                         replaced by a proper task manager as soon as possible. #}
-            {% set _ = Counter.objects.filter(type="BAR").handle_timeout() %}
           {% endcache %}
           {% for bar in Counter.objects.annotate_has_barman(user).annotate_is_open().filter(type="BAR") %}
             <li>

core/templates/core/base/notifications.jinja

@@ -10,7 +10,7 @@
   <template x-for="(message, index) in $notifications.getAll()">
     <div class="alert" :class="`alert-${message.tag}`" x-transition>
       <span class="alert-main" x-text="message.text"></span>
-      <span class="clickable" @click="messages = messages.filter((item, i) => i !== index)">
+      <span class="clickable" @click="$store.notifications = $store.notifications.filter((item, i) => i !== index)">
         <i class="fa fa-close"></i>
       </span>
     </div>

core/tests/test_user.py

@@ -200,7 +200,11 @@ class TestFilterInactive(TestCase):
         ]
         sale_recipe.make(customer=cls.users[3].customer, date=time_active)
         baker.make(
-            Refilling, customer=cls.users[4].customer, date=time_active, counter=counter
+            Refilling,
+            customer=cls.users[4].customer,
+            date=time_active,
+            counter=counter,
+            amount=1,
         )
         sale_recipe.make(customer=cls.users[5].customer, date=time_inactive)
 
@@ -455,7 +459,9 @@ def test_user_preferences(client: Client):
 @pytest.mark.django_db
 def test_user_stats(client: Client):
     user = subscriber_user.make()
-    baker.make(Refilling, customer=user.customer, amount=99999)
+    baker.make(
+        Refilling, customer=user.customer, amount=settings.SITH_ACCOUNT_MAX_MONEY
+    )
     bars = [b[0] for b in settings.SITH_COUNTER_BARS]
     baker.make(
         Permanency,

core/views/forms.py

@@ -40,8 +40,9 @@ from django.forms import (
     DateInput,
     DateTimeInput,
     TextInput,
+    Widget,
 )
-from django.utils.timezone import localtime, now
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from phonenumber_field.widgets import RegionalPhoneNumberWidget
 from PIL import Image
@@ -100,8 +101,8 @@ class FutureDateTimeField(forms.DateTimeField):
 
     default_validators = [validate_future_timestamp]
 
-    def widget_attrs(self, widget: forms.Widget) -> dict[str, str]:
+    def widget_attrs(self, widget: Widget) -> dict[str, str]:
-        return {"min": widget.format_value(localtime())}
+        return {"min": widget.format_value(now())}
 
 
 # Forms

core/views/mixins.py

@@ -78,7 +78,7 @@ class FragmentMixin(TemplateResponseMixin, AllowFragment, ContextMixin):
             return render(
                 request,
                 "app/template.jinja",
-                context={"fragment": fragment(request)}
+                context={"fragment": fragment(request)
             }
 
         # in urls.py

counter/fields.py

@@ -1,22 +1,68 @@
 from decimal import Decimal
 
 from django.conf import settings
+from django.core import checks
+from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db import models
+from django.utils.functional import cached_property
 
 
 class CurrencyField(models.DecimalField):
     """Custom database field used for currency."""
 
-    def __init__(self, *args, **kwargs):
+    def __init__(
-        kwargs["max_digits"] = 12
+        self, verbose_name=None, name=None, min_value=None, max_value=None, **kwargs
-        kwargs["decimal_places"] = 2
+    ):
-        super().__init__(*args, **kwargs)
+        kwargs.update({"max_digits": 12, "decimal_places": 2})
+        self.min_value = min_value
+        self.max_value = max_value
+        super().__init__(verbose_name, name, **kwargs)
 
     def to_python(self, value):
         if value is None:
             return None
         return super().to_python(value).quantize(Decimal("0.01"))
 
+    @cached_property
+    def validators(self):
+        res = []
+        if self.max_value:
+            res.append(MaxValueValidator(self.max_value))
+        if self.min_value:
+            res.append(MinValueValidator(self.min_value))
+        return [*super().validators, *res]
+
+    def check(self, **kwargs):  # pragma: no cover
+        # this is executed during runserver, but won't run in prod
+        errors = super().check(**kwargs)
+        for name, val in ("min_value", self.min_value), ("max_value", self.max_value):
+            if not val:
+                continue
+            try:
+                float(val)
+            except ValueError:
+                errors.append(
+                    checks.Error(
+                        f"CurrencyField.{name} must be a valid float",
+                        obj=self,
+                        id="sith.E001",
+                    )
+                )
+        return errors
+
+    def formfield(self, **kwargs):
+        return super().formfield(
+            **{"min_value": self.min_value, "max_value": self.max_value, **kwargs}
+        )
+
+    def deconstruct(self):
+        name, path, args, kwargs = super().deconstruct()
+        if self.min_value is not None:
+            kwargs["min_value"] = self.min_value
+        if self.max_value is not None:
+            kwargs["max_value"] = self.max_value
+        return name, path, args, kwargs
+
 
 if settings.TESTING:
     from model_bakery import baker

counter/forms.py

@@ -3,12 +3,16 @@ import math
 import uuid
 from collections import defaultdict
 from datetime import date, datetime, timezone
+from typing import ClassVar
 
 from dateutil.relativedelta import relativedelta
 from django import forms
+from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.db.models import Exists, OuterRef, Q
 from django.forms import BaseModelFormSet
+from django.http import HttpRequest
+from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_celery_beat.models import ClockedSchedule
@@ -17,6 +21,7 @@ from phonenumber_field.widgets import RegionalPhoneNumberWidget
 from club.models import Club
 from club.widgets.ajax_select import AutoCompleteSelectClub
 from core.models import User, UserQuerySet
+from core.views import LoginForm
 from core.views.forms import (
     FutureDateTimeField,
     NFCTextInput,
@@ -91,30 +96,18 @@ class StudentCardForm(forms.ModelForm):
 
 
 class GetUserForm(forms.Form):
-    """The Form class aims at providing a valid user_id field in its cleaned data, in order to pass it to some view,
+    """Find a user to show its click page."""
-    reverse function, or any other use.
-
-    The Form implements a nice JS widget allowing the user to type a customer account id, or search the database with
-    some nickname, first name, or last name (TODO)
-    """
 
     code = forms.CharField(
         label="Code",
         max_length=StudentCard.UID_SIZE,
         required=False,
-        widget=NFCTextInput,
+        widget=NFCTextInput(attrs={"autofocus": True}),
     )
     id = forms.CharField(
-        label=_("Select user"),
+        label=_("Select user"), widget=AutoCompleteSelectUser, required=False
-        help_text=None,
-        widget=AutoCompleteSelectUser,
-        required=False,
     )
 
-    def as_p(self):
-        self.fields["code"].widget.attrs["autofocus"] = True
-        return super().as_p()
-
     def clean(self):
         cleaned_data = super().clean()
         customer = None
@@ -136,11 +129,40 @@ class GetUserForm(forms.Form):
 
         if customer is None or not customer.can_buy:
             raise forms.ValidationError(_("User not found"))
-        cleaned_data["user_id"] = customer.user.id
+        cleaned_data["user_id"] = customer.user_id
         cleaned_data["user"] = customer.user
         return cleaned_data
 
 
+class CounterLoginForm(LoginForm):
+    """LoginForm to log a barman in a counter.
+
+    To be able to log in a counter, a user must :
+
+    - be part of the sellers of the given counter
+    - not being already logged in any counter
+    """
+
+    def __init__(self, *args, request: HttpRequest, counter: Counter, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.counter = counter
+        self.request = request
+
+    def confirm_login_allowed(self, user: User):
+        super().confirm_login_allowed(user)
+        if not self.counter.sellers.contains(user):
+            raise ValidationError(
+                message=_("You are not a barman of this counter."), code="not_barman"
+            )
+        if user in self.request.barmen:
+            message = (
+                _("You are already logged in this counter.")
+                if user in self.counter.barmen_list
+                else _("You are already logged in another counter.")
+            )
+            raise ValidationError(message=message, code="already_logged_in")
+
+
 class RefillForm(forms.ModelForm):
     allowed_refilling_methods = [
         Refilling.PaymentMethod.CASH,
@@ -149,18 +171,19 @@ class RefillForm(forms.ModelForm):
 
     error_css_class = "error"
     required_css_class = "required"
-    amount = forms.FloatField(
-        min_value=0, widget=forms.NumberInput(attrs={"class": "focus"})
-    )
 
     class Meta:
         model = Refilling
         fields = ["amount", "payment_method"]
         widgets = {"payment_method": forms.RadioSelect}
 
-    def __init__(self, *args, **kwargs):
+    def __init__(
+        self, *args, counter: Counter, operator: User, customer: Customer, **kwargs
+    ):
         super().__init__(*args, **kwargs)
-
+        max_value = settings.SITH_ACCOUNT_MAX_MONEY - customer.amount
+        # server-side max_value validation is done by Refilling.clean
+        self.fields["amount"].widget.attrs["max"] = max_value
         self.fields["payment_method"].choices = (
             method
             for method in self.fields["payment_method"].choices
@@ -168,6 +191,9 @@ class RefillForm(forms.ModelForm):
         )
         if self.fields["payment_method"].initial not in self.allowed_refilling_methods:
             self.fields["payment_method"].initial = self.allowed_refilling_methods[0]
+        self.instance.counter = counter
+        self.instance.operator = operator
+        self.instance.customer = customer
 
 
 class CounterEditForm(forms.ModelForm):
@@ -409,6 +435,7 @@ class ProductForm(forms.ModelForm):
             "club",
             "limit_age",
             "tray",
+            "clic_limit",
             "archived",
         ]
         help_texts = {
@@ -540,16 +567,7 @@ class BasketItemForm(forms.Form):
     quantity = forms.IntegerField(min_value=1, required=True)
     price_id = forms.IntegerField(min_value=0, required=True)
 
-    def __init__(
+    def __init__(self, allowed_prices: dict[int, Price], *args, **kwargs):
-        self,
-        customer: Customer,
-        counter: Counter,
-        allowed_prices: dict[int, Price],
-        *args,
-        **kwargs,
-    ):
-        self.customer = customer  # Used by formset
-        self.counter = counter  # Used by formset
         self.allowed_prices = allowed_prices
         super().__init__(*args, **kwargs)
 
@@ -584,6 +602,15 @@ class BasketItemForm(forms.Form):
 
 
 class BaseBasketForm(forms.BaseFormSet):
+    # Minimum amount of money there must be on the account after the transaction
+    # If None, the min balance check is skipped
+    min_result_balance: ClassVar[int | None] = 0
+
+    def __init__(self, *args, customer: Customer, counter: Counter, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.customer = customer
+        self.counter = counter
+
     def clean(self):
         self.forms = [form for form in self.forms if form.cleaned_data != {}]
 
@@ -592,8 +619,8 @@ class BaseBasketForm(forms.BaseFormSet):
 
         self._check_forms_have_errors()
         self._check_product_are_unique()
-        self._check_recorded_products(self[0].customer)
+        self._check_recorded_products()
-        self._check_enough_money(self[0].counter, self[0].customer)
+        self._check_account_balance()
 
     def _check_forms_have_errors(self):
         if any(len(form.errors) > 0 for form in self):
@@ -604,12 +631,35 @@ class BaseBasketForm(forms.BaseFormSet):
         if len(price_ids) != len(self.forms):
             raise forms.ValidationError(_("Duplicated product entries."))
 
-    def _check_enough_money(self, counter: Counter, customer: Customer):
+    @cached_property
-        self.total_price = sum([data["total_price"] for data in self.cleaned_data])
+    def total_price(self):
-        if self.total_price > customer.amount:
+        refill = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING
-            raise forms.ValidationError(_("Not enough money"))
+        total_other = sum(
+            form.cleaned_data["total_price"]
+            for form in self.forms
+            if form.price.product.product_type_id != refill
+        )
+        total_refill = sum(
+            form.cleaned_data["total_price"]
+            for form in self.forms
+            if form.price.product.product_type_id == refill
+        )
+        return total_other - total_refill
 
-    def _check_recorded_products(self, customer: Customer):
+    def _check_account_balance(self):
+        result_balance = self.customer.amount - self.total_price
+        if (
+            self.min_result_balance is not None
+            and self.min_result_balance > result_balance
+        ):
+            raise forms.ValidationError(_("Not enough money"))
+        if result_balance > settings.SITH_ACCOUNT_MAX_MONEY:
+            raise ValidationError(
+                _("There cannot be more than %(money)d€ on an AE account")
+                % {"money": settings.SITH_ACCOUNT_MAX_MONEY}
+            )
+
+    def _check_recorded_products(self):
         """Check for, among other things, ecocups and pitchers"""
         items = defaultdict(int)
         for form in self.forms:
@@ -618,7 +668,7 @@ class BaseBasketForm(forms.BaseFormSet):
         returnables = list(
             ReturnableProduct.objects.filter(
                 Q(product_id__in=ids) | Q(returned_product_id__in=ids)
-            ).annotate_balance_for(customer)
+            ).annotate_balance_for(self.customer)
         )
         limit_reached = []
         for returnable in returnables:

counter/middleware.py

@@ -0,0 +1,64 @@
+from typing import TYPE_CHECKING, Callable
+
+from django.db.models import Exists, OuterRef
+from django.http import HttpRequest, HttpResponse
+from django.utils.functional import SimpleLazyObject, empty
+
+from core.models import User
+from counter.models import Permanency
+
+if TYPE_CHECKING:
+    from django.contrib.sessions.backends.base import SessionBase
+
+
+SESSION_BARMEN_KEY = "barmen_ids"
+
+
+def get_cached_barmen(request: HttpRequest) -> set[User]:
+    if not hasattr(request, "_cached_barmen"):
+        session: SessionBase = request.session
+        barmen_ids = session.get(SESSION_BARMEN_KEY, [])
+        if barmen_ids:
+            request._cached_barmen = set(
+                User.objects.filter(
+                    Exists(Permanency.objects.filter(user=OuterRef("pk"), end=None)),
+                    id__in=barmen_ids,
+                )
+            )
+        else:
+            request._cached_barmen = set()
+
+    return request._cached_barmen
+
+
+class BarmenMiddleware:
+    """Inject barmen logged in the current session.
+
+    In a similar fashion as `request.user`, `request.barmen` contains
+    users that are barmen in the current session, and ONLY them ;
+    if a user is logged as a barman on another session,
+    it will not be in `request.barmen`.
+
+    Notes:
+        In case of ended permanence, users will be automatically
+        removed from `request.barmen`.
+        However, in case of newly started permanence, this middleware
+        cannot add new barmen in the session data, so that operation
+        must be explicitly done in the barman login view.
+    """
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest):
+        request.barmen = SimpleLazyObject(lambda: get_cached_barmen(request))
+
+        response = self.get_response(request)
+
+        if request.barmen._wrapped is not empty and {
+            b.id for b in request.barmen
+        } != set(request.session.get(SESSION_BARMEN_KEY, [])):
+            # update the session data only if `session.barmen`
+            # has been accessed and modified.
+            request.session[SESSION_BARMEN_KEY] = [b.id for b in request.barmen]
+        return response

counter/migrations/0040_product_clic_limit.py

@@ -0,0 +1,25 @@
+# Generated by Django 5.2.13 on 2026-05-13 11:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0039_price")]
+
+    operations = [
+        migrations.RemoveField(model_name="product", name="buying_groups"),
+        migrations.AddField(
+            model_name="product",
+            name="clic_limit",
+            field=models.PositiveSmallIntegerField(
+                blank=True,
+                help_text=(
+                    "If a limit is set, the product won't be purchasable "
+                    "anymore on the eboutic once the latter is reached."
+                ),
+                null=True,
+                verbose_name="clic limit",
+            ),
+        ),
+        migrations.RemoveField(model_name="counter", name="token"),
+    ]

counter/migrations/0041_alter_billinginfo_country_and_more.py

@@ -0,0 +1,26 @@
+# Generated by Django 5.2.14 on 2026-06-02 10:45
+
+import django_countries.fields
+import phonenumber_field.modelfields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0040_product_clic_limit")]
+
+    operations = [
+        migrations.AlterField(
+            model_name="billinginfo",
+            name="country",
+            field=django_countries.fields.CountryField(
+                max_length=2, verbose_name="Country"
+            ),
+        ),
+        migrations.AlterField(
+            model_name="billinginfo",
+            name="phone_number",
+            field=phonenumber_field.modelfields.PhoneNumberField(
+                max_length=128, region=None, verbose_name="Phone number"
+            ),
+        ),
+    ]

counter/migrations/0042_alter_customer_amount_alter_refilling_amount.py

@@ -0,0 +1,30 @@
+# Generated by Django 5.2.15 on 2026-06-07 12:08
+
+from django.db import migrations
+
+import counter.fields
+
+
+class Migration(migrations.Migration):
+    dependencies = [("counter", "0041_alter_billinginfo_country_and_more")]
+
+    operations = [
+        migrations.AlterField(
+            model_name="customer",
+            name="amount",
+            field=counter.fields.CurrencyField(
+                decimal_places=2,
+                default=0,
+                max_digits=12,
+                max_value=250,
+                verbose_name="amount",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="refilling",
+            name="amount",
+            field=counter.fields.CurrencyField(
+                decimal_places=2, max_digits=12, min_value=0.01, verbose_name="amount"
+            ),
+        ),
+    ]

counter/models.py

@@ -22,18 +22,19 @@ import string
 from datetime import date, datetime, timedelta
 from datetime import timezone as tz
 from decimal import Decimal
-from typing import TYPE_CHECKING, Literal, Self
+from typing import Literal, Self
 
 from dict2xml import dict2xml
 from django.conf import settings
 from django.core.validators import MinLengthValidator
 from django.db import models
-from django.db.models import Exists, F, OuterRef, Q, QuerySet, Subquery, Sum, Value
+from django.db.models import Exists, F, Max, OuterRef, Q, QuerySet, Subquery, Sum, Value
 from django.db.models.functions import Coalesce, Concat, Length
 from django.forms import ValidationError
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_celery_beat.models import PeriodicTask
 from django_countries.fields import CountryField
@@ -47,9 +48,6 @@ from core.utils import get_start_of_semester
 from counter.fields import CurrencyField
 from subscription.models import Subscription
 
-if TYPE_CHECKING:
-    from collections.abc import Sequence
-
 
 def get_eboutic() -> Counter:
     return Counter.objects.filter(type="EBOUTIC").order_by("id").first()
@@ -101,7 +99,9 @@ class Customer(models.Model):
 
     user = models.OneToOneField(User, primary_key=True, on_delete=models.CASCADE)
     account_id = models.CharField(_("account id"), max_length=10, unique=True)
-    amount = CurrencyField(_("amount"), default=0)
+    amount: CurrencyField = CurrencyField(
+        _("amount"), max_value=settings.SITH_ACCOUNT_MAX_MONEY, default=0
+    )
 
     objects = CustomerQuerySet.as_manager()
 
@@ -158,13 +158,15 @@ class Customer(models.Model):
             unique_fields=["customer", "returnable"],
         )
 
-    @property
+    @cached_property
     def can_buy(self) -> bool:
         """Check if whether this customer has the right to purchase any item."""
-        subscription = self.user.subscriptions.order_by("subscription_end").last()
+        subscription_end = self.user.subscriptions.aggregate(
-        if subscription is None:
+            res=Max("subscription_end")
+        ).get("res")
+        if subscription_end is None:
             return False
-        return (date.today() - subscription.subscription_end) < timedelta(days=90)
+        return (date.today() - subscription_end) < timedelta(days=90)
 
     @classmethod
     def get_or_create(cls, user: User) -> tuple[Customer, bool]:
@@ -230,15 +232,8 @@ class BillingInfo(models.Model):
     address_2 = models.CharField(_("Address 2"), max_length=50, blank=True, null=True)
     zip_code = models.CharField(_("Zip code"), max_length=16)  # code postal
     city = models.CharField(_("City"), max_length=50)
-    country = CountryField(blank_label=_("Country"))
+    country = CountryField(_("Country"))
-
+    phone_number = PhoneNumberField(_("Phone number"))
-    # This table was created during the A22 semester.
-    # However, later on, CA asked for the phone number to be added to the billing info.
-    # As the table was already created, this new field had to be nullable,
-    # even tough it is required by the bank and shouldn't be null.
-    # If one day there is no null phone number remaining,
-    # please make the field non-nullable.
-    phone_number = PhoneNumberField(_("Phone number"), null=True, blank=False)
 
     def __str__(self):
         return f"{self.first_name} {self.last_name}"
@@ -353,6 +348,40 @@ class ProductType(OrderedModel):
         return user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID)
 
 
+class ProductQuerySet(models.QuerySet):
+    def under_clic_limit(self) -> Self:
+        """Filter product which clic limit isn't reached yet.
+
+        The clic limit is reached when the amount of sales
+        and of items in a basket for less than 15 minutes
+        is greater or equal than `Product.clic_limit`.
+        """
+        # import here to avoid circular import
+        from eboutic.models import BasketItem
+
+        nb_click_subquery = Subquery(
+            Selling.objects.filter(product_id=OuterRef("id"))
+            .values("product_id")
+            .annotate(res=Sum("quantity", default=0))
+            .values("res")[:1]
+        )
+        nb_basket_items_subquery = Subquery(
+            BasketItem.objects.filter(
+                product_id=OuterRef("id"),
+                basket__date__gt=now()
+                - settings.SITH_EBOUTIC_BASKET_TIMEOUT
+                - settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT,
+            )
+            .values("product_id")
+            .annotate(res=Sum("quantity"))
+            .values("res")[:1]
+        )
+        return self.annotate(
+            clicked=Coalesce(nb_click_subquery, 0),
+            reserved=Coalesce(nb_basket_items_subquery, 0),
+        ).filter(Q(clic_limit=None) | Q(clic_limit__gt=(F("clicked") + F("reserved"))))
+
+
 class Product(models.Model):
     """A product, with all its related information."""
 
@@ -370,8 +399,7 @@ class Product(models.Model):
     )
     code = models.CharField(_("code"), max_length=16, blank=True)
     purchase_price = CurrencyField(
-        _("purchase price"),
+        _("purchase price"), help_text=_("Initial cost of purchasing the product")
-        help_text=_("Initial cost of purchasing the product"),
     )
     icon = ResizedImageField(
         height=70,
@@ -388,13 +416,21 @@ class Product(models.Model):
     tray = models.BooleanField(
         _("tray price"), help_text=_("Buy five, get the sixth free"), default=False
     )
-    buying_groups = models.ManyToManyField(
+    clic_limit = models.PositiveSmallIntegerField(
-        Group, related_name="products", verbose_name=_("buying groups"), blank=True
+        _("clic limit"),
+        help_text=_(
+            "If a limit is set, the product won't be purchasable "
+            "anymore on the eboutic once the latter is reached."
+        ),
+        null=True,
+        blank=True,
     )
     archived = models.BooleanField(_("archived"), default=False)
     created_at = models.DateTimeField(_("created at"), auto_now_add=True)
     updated_at = models.DateTimeField(_("updated at"), auto_now=True)
 
+    objects = ProductQuerySet.as_manager()
+
     class Meta:
         verbose_name = _("product")
 
@@ -580,7 +616,6 @@ class Counter(models.Model):
     view_groups = models.ManyToManyField(
         Group, related_name="viewable_counters", blank=True
     )
-    token = models.CharField(_("token"), max_length=30, null=True, blank=True)
 
     objects = CounterQuerySet.as_manager()
 
@@ -733,10 +768,8 @@ class Counter(models.Model):
         # but they share the same primary key
         return self.type == "BAR" and any(b.pk == customer.pk for b in self.barmen_list)
 
-    def get_prices_for(
+    def get_prices_for(self, customer: Customer) -> PriceQuerySet:
-        self, customer: Customer, *, order_by: Sequence[str] | None = None
+        return (
-    ) -> list[Price]:
-        qs = (
             Price.objects.filter(
                 product__counters=self, product__product_type__isnull=False
             )
@@ -744,9 +777,6 @@ class Counter(models.Model):
             .select_related("product", "product__product_type")
             .prefetch_related("groups")
         )
-        if order_by:
-            qs = qs.order_by(*order_by)
-        return list(qs)
 
 
 class CounterSellers(models.Model):
@@ -797,7 +827,7 @@ class Refilling(models.Model):
     counter = models.ForeignKey(
         Counter, related_name="refillings", blank=False, on_delete=models.CASCADE
     )
-    amount = CurrencyField(_("amount"))
+    amount: CurrencyField = CurrencyField(_("amount"), min_value=0.01)
     operator = models.ForeignKey(
         User,
         related_name="refillings_as_operator",
@@ -851,6 +881,14 @@ class Refilling(models.Model):
             return False
         return user.is_owner(self.counter) and self.payment_method != "CARD"
 
+    def clean(self):
+        super().clean()
+        if (self.amount + self.customer.amount) > settings.SITH_ACCOUNT_MAX_MONEY:
+            raise ValidationError(
+                _("There cannot be more than %(money)d€ on an AE account")
+                % {"money": settings.SITH_ACCOUNT_MAX_MONEY}
+            )
+
     def delete(self, *args, **kwargs):
         self.customer.amount -= self.amount
         self.customer.save()

counter/signals.py

@@ -20,41 +20,34 @@
 # Place - Suite 330, Boston, MA 02111-1307, USA.
 #
 #
+import random
 
 from django.db.models.signals import pre_delete
 from django.dispatch import receiver
 
 from core.middleware import get_signal_request
 from core.models import OperationLog
-from counter.models import Counter, Refilling, Selling
+from counter.models import Refilling, Selling
 
 
-def write_log(instance, operation_type):
+def write_log(instance: Selling | Refilling, operation_type):
     def get_user():
         request = get_signal_request()
 
         if not request:
             return None
 
-        # Get a random barmen if deletion is from a counter
+        if request.barmen:
-        session = getattr(request, "session", {})
+            return random.choice(list(request.barmen))
-        session_token = session.get("counter_token", None)
-        if session_token:
-            counter = Counter.objects.filter(token=session_token).first()
-            if counter and len(counter.barmen_list) > 0:
-                return counter.get_random_barman()
 
         # Get the current logged user if not from a counter
-        if request.user and not request.user.is_anonymous:
+        if request.user.is_authenticated:
             return request.user
 
-        # Return None by default
         return None
 
     OperationLog(
-        label=str(instance),
+        label=str(instance), operator=get_user(), operation_type=operation_type
-        operator=get_user(),
-        operation_type=operation_type,
     ).save()
 
 

counter/static/bundled/counter/components/counter-product-select-index.ts

@@ -1,12 +1,12 @@
-import type { RecursivePartial, TomSettings } from "tom-select/dist/types/types";
+import type { RecursivePartial, TomSettings } from "tom-select/src/types";
-import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base.ts";
+import { AutoCompleteSelectBase } from "#core:core/components/ajax-select-base";
-import { registerComponent } from "#core:utils/web-components.ts";
+import { registerComponent } from "#core:utils/web-components";
 
 const productParsingRegex = /^(\d+x)?(.*)/i;
 const codeParsingRegex = / \((\w+)\)$/;
 
 function parseProduct(query: string): [number, string] {
-  const parsed = productParsingRegex.exec(query);
+  const parsed = productParsingRegex.exec(query) as RegExpExecArray;
   return [Number.parseInt(parsed[1] || "1", 10), parsed[2]];
 }
 
@@ -63,13 +63,6 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
         );
       },
     );
-
-    this.widget.hook("after", "onOptionSelect", () => {
-      /* Focus the next element if it's an input */
-      if (this.nextElementSibling.nodeName === "INPUT") {
-        (this.nextElementSibling as HTMLInputElement).focus();
-      }
-    });
   }
   protected tomSelectSettings(): RecursivePartial<TomSettings> {
     /* We disable the dropdown on focus because we're going to always autofocus the widget */
@@ -80,9 +73,7 @@ export class CounterProductSelect extends AutoCompleteSelectBase {
       // We need to manually set weights or it results on an inconsistent
       // behavior between production and development environment
       searchField: [
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "code", weight: 2 },
-        // @ts-expect-error documentation says it's fine, specified type is wrong
         { field: "text", weight: 0.5 },
       ],
     };

counter/static/bundled/counter/counter-click-index.ts

@@ -3,7 +3,6 @@ import { BasketItem } from "#counter:counter/basket";
 import type {
   CounterConfig,
   CounterItem,
-  ErrorMessage,
   ProductFormula,
 } from "#counter:counter/types";
 import type { CounterProductSelect } from "./components/counter-product-select-index";
@@ -24,21 +23,24 @@ document.addEventListener("alpine:init", () => {
         }
       }
 
-      this.codeField = this.$refs.codeField;
+      this.codeField = this.$refs.codeField as CounterProductSelect;
+      this.codeField.widget.hook("after", "onOptionSelect", () => {
+        this.handleCode();
+      });
       this.codeField.widget.focus();
 
       // It's quite tricky to manually apply attributes to the management part
       // of a formset so we dynamically apply it here
       this.$refs.basketManagementForm
         .querySelector("#id_form-TOTAL_FORMS")
-        .setAttribute(":value", "getBasketSize()");
+        ?.setAttribute(":value", "getBasketSize()");
     },
 
     removeFromBasket(id: string) {
       delete this.basket[id];
     },
 
-    addToBasket(id: string, quantity: number): ErrorMessage {
+    addToBasket(id: string, quantity: number) {
       const item: BasketItem =
         this.basket[id] || new BasketItem(config.products[id], 0);
 
@@ -47,7 +49,7 @@ document.addEventListener("alpine:init", () => {
 
       if (item.quantity <= 0) {
         delete this.basket[id];
-        return "";
+        return;
       }
 
       this.basket[id] = item;
@@ -69,7 +71,7 @@ document.addEventListener("alpine:init", () => {
       const products = new Set(
         Object.values(this.basket).map((item: BasketItem) => item.product.productId),
       );
-      const formula: ProductFormula = config.formulas.find((f: ProductFormula) => {
+      const formula = config.formulas.find((f: ProductFormula) => {
         return f.products.every((p: number) => products.has(p));
       });
       if (formula === undefined) {
@@ -77,9 +79,13 @@ document.addEventListener("alpine:init", () => {
       }
       // Now that the formula is found, remove the items composing it from the basket
       for (const product of formula.products) {
-        const key = Object.entries(this.basket).find(
+        const item = Object.entries(this.basket).find(
           ([_, i]: [string, BasketItem]) => i.product.productId === product,
-        )[0];
+        );
+        if (item === undefined) {
+          continue;
+        }
+        const key = item[0];
         this.basket[key].quantity -= 1;
         if (this.basket[key].quantity <= 0) {
           this.removeFromBasket(key);
@@ -89,7 +95,7 @@ document.addEventListener("alpine:init", () => {
       const result = Object.values(config.products)
         .filter((item: CounterItem) => item.productId === formula.result)
         .reduce((acc, curr) => (acc.price.amount < curr.price.amount ? acc : curr));
-      this.addToBasket(result.price.id, 1);
+      this.addToBasket(result.price.id.toString(), 1);
       this.alertMessage.display(
         interpolate(
           gettext("Formula %(formula)s applied"),
@@ -116,14 +122,18 @@ document.addEventListener("alpine:init", () => {
     },
 
     onRefillingSuccess(event: CustomEvent) {
-      if (event.type !== "htmx:after-request" || event.detail.failed) {
+      if (
+        event.type !== "htmx:after-swap" ||
+        event.detail.failed ||
+        event.detail.elt.querySelector(".errorlist")
+      ) {
         return;
       }
       this.customerBalance += Number.parseFloat(
         (event.detail.target.querySelector("#id_amount") as HTMLInputElement).value,
       );
-      document.getElementById("selling-accordion").setAttribute("open", "");
+      document.getElementById("selling-accordion")?.setAttribute("open", "");
-      this.codeField.widget.focus();
+      this.codeField?.widget.focus();
     },
 
     finish() {
@@ -133,7 +143,7 @@ document.addEventListener("alpine:init", () => {
         });
         return;
       }
-      this.$refs.basketForm.submit();
+      (this.$refs.basketForm as HTMLFormElement).submit();
     },
 
     cancel() {
@@ -141,6 +151,8 @@ document.addEventListener("alpine:init", () => {
     },
 
     handleCode() {
+      if (!this.codeField) throw Error("Unexpected null codeField.");
+
       const [quantity, code] = this.codeField.getSelectedProduct() as [number, string];
 
       if (this.codeField.getOperationCodes().includes(code.toUpperCase())) {
@@ -154,6 +166,7 @@ document.addEventListener("alpine:init", () => {
         this.addToBasket(code, quantity);
       }
       this.codeField.widget.clear();
+      this.codeField.widget.setTextboxValue("");
       this.codeField.widget.focus();
     },
   }));

counter/static/counter/css/counter-click.scss

@@ -42,7 +42,28 @@
   min-width: 350px;
 
   ul {
-    list-style-type: none;
+    list-style: none;
+    display: flex;
+    flex-direction: column;
+    gap: .5rem;
+    margin-left: 0;
+
+    .basket-row {
+      display: flex;
+      align-items: center;
+      gap: 1rem;
+
+      .product-name {
+        flex: 1 2 0;
+        min-width: 0;
+        text-wrap: wrap;
+      }
+    }
+  }
+
+  form {
+    margin-top: .5rem;
+    margin-bottom: .5rem;
   }
 }
 

counter/templates/counter/counter_click.jinja

@@ -56,10 +56,15 @@
         <div class="accordion-content">
           {% set counter_click_url = url('counter:click', counter_id=counter.id, user_id=customer.user_id) %}
 
-          <form method="post" action=""
+          <form method="post" action="" @submit.prevent="handleCode">
-                class="code_form" @submit.prevent="handleCode">
 
-            <counter-product-select name="code" x-ref="codeField" autofocus required placeholder="{% trans %}Select a product...{% endtrans %}">
+            <counter-product-select
+              name="code"
+              x-ref="codeField"
+              autofocus
+              required
+              placeholder="{% trans %}Select a product...{% endtrans %}"
+            >
               <option value=""></option>
               <optgroup label="{% trans %}Operations{% endtrans %}">
                 <option value="FIN">{% trans %}Confirm (FIN){% endtrans %}</option>
@@ -68,13 +73,11 @@
               {%- for category, prices in categories.items() -%}
                 <optgroup label="{{ category }}">
                   {%- for price in prices -%}
-                    <option value="{{ price.id }}">{{ price.full_label }}</option>
+                    <option value="{{ price.id }}">{{ price.full_label }} ({{ price.product.code }})</option>
                   {%- endfor -%}
                 </optgroup>
               {%- endfor -%}
             </counter-product-select>
-
-            <input type="submit" value="{% trans %}Go{% endtrans %}"/>
           </form>
 
           {% for error in form.non_form_errors() %}
@@ -102,7 +105,9 @@
               {{ form.management_form }}
             </div>
             <ul>
-              <li x-show="getBasketSize() === 0">{% trans %}This basket is empty{% endtrans %}</li>
+              <li x-show="getBasketSize() === 0">
+                <em>{% trans %}This basket is empty{% endtrans %}</em>
+              </li>
               <template x-for="(item, index) in Object.values(basket)" :key="item.product.price.id">
                 <li>
                   <template x-for="error in item.errors">
@@ -110,19 +115,23 @@
                     </div>
                   </template>
 
-                  <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
+                  <div class="basket-row">
-                  <span class="quantity" x-text="item.quantity"></span>
+                    <div>
-                  <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                      <button @click.prevent="addToBasket(item.product.price.id, -1)">-</button>
+                      <span class="quantity" x-text="item.quantity"></span>
+                      <button @click.prevent="addToBasket(item.product.price.id, 1)">+</button>
+                    </div>
 
-                  <span x-text="item.product.name"></span> :
+                    <span class="product-name" x-text="item.product.name"></span>
-                  <span x-text="item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })">€</span>
+                    <span x-text="`${item.sum().toLocaleString(undefined, { minimumFractionDigits: 2 })} €`"></span>
-                  <span x-show="item.getBonusQuantity() > 0"
+                    <span x-show="item.getBonusQuantity() > 0"
-                        x-text="`${item.getBonusQuantity()} x P`"></span>
+                          x-text="`${item.getBonusQuantity()} x P`"></span>
 
-                  <button
+                    <button
-                    class="remove-item"
+                      class="remove-item"
-                    @click.prevent="removeFromBasket(item.product.price.id)"
+                      @click.prevent="removeFromBasket(item.product.price.id)"
-                  ><i class="fa fa-trash-can delete-action"></i></button>
+                    ><i class="fa fa-trash-can delete-action"></i></button>
+                  </div>
 
                   <input
                     type="hidden"
@@ -167,13 +176,17 @@
           </form>
         </div>
       </details>
-      <details class="accordion" name="selling">
+      <details
+        class="accordion"
+        name="selling"
+        @toggle="if ($event.newState === 'open') $el.querySelector('input[type=number]')?.focus()"
+      >
         <summary>{% trans %}Refilling{% endtrans %}</summary>
         {% if object.type == "BAR" %}
           {% if refilling_fragment %}
             <div
               class="accordion-content"
-              @htmx:after-request="onRefillingSuccess"
+              @htmx:after-swap="onRefillingSuccess"
             >
               {{ refilling_fragment }}
             </div>

counter/templates/counter/counter_main.jinja

@@ -32,12 +32,11 @@
       </ul>
       <p><strong>{% trans %}Total: {% endtrans %}{{ last_total }} €</strong></p>
     {% endif %}
-    {% if barmen %}
+    {% if can_click %}
       <p>{% trans %}Enter client code:{% endtrans %}</p>
-      <form method="post" action="">
+      <form method="post" action="" id="select-user-form">
         {% csrf_token %}
-        <input type="hidden" name="counter_token" value="{{ counter.token }}" />
+        {{ form }}
-        {{ form.as_p() }}
         <p><input type="submit" value="{% trans %}validate{% endtrans %}" /></p>
       </form>
     {% else %}
@@ -45,17 +44,36 @@
     {% endif %}
   </div>
   {% if counter.type == 'BAR' %}
-    <div>
+    <h3>{% trans %}Barmen:{% endtrans %}</h3>
-      <h3>{% trans %}Barman: {% endtrans %}</h3>
+
+    {% if barmen_here %}
+      <div class="row gap-2x">
+        <div>
+          <h4>{% trans %}On this device{% endtrans %}</h4>
+          {% for b in barmen_here %}
+            <p>{{ barman_logout_link(b) }}</p>
+          {% endfor %}
+        </div>
+        <div>
+          <h4>{% trans %}Elsewhere{% endtrans %}</h4>
+          {% if barmen_here|length == barmen|length %}
+            {# all logged barmen are logged in this session #}
+            <p><em>{% trans %}No barman logged elsewhere{% endtrans %}</em></p>
+          {% else %}
+            {% for b in barmen %}
+              {%- if b not in barmen_here -%}
+                <p>{{ barman_logout_link(b) }}</p>
+              {%- endif -%}
+            {% endfor %}
+          {% endif %}
+        </div>
+      </div>
+    {% else %}
       {% for b in barmen %}
         <p>{{ barman_logout_link(b) }}</p>
       {% endfor %}
-      <form method="post" action="{{ url('counter:login', counter_id=counter.id) }}">
+    {% endif %}
-        {% csrf_token %}
+    {{ login_fragment }}
-        {{ login_form.as_p() }}
-        <p><input type="submit" value="{% trans %}login{% endtrans %}" /></p>
-      </form>
-    </div>
   {% endif %}
 {% endblock %}
 
@@ -63,10 +81,10 @@
   {{ super() }}
   <script type="text/javascript">
     window.addEventListener("DOMContentLoaded", () => {
-      // The login form annoyingly takes priority over the code form 
+      {# The login form annoyingly takes priority over the code form
-      // This is due to the loading time of the web component
+         This is due to the loading time of the web component
-      // We can't rely on DOMContentLoaded to know if the component is there so we
+         We can't rely on DOMContentLoaded to know if the component is there so we
-      // periodically run a script until the field is there
+         periodically run a script until the field is there #}
       const autofocus = () => {
         const field = document.querySelector("input[id='id_code']");
         if (field === null){

counter/templates/counter/fragments/login.jinja

@@ -0,0 +1,5 @@
+<form hx-post="{{ action }}" hx-swap="outerHTML">
+  {% csrf_token %}
+  {{ form }}
+  <input type="submit" value="{% trans %}Confirm{% endtrans %}"/>
+</form>

counter/templates/counter/product_form.jinja

@@ -118,6 +118,7 @@
         </div>
       </div>
     </fieldset>
+    <fieldset><div>{{ form.clic_limit.as_field_group() }}</div></fieldset>
     <fieldset><div>{{ form.counters.as_field_group() }}</div></fieldset>
 
     <h3 class="margin-bottom">{% trans %}Prices{% endtrans %}</h3>

counter/tests/test_counter.py

@@ -17,9 +17,11 @@ from datetime import timedelta
 from decimal import Decimal
 
 import pytest
+from bs4 import BeautifulSoup
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
 from django.contrib.auth.models import Permission, make_password
+from django.contrib.messages import DEFAULT_LEVELS, get_messages
 from django.http import HttpResponse
 from django.shortcuts import resolve_url
 from django.test import Client, TestCase
@@ -37,6 +39,7 @@ from core.models import BanGroup, Group, User
 from counter.baker_recipes import price_recipe, product_recipe, sale_recipe
 from counter.models import (
     Counter,
+    CounterSellers,
     Customer,
     Permanency,
     ProductType,
@@ -66,10 +69,14 @@ class TestFullClickBase(TestCase):
         cls.subscriber = subscriber_user.make()
 
         cls.counter = baker.make(Counter, type="BAR")
-        cls.counter.sellers.add(cls.barmen, cls.board_admin)
-
         cls.other_counter = baker.make(Counter, type="BAR")
-        cls.other_counter.sellers.add(cls.barmen)
+        CounterSellers.objects.bulk_create(
+            [
+                CounterSellers(counter=cls.counter, user=cls.barmen),
+                CounterSellers(counter=cls.counter, user=cls.board_admin),
+                CounterSellers(counter=cls.other_counter, user=cls.barmen),
+            ]
+        )
 
         cls.yet_another_counter = baker.make(Counter, type="BAR")
 
@@ -114,7 +121,10 @@ class TestRefilling(TestFullClickBase):
     ) -> HttpResponse:
         used_client = client if client is not None else self.client
         return used_client.post(
-            reverse("counter:refilling_create", kwargs={"customer_id": user.pk}),
+            reverse(
+                "counter:refilling_create",
+                kwargs={"customer_id": user.pk, "counter_id": self.counter.pk},
+            ),
             {"amount": str(amount), "payment_method": Refilling.PaymentMethod.CASH},
             HTTP_REFERER=reverse(
                 "counter:click", kwargs={"counter_id": counter.id, "user_id": user.pk}
@@ -134,23 +144,28 @@ class TestRefilling(TestFullClickBase):
         assert self.updated_amount(self.customer) == 0
 
     def test_refilling_no_refer_fail(self):
+        """Check that the refill fails is the HTTP_REFERER header is missing"""
+
         def refill():
             return self.client.post(
                 reverse(
                     "counter:refilling_create",
-                    kwargs={"customer_id": self.customer.pk},
+                    kwargs={
+                        "customer_id": self.customer.pk,
+                        "counter_id": self.counter.pk,
+                    },
                 ),
                 {"amount": "10", "payment_method": "CASH"},
             )
 
         self.client.force_login(self.club_admin)
-        assert refill()
+        assert refill().status_code == 403
 
         self.client.force_login(self.root)
-        assert refill()
+        assert refill().status_code == 403
 
         self.client.force_login(self.subscriber)
-        assert refill()
+        assert refill().status_code == 403
 
         assert self.updated_amount(self.customer) == 0
 
@@ -186,6 +201,17 @@ class TestRefilling(TestFullClickBase):
             == 404
         )
 
+    def test_refilling_above_limit_fails(self):
+        """Test that it's forbidden to refill a customer above the limit."""
+        self.login_in_bar()
+        limit = settings.SITH_ACCOUNT_MAX_MONEY
+        # create a refilling to check that current balance is taken into account
+        baker.make(Refilling, customer=self.customer.customer, amount=limit // 2)
+        response = self.refill_user(self.customer, self.counter, (limit // 2) + 1)
+        assert response.status_code == 200  # no redirect = failure
+        self.customer.customer.refresh_from_db()
+        assert self.updated_amount(self.customer) == limit // 2
+
     def test_refilling_counter_success(self):
         self.login_in_bar()
 
@@ -442,9 +468,19 @@ class TestCounterClick(TestFullClickBase):
 
     def test_click_not_connected(self):
         force_refill_user(self.customer, 10)
+
+        # trying to click on a bar without being logged should result
+        # in a redirect to the counter page with an error message
         res = self.submit_basket(self.customer, [BasketItem(self.snack.id, 2)])
         assertRedirects(res, self.counter.get_absolute_url())
+        messages = list(get_messages(res.wsgi_request))
+        assert len(messages) == 1
+        assert messages[0].level == DEFAULT_LEVELS["ERROR"]
+        assert (
+            messages[0].message == "Vous ne pouvez pas cliquer des gens sur ce comptoir"
+        )
 
+        # trying to click on an office counter without permission should 403
         res = self.submit_basket(
             self.customer, [BasketItem(self.snack.id, 2)], counter=self.club_counter
         )
@@ -499,6 +535,19 @@ class TestCounterClick(TestFullClickBase):
 
         assert self.updated_amount(self.customer) == Decimal(10)
 
+    def test_unrecord_above_limit_fails(self):
+        """Test that it's forbidden to give back a recorded product
+        if it puts the account balance above the limit.
+        """
+        self.login_in_bar()
+        limit = settings.SITH_ACCOUNT_MAX_MONEY
+        # put the account balance just at the limit
+        baker.make(Refilling, customer=self.customer.customer, amount=limit)
+        response = self.submit_basket(self.customer, [BasketItem(self.dcons.id, 1)])
+        assert response.status_code == 200  # no redirect = failure
+        self.customer.customer.refresh_from_db()
+        assert self.updated_amount(self.customer) == limit
+
     def test_annotate_has_barman_queryset(self):
         """Test if the custom queryset method `annotate_has_barman` works as intended."""
         counters = Counter.objects.annotate_has_barman(self.barmen)
@@ -596,7 +645,7 @@ class TestCounterClick(TestFullClickBase):
             product=iter(_product_recipe.make(archived=False, _quantity=2)),
             groups=[group],
         )
-        customer_prices = counter.get_prices_for(customer)
+        customer_prices = list(counter.get_prices_for(customer))
         assert unarchived_prices == customer_prices
 
 
@@ -718,59 +767,97 @@ class TestCounterStats(TestCase):
 class TestBarmanConnection(TestCase):
     @classmethod
     def setUpTestData(cls):
-        cls.krophil = User.objects.get(username="krophil")
+        cls.barman = subscriber_user.make()
-        cls.skia = User.objects.get(username="skia")
+        cls.barman.set_password("plop")
-        cls.skia.customer.account = 800
+        cls.barman.save()
-        cls.krophil.customer.save()
+        cls.counter = baker.make(Counter, type="BAR", sellers=[cls.barman])
-        cls.skia.customer.save()
+        cls.login_url = reverse("counter:login", kwargs={"counter_id": cls.counter.id})
-
+        cls.detail_url = reverse(
-        cls.counter = Counter.objects.get(id=2)
+            "counter:details", kwargs={"counter_id": cls.counter.id}
+        )
 
     def test_barman_granted(self):
+        response = self.client.post(
+            self.login_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert response.status_code == 200
+        assert response.headers["HX-Redirect"] == self.detail_url
+        last_perm = Permanency.objects.last()
+        assert last_perm.counter == self.counter
+        assert last_perm.user == self.barman
+        assert last_perm.end is None
+        assert self.barman in response.wsgi_request.barmen
+        response = self.client.get(
+            self.detail_url, {"username": self.barman.username, "password": "plop"}
+        )
+        assert response.context_data.get("barmen") == [self.barman]
+        soup = BeautifulSoup(response.text, "lxml")
+        assert soup.find("form", id="select-user-form") is not None
+
+    def assert_counter_login_fails(self, user: User):
+        initial_perms = set(self.counter.permanencies.filter(user=user, end=None))
+        response = self.client.post(
+            self.login_url, {"username": user.username, "password": "plop"}
+        )
+        assert "HX-Redirect" not in response.headers
+        assert (
+            set(self.counter.permanencies.filter(user=user, end=None)) == initial_perms
+        )
+        if initial_perms:
+            # the user was already logged in, and we already tested
+            # that it didn't re-login, so we can skip the next assertions.
+            return
+
+        self.counter.refresh_from_db()
+        assert response.wsgi_request.barmen.isdisjoint(set(self.counter.barmen_list))
+
+        response = self.client.get(self.detail_url)
+        assert response.context_data.get("barmen") == []
+        soup = BeautifulSoup(response.text, "lxml")
+        assert soup.find("form", id="select-user-form") is None
+
+    def test_barman_not_seller(self):
+        """Test when the barman is not a seller of the counter"""
+        not_barman = subscriber_user.make()
+        not_barman.set_password("plop")
+        not_barman.save()
+        self.assert_counter_login_fails(not_barman)
+
+    def test_barman_already_logged(self):
+        """Test when the barman is already logged in the current counter."""
         self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
+            self.login_url, {"username": self.barman.username, "password": "plop"}
-            {"username": "krophil", "password": "plop"},
         )
-        response = self.client.get(reverse("counter:details", args=[self.counter.id]))
+        self.assert_counter_login_fails(self.barman)
 
-        assert "<p>Entrez un code client : </p>" in str(response.content)
+    def test_barman_already_logged_elsewhere(self):
-
+        """Test when the barman is already logged in another counter."""
-    def test_counters_list_barmen(self):
+        other_counter = baker.make(Counter, type="BAR")
+        CounterSellers.objects.create(counter=other_counter, user=self.barman)
         self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
+            reverse("counter:login", kwargs={"counter_id": other_counter.id}),
-            {"username": "krophil", "password": "plop"},
+            {"username": self.barman.username, "password": "plop"},
         )
-        response = self.client.get(reverse("counter:activity", args=[self.counter.id]))
+        self.assert_counter_login_fails(self.barman)
 
-        assert '<li><a href="/user/10/">Kro Phil&#39;</a></li>' in str(response.content)
+    def test_login_on_non_bar_counter(self):
-
+        counter = baker.make(Counter, type="OFFICE")
-    def test_barman_denied(self):
+        CounterSellers.objects.create(counter=counter, user=self.barman)
-        self.client.post(
+        url = reverse("counter:login", kwargs={"counter_id": counter.id})
-            reverse("counter:login", args=[self.counter.id]),
+        response = self.client.get(url)
-            {"username": "skia", "password": "plop"},
+        assert response.status_code == 403
+        response = self.client.post(
+            url, {"username": self.barman.username, "password": "plop"}
         )
-        response_get = self.client.get(
+        assert response.status_code == 403
-            reverse("counter:details", args=[self.counter.id])
-        )
-
-        assert "<p>Merci de vous identifier</p>" in str(response_get.content)
-
-    def test_counters_list_no_barmen(self):
-        self.client.post(
-            reverse("counter:login", args=[self.counter.id]),
-            {"username": "krophil", "password": "plop"},
-        )
-        response = self.client.get(reverse("counter:activity", args=[self.counter.id]))
-
-        assert '<li><a href="/user/1/">S&#39; Kia</a></li>' not in str(response.content)
 
 
 @pytest.mark.django_db
-def test_barman_timeout():
+def test_barman_timeout(client: Client):
     """Test that barmen timeout is well managed."""
     bar = baker.make(Counter, type="BAR")
     user = baker.make(User)
-    bar.sellers.add(user)
+    CounterSellers.objects.create(counter=bar, user=user)
     baker.make(Permanency, counter=bar, user=user, start=now())
 
     qs = Counter.objects.annotate_is_open().filter(pk=bar.pk)
@@ -786,6 +873,8 @@ def test_barman_timeout():
         bar = qs[0]
         assert not bar.is_open
         assert bar.barmen_list == []
+    res = client.get("")
+    assert res.wsgi_request.barmen == set()
 
 
 class TestClubCounterClickAccess(TestCase):
@@ -835,14 +924,14 @@ class TestClubCounterClickAccess(TestCase):
 
     def test_barman(self):
         """Sellers should be able to click on office counters"""
-        self.counter.sellers.add(self.user)
+        CounterSellers.objects.create(counter=self.counter, user=self.user)
         self.client.force_login(self.user)
         res = self.client.get(self.click_url)
         assert res.status_code == 200
 
     def test_both_barman_and_board_member(self):
         """If the user is barman and board member, he should be authorized as well."""
-        self.counter.sellers.add(self.user)
+        CounterSellers.objects.create(counter=self.counter, user=self.user)
         baker.make(
             Membership, club=self.counter.club, user=self.user, role=self.board_role
         )
@@ -866,16 +955,17 @@ class TestCounterLogout:
                 reverse("counter:logout", kwargs={"counter_id": permanence.counter_id}),
                 data={"user_id": permanence.user_id},
             )
-            assertRedirects(
+        assertRedirects(
-                res,
+            res,
-                reverse(
+            reverse("counter:details", kwargs={"counter_id": permanence.counter_id}),
-                    "counter:details", kwargs={"counter_id": permanence.counter_id}
+        )
-                ),
+        permanence.refresh_from_db()
-            )
+        assert permanence.end == permanence.activity
-            permanence.refresh_from_db()
+        assert permanence.user not in res.wsgi_request.barmen
-            assert permanence.end == now()
 
     def test_logout_doesnt_change_old_permanences(self, client: Client):
+        # regression test for #1141
+        # https://github.com/ae-utbm/sith/pull/1141
         perm_counter = baker.make(Counter, type="BAR")
         permanence = baker.make(
             Permanency,
@@ -896,6 +986,6 @@ class TestCounterLogout:
                 data={"user_id": permanence.user_id},
             )
             permanence.refresh_from_db()
-            assert permanence.end == now()
+            assert permanence.end == permanence.activity
             old_permanence.refresh_from_db()
             assert old_permanence.end == old_end

counter/tests/test_customer.py

@@ -15,6 +15,7 @@ from core.models import User
 from counter.baker_recipes import product_recipe, refill_recipe, sale_recipe
 from counter.models import (
     Counter,
+    CounterSellers,
     Customer,
     Refilling,
     ReturnableProduct,
@@ -38,7 +39,7 @@ class TestStudentCard(TestCase):
         cls.subscriber = subscriber_user.make()
 
         cls.counter = baker.make(Counter, type="BAR")
-        cls.counter.sellers.add(cls.barmen)
+        CounterSellers.objects.create(counter=cls.counter, user=cls.barmen)
 
         cls.club_counter = baker.make(Counter)
         role = baker.make(ClubRole, club=cls.club_counter.club, is_board=True)

counter/tests/test_product.py

@@ -1,3 +1,4 @@
+import itertools
 from io import BytesIO
 from typing import Callable
 from uuid import uuid4
@@ -8,6 +9,7 @@ from django.core.cache import cache
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.test import Client, TestCase
 from django.urls import reverse
+from django.utils.timezone import now
 from model_bakery import baker
 from model_bakery.recipe import Recipe
 from PIL import Image
@@ -16,9 +18,10 @@ from pytest_django.asserts import assertNumQueries, assertRedirects
 from club.models import Club
 from core.baker_recipes import board_user, subscriber_user
 from core.models import Group, User
-from counter.baker_recipes import product_recipe
+from counter.baker_recipes import product_recipe, sale_recipe
 from counter.forms import ProductForm, ProductPriceFormSet
-from counter.models import Price, Product, ProductType
+from counter.models import Price, Product, ProductType, Selling
+from eboutic.models import Basket, BasketItem
 
 
 @pytest.mark.django_db
@@ -222,3 +225,59 @@ def test_price_for_user():
     assert list(qs.for_user(users[0])) == [prices[0], prices[1], prices[4]]
     assert list(qs.for_user(users[1])) == [prices[0], prices[4]]
     assert list(qs.for_user(users[2])) == [prices[0], prices[3]]
+
+
+class TestProductClicLimit(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.products = product_recipe.make(
+            clic_limit=itertools.chain([5, 10, 15], itertools.repeat(None)),
+            _quantity=6,
+            _bulk_create=True,
+        )
+        cls.qs = Product.objects.filter(id__in=[p.id for p in cls.products])
+
+    def test_no_sales_or_basket(self):
+        """Test that it works if no sales has been made yet"""
+        assert list(self.qs.under_clic_limit()) == self.products
+
+    def test_with_sales(self):
+        """Test that it works when there are existing sales"""
+        sales = sale_recipe.make(
+            product=itertools.cycle(self.products),
+            _quantity=len(self.products) * 5,
+            _bulk_create=True,
+        )
+        Selling.objects.filter(id__in=[s.id for s in sales]).update(quantity=2)
+        assert list(self.qs.under_clic_limit()) == self.products[2:]
+
+    def test_with_sales_and_basket(self):
+        """Test that it works when there are existing sales and basket items."""
+        sales = sale_recipe.make(
+            product=itertools.cycle(self.products),
+            _quantity=len(self.products) * 5,
+            _bulk_create=True,
+        )
+        Selling.objects.filter(id__in=[s.id for s in sales]).update(quantity=1)
+        basket = baker.make(
+            Basket, date=now() - settings.SITH_EBOUTIC_BASKET_TIMEOUT / 2
+        )
+        items = baker.make(
+            BasketItem,
+            product=itertools.cycle(self.products),
+            basket=basket,
+            _quantity=len(self.products) * 5,
+        )
+        BasketItem.objects.filter(id__in=[i.id for i in items]).update(quantity=1)
+        assert list(self.qs.under_clic_limit()) == self.products[2:]
+
+        # expired basket items shouldn't be accounted when computing clic limit
+        item = BasketItem.objects.filter(product=self.products[1])[0]
+        item.basket = baker.make(
+            Basket,
+            date=now()
+            - settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            - settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT,
+        )
+        item.save()
+        assert list(self.qs.under_clic_limit()) == self.products[1:]

counter/urls.py

@@ -41,7 +41,6 @@ from counter.views.admin import (
     ReturnableProductUpdateView,
     SellingDeleteView,
 )
-from counter.views.auth import counter_login, counter_logout
 from counter.views.cash import (
     CashSummaryEditView,
     CashSummaryListView,
@@ -57,7 +56,9 @@ from counter.views.eticket import (
 from counter.views.home import (
     CounterActivityView,
     CounterLastOperationsView,
+    CounterLoginFragment,
     CounterMain,
+    counter_logout,
 )
 from counter.views.invoice import InvoiceCallView
 from counter.views.student_card import StudentCardDeleteView, StudentCardFormFragment
@@ -66,7 +67,7 @@ urlpatterns = [
     path("<int:counter_id>/", CounterMain.as_view(), name="details"),
     path("<int:counter_id>/click/<int:user_id>/", CounterClick.as_view(), name="click"),
     path(
-        "refill/<int:customer_id>/",
+        "<int:counter_id>/refill/<int:customer_id>/",
         RefillingCreateView.as_view(),
         name="refilling_create",
     ),
@@ -82,7 +83,7 @@ urlpatterns = [
     ),
     path("<int:counter_id>/activity/", CounterActivityView.as_view(), name="activity"),
     path("<int:counter_id>/stats/", CounterStatView.as_view(), name="stats"),
-    path("<int:counter_id>/login/", counter_login, name="login"),
+    path("<int:counter_id>/login/", CounterLoginFragment.as_view(), name="login"),
     path("<int:counter_id>/logout/", counter_logout, name="logout"),
     path("eticket/<int:selling_id>/pdf/", EticketPDFView.as_view(), name="eticket_pdf"),
     path(

counter/utils.py

@@ -3,8 +3,6 @@ from urllib.parse import urlparse
 from django.http import HttpRequest
 from django.urls import resolve
 
-from counter.models import Counter
-
 
 def is_logged_in_counter(request: HttpRequest) -> bool:
     """Check if the request is sent from a device logged to a counter.
@@ -20,24 +18,13 @@ def is_logged_in_counter(request: HttpRequest) -> bool:
       or the request path belongs to the counter app
       (eg. the barman went back to the main by missclick and go back
       to the counter)
-    - The current session has a counter token associated with it.
+    - There are barmen logged in the current session
-    - A counter with this token exists.
-    - The counter is open
     """
     referer_ok = (
         "HTTP_REFERER" in request.META
         and resolve(urlparse(request.META["HTTP_REFERER"]).path).app_name == "counter"
     )
-    has_token = (
+    if not referer_ok and request.resolver_match.app_name != "counter":
-        (referer_ok or request.resolver_match.app_name == "counter")
-        and "counter_token" in request.session
-        and request.session["counter_token"]
-    )
-    if not has_token:
         return False
 
-    return (
+    return bool(request.barmen)
-        Counter.objects.annotate_is_open()
-        .filter(token=request.session["counter_token"], is_open=True)
-        .exists()
-    )

counter/views/auth.py

@@ -1,53 +0,0 @@
-#
-# Copyright 2023 © AE UTBM
-# ae@utbm.fr / ae.info@utbm.fr
-#
-# This file is part of the website of the UTBM Student Association (AE UTBM),
-# https://ae.utbm.fr.
-#
-# You can find the source code of the website at https://github.com/ae-utbm/sith
-#
-# LICENSED UNDER THE GNU GENERAL PUBLIC LICENSE VERSION 3 (GPLv3)
-# SEE : https://raw.githubusercontent.com/ae-utbm/sith/master/LICENSE
-# OR WITHIN THE LOCAL FILE "LICENSE"
-#
-#
-
-from django.http import HttpRequest, HttpResponseRedirect
-from django.shortcuts import get_object_or_404, redirect
-from django.utils import timezone
-from django.utils.timezone import now
-from django.views.decorators.http import require_POST
-
-from core.views.forms import LoginForm
-from counter.models import Counter, Permanency
-
-
-@require_POST
-def counter_login(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
-    """Log a user in a counter.
-
-    A successful login will result in the beginning of a counter duty
-    for the user.
-    """
-    counter = get_object_or_404(Counter, pk=counter_id)
-    form = LoginForm(request, data=request.POST)
-    if not form.is_valid():
-        return redirect(counter.get_absolute_url() + "?credentials")
-    user = form.get_user()
-    if not counter.sellers.contains(user) or user in counter.barmen_list:
-        return redirect(counter.get_absolute_url() + "?sellers")
-    if len(counter.barmen_list) == 0:
-        counter.gen_token()
-    request.session["counter_token"] = counter.token
-    counter.permanencies.create(user=user, start=timezone.now())
-    return redirect(counter)
-
-
-@require_POST
-def counter_logout(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
-    """End the permanency of a user in this counter."""
-    Permanency.objects.filter(
-        counter=counter_id, user=request.POST["user_id"], end=None
-    ).update(end=now())
-    return redirect("counter:details", counter_id=counter_id)

counter/views/click.py

@@ -12,8 +12,10 @@
 # OR WITHIN THE LOCAL FILE "LICENSE"
 #
 #
+import random
 from collections import defaultdict
 
+from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.db.models import Q
@@ -21,7 +23,8 @@ from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, resolve_url
 from django.urls import reverse
 from django.utils.safestring import SafeString
-from django.views.generic import FormView
+from django.utils.translation import gettext as _
+from django.views.generic import CreateView, FormView
 from django.views.generic.detail import SingleObjectMixin
 from ninja.main import HttpRequest
 
@@ -33,6 +36,7 @@ from counter.models import (
     Counter,
     Customer,
     ProductFormula,
+    Refilling,
     ReturnableProduct,
     Selling,
 )
@@ -46,7 +50,7 @@ def get_operator(request: HttpRequest, counter: Counter, customer: Customer) ->
         return request.user
     if counter.customer_is_barman(customer):
         return customer.user
-    return counter.get_random_barman()
+    return random.choice(list(request.barmen))
 
 
 class CounterClick(
@@ -69,16 +73,16 @@ class CounterClick(
     current_tab = "counter"
 
     def get_form_kwargs(self):
-        kwargs = super().get_form_kwargs()
+        return super().get_form_kwargs() | {
-        kwargs["form_kwargs"] = {
             "customer": self.customer,
             "counter": self.object,
-            "allowed_prices": {price.id: price for price in self.prices},
+            "form_kwargs": {
+                "allowed_prices": {price.id: price for price in self.prices}
+            },
         }
-        return kwargs
 
     def dispatch(self, request, *args, **kwargs):
-        self.customer = get_object_or_404(Customer, user__id=self.kwargs["user_id"])
+        self.customer = get_object_or_404(Customer, user_id=self.kwargs["user_id"])
         obj: Counter = self.get_object()
 
         if not self.customer.can_buy or self.customer.user.is_banned_counter:
@@ -96,14 +100,13 @@ class CounterClick(
             # or a seller of this counter.
             raise PermissionDenied
 
-        if obj.type == "BAR" and (
+        if obj.type == "BAR" and not (
-            not obj.is_open
+            request.barmen and request.barmen.issubset(set(obj.barmen_list))
-            or "counter_token" not in request.session
-            or request.session["counter_token"] != obj.token
         ):
+            messages.error(request, _("You cannot click users on this counter"))
             return redirect(obj)  # Redirect to counter
 
-        self.prices = obj.get_prices_for(self.customer)
+        self.prices = list(obj.get_prices_for(self.customer))
 
         return super().dispatch(request, *args, **kwargs)
 
@@ -199,7 +202,7 @@ class CounterClick(
             )
         if self.object.can_refill():
             res["refilling_fragment"] = RefillingCreateView.as_fragment()(
-                self.request, customer=self.customer
+                self.request, customer=self.customer, counter=self.object
             )
         return res
 
@@ -223,9 +226,10 @@ class CounterClick(
         return kwargs
 
 
-class RefillingCreateView(FragmentMixin, FormView):
+class RefillingCreateView(FragmentMixin, CreateView):
     """This is a fragment only view which integrates with counter_click.jinja"""
 
+    model = Refilling
     form_class = RefillForm
     template_name = "counter/fragments/create_refill.jinja"
 
@@ -237,34 +241,35 @@ class RefillingCreateView(FragmentMixin, FormView):
         if not is_logged_in_counter(request):
             raise PermissionDenied
 
-        self.counter: Counter = get_object_or_404(
+        self.counter: Counter = get_object_or_404(Counter, id=self.kwargs["counter_id"])
-            Counter, token=request.session["counter_token"]
-        )
 
-        if not self.counter.can_refill():
+        if not (
+            request.barmen
+            and request.barmen.issubset(self.counter.barmen_list)
+            and self.counter.can_refill()
+        ):
             raise PermissionDenied
 
-        self.operator = get_operator(request, self.counter, self.customer)
-
         return super().dispatch(request, *args, **kwargs)
 
     def render_fragment(self, request, **kwargs) -> SafeString:
         self.customer = kwargs.pop("customer")
+        self.counter = kwargs.pop("counter")
+        self.object = None
         return super().render_fragment(request, **kwargs)
 
-    def form_valid(self, form):
+    def get_form_kwargs(self):
-        res = super().form_valid(form)
+        return super().get_form_kwargs() | {
-        form.clean()
+            "counter": self.counter,
-        form.instance.counter = self.counter
+            "operator": get_operator(self.request, self.counter, self.customer),
-        form.instance.operator = self.operator
+            "customer": self.customer,
-        form.instance.customer = self.customer
+        }
-        form.instance.save()
-        return res
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
         kwargs["action"] = reverse(
-            "counter:refilling_create", kwargs={"customer_id": self.customer.pk}
+            "counter:refilling_create",
+            kwargs={"customer_id": self.customer.pk, "counter_id": self.counter.pk},
         )
         return kwargs
 

counter/views/home.py

@@ -15,78 +15,120 @@
 from datetime import timedelta
 
 from django.conf import settings
-from django.http import HttpResponseRedirect
+from django.core.exceptions import PermissionDenied
-from django.urls import reverse, reverse_lazy
+from django.db.models import F
+from django.http import HttpRequest, HttpResponseRedirect
+from django.shortcuts import redirect
+from django.urls import reverse
 from django.utils import timezone
-from django.utils.translation import gettext_lazy as _
+from django.utils.safestring import SafeString
+from django.views.decorators.http import require_POST
 from django.views.generic import DetailView
-from django.views.generic.edit import FormMixin, ProcessFormView
+from django.views.generic.detail import SingleObjectMixin
+from django.views.generic.edit import FormView
 
 from core.auth.mixins import CanViewMixin
-from core.views.forms import LoginForm
+from core.views import FragmentMixin, UseFragmentsMixin
-from counter.forms import GetUserForm
+from counter.forms import CounterLoginForm, GetUserForm
-from counter.models import Counter
+from counter.models import Counter, Permanency
 from counter.utils import is_logged_in_counter
 from counter.views.mixins import CounterTabsMixin
 
 
+class CounterLoginFragment(FragmentMixin, SingleObjectMixin, FormView):
+    model = Counter
+    form_class = CounterLoginForm
+    reload_on_redirect = True
+    pk_url_kwarg = "counter_id"
+    template_name = "counter/fragments/login.jinja"
+
+    def dispatch(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        if self.object.type != "BAR":
+            # barmen have to log in only if it is a bar,
+            # so calling this view on a non-bar counter makes no sense
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {
+            "request": self.request,
+            "counter": self.object,
+        }
+
+    def form_valid(self, form: CounterLoginForm):
+        user = form.get_user()
+        self.object.permanencies.create(user=user, start=timezone.now())
+        self.request.barmen.add(user)
+        self.success_url = reverse(
+            "counter:details", kwargs={"counter_id": self.object.id}
+        )
+        return super().form_valid(form)
+
+    def render_fragment(self, request, **kwargs) -> SafeString:
+        self.object = kwargs.pop("counter")
+        return super().render_fragment(request, **kwargs)
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {
+            "action": reverse("counter:login", kwargs={"counter_id": self.object.id})
+        }
+
+
+@require_POST
+def counter_logout(request: HttpRequest, counter_id: int) -> HttpResponseRedirect:
+    """End the permanency of a user in this counter."""
+    Permanency.objects.filter(
+        counter=counter_id, user=request.POST["user_id"], end=None
+    ).update(end=F("activity"))
+    return redirect("counter:details", counter_id=counter_id)
+
+
 class CounterMain(
-    CounterTabsMixin, CanViewMixin, DetailView, ProcessFormView, FormMixin
+    CounterTabsMixin, UseFragmentsMixin, CanViewMixin, SingleObjectMixin, FormView
 ):
     """The public (barman) view."""
 
     model = Counter
+    queryset = Counter.objects.exclude(type="EBOUTIC")
     template_name = "counter/counter_main.jinja"
     pk_url_kwarg = "counter_id"
-    form_class = (
+    form_class = GetUserForm
-        GetUserForm  # Form to enter a client code and get the corresponding user id
-    )
     current_tab = "counter"
 
-    def get_queryset(self):
+    def dispatch(self, request, *args, **kwargs):
-        return super().get_queryset().exclude(type="EBOUTIC")
+        self.object: Counter = self.get_object()
+        if self.object.type == "BAR":
+            self.object.update_activity()
+        return super().dispatch(request, *args, **kwargs)
 
-    def post(self, request, *args, **kwargs):
+    def get_fragment_context_data(self) -> dict[str, SafeString]:
-        self.object = self.get_object()
+        login_fragment = (
-        if self.object.type == "BAR" and not (
+            CounterLoginFragment.as_fragment()(self.request, counter=self.object)
-            "counter_token" in self.request.session
+            if self.object.type == "BAR"
-            and self.request.session["counter_token"] == self.object.token
+            else ""
-        ):  # Check the token to avoid the bar to be stolen
+        )
-            return HttpResponseRedirect(
+        return super().get_fragment_context_data() | {"login_fragment": login_fragment}
-                reverse_lazy(
-                    "counter:details",
-                    args=self.args,
-                    kwargs={"counter_id": self.object.id},
-                )
-                + "?bad_location"
-            )
-        return super().post(request, *args, **kwargs)
 
     def get_context_data(self, **kwargs):
         """We handle here the login form for the barman."""
-        if self.request.method == "POST":
-            self.object = self.get_object()
-        self.object.update_activity()
         kwargs = super().get_context_data(**kwargs)
-        kwargs["login_form"] = LoginForm()
-        kwargs["login_form"].fields["username"].widget.attrs["autofocus"] = True
-        kwargs[
-            "login_form"
-        ].cleaned_data = {}  # add_error fails if there are no cleaned_data
-        if "credentials" in self.request.GET:
-            kwargs["login_form"].add_error(None, _("Bad credentials"))
-        if "sellers" in self.request.GET:
-            kwargs["login_form"].add_error(None, _("User is not barman"))
-        kwargs["form"] = self.get_form()
-        kwargs["form"].cleaned_data = {}  # same as above
-        if "bad_location" in self.request.GET:
-            kwargs["form"].add_error(
-                None, _("Bad location, someone is already logged in somewhere else")
-            )
         if self.object.type == "BAR":
             kwargs["barmen"] = self.object.barmen_list
-        elif self.request.user.is_authenticated:
+            kwargs["barmen_here"] = list(
-            kwargs["barmen"] = [self.request.user]
+                self.request.barmen.intersection(self.object.barmen_list)
+            )
+        kwargs["can_click"] = (
+            self.object.type == "BAR"
+            and self.request.barmen
+            and self.request.barmen.issubset(set(self.object.barmen_list))
+        ) or (
+            self.object.type == "OFFICE"
+            and (
+                self.object.sellers.contains(self.request.user)
+                or self.object.club.has_rights_in_club(self.request.user)
+            )
+        )
         if "last_basket" in self.request.session:
             kwargs["last_basket"] = self.request.session.pop("last_basket")
             kwargs["last_customer"] = self.request.session.pop("last_customer")
@@ -96,14 +138,17 @@ class CounterMain(
             )
         return kwargs
 
-    def form_valid(self, form):
+    def form_valid(self, form: GetUserForm):
         """We handle here the redirection, passing the user id of the asked customer."""
-        self.kwargs["user_id"] = form.cleaned_data["user_id"]
+        self.success_url = reverse(
+            "counter:click",
+            kwargs={
+                "counter_id": self.kwargs["counter_id"],
+                "user_id": form.cleaned_data["user_id"],
+            },
+        )
         return super().form_valid(form)
 
-    def get_success_url(self):
-        return reverse_lazy("counter:click", args=self.args, kwargs=self.kwargs)
-
 
 class CounterLastOperationsView(CounterTabsMixin, CanViewMixin, DetailView):
     """Provide the last operations to allow barmen to delete them."""

docs/tutorial/etransaction.md

@@ -1,4 +1,6 @@
 
+## Fonctionnement général
+
 La boutique en ligne nécessite une interaction
 avec la banque pour son fonctionnement.
 
@@ -9,3 +11,32 @@ Nous ne pouvons donc que vous redirigez vers la doc du crédit
 agricole : 
 [https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-e-transactions/ma-documentation/](https://www.ca-moncommerce.com/espace-client-mon-commerce/up2pay-e-transactions/ma-documentation/)
 
+## Limite de clic et expiration des paniers
+
+Certains produits peuvent avoir un quota de vente.
+Une fois ce dernier atteint, il ne doit plus être possible de les acheter.
+
+Pour éviter que cette limite soit dépassée si jamais plusieurs utilisateurs
+commandent et achètent ce produit à peu près en même temps,
+un produit est considéré comme « réservé » une fois placé dans un panier.
+La création du panier s'effectue lors de la soumission du formulaire sur l'eboutic.
+Une fois la transaction accomplie, le panier est supprimé.
+
+Cependant, il reste un problème : 
+que faire des utilisateurs qui créent un panier, mais ne terminent
+pas la transaction ?
+Pour résoudre ce cas, les paniers ont une durée de validité,
+définie dans le `settings.py`, grâce à deux variables :
+
+- `settings.SITH_EBOUTIC_BASKET_TIMEOUT` : 
+  le temps pendant lequel un utilisateur peut payer avec son compte AE
+  ou démarrer une etransaction
+- `settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT` :
+  le temps alloué à l'utilisateur pour effectuer une etransaction ;
+  au-delà de cette durée, la banque refusera le paiement
+  et notifiera le sith de l'erreur.
+
+Une fois expiré le temps défini par 
+`settings.SITH_EBOUTIC_BASKET_TIMEOUT + settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT`, 
+les produits contenus dans le panier sont à nouveau 
+disponibles à la vente.

eboutic/api.py

@@ -1,3 +1,6 @@
+from typing import Any
+
+from ninja import Status
 from ninja_extra import ControllerBase, api_controller, route
 from ninja_extra.exceptions import NotFound
 
@@ -8,13 +11,19 @@ from eboutic.models import Basket
 
 @api_controller("/etransaction", permissions=[CanView])
 class EtransactionInfoController(ControllerBase):
-    @route.get("/data/{basket_id}", url_name="etransaction_data")
+    @route.get(
+        "/data/{basket_id}",
+        url_name="etransaction_data",
+        response={200: dict[str, Any], 410: str},
+    )
     def fetch_etransaction_data(self, basket_id: int):
         """Generate the data to pay an eboutic command with paybox.
 
         The data is generated with the basket that is used by the current session.
         """
         basket: Basket = self.get_object_or_exception(Basket, pk=basket_id)
+        if basket.is_expired:
+            return Status(410, "This basket is expired.")
         try:
             return dict(basket.get_e_transaction_data())
         except BillingInfo.DoesNotExist as e:

eboutic/models.py

@@ -16,7 +16,6 @@ from __future__ import annotations
 
 import hmac
 from datetime import datetime
-from enum import Enum
 from typing import Self
 
 from dict2xml import dict2xml
@@ -24,6 +23,7 @@ from django.conf import settings
 from django.db import DataError, models
 from django.db.models import F, OuterRef, Subquery, Sum
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 
 from core.models import User
@@ -39,30 +39,6 @@ from counter.models import (
 )
 
 
-class BillingInfoState(Enum):
-    VALID = 1
-    EMPTY = 2
-    MISSING_PHONE_NUMBER = 3
-
-    @classmethod
-    def from_model(cls, info: BillingInfo | None) -> BillingInfoState:
-        if info is None:
-            return cls.EMPTY
-        for attr in [
-            "first_name",
-            "last_name",
-            "address_1",
-            "zip_code",
-            "city",
-            "country",
-        ]:
-            if getattr(info, attr) == "":
-                return cls.EMPTY
-        if info.phone_number is None:
-            return cls.MISSING_PHONE_NUMBER
-        return cls.VALID
-
-
 class Basket(models.Model):
     """Basket is built when the user connects to an eboutic page."""
 
@@ -95,6 +71,19 @@ class Basket(models.Model):
             ]
         )
 
+    @property
+    def is_expired(self) -> bool:
+        """Return True if this basket is expired.
+
+        An expired basket can no longer be used tp pay with sith account
+        or to start an etransaction.
+
+        Warnings:
+            Users have an additional time if they pay with an etransaction,
+            so an expired basket may be purchased after its expiration in that case.
+        """
+        return (self.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT) <= now()
+
     def generate_sales(
         self, counter, seller: User, payment_method: Selling.PaymentMethod
     ):
@@ -133,15 +122,22 @@ class Basket(models.Model):
         ]
 
     def get_e_transaction_data(self) -> list[tuple[str, str]]:
+        """Get data for etransaction payment.
+
+        Raises:
+            Customer.DoesNotExist: if the user linked to this basket
+                has no customer account
+            BillingInfo.DoesNotExist: if the user linked to this basket has no
+                billing infos, or incorrect billing infos.
+            ValueError: if this is called on a basket which payment delay is expired.
+        """
         user = self.user
         if not hasattr(user, "customer"):
             raise Customer.DoesNotExist
+        if self.is_expired:
+            raise ValueError("This method cannot be called on an expired basket.")
         customer = user.customer
-        if (
+        if not hasattr(user.customer, "billing_infos"):
-            not hasattr(user.customer, "billing_infos")
-            or BillingInfoState.from_model(user.customer.billing_infos)
-            != BillingInfoState.VALID
-        ):
             raise BillingInfo.DoesNotExist
         cart = {
             "shoppingcart": {"total": {"totalQuantity": min(self.items.count(), 99)}}
@@ -155,6 +151,10 @@ class Basket(models.Model):
             ("PBX_IDENTIFIANT", settings.SITH_EBOUTIC_PBX_IDENTIFIANT),
             ("PBX_TOTAL", str(int(self.total * 100))),
             ("PBX_DEVISE", "978"),  # This is Euro
+            (
+                "PBX_DISPLAY",
+                str(int(settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT.total_seconds())),
+            ),
             ("PBX_CMD", str(self.id)),
             ("PBX_PORTEUR", user.email),
             ("PBX_RETOUR", "Amount:M;BasketID:R;Auto:A;Error:E;Sig:K"),
@@ -219,16 +219,14 @@ class Invoice(models.Model):
         if self.validated:
             raise DataError(_("Invoice already validated"))
         customer, _created = Customer.get_or_create(user=self.user)
-        kwargs = {
+        kwargs = {"counter": get_eboutic(), "customer": customer, "date": self.date}
-            "counter": get_eboutic(),
-            "customer": customer,
-            "date": self.date,
-            "payment_method": Selling.PaymentMethod.CARD,
-        }
         for i in self.items.select_related("product"):
             if i.product.product_type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING:
                 Refilling.objects.create(
-                    **kwargs, operator=self.user, amount=i.unit_price * i.quantity
+                    **kwargs,
+                    operator=self.user,
+                    amount=i.unit_price * i.quantity,
+                    payment_method=Refilling.PaymentMethod.CARD,
                 )
             else:
                 Selling.objects.create(
@@ -239,6 +237,7 @@ class Invoice(models.Model):
                     seller=self.user,
                     unit_price=i.unit_price,
                     quantity=i.quantity,
+                    payment_method=Selling.PaymentMethod.CARD,
                 )
         self.validated = True
         self.save()

eboutic/static/bundled/eboutic/checkout-index.ts

@@ -1,22 +1,76 @@
+import { type Notification, NotificationLevel } from "#core:utils/notifications";
 import { etransactioninfoFetchEtransactionData } from "#openapi";
 
+interface Basket {
+  id: number;
+  timeout: Date;
+}
 document.addEventListener("alpine:init", () => {
-  Alpine.data("etransaction", (initialData, basketId: number) => ({
+  Alpine.data(
-    data: initialData,
+    "etransaction",
-    isCbAvailable: Object.keys(initialData).length > 0,
+    (initialData: Record<string, string>, basket: Basket) => ({
+      data: initialData,
+      isCbAvailable: Object.keys(initialData).length > 0,
+      isSithAvailable: true,
 
-    async fill() {
+      init() {
-      this.isCbAvailable = false;
+        const now = new Date();
-      const res = await etransactioninfoFetchEtransactionData({
+        const timeout = basket.timeout.getTime() - now.getTime();
-        path: {
+        if (timeout > 0) {
+          // if not going inside this condition, it means that
+          // basket was already outdated at initial page load,
+          // in which case disabling buttons and displaying
+          // error message has been done at rendering time
+          setTimeout(() => this.timeoutBasket(), timeout);
+        }
+      },
+
+      /**
+       * Make this basket into a timeout state.
+       * All submission inputs are disabled, and an error message is displayed.
+       */
+      timeoutBasket() {
+        this.isCbAvailable = false;
+        this.isSithAvailable = false;
+        const message = gettext("Basket expired");
+
+        const existingNotif: Notification | undefined = this.$notifications
+          .getAll()
+          .find(
+            (n: Notification) =>
+              n.tag === NotificationLevel.Error && n.text === message,
+          );
+        if (existingNotif === undefined) {
+          this.$notifications.error(message);
+        }
+      },
+
+      /**
+       * Refresh the data used for etransaction.
+       *
+       * Note: if this is called while the basket is expired, it will be a no-op
+       */
+      async fill() {
+        if (new Date() > basket.timeout) {
+          // refresh etransaction data only if the basket is still valid.
+          this.timeoutBasket();
+          return;
+        }
+        this.isCbAvailable = false;
+        const res = await etransactioninfoFetchEtransactionData({
           // biome-ignore lint/style/useNamingConvention: api is in snake_case
-          basket_id: basketId,
+          path: { basket_id: basket.id },
-        },
+        });
-      });
+        if (res.response.ok) {
-      if (res.response.ok) {
+          this.data = res.data as Record<string, string>;
-        this.data = res.data;
+          this.isCbAvailable = true;
-        this.isCbAvailable = true;
+        } else if (res.response.status === 410) {
-      }
+          // The basket is expired, so no payment method should be available at all.
-    },
+          // This shouldn't happen, because we don't send the request
-  }));
+          // when the timeout is passed, but we are better safe than sorry
+          this.timeoutBasket();
+        }
+      },
+    }),
+  );
 });

eboutic/static/bundled/eboutic/eboutic-index.ts

@@ -5,13 +5,14 @@ interface BasketItem {
   name: string;
   quantity: number;
   unitPrice: number;
+  isRefill: boolean;
 }
 
 const BASKET_CACHE_KEY = "basket";
-const BASKET_CACHE_VERSION = 1;
+const BASKET_CACHE_VERSION = 2;
 
 document.addEventListener("alpine:init", () => {
-  Alpine.data("basket", (lastPurchaseTime?: number) => ({
+  Alpine.data("basket", (validPrices: number[], lastPurchaseTime?: number) => ({
     basket: [] as BasketItem[],
 
     init() {
@@ -19,25 +20,31 @@ document.addEventListener("alpine:init", () => {
       this.$watch("basket", () => {
         this.saveBasket();
       });
-      // Invalidate basket if a purchase was made
-      if (lastPurchaseTime !== null && localStorage.basketTimestamp !== undefined) {
-        if (
-          new Date(lastPurchaseTime) >=
-          new Date(Number.parseInt(localStorage.basketTimestamp, 10))
-        ) {
-          this.basket = [];
-        }
-      }
       document
         .getElementById("id_form-TOTAL_FORMS")
-        .setAttribute(":value", "basket.length");
+        ?.setAttribute(":value", "basket.length");
     },
 
     loadBasket(): BasketItem[] {
       const cached = versionedLocalStorage.getItem<BasketItem[]>(BASKET_CACHE_KEY, {
         version: BASKET_CACHE_VERSION,
       });
-      return cached ?? [];
+      if (!cached) {
+        return [];
+      }
+      if (
+        lastPurchaseTime &&
+        localStorage.basketTimestamp &&
+        new Date(lastPurchaseTime) >=
+          new Date(Number.parseInt(localStorage.basketTimestamp, 10))
+      ) {
+        // Invalidate basket if a purchase was made
+        return [];
+      }
+      // The basket is cached and not expired, so return it,
+      // but without items that are invalid
+      // (e.g. because the product is archived, or sold out)
+      return cached.filter((item) => validPrices.includes(item.priceId));
     },
 
     saveBasket() {
@@ -58,6 +65,19 @@ document.addEventListener("alpine:init", () => {
       );
     },
 
+    /**
+     * Get the total of money that would be added to the AE account on basket purchase.
+     */
+    getTotalAdded() {
+      return this.basket
+        .filter((item) => item.isRefill || item.unitPrice < 0)
+        .reduce(
+          (acc: number, item: BasketItem) =>
+            acc + Math.abs(item.quantity * item.unitPrice),
+          0,
+        );
+    },
+
     /**
      * Add 1 to the quantity of an item in the basket
      * @param {BasketItem} item
@@ -80,7 +100,7 @@ document.addEventListener("alpine:init", () => {
 
       if (this.basket[index].quantity === 0) {
         this.basket = this.basket.filter(
-          (e: BasketItem) => e.priceId !== this.basket[index].id,
+          (e: BasketItem) => e.priceId !== this.basket[index].priceId,
         );
       }
     },
@@ -97,14 +117,16 @@ document.addEventListener("alpine:init", () => {
      * @param id The id of the product to add
      * @param name The name of the product
      * @param price The unit price of the product
+     * @param isRefill true if the product is a refill bond
      * @returns The created item
      */
-    createItem(id: number, name: string, price: number): BasketItem {
+    createItem(id: number, name: string, price: number, isRefill: boolean): BasketItem {
       const newItem = {
         priceId: id,
         name,
         quantity: 0,
         unitPrice: price,
+        isRefill,
       } as BasketItem;
 
       this.basket.push(newItem);
@@ -119,16 +141,17 @@ document.addEventListener("alpine:init", () => {
      * @param id The id of the product to add
      * @param name The name of the product
      * @param price The unit price of the product
+     * @param isRefill true if the product is a refill bond
      */
-    addFromCatalog(id: number, name: string, price: number) {
+    addFromCatalog(id: number, name: string, price: number, isRefill: boolean) {
-      let item = this.basket.find((e: BasketItem) => e.priceId === id);
+      const item = this.basket.find((e: BasketItem) => e.priceId === id);
 
       // if the item is not in the basket, we create it
       // else we add + 1 to it
       if (item) {
         this.add(item);
       } else {
-        item = this.createItem(id, name, price);
+        this.createItem(id, name, price, isRefill);
       }
     },
   }));

eboutic/templates/eboutic/eboutic_billing_info.jinja

@@ -21,9 +21,10 @@
       hx-swap="outerHTML"
       hx-target="#billing-infos-fragment"
       x-show="collapsed"
+      x-cloak
     >
       {% csrf_token %}
-      {{ form.as_p() }}
+      {{ form }}
       <br>
       <input
         type="submit" class="btn btn-blue clickable"

eboutic/templates/eboutic/eboutic_checkout.jinja

@@ -16,17 +16,20 @@
   <h3>{% trans %}Eboutic{% endtrans %}</h3>
 
   <script type="text/javascript">
-    let billingInfos = {{ billing_infos|safe }};
+    const billingInfos = {{ billing_infos|safe }};
   </script>
 
-  <div x-data="etransaction(billingInfos, {{ basket.id }})">
+  <div x-data='etransaction(
+               billingInfos,
+               { id: {{ basket.id }}, timeout: new Date("{{ basket.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT }}") }
+               )'>
     <p>{% trans %}Basket: {% endtrans %}</p>
     <table>
       <thead>
         <tr>
           <td>Article</td>
-          <td>Quantity</td>
+          <td>{% trans %}Quantity{% endtrans %}</td>
-          <td>Unit price</td>
+          <td>{% trans %}Unit price{% endtrans %}</td>
         </tr>
       </thead>
       <tbody>
@@ -60,10 +63,41 @@
       <div @htmx:after-request="fill">
         {{ billing_infos_form }}
       </div>
-      {% include "core/base/notifications.jinja" %}
+    {% endif %}
+    {% include "core/base/notifications.jinja" %}
+    {% if settings.SITH_EBOUTIC_CB_ENABLED or (basket.total <= user.account_balance and not basket.contains_refilling_item) %}
+      {# don't display the cgv form if no payment mean is available #}
+      <form id="cgv-form" x-ref="cgvForm">
+      {# In order to have one CGV button for both payment means,
+         we have a third dummy form, containing only the cgv button,
+         which validation is triggered when one of the two other forms is submitted.
+         If the validation of this form fails, the submit event will be cancelled. #}
+        <div class="form-group">
+          <input
+            type="checkbox"
+            id="cgv-checkbox"
+            name="cgv"
+            required
+            {% if basket.is_expired %}
+              disabled="disabled"
+            {% else %}
+              :disabled="!isCbAvailable && !isSithAvailable"
+            {% endif %}
+          >
+          <label for="cgv-checkbox">
+            {% trans  trimmed %}I have read and I accept{% endtrans %}
+            <a href="{{ url('core:page', 'cgv') }}">{% trans %}the general terms and conditions{% endtrans%}</a>
+            {%trans%}of the student association of the UTBM{% endtrans %}
+          </label>
+        </div>
+      </form>
+    {% endif %}
+    {% if settings.SITH_EBOUTIC_CB_ENABLED %}
       <form
         method="post"
+        id="bank-payment-form"
         action="{{ settings.SITH_EBOUTIC_ET_URL }}"
+        @submit="if (!$refs.cgvForm.reportValidity()) $event.preventDefault()"
       >
         <template x-for="[key, value] in Object.entries(data)" :key="key">
           <input type="hidden" :name="key" :value="value">
@@ -72,7 +106,11 @@
           x-cloak
           type="submit"
           id="bank-submit-button"
-          :disabled="!isCbAvailable"
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isCbAvailable"
+          {% endif %}
           class="btn btn-blue"
           value="{% trans %}Pay with credit card{% endtrans %}"
         />
@@ -91,9 +129,23 @@
     {% elif basket.total > user.account_balance %}
       <p>{% trans %}AE account payment disabled because you do not have enough money remaining.{% endtrans %}</p>
     {% else %}
-      <form method="post" action="{{ url('eboutic:pay_with_sith', basket_id=basket.id) }}" name="sith-pay-form">
+      <form
+        method="post"
+        action="{{ url('eboutic:pay_with_sith', basket_id=basket.id) }}"
+        id="sith-payment-form"
+        @submit="if (!$refs.cgvForm.reportValidity()) $event.preventDefault()"
+      >
         {% csrf_token %}
-        <input class="btn btn-blue" type="submit" value="{% trans %}Pay with Sith account{% endtrans %}"/>
+        <input
+          {% if basket.is_expired %}
+            disabled="disabled"
+          {% else %}
+            :disabled="!isSithAvailable"
+          {% endif %}
+          class="btn btn-blue"
+          type="submit"
+          value="{% trans %}Pay with Sith account{% endtrans %}"
+        />
       </form>
     {% endif %}
   </div>

eboutic/templates/eboutic/eboutic_main.jinja

@@ -30,7 +30,17 @@
 {% block content %}
   <h1 id="eboutic-title">{% trans %}Eboutic{% endtrans %}</h1>
 
-  <div id="eboutic" x-data="basket({{ last_purchase_time }})">
+  <div
+    id="eboutic"
+    x-data="basket(
+            [{%- for prices in categories -%}
+              {%- for p in prices -%}
+                {% if not p.sold_out %}{{ p.id }},{% endif %}
+              {%- endfor -%}
+            {%- endfor -%}],
+            {{ last_purchase_time }},
+            )"
+  >
     <div id="basket">
       <h3>Panier</h3>
       <form method="post" action="">
@@ -48,6 +58,17 @@
             </div>
           </div>
         {% endif %}
+        <template x-if="(getTotalAdded() + {{ customer_amount }}) > {{ settings.SITH_ACCOUNT_MAX_MONEY }}">
+          <div class="alert alert-red">
+            <div class="alert-main">
+              {% trans trimmed limit=settings.SITH_ACCOUNT_MAX_MONEY %}
+                You cannot purchase the current basket,
+                because it would put your AE account balance
+                above the {{ limit }}€ limit
+              {% endtrans %}
+            </div>
+          </div>
+        </template>
         <ul class="item-list">
           {# Starting money #}
           <li>
@@ -99,9 +120,12 @@
             <i class="fa fa-trash"></i>
             {% trans %}Clear{% endtrans %}
           </button>
-          <button class="btn btn-blue">
+          <button
+            class="btn btn-blue"
+            :disabled="(getTotalAdded() + {{ customer_amount }}) > {{ settings.SITH_ACCOUNT_MAX_MONEY }}"
+          >
             <i class="fa fa-check"></i>
-            <input type="submit" value="{% trans %}Validate{% endtrans %}"/>
+            {% trans %}Validate{% endtrans %}
           </button>
         </div>
       </form>
@@ -187,9 +211,15 @@
             {% for price in prices %}
               <button
                 id="{{ price.id }}"
-                class="card product-button clickable shadow"
+                class="card clickable shadow"
                 :class="{selected: basket.some((i) => i.priceId === {{ price.id }})}"
-                @click='addFromCatalog({{ price.id }}, {{ price.full_label|tojson }}, {{ price.amount }})'
+                @click='addFromCatalog(
+                        {{ price.id }},
+                        {{ price.full_label|tojson }},
+                        {{ price.amount }},
+                        {{ (price.product.product_type_id == settings.SITH_COUNTER_PRODUCTTYPE_REFILLING)|lower }}
+                        )'
+                {% if price.sold_out %}disabled{% endif %}
               >
                 {% if price.product.icon %}
                   <img
@@ -202,6 +232,9 @@
                 {% endif %}
                 <div class="card-content">
                   <h4 class="card-title">{{ price.full_label }}</h4>
+                  {% if price.sold_out -%}
+                    <p><em>{% trans %}Product sold out{% endtrans %}</em></p>
+                  {%- endif %}
                   <p>{{ price.amount }} €</p>
                 </div>
               </button>

eboutic/tests/test_basket.py

@@ -1,14 +1,19 @@
+import re
 from datetime import datetime, timezone
 
+import freezegun
 import pytest
+from bs4 import BeautifulSoup
+from django.conf import settings
 from django.http import HttpResponse
 from django.test import TestCase
 from django.test.client import Client
 from django.urls import reverse
-from django.utils.timezone import localdate
+from django.utils.timezone import localdate, now
 from model_bakery import baker
 from pytest_django.asserts import assertRedirects
 
+import eboutic.models
 from core.baker_recipes import subscriber_user
 from core.models import Group, User
 from counter.baker_recipes import (
@@ -130,9 +135,11 @@ def test_eboutic_basket_expiry(
             _bulk_create=True,
         )
 
+    soup = BeautifulSoup(client.get(reverse("eboutic:main")).text, "lxml")
     assert (
-        f'x-data="basket({int(expected.timestamp() * 1000) if expected else "null"})"'
+        # remove any space from the value before asserting
-        in client.get(reverse("eboutic:main")).text
+        re.sub(r"\s+", "", soup.find(id="eboutic").attrs["x-data"])
+        == f"basket([],{int(expected.timestamp() * 1000) if expected else 'null'},)"
     )
 
 
@@ -231,26 +238,66 @@ class TestEboutic(TestCase):
 
     def test_add_forbidden_product(self):
         self.client.force_login(self.new_customer)
-        response = self.submit_basket([BasketItem(self.beer.id, 1)])
+        for product in self.beer, self.cotiz, self.not_in_counter:
-        assert response.status_code == 200
+            response = self.submit_basket([BasketItem(product.id, 1)])
-        assert Basket.objects.first() is None
+            assert response.status_code == 200
+            assert not Basket.objects.exists()
 
-        response = self.submit_basket([BasketItem(self.cotiz.id, 1)])
+    def test_sold_out_product(self):
+        sold_out = product_recipe.make(
+            clic_limit=3, counters=[self.eboutic], product_type=baker.make(ProductType)
+        )
+        price = price_recipe.make(product=sold_out, groups=[self.group_cotiz], amount=0)
+        sale_recipe.make(
+            product=sold_out,
+            customer=self.subscriber.customer,
+            unit_price=0,
+            quantity=1,
+        )
+        baker.make(
+            eboutic.models.BasketItem,
+            basket=baker.make(Basket),
+            product=sold_out,
+            quantity=2,
+        )
+        self.client.force_login(self.subscriber)
+        response = self.submit_basket([BasketItem(price.id, 1)])
         assert response.status_code == 200
-        assert Basket.objects.first() is None
+        assert Basket.objects.count() == 1
+        with freezegun.freeze_time(
+            now()
+            + settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            + settings.SITH_EBOUTIC_ETRANSACTION_TIMEOUT
+        ):
+            # after a while, unpaid basket items should expire and make the
+            # product available again.
+            response = self.submit_basket([BasketItem(price.id, 1)])
+        assertRedirects(
+            response,
+            reverse("eboutic:checkout", kwargs={"basket_id": Basket.objects.last().id}),
+        )
+        assert Basket.objects.count() == 2
 
-        response = self.submit_basket([BasketItem(self.not_in_counter.id, 1)])
+    def test_refill_limit(self):
-        assert response.status_code == 200
+        """Test that an eboutic basket cannot refill an account above the limit."""
-        assert Basket.objects.first() is None
+        self.client.force_login(self.subscriber)
+        product = product_recipe.make(
+            product_type_id=settings.SITH_COUNTER_PRODUCTTYPE_REFILLING,
+            counters=[self.eboutic],
+        )
+        price = price_recipe.make(
+            product=product,
+            groups=[self.group_cotiz],
+            amount=settings.SITH_ACCOUNT_MAX_MONEY // 10,
+        )
 
-        self.client.force_login(self.new_customer)
+        response = self.submit_basket([BasketItem(price.id, 10)])
-        response = self.submit_basket([BasketItem(self.cotiz.id, 1)])
+        assert Basket.objects.count() == 1
-        assert response.status_code == 200
+        assertRedirects(response, reverse("eboutic:checkout", kwargs={"basket_id": 1}))
-        assert Basket.objects.first() is None
 
-        response = self.submit_basket([BasketItem(self.not_in_counter.id, 1)])
+        response = self.submit_basket([BasketItem(price.id, 11)])
-        assert response.status_code == 200
+        assert Basket.objects.count() == 1
-        assert Basket.objects.first() is None
+        assert response.status_code == 200  # no redirect = form validation failed
 
     def test_create_basket(self):
         self.client.force_login(self.new_customer)

eboutic/tests/test_billing_info.py

@@ -37,12 +37,9 @@ class TestBillingInfo:
 
     def test_edit_infos(self, client: Client, payload: dict[str, str]):
         user = subscriber_user.make()
-        baker.make(BillingInfo, customer=user.customer)
+        baker.make(BillingInfo, customer=user.customer, phone_number="06 01 02 03 04")
         client.force_login(user)
-        response = client.post(
+        response = client.post(reverse("eboutic:billing_infos"), payload)
-            reverse("eboutic:billing_infos"),
-            payload,
-        )
         user.refresh_from_db()
         infos = BillingInfo.objects.get(customer__user=user)
         assert response.status_code == 302

eboutic/tests/test_payment.py

@@ -3,6 +3,7 @@ import urllib
 from decimal import Decimal
 from typing import TYPE_CHECKING
 
+import freezegun
 from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.hazmat.primitives.hashes import SHA1
@@ -17,7 +18,7 @@ from pytest_django.asserts import assertRedirects
 
 from core.baker_recipes import old_subscriber_user, subscriber_user
 from counter.baker_recipes import price_recipe, product_recipe
-from counter.models import Product, ProductType, Selling
+from counter.models import Product, ProductType, Refilling, Selling
 from counter.tests.test_counter import force_refill_user
 from eboutic.models import Basket, BasketItem
 
@@ -105,7 +106,7 @@ class TestPaymentSith(TestPaymentBase):
             ),
             reverse("eboutic:payment_result", kwargs={"result": "success"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == Decimal(1)
 
@@ -139,10 +140,7 @@ class TestPaymentSith(TestPaymentBase):
         assert len(messages) == 1
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert messages[0].message == "Solde insuffisant"
-
+        assert not Basket.objects.filter(id=self.basket.id).exists()
-        assert Basket.objects.contains(self.basket), (
-            "After an unsuccessful request, the basket should be kept"
-        )
 
     def test_refilling_in_basket(self):
         BasketItem.from_price(self.refilling.prices.first(), 1, self.basket).save()
@@ -157,7 +155,7 @@ class TestPaymentSith(TestPaymentBase):
             response,
             reverse("eboutic:payment_result", kwargs={"result": "failure"}),
         )
-        assert Basket.objects.filter(id=self.basket.id).first() is not None
+        assert not Basket.objects.filter(id=self.basket.id).exists()
         messages = list(get_messages(response.wsgi_request))
         assert messages[0].level == DEFAULT_LEVELS["ERROR"]
         assert (
@@ -167,6 +165,24 @@ class TestPaymentSith(TestPaymentBase):
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == initial_account_balance
 
+    def test_basket_expired(self):
+        self.client.force_login(self.customer)
+        initial_account_balance = self.customer.customer.amount
+        with freezegun.freeze_time(settings.SITH_EBOUTIC_BASKET_TIMEOUT):
+            response = self.client.post(
+                reverse("eboutic:pay_with_sith", kwargs={"basket_id": self.basket.id})
+            )
+        assertRedirects(
+            response,
+            reverse("eboutic:payment_result", kwargs={"result": "failure"}),
+        )
+        messages = list(get_messages(response.wsgi_request))
+        assert messages[0].level == DEFAULT_LEVELS["ERROR"]
+        assert messages[0].message == "Panier expiré"
+        assert not Basket.objects.filter(id=self.basket.id).exists()
+        self.customer.customer.refresh_from_db()
+        assert self.customer.customer.amount == initial_account_balance
+
 
 class TestPaymentCard(TestPaymentBase):
     def generate_bank_valid_answer(self, basket: Basket):
@@ -236,6 +252,10 @@ class TestPaymentCard(TestPaymentBase):
 
         self.customer.customer.refresh_from_db()
         assert self.customer.customer.amount == price.amount * 2
+        refill = self.customer.customer.refillings.last()
+        assert refill is not None
+        assert refill.amount == price.amount * 2
+        assert refill.payment_method == Refilling.PaymentMethod.CARD
 
     def test_multiple_responses(self):
         bank_response = self.generate_bank_valid_answer(self.basket)

eboutic/views.py

@@ -33,12 +33,14 @@ from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.messages.views import SuccessMessageMixin
 from django.core.exceptions import SuspiciousOperation, ValidationError
 from django.db import DatabaseError, transaction
-from django.db.models import Subquery
+from django.db.models import Exists, OuterRef, Subquery
 from django.db.models.fields import forms
 from django.db.utils import cached_property
 from django.http import HttpResponse
 from django.shortcuts import redirect, render
 from django.urls import reverse
+from django.utils.formats import localize
+from django.utils.timezone import localtime
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.http import require_GET
 from django.views.generic import DetailView, FormView, TemplateView, UpdateView, View
@@ -56,7 +58,7 @@ from counter.models import (
     Selling,
     get_eboutic,
 )
-from eboutic.models import Basket, BasketItem, BillingInfoState, Invoice, InvoiceItem
+from eboutic.models import Basket, BasketItem, Invoice, InvoiceItem
 
 if TYPE_CHECKING:
     from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
@@ -64,9 +66,7 @@ if TYPE_CHECKING:
 
 
 class BaseEbouticBasketForm(BaseBasketForm):
-    def _check_enough_money(self, *args, **kwargs):
+    min_result_balance = None  # user can pay by card, so no minimum enforced
-        # Disable money check
-        ...
 
 
 EbouticBasketForm = forms.formset_factory(
@@ -86,13 +86,15 @@ class EbouticMainView(LoginRequiredMixin, FormView):
     form_class = EbouticBasketForm
 
     def get_form_kwargs(self):
-        kwargs = super().get_form_kwargs()
+        return super().get_form_kwargs() | {
-        kwargs["form_kwargs"] = {
             "customer": self.customer,
             "counter": get_eboutic(),
-            "allowed_prices": {price.id: price for price in self.prices},
+            "form_kwargs": {
+                "allowed_prices": {
+                    price.id: price for price in self.prices if not price.sold_out
+                }
+            },
         }
-        return kwargs
 
     def form_valid(self, formset):
         if len(formset) == 0:
@@ -116,9 +118,14 @@ class EbouticMainView(LoginRequiredMixin, FormView):
 
     @cached_property
     def prices(self) -> list[Price]:
-        return get_eboutic().get_prices_for(
+        eboutic = get_eboutic()
-            self.customer,
+        sold_out_subquery = ~Exists(
-            order_by=["product__product_type__order", "product_id", "amount"],
+            eboutic.products.under_clic_limit().filter(id=OuterRef("product_id"))
+        )
+        return list(
+            eboutic.get_prices_for(self.customer)
+            .annotate(sold_out=sold_out_subquery)
+            .order_by("product__product_type__order", "product_id", "amount")
         )
 
     @cached_property
@@ -178,7 +185,7 @@ def payment_result(request, result: str) -> HttpResponse:
 class BillingInfoFormFragment(
     LoginRequiredMixin, FragmentMixin, SuccessMessageMixin, UpdateView
 ):
-    """Update billing info"""
+    """Update or create billing info"""
 
     model = BillingInfo
     form_class = BillingInfoForm
@@ -187,9 +194,7 @@ class BillingInfoFormFragment(
 
     def get_initial(self):
         if self.object is None:
-            return {
+            return {"country": Country(code="FR")}
-                "country": Country(code="FR"),
-            }
         return {}
 
     def render_fragment(self, request, **kwargs) -> SafeString:
@@ -211,26 +216,15 @@ class BillingInfoFormFragment(
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
-        kwargs["billing_infos_state"] = BillingInfoState.from_model(self.object)
         kwargs["action"] = reverse("eboutic:billing_infos")
-        match BillingInfoState.from_model(self.object):
+        if not self.object:
-            case BillingInfoState.EMPTY:
+            messages.warning(
-                messages.warning(
+                self.request,
-                    self.request,
+                _(
-                    _(
+                    "You must fill your billing infos "
-                        "You must fill your billing infos if you want to pay with your credit card"
+                    "if you want to pay with your credit card"
-                    ),
+                ),
-                )
+            )
-            case BillingInfoState.MISSING_PHONE_NUMBER:
-                messages.warning(
-                    self.request,
-                    _(
-                        "The Crédit Agricole changed its policy related to the billing "
-                        + "information that must be provided in order to pay with a credit card. "
-                        + "If you want to pay with your credit card, you must add a phone number "
-                        + "to the data you already provided.",
-                    ),
-                )
         return kwargs
 
     def get_success_url(self, **kwargs):
@@ -255,10 +249,19 @@ class EbouticCheckout(CanViewMixin, UseFragmentsMixin, DetailView):
             kwargs["customer_amount"] = None
         kwargs["billing_infos"] = {}
 
-        with contextlib.suppress(BillingInfo.DoesNotExist):
+        if self.object.is_expired:
-            kwargs["billing_infos"] = json.dumps(
+            messages.error(self.request, _("Basket expired"))
-                dict(self.object.get_e_transaction_data())
+        else:
+            timeout = self.object.date + settings.SITH_EBOUTIC_BASKET_TIMEOUT
+            messages.warning(
+                self.request,
+                _("Basket available until %(until)s")
+                % {"until": localize(localtime(timeout).time())},
             )
+            with contextlib.suppress(BillingInfo.DoesNotExist):
+                kwargs["billing_infos"] = json.dumps(
+                    dict(self.object.get_e_transaction_data())
+                )
         return kwargs
 
 
@@ -268,9 +271,14 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
 
     def post(self, request, *args, **kwargs):
         basket = self.get_object()
+        if basket.is_expired:
+            messages.error(self.request, _("Basket expired"))
+            basket.delete()
+            return redirect("eboutic:payment_result", "failure")
         refilling = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING
         if basket.items.filter(product__product_type_id=refilling).exists():
             messages.error(self.request, _("You can't buy a refilling with sith money"))
+            basket.delete()
             return redirect("eboutic:payment_result", "failure")
 
         eboutic = get_eboutic()
@@ -288,6 +296,7 @@ class EbouticPayWithSith(CanViewMixin, SingleObjectMixin, View):
         except DatabaseError as e:
             sentry_sdk.capture_exception(e)
         except ValidationError as e:
+            basket.delete()
             messages.error(self.request, e.message)
         return redirect("eboutic:payment_result", "failure")
 

election/forms.py

@@ -1,6 +1,18 @@
+from datetime import timedelta
+from itertools import groupby, islice
+from operator import attrgetter
+
 from django import forms
+from django.conf import settings
+from django.db import transaction
+from django.db.models import Count
+from django.forms.models import ModelChoiceIterator, ModelChoiceIteratorValue
+from django.utils.timezone import localdate, localtime
 from django.utils.translation import gettext_lazy as _
 
+from club.forms import ClubRoleChoiceField
+from club.models import ClubRole, Membership
+from club.widgets.ajax_select import AutoCompleteSelectMultipleClub
 from core.models import User
 from core.views.forms import SelectDateTime
 from core.views.widgets.ajax_select import (
@@ -79,27 +91,20 @@ class VoteForm(forms.Form):
 class RoleForm(forms.ModelForm):
     """Form for creating a role."""
 
+    required_css_class = "required"
+    error_css_class = "error"
+
     class Meta:
         model = Role
-        fields = ["title", "election", "description", "max_choice"]
+        fields = ["club_role", "title", "description", "max_choice"]
-        widgets = {"election": AutoCompleteSelect}
+        field_classes = {"club_role": ClubRoleChoiceField}
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, election: Election, **kwargs):
-        election_id = kwargs.pop("election_id", None)
         super().__init__(*args, **kwargs)
-        if election_id:
+        self.instance.election = election
-            self.fields["election"].queryset = Election.objects.filter(
+        self.fields["club_role"].queryset = ClubRole.objects.filter(
-                id=election_id
+            is_board=True, club__in=election.clubs.all()
-            ).all()
+        )
-
-    def clean(self):
-        cleaned_data = super().clean()
-        title = cleaned_data.get("title")
-        election = cleaned_data.get("election")
-        if Role.objects.filter(title=title, election=election).exists():
-            raise forms.ValidationError(
-                _("This role already exists for this election"), code="invalid"
-            )
 
 
 class ElectionListForm(forms.ModelForm):
@@ -108,21 +113,21 @@ class ElectionListForm(forms.ModelForm):
         fields = ("title", "election")
         widgets = {"election": AutoCompleteSelect}
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, election: Election, **kwargs):
-        election_id = kwargs.pop("election_id", None)
         super().__init__(*args, **kwargs)
-        if election_id:
+        self.instance.election = election
-            self.fields["election"].queryset = Election.objects.filter(
-                id=election_id
-            ).all()
 
 
 class ElectionForm(forms.ModelForm):
+    required_css_class = "required"
+    error_css_class = "error"
+
     class Meta:
         model = Election
         fields = [
             "title",
             "description",
+            "clubs",
             "archived",
             "start_candidature",
             "end_candidature",
@@ -134,21 +139,120 @@ class ElectionForm(forms.ModelForm):
             "candidature_groups",
         ]
         widgets = {
+            "clubs": AutoCompleteSelectMultipleClub,
             "edit_groups": AutoCompleteSelectMultipleGroup,
             "view_groups": AutoCompleteSelectMultipleGroup,
             "vote_groups": AutoCompleteSelectMultipleGroup,
             "candidature_groups": AutoCompleteSelectMultipleGroup,
+            "start_date": SelectDateTime,
+            "end_date": SelectDateTime,
+            "start_candidature": SelectDateTime,
+            "end_candidature": SelectDateTime,
         }
 
-    start_date = forms.DateTimeField(
+
-        label=_("Start date"), widget=SelectDateTime, required=True
+class ElectionCreateForm(ElectionForm):
-    )
+    """ElectionForm, but specifically for creation."""
-    end_date = forms.DateTimeField(
+
-        label=_("End date"), widget=SelectDateTime, required=True
+    def __init__(self, *args, initial: dict | None = None, **kwargs):
-    )
+        # propose sound default timestamps :
-    start_candidature = forms.DateTimeField(
+        # start of candidatures at tomorrow 00h01, start of votes a week later.
-        label=_("Start candidature"), widget=SelectDateTime, required=True
+        start = localtime().replace(hour=0, minute=1, second=0) + timedelta(days=1)
-    )
+        default_initial = {
-    end_candidature = forms.DateTimeField(
+            "start_candidature": start,
-        label=_("End candidature"), widget=SelectDateTime, required=True
+            "end_candidature": start + timedelta(days=7, minutes=-2),  # 23h59
-    )
+            "start_date": start + timedelta(days=7),  # 00h01
+            "end_date": start + timedelta(days=14, minutes=-2),  # 23h59
+            "view_groups": [settings.SITH_GROUP_PUBLIC_ID],
+            "vote_groups": [settings.SITH_GROUP_SUBSCRIBERS_ID],
+            "candidature_groups": [settings.SITH_GROUP_SUBSCRIBERS_ID],
+        }
+        if initial:
+            default_initial.update(initial)
+        super().__init__(*args, initial=default_initial, **kwargs)
+
+    def save(self, commit=True):  # noqa: FBT002
+        instance = super().save(commit=commit)
+        if commit:
+            ElectionList.objects.create(title="Candidat⸱e libre", election=instance)
+        return instance
+
+
+class ElectionWinnerChoiceIterator(ModelChoiceIterator):
+    """Iterate over the candidates that gathered enough votes"""
+
+    def __iter__(self):
+        # for each role, yield only the N first candidates,
+        # where N is the election role max_choice
+        qs = (
+            self.queryset.annotate(nb_votes=Count("votes"))
+            .order_by("role__order", "-nb_votes")
+            .select_related("role", "user", "role__club_role", "role__club_role__club")
+        )
+        yield from (
+            (
+                f"{role.title} \u2013 {role.club_role.club.name}",
+                [self.choice(cand) for cand in islice(candidates, role.max_choice)],
+            )
+            for role, candidates in groupby(qs, key=attrgetter("role"))
+        )
+
+    def choice(self, obj: Candidature):
+        return (
+            ModelChoiceIteratorValue(self.field.prepare_value(obj), obj),
+            obj.user.get_full_name(),
+        )
+
+
+class ElectionWinnerChoiceField(forms.ModelMultipleChoiceField):
+    """Custom `ModelChoiceField` for `[ClubRole][club.models.ClubRole]`.
+
+    If only one club is involved, behave like the base `ModelChoiceField`.
+    If dealing with the roles of multiple clubs, group the roles
+    into a different `optgroup` for each club.
+    """
+
+    iterator = ElectionWinnerChoiceIterator
+    widget = forms.CheckboxSelectMultiple
+
+
+class ApplyElectionResultForm(forms.Form):
+    """Form to select winners of an election, and automatically apply the results."""
+
+    candidates = ElectionWinnerChoiceField(Candidature.objects.none())
+
+    def __init__(self, *args, election: Election, **kwargs):
+        self.election = election
+        super().__init__(*args, **kwargs)
+        qs = Candidature.objects.filter(
+            role__election=election, role__club_role__isnull=False
+        )
+        # pass all candidates to the ModelChoiceField ;
+        # its inner choice iterator will take care of filtering only the winners.
+        self.fields["candidates"].queryset = qs
+        # By default, mark every candidate as selected.
+        # Election results are usually completely validated during the AG,
+        # so it makes more sense UX-wise to eventually unselect a candidate
+        # than to select everyone.
+        self.fields["candidates"].initial = qs.values_list("id", flat=True)
+
+    def save(self):
+        if self.errors:
+            return
+        candidates: list[Candidature] = list(self.cleaned_data["candidates"])
+        with transaction.atomic():
+            Membership.objects.filter(
+                role__in=[c.role.club_role for c in candidates],
+                end_date=None,
+                start_date__lt=self.election.end_date,
+            ).update(end_date=localdate())
+            memberships = [
+                Membership(
+                    user_id=c.user_id,
+                    club_id=c.role.club_role.club_id,
+                    role=c.role.club_role,
+                )
+                for c in candidates
+            ]
+            Membership.objects.bulk_create(memberships)
+            Membership._add_club_groups(memberships)

election/migrations/0006_role_club_role_alter_role_description.py

@@ -0,0 +1,62 @@
+# Generated by Django 5.2.14 on 2026-05-30 20:00
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("club", "0017_linktype_clublink"),
+        ("election", "0005_alter_candidature_program_alter_candidature_user"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="election",
+            name="clubs",
+            field=models.ManyToManyField(
+                help_text="The club(s) this election is held for.",
+                related_name="elections",
+                to="club.club",
+                verbose_name="clubs",
+            ),
+        ),
+        migrations.AddField(
+            model_name="role",
+            name="club_role",
+            field=models.ForeignKey(
+                blank=True,
+                help_text=(
+                    "A club role. Filling this will allow automatic "
+                    "completion of title and description, "
+                    "and automatic assignation after the elections."
+                ),
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="election_roles",
+                to="club.clubrole",
+                verbose_name="club role",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="role",
+            name="description",
+            field=models.TextField(blank=True, default="", verbose_name="description"),
+        ),
+        migrations.AlterField(
+            model_name="role",
+            name="max_choice",
+            field=models.PositiveSmallIntegerField(
+                default=1, verbose_name="max choice"
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="role",
+            constraint=models.UniqueConstraint(
+                fields=("title", "election"),
+                name="title_election_unique_constraint",
+                violation_error_code="invalid",
+                violation_error_message="This role already exists for this election",
+            ),
+        ),
+    ]

election/models.py

@@ -5,6 +5,7 @@ from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from ordered_model.models import OrderedModel
 
+from club.models import Club, ClubRole, Membership
 from core.models import Group, User
 
 
@@ -13,6 +14,12 @@ class Election(models.Model):
 
     title = models.CharField(_("title"), max_length=255)
     description = models.TextField(_("description"), null=True, blank=True)
+    clubs = models.ManyToManyField(
+        Club,
+        related_name="elections",
+        verbose_name=_("clubs"),
+        help_text=_("The club(s) this election is held for."),
+    )
     start_candidature = models.DateTimeField(_("start candidature"), blank=False)
     end_candidature = models.DateTimeField(_("end candidature"), blank=False)
     start_date = models.DateTimeField(_("start date"), blank=False)
@@ -94,9 +101,18 @@ class Election(models.Model):
             results[role.title] = role.results(total_vote)
         return results
 
+    @cached_property
+    def results_applied(self) -> bool:
+        """Returns True if one or more roles of this election have been applied."""
+        return Membership.objects.filter(
+            role__election_roles__election=self,
+            end_date=None,
+            start_date__gte=self.end_date,
+        ).exists()
+
 
 class Role(OrderedModel):
-    """This class allows to create a new role avaliable for a candidature."""
+    """This class allows to create a new role available for a candidature."""
 
     election = models.ForeignKey(
         Election,
@@ -105,17 +121,42 @@ class Role(OrderedModel):
         on_delete=models.CASCADE,
     )
     title = models.CharField(_("title"), max_length=255)
-    description = models.TextField(_("description"), null=True, blank=True)
+    description = models.TextField(_("description"), default="", blank=True)
-    max_choice = models.IntegerField(_("max choice"), default=1)
+    max_choice = models.PositiveSmallIntegerField(_("max choice"), default=1)
+    club_role = models.ForeignKey(
+        ClubRole,
+        related_name="election_roles",
+        verbose_name=_("club role"),
+        help_text=_(
+            "A club role. Filling this will allow automatic "
+            "completion of title and description, "
+            "and automatic assignation after the elections."
+        ),
+        on_delete=models.CASCADE,
+        null=True,
+        blank=True,
+    )
+
+    order_with_respect_to = "election"
+
+    class Meta(OrderedModel.Meta):
+        constraints = [
+            models.UniqueConstraint(
+                fields=["title", "election"],
+                name="title_election_unique_constraint",
+                violation_error_message=_("This role already exists for this election"),
+                violation_error_code="invalid",
+            )
+        ]
 
     def __str__(self):
         return f"{self.title} - {self.election.title}"
 
     def results(self, total_vote: int) -> dict[str, dict[str, int | float]]:
         if total_vote == 0:
-            candidates = self.candidatures.values_list("user__username")
+            candidates = self.candidatures.values_list("user__username", flat=True)
             return {
-                key: {"vote": 0, "percent": 0} for key in ["blank_votes", *candidates]
+                key: {"vote": 0, "percent": 0} for key in ["blank vote", *candidates]
             }
         total_vote *= self.max_choice
         results = {"total vote": total_vote}

election/templates/election/election_detail.jinja

@@ -29,13 +29,25 @@
         {% trans %}Polls closed {% endtrans %}
       {%- else %}
         {% trans %}Polls will open {% endtrans %}
-        <time datetime="{{ election.start_date }}">{{ election.start_date|localtime|date(DATETIME_FORMAT)}}</time>
+        <time datetime="{{ election.start_date }}">{{ election.start_date|localtime|date(DATETIME_FORMAT) }}</time>
-        {% trans %} at {% endtrans %}<time>{{ election.start_date|localtime|time(DATETIME_FORMAT)}}</time>
+        {% trans %}at{% endtrans %}
+        <time>{{ election.start_date|localtime|time(DATETIME_FORMAT) }}</time>
         {% trans %}and will close {% endtrans %}
       {%- endif %}
-      <time datetime="{{ election.end_date }}">{{ election.end_date|localtime|date(DATETIME_FORMAT)}}</time>
+      <time datetime="{{ election.end_date }}">{{ election.end_date|localtime|date(DATETIME_FORMAT) }}</time>
-      {% trans %} at {% endtrans %}<time>{{ election.end_date|localtime|time(DATETIME_FORMAT)}}</time>
+      {% trans %}at{% endtrans %}
+      <time>{{ election.end_date|localtime|time(DATETIME_FORMAT) }}</time>
     </p>
+    {%- if election.is_vote_finished and user.can_edit(election) %}
+      <details class="accordion" name="apply-result">
+        <summary>{% trans %}Apply election result{% endtrans %}</summary>
+        <div
+          class="accordion-content aria-busy-grow"
+          hx-get="{{ url("election:apply_result", election_id=election.id) }}"
+          hx-trigger="toggle from:closest details once"
+        ></div>
+      </details>
+    {% endif %}
     {%- if user_has_voted %}
       <p class="election__elector-infos">
         {%- if election.is_vote_active %}
@@ -47,17 +59,27 @@
     {%- endif %}
   </section>
   <section class="election_vote">
-    <form action="{{ url('election:vote', election.id) }}" method="post" class="election__vote-form" name="vote-form" id="vote-form">
+    <form
+      action="{{ url('election:vote', election.id) }}"
+      method="post"
+      class="election__vote-form"
+      name="vote-form"
+      id="vote-form"
+    >
       {% csrf_token %}
       <table class="election_table">
         <thead class="lists">
           <tr>
-            <th class="column" style="width: {{ 100 / (election_lists|length + 1) }}%">{% trans %}Blank vote{% endtrans %}</th>
+            <th class="column" style="width: {{ 100 / (election_lists|length + 1) }}%">
+              {% trans %}Blank vote{% endtrans %}
+            </th>
             {%- for election_list in election_lists %}
               <th class="column" style="width: {{ 100 / (election_lists|length + 1) }}%">
                 <span>{{ election_list.title }}</span>
                 {% if user.can_edit(election_list) and election.is_vote_editable -%}
-                  <a href="{{ url('election:delete_list', list_id=election_list.id) }}"><i class="fa-regular fa-trash-can delete-action"></i></a>
+                  <a href="{{ url('election:delete_list', list_id=election_list.id) }}">
+                    <i class="fa-regular fa-trash-can delete-action"></i>
+                  </a>
                 {% endif %}
               </th>
             {%- endfor %}
@@ -103,22 +125,45 @@
                       <button disabled><i class="fa fa-arrow-down"></i></button>
                       <button disabled><i class="fa fa-caret-down"></i></button>
                     {%- else -%}
-                      <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=bottom');"><i class="fa fa-arrow-down"></i></button>
+                      <button
-                      <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=down');"><i class="fa fa-caret-down"></i></button>
+                        type="button"
+                        onclick="window.location.replace('?role={{ role.id }}&action=bottom');"
+                      >
+                        <i class="fa fa-arrow-down"></i>
+                      </button>
+                      <button
+                        type="button"
+                        onclick="window.location.replace('?role={{ role.id }}&action=down');"
+                      >
+                        <i class="fa fa-caret-down"></i>
+                      </button>
                     {%- endif -%}
                     {%- if loop.first -%}
                       <button disabled><i class="fa fa-caret-up"></i></button>
                       <button disabled><i class="fa fa-arrow-up"></i></button>
                     {%- else -%}
-                      <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=up');"><i class="fa fa-caret-up"></i></button>
+                      <button
-                      <button type="button" onclick="window.location.replace('?role={{ role.id }}&action=top');"><i class="fa fa-arrow-up"></i></button>
+                        type="button"
+                        onclick="window.location.replace('?role={{ role.id }}&action=up');"
+                      >
+                        <i
+                          class="fa fa-caret-up"></i>
+                      </button>
+                      <button
+                        type="button"
+                        onclick="window.location.replace('?role={{ role.id }}&action=top');"
+                      ><i class="fa fa-arrow-up"></i>
+                      </button>
                     {%- endif -%}
                   </div>
                 {%- endif -%}
               </td>
             </tr>
             <tr class="role_candidates">
-              <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%">
+              <td
+                class="list_per_role"
+                style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%"
+              >
                 {%- if role.max_choice == 1 and show_vote_buttons %}
                   <div class="radio-btn">
                     {% set input_id = "blank_vote_" + role.id|string %}
@@ -131,26 +176,46 @@
                 {%- if election.is_vote_finished %}
                   {%- set results = election_results[role.title]['blank vote'] %}
                   <div class="election__results">
-                    <strong>{{ results.vote }} {% trans %}votes{% endtrans %} ({{ "%.2f" % results.percent }} %)</strong>
+                    <strong>
+                      {{ results.vote }} {% trans %}votes{% endtrans %} ({{ "%.2f" % results.percent }} %)
+                    </strong>
                   </div>
                 {%- endif %}
               </td>
               {%- for election_list in election_lists %}
-                <td class="list_per_role" style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%">
+                <td
+                  class="list_per_role"
+                  style="width: 100%; max-width: {{ 100 / (election_lists|length + 1) }}%"
+                >
                   <ul class="candidates">
                     {%- for candidature in election_list.candidatures.select_related("user", "user__profile_pict").filter(role=role) %}
                       <li class="candidate">
                         {%- if show_vote_buttons %}
                           {% set input_id = "candidature_" + candidature.id|string %}
-                          <input id="{{ input_id }}" type="{{ 'checkbox' if role.max_choice > 1 else 'radio' }}" {{ 'checked' if candidature.id|string in role_data else '' }} {{ 'disabled' if user_has_voted else '' }} name="{{ role.title }}" value="{{ candidature.id }}">
+                          <input
+                            id="{{ input_id }}"
+                            type="{{ 'checkbox' if role.max_choice > 1 else 'radio' }}"
+                            {% if candidature.id|string in role_data %}checked{% endif %}
+                            {% if user_has_voted %}disabled{% endif %}
+                            name="{{ role.title }}"
+                            value="{{ candidature.id }}"
+                          >
                           <label for="{{ input_id }}">
                         {%- endif %}
                         <figure>
                           {%- if user.can_view(candidature.user) %}
                             {% if candidature.user.profile_pict %}
-                              <img class="candidate__picture" src="{{ candidature.user.profile_pict.get_download_url() }}" alt="{% trans %}Profile{% endtrans %}">
+                              <img
+                                class="candidate__picture"
+                                src="{{ candidature.user.profile_pict.get_download_url() }}"
+                                alt="{% trans %}Profile{% endtrans %}"
+                              >
                             {% else %}
-                              <img class="candidate__picture" src="{{ static('core/img/unknown.jpg') }}" alt="{% trans %}Profile{% endtrans %}">
+                              <img
+                                class="candidate__picture"
+                                src="{{ static('core/img/unknown.jpg') }}"
+                                alt="{% trans %}Profile{% endtrans %}"
+                              >
                             {% endif %}
                           {%- endif %}
                           <figcaption class="candidate__details">
@@ -164,8 +229,12 @@
                           {%- if user.can_edit(candidature) -%}
                             {%- if election.is_vote_editable -%}
                               <div class="edit_btns">
-                                <a href="{{url('election:update_candidate', candidature_id=candidature.id)}}"><i class="fa-regular fa-pen-to-square edit-action"></i>️</a>
+                                <a href="{{ url('election:update_candidate', candidature_id=candidature.id) }}">
-                                <a href="{{url('election:delete_candidate', candidature_id=candidature.id)}}"><i class="fa-regular fa-trash-can delete-action"></i></a>
+                                  <i class="fa-regular fa-pen-to-square edit-action"></i>
+                                </a>
+                                <a href="{{ url('election:delete_candidate', candidature_id=candidature.id) }}">
+                                  <i class="fa-regular fa-trash-can delete-action"></i>
+                                </a>
                               </div>
                             {%- endif -%}
                           {%- endif -%}

election/templates/election/election_list.jinja

@@ -7,7 +7,7 @@
 
 {% block head %}
   {{ super() -}}
-  <style type="text/css">
+  <style>
     small {
       font-size: smaller;
     }
@@ -20,6 +20,9 @@
 
 {% block content %}
   <h3>{% trans %}Current elections{% endtrans %}</h3>
+  <a class="btn btn-blue" href="{{ url("election:create") }}">
+    <i class="fa fa-plus"></i>{% trans %}New election{% endtrans %}
+  </a>
   {%- for election in object_list %}
     <hr>
     <section>
@@ -32,7 +35,7 @@
         {% trans %} at {% endtrans %}<time>{{ election.start_candidature|localtime|time(DATETIME_FORMAT) }}</time>
         {% trans %}to{% endtrans %}
         <time datetime="{{ election.end_candidature }}">{{ election.end_candidature|localtime|date(DATETIME_FORMAT) }}</time>
-        {% trans %} at {% endtrans %}<time>{{ election.end_candidature|time(DATETIME_FORMAT) }}</time>
+        {% trans %} at {% endtrans %}<time>{{ election.end_candidature|localtime|time(DATETIME_FORMAT) }}</time>
       </p>
       <p>
         {% trans %}Polls open from{% endtrans %}

election/templates/election/fragments/apply_result.jinja

@@ -0,0 +1,51 @@
+<div id="apply-election-result-fragment">
+  {% if not form.candidates.field.choices %}
+    <em>{% trans %}No result to apply{% endtrans %}</em>
+    <p>
+      {% trans trimmed %}
+        This may be because no role of this election
+        was linked to a club role.
+      {% endtrans %}
+    </p>
+  {% elif form.election.results_applied %}
+    <em>
+      {%- trans trimmed -%}
+        The results of this election have been applied
+      {%- endtrans -%}
+    </em>
+    <p>
+      {% for club in clubs %}
+        <a href="{{ url("club:club_members", club_id=club.id) }}" class="btn btn-blue">
+          <i class="fa fa-arrow-up-right-from-square"></i>
+          {% trans club=club.name %}{{ club }} members{% endtrans %}
+        </a>
+      {% endfor %}
+    </p>
+  {% else %}
+    <div class="alert alert-yellow">
+      <div class="alert-main">
+        <strong class="alert-title">{% trans %}Warning{% endtrans %}</strong>
+        <p>
+          {%- trans trimmed -%}
+            Only election roles linked to a club role will be automatically applied.
+          {%- endtrans -%}
+        </p>
+        <p>
+          {%- trans trimmed -%}
+            Don't forget to manually apply the eventual remaining roles afterward.
+          {%- endtrans -%}
+        </p>
+      </div>
+    </div>
+    <form
+      hx-post="{{ url("election:apply_result", election_id=form.election.id) }}"
+      hx-swap="outerHTML"
+      hx-target="#apply-election-result-fragment"
+      hx-disabled-elt="find input[type='submit']"
+    >
+      {% csrf_token %}
+      {{ form }}
+      <input type="submit" class="btn btn-blue">
+    </form>
+  {% endif %}
+</div>

election/templates/election/role_form.jinja

@@ -0,0 +1,53 @@
+{% extends "core/base.jinja" %}
+
+{% block title %}
+  {% trans name=object_name %}Election role{% endtrans %}
+{% endblock %}
+
+{% block content %}
+  {% if object %}
+    <h1>{% trans election=election %}Create role for election "{{ election }}"{% endtrans %}</h1>
+  {% else %}
+    <h1>{% trans election=election %}Edit role for election "{{ election }}"{% endtrans %}</h1>
+  {% endif %}
+  <form action="" method="post" x-data="{role: null, title: '', description: ''}">
+    {% csrf_token %}
+    <div class="form-group">
+      {{ form.club_role.label_tag() }}
+      {{ form.club_role.errors }}
+      {{ form.club_role|add_attr("x-model.fill=role,autofocus=true") }}
+      <button
+        class="btn btn-blue"
+        @click.prevent="title = roles[role]?.title ?? '';
+                        description = roles[role]?.description ?? '';"
+      >
+        {% trans %}autofill form{% endtrans %}
+      </button>
+      <span class="helptext">{{ form.club_role.help_text }}</span>
+    </div>
+    <div class="form-group">
+      {{ form.title.label_tag() }}
+      {{ form.title.errors }}
+      {{ form.title|add_attr("x-model.fill=title") }}
+    </div>
+    <div class="form-group">
+      {{ form.description.label_tag() }}
+      {{ form.description.errors }}
+      {{ form.description|add_attr("x-model.fill=description") }}
+    </div>
+    <div class="form-group">
+      {{ form.max_choice.as_field_group() }}
+    </div>
+    <p><input type="submit" value="{% trans %}Save{% endtrans %}" /></p>
+  </form>
+{% endblock %}
+
+{% block script %}
+  <script>
+    const roles = {
+      {%- for role in form.club_role.field.queryset -%}
+        {{ role.id }}: { title: {{ role.name|tojson }}, description: {{ role.description|tojson }} },
+      {%- endfor -%}
+    };
+  </script>
+{% endblock %}

election/tests/test_apply_result.py

@@ -0,0 +1,191 @@
+import itertools
+from datetime import timedelta
+
+from bs4 import BeautifulSoup
+from django.contrib.auth.models import Permission
+from django.test import TestCase
+from django.urls import reverse
+from django.utils.timezone import localdate, now
+from model_bakery import baker, seq
+from model_bakery.recipe import Recipe
+from pytest_django.asserts import assertRedirects
+
+from club.models import Club, ClubRole, Membership
+from core.baker_recipes import subscriber_user
+from core.models import Group, User
+from election.models import Candidature, Election, ElectionList, Role, Vote
+
+
+class TestApplyResult(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        # setup is a little bit complicated, but we have to make a whole
+        # election to test result application, including the election,
+        # the lists, the roles, the candidates and the votes.
+        cls.club = baker.make(Club)
+        cls.club_roles = baker.make(
+            ClubRole,
+            club=cls.club,
+            is_presidency=iter([True, False, False]),
+            is_board=True,
+            _quantity=3,
+            _bulk_create=True,
+        )
+        cls.election = baker.make(
+            Election,
+            clubs=[cls.club],
+            edit_groups=[baker.make(Group)],
+            end_date=now() - timedelta(minutes=1),
+        )
+        lists = baker.make(
+            ElectionList, election=cls.election, _quantity=2, _bulk_create=True
+        )
+        role_recipe = Recipe(Role, election=cls.election, title=seq("election role "))
+        roles = [
+            *role_recipe.make(
+                club_role=iter(cls.club_roles), _quantity=len(cls.club_roles)
+            ),
+            role_recipe.make(),
+        ]
+        roles[1].max_choice = 2
+        roles[1].save()
+        cls.candidatures = baker.make(
+            Candidature,
+            election_list=itertools.chain(
+                itertools.repeat(lists[0], len(roles)),
+                itertools.repeat(lists[1], len(roles)),
+            ),
+            role=itertools.cycle(roles),
+            user=iter(
+                baker.make(
+                    User, username=seq("user "), _quantity=len(lists) * len(roles)
+                )
+            ),
+            _quantity=len(lists) * len(roles),
+            _bulk_create=True,
+        )
+        votes = iter(
+            baker.make(
+                Vote,
+                role=itertools.cycle(roles),
+                _quantity=6 * len(roles),
+                _bulk_create=True,
+            )
+        )
+        through = []
+        for cand in cls.candidatures:
+            nb_voices = 4 if cand.election_list_id == lists[0].id else 2
+            through.extend(
+                [
+                    Vote.candidature.through(candidature=cand, vote=v)
+                    for v in itertools.islice(votes, nb_voices)
+                ]
+            )
+        Vote.candidature.through.objects.bulk_create(through)
+        cls.election.voters.set(baker.make(User, _quantity=8, _bulk_create=True))
+        cls.url = reverse(
+            "election:apply_result", kwargs={"election_id": cls.election.id}
+        )
+
+    def test_election_result(self):
+        # we have made a complex setup, so testing the results is
+        # useful to be sure we didn't make mistake when generating data
+        assert self.election.results == {
+            "election role 1": {
+                "blank vote": {"percent": 25.0, "vote": 2},
+                "total vote": 8,
+                "user 1": {"percent": 50.0, "vote": 4},
+                "user 5": {"percent": 25.0, "vote": 2},
+            },
+            "election role 2": {
+                "blank vote": {"percent": 62.5, "vote": 10},
+                "total vote": 16,
+                "user 2": {"percent": 25.0, "vote": 4},
+                "user 6": {"percent": 12.5, "vote": 2},
+            },
+            "election role 3": {
+                "blank vote": {"percent": 25.0, "vote": 2},
+                "total vote": 8,
+                "user 3": {"percent": 50.0, "vote": 4},
+                "user 7": {"percent": 25.0, "vote": 2},
+            },
+            "election role 4": {
+                "blank vote": {"percent": 25.0, "vote": 2},
+                "total vote": 8,
+                "user 4": {"percent": 50.0, "vote": 4},
+                "user 8": {"percent": 25.0, "vote": 2},
+            },
+        }
+
+    def test_apply_result(self):
+        user = baker.make(
+            User, user_permissions=[Permission.objects.get(codename="add_membership")]
+        )
+        self.client.force_login(user)
+        response = self.client.get(self.url)
+        soup = BeautifulSoup(response.text, "lxml")
+        inputs = soup.find_all("input", attrs={"type": "checkbox"})
+        assert all("checked" in i.attrs for i in inputs)
+        ids = {int(i.attrs["value"]) for i in inputs}
+        assert ids == {
+            self.candidatures[0].id,
+            self.candidatures[1].id,
+            self.candidatures[2].id,
+            self.candidatures[5].id,
+        }
+        response = self.client.post(
+            self.url, data={"candidates": ids.difference({self.candidatures[5].id})}
+        )
+        assertRedirects(response, self.url)
+        for candidate in self.candidatures[0:3]:
+            assert Membership.objects.filter(
+                start_date=localdate(),
+                end_date=None,
+                user=candidate.user,
+                role=candidate.role.club_role,
+            ).exists()
+            assert self.club.members_group.users.contains(candidate.user)
+            assert self.club.board_group.users.contains(candidate.user)
+        # candidatures[5] was unchecked, so it shouldn't receive a club role
+        assert not self.candidatures[5].user.memberships.exists()
+
+        # now that results are applied, it shouldn't be possible to replay the request
+        response = self.client.get(self.url)
+        assert "Les résultats de cette élection ont été appliqués" in response.text
+        response = self.client.post(self.url, data={"candidates": ids})
+        assert response.status_code == 403
+
+    def test_no_result_to_apply(self):
+        self.election.roles.update(club_role=None)
+        user = baker.make(
+            User, user_permissions=[Permission.objects.get(codename="add_membership")]
+        )
+        self.client.force_login(user)
+        response = self.client.get(self.url)
+        soup = BeautifulSoup(response.text, "lxml")
+        assert not soup.find("input", attrs={"type": "checkbox"})
+        assert "Pas de résultats à appliquer" in response.text
+
+    def test_access_denied(self):
+        user = subscriber_user.make()
+        self.client.force_login(user)
+        response = self.client.get(self.url)
+        assert response.status_code == 403
+        response = self.client.post(
+            self.url, data={"candidates": [self.candidatures[0].id]}
+        )
+        assert response.status_code == 403
+
+    def test_election_not_finished(self):
+        user = baker.make(
+            User, user_permissions=[Permission.objects.get(codename="add_membership")]
+        )
+        self.election.end_date = now() + timedelta(minutes=1)
+        self.election.save()
+        self.client.force_login(user)
+        response = self.client.get(self.url)
+        assert response.status_code == 403
+        response = self.client.post(
+            self.url, data={"candidates": [self.candidatures[0].id]}
+        )
+        assert response.status_code == 403

election/tests/test_election.py

@@ -2,13 +2,15 @@ from datetime import timedelta
 
 import pytest
 from django.conf import settings
+from django.contrib.auth.models import Permission
 from django.test import Client, TestCase
 from django.urls import reverse
-from django.utils.timezone import now
+from django.utils.timezone import localtime, now
 from model_bakery import baker
 from model_bakery.recipe import Recipe
 from pytest_django.asserts import assertRedirects
 
+from club.models import Club
 from core.baker_recipes import subscriber_user
 from core.models import Group, User
 from election.models import Candidature, Election, ElectionList, Role, Vote
@@ -38,7 +40,6 @@ class TestElectionDetail(TestElection):
             reverse("election:detail", args=str(self.election.id))
         )
         assert response.status_code == 200
-        assert "La roue tourne" in str(response.content)
 
 
 class TestElectionUpdateView(TestElection):
@@ -213,3 +214,42 @@ def test_election_results():
             "total vote": 100,
         },
     }
+
+
+@pytest.mark.django_db
+def test_create_election(client: Client):
+    user_group = baker.make(Group)
+    user = baker.make(
+        User,
+        user_permissions=[Permission.objects.get(codename="add_election")],
+        groups=[user_group],
+    )
+    club = baker.make(Club)
+    client.force_login(user)
+    url = reverse("election:create")
+
+    res = client.get(url)
+    assert res.status_code == 200
+
+    start = localtime().replace(hour=0, minute=1, second=0) + timedelta(days=1)
+    res = client.post(
+        url,
+        data={
+            "title": "foo",
+            "clubs": [club.id],
+            "view_groups": [user_group.id],
+            "start_candidature": start,
+            "end_candidature": start + timedelta(days=7, minutes=-2),
+            "start_date": start + timedelta(days=7),
+            "end_date": start + timedelta(days=14, minutes=-2),
+        },
+    )
+    election = Election.objects.last()
+    assertRedirects(
+        res, reverse("election:detail", kwargs={"election_id": election.id})
+    )
+    assert election.title == "foo"
+    assert list(election.clubs.all()) == [club]
+    assert list(election.election_lists.values_list("title", flat=True)) == [
+        "Candidat⸱e libre"
+    ]

election/tests/test_role.py

@@ -0,0 +1,110 @@
+from datetime import timedelta
+
+import pytest
+from django.conf import settings
+from django.contrib.auth.models import Permission
+from django.test import TestCase
+from django.urls import reverse
+from django.utils.timezone import now
+from model_bakery import baker
+from pytest_django.asserts import assertRedirects
+
+from club.models import Club, ClubRole
+from core.baker_recipes import subscriber_user
+from core.models import Group, User
+from election.models import Election, Role
+
+
+@pytest.mark.django_db
+class TestCreateRole(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.club = baker.make(Club)
+        cls.edit_group = baker.make(Group)
+        cls.election = baker.make(
+            Election,
+            clubs=[cls.club],
+            edit_groups=[cls.edit_group],
+            view_groups=[Group.objects.get(id=settings.SITH_GROUP_PUBLIC_ID)],
+            end_candidature=now() + timedelta(days=1),
+        )
+        cls.url = reverse(
+            "election:create_role", kwargs={"election_id": cls.election.id}
+        )
+        cls.election_url = reverse(
+            "election:detail", kwargs={"election_id": cls.election.id}
+        )
+        cls.permission = Permission.objects.get(codename="add_role")
+
+    def assert_role_creation_ok(self):
+        response = self.client.get(self.url)
+        assert response.status_code == 200
+        response = self.client.post(self.url, data={"title": "foo", "max_choice": 1})
+        assertRedirects(response, self.election_url)
+        roles = list(self.election.roles.all())
+        assert len(roles) == 1
+        assert roles[0].title == "foo"
+
+    def assert_role_creation_denied(self):
+        initial_role_count = self.election.roles.count()
+        response = self.client.get(self.url)
+        assert response.status_code == 403
+        response = self.client.post(self.url, data={"title": "foo", "max_choice": 1})
+        assert response.status_code == 403
+        assert self.election.roles.count() == initial_role_count
+
+    def test_admin(self):
+        user = baker.make(User, user_permissions=[self.permission])
+        self.client.force_login(user)
+        self.assert_role_creation_ok()
+
+    def test_edit_group(self):
+        user = baker.make(User, groups=[self.edit_group])
+        self.client.force_login(user)
+        self.assert_role_creation_ok()
+
+    def test_role_linked_to_club_role(self):
+        user = baker.make(User, user_permissions=[self.permission])
+        self.client.force_login(user)
+        club_role = baker.make(ClubRole, is_board=True, club=self.club)
+        response = self.client.post(
+            self.url, data={"title": "foo", "max_choice": 1, "club_role": club_role.id}
+        )
+        assertRedirects(response, self.election_url)
+        roles = list(self.election.roles.all())
+        assert len(roles) == 1
+        assert roles[0].title == "foo"
+        assert roles[0].club_role == club_role
+
+    def test_permission_denied(self):
+        user = subscriber_user.make()
+        self.client.force_login(user)
+        self.assert_role_creation_denied()
+
+    def test_election_not_editable(self):
+        user = baker.make(User, user_permissions=[self.permission])
+        self.election.end_candidature = now() - timedelta(minutes=1)
+        self.election.save()
+        self.client.force_login(user)
+        self.assert_role_creation_denied()
+
+
+class TestUpdateRole(TestCreateRole):
+    @classmethod
+    def setUpTestData(cls):
+        # TestUpdateRole is just TestCreateRole, but with different parameters
+        cls.club = baker.make(Club)
+        cls.edit_group = baker.make(Group)
+        cls.election = baker.make(
+            Election,
+            clubs=[cls.club],
+            edit_groups=[cls.edit_group],
+            view_groups=[Group.objects.get(id=settings.SITH_GROUP_PUBLIC_ID)],
+            end_candidature=now() + timedelta(days=1),
+        )
+        cls.role = baker.make(Role, election=cls.election)
+        cls.url = reverse("election:update_role", kwargs={"role_id": cls.role.id})
+        cls.election_url = reverse(
+            "election:detail", kwargs={"election_id": cls.election.id}
+        )
+        cls.permission = Permission.objects.get(codename="change_role")

election/urls.py

@@ -1,6 +1,7 @@
 from django.urls import path
 
 from election.views import (
+    ApplyResultFragment,
     CandidatureCreateView,
     CandidatureDeleteView,
     CandidatureUpdateView,
@@ -56,4 +57,9 @@ urlpatterns = [
     ),
     path("<int:election_id>/vote/", VoteFormView.as_view(), name="vote"),
     path("<int:election_id>/detail/", ElectionDetailView.as_view(), name="detail"),
+    path(
+        "fragment/<int:election_id>/apply/",
+        ApplyResultFragment.as_view(),
+        name="apply_result",
+    ),
 ]

election/views.py

@@ -18,7 +18,9 @@ from django.views.generic.edit import CreateView, DeleteView, FormView, UpdateVi
 
 from core.auth.mixins import CanEditMixin, CanViewMixin
 from election.forms import (
+    ApplyElectionResultForm,
     CandidateForm,
+    ElectionCreateForm,
     ElectionForm,
     ElectionListForm,
     RoleForm,
@@ -208,7 +210,7 @@ class CandidatureCreateView(LoginRequiredMixin, CreateView):
 
 class ElectionCreateView(PermissionRequiredMixin, CreateView):
     model = Election
-    form_class = ElectionForm
+    form_class = ElectionCreateForm
     template_name = "core/create.jinja"
     permission_required = "election.add_election"
 
@@ -219,7 +221,7 @@ class ElectionCreateView(PermissionRequiredMixin, CreateView):
 class RoleCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
     model = Role
     form_class = RoleForm
-    template_name = "core/create.jinja"
+    template_name = "election/role_form.jinja"
 
     @cached_property
     def election(self):
@@ -228,22 +230,17 @@ class RoleCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
     def test_func(self):
         if not self.election.is_vote_editable:
             return False
-        if self.request.user.has_perm("election.add_role"):
+        user = self.request.user
-            return True
+        return user.has_perm("election.add_role") or user.can_edit(self.election)
-        return self.election.edit_groups.filter(
-            id__in=self.request.user.all_groups
-        ).exists()
-
-    def get_initial(self):
-        return {"election": self.election}
 
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"election_id": self.election.id}
+        return super().get_form_kwargs() | {"election": self.election}
 
     def get_success_url(self, **kwargs):
-        return reverse(
+        return reverse("election:detail", kwargs={"election_id": self.election.id})
-            "election:detail", kwargs={"election_id": self.object.election_id}
+
-        )
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {"election": self.election}
 
 
 class ElectionListCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
@@ -267,16 +264,11 @@ class ElectionListCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView
         )
         return not groups.isdisjoint(self.request.user.all_groups.keys())
 
-    def get_initial(self):
-        return {"election": self.election}
-
     def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"election_id": self.election.id}
+        return super().get_form_kwargs() | {"election": self.election}
 
     def get_success_url(self, **kwargs):
-        return reverse(
+        return reverse("election:detail", kwargs={"election_id": self.election.id})
-            "election:detail", kwargs={"election_id": self.object.election_id}
-        )
 
 
 # Update view
@@ -288,18 +280,6 @@ class ElectionUpdateView(CanEditMixin, UpdateView):
     template_name = "core/edit.jinja"
     pk_url_kwarg = "election_id"
 
-    def get_initial(self):
-        return {
-            "start_date": self.object.start_date.strftime("%Y-%m-%d %H:%M:%S"),
-            "end_date": self.object.end_date.strftime("%Y-%m-%d %H:%M:%S"),
-            "start_candidature": self.object.start_candidature.strftime(
-                "%Y-%m-%d %H:%M:%S"
-            ),
-            "end_candidature": self.object.end_candidature.strftime(
-                "%Y-%m-%d %H:%M:%S"
-            ),
-        }
-
     def get_success_url(self, **kwargs):
         return reverse_lazy("election:detail", kwargs={"election_id": self.object.id})
 
@@ -324,48 +304,30 @@ class CandidatureUpdateView(LoginRequiredMixin, CanEditMixin, UpdateView):
         )
 
 
-class RoleUpdateView(CanEditMixin, UpdateView):
+class RoleUpdateView(UserPassesTestMixin, UpdateView):
     model = Role
     form_class = RoleForm
-    template_name = "core/edit.jinja"
+    template_name = "election/role_form.jinja"
     pk_url_kwarg = "role_id"
 
-    def dispatch(self, request, *arg, **kwargs):
+    @cached_property
-        self.object = self.get_object()
+    def election(self):
-        if not self.object.election.is_vote_editable:
+        return self.get_object().election
-            raise PermissionDenied
-        return super().dispatch(request, *arg, **kwargs)
 
-    def remove_fields(self):
+    def test_func(self):
-        self.form.fields.pop("election", None)
+        if not self.election.is_vote_editable:
+            return False
+        user = self.request.user
+        return user.has_perm("election.change_role") or user.can_edit(self.election)
 
-    def get(self, request, *args, **kwargs):
+    def get_context_data(self, **kwargs):
-        self.object = self.get_object()
+        return super().get_context_data(**kwargs) | {"election": self.election}
-        self.form = self.get_form()
-        self.remove_fields()
-        return self.render_to_response(self.get_context_data(form=self.form))
-
-    def post(self, request, *args, **kwargs):
-        self.object = self.get_object()
-        self.form = self.get_form()
-        self.remove_fields()
-        if (
-            request.user.is_authenticated
-            and request.user.can_edit(self.object)
-            and self.form.is_valid()
-        ):
-            return super().form_valid(self.form)
-        return self.form_invalid(self.form)
 
     def get_form_kwargs(self):
-        kwargs = super().get_form_kwargs()
+        return super().get_form_kwargs() | {"election": self.election}
-        kwargs["election_id"] = self.object.election.id
-        return kwargs
 
     def get_success_url(self, **kwargs):
-        return reverse_lazy(
+        return reverse("election:detail", kwargs={"election_id": self.election.id})
-            "election:detail", kwargs={"election_id": self.object.election.id}
-        )
 
 
 # Delete Views
@@ -425,3 +387,41 @@ class ElectionListDeleteView(CanEditMixin, DeleteView):
 
     def get_success_url(self, **kwargs):
         return reverse("election:detail", kwargs={"election_id": self.election.id})
+
+
+class ApplyResultFragment(LoginRequiredMixin, UserPassesTestMixin, FormView):
+    template_name = "election/fragments/apply_result.jinja"
+    form_class = ApplyElectionResultForm
+
+    @cached_property
+    def election(self):
+        return get_object_or_404(Election, pk=self.kwargs["election_id"])
+
+    def test_func(self):
+        if not self.election.is_vote_finished:
+            return False
+        if self.request.user.has_perm("club.add_membership"):
+            return True
+        return self.election.edit_groups.filter(
+            id__in=self.request.user.all_groups
+        ).exists()
+
+    def post(self, request, *args, **kwargs):
+        if self.election.results_applied:
+            raise PermissionDenied
+        return super().post(request, *args, **kwargs)
+
+    def get_form_kwargs(self):
+        return super().get_form_kwargs() | {"election": self.election}
+
+    def form_valid(self, form: ApplyElectionResultForm):
+        form.save()
+        return super().form_valid(form)
+
+    def get_context_data(self, **kwargs):
+        return super().get_context_data(**kwargs) | {"clubs": self.election.clubs.all()}
+
+    def get_success_url(self, **kwargs):
+        return reverse(
+            "election:apply_result", kwargs={"election_id": self.election.id}
+        )

locale/fr/LC_MESSAGES/django.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-12 11:12+0200\n"
+"POT-Creation-Date: 2026-06-10 20:18+0200\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -141,8 +141,7 @@ msgstr "vous devez spécifier au moins un utilisateur ou une adresse email"
 msgid "Begin date"
 msgstr "Date de début"
 
-#: club/forms.py com/forms.py counter/forms.py election/forms.py
+#: club/forms.py com/forms.py counter/forms.py subscription/forms.py
-#: subscription/forms.py
 msgid "End date"
 msgstr "Date de fin"
 
@@ -261,7 +260,7 @@ msgstr ""
 "Si ce rôle est inactif, il ne pourra pas être attribué aux gens qui "
 "rejoignent le club."
 
-#: club/models.py
+#: club/models.py election/models.py
 msgid "club role"
 msgstr "rôle de club"
 
@@ -304,11 +303,6 @@ msgstr "date de fin"
 msgid "role"
 msgstr "rôle"
 
-#: club/models.py core/models.py counter/models.py election/models.py
-#: forum/models.py reservation/models.py
-msgid "description"
-msgstr "description"
-
 #: club/models.py
 msgid "past member"
 msgstr "ancien membre"
@@ -368,11 +362,8 @@ msgid "Unregistered user"
 msgstr "Utilisateur non enregistré"
 
 #: club/models.py
-#, python-format
+msgid "The base url that links with this type must respect"
-msgid "The base url that links with this type must respect (e.g. `%(url)s`)"
+msgstr "L'url de base que tous les liens de ce type doivent respecter"
-msgstr ""
-"L'url de base que tous les liens de ce type doivent respecter (par exemple "
-"`%(url)s`)"
 
 #: club/models.py counter/models.py
 msgid "icon"
@@ -600,6 +591,7 @@ msgstr ""
 #: counter/templates/counter/cash_register_summary.jinja
 #: counter/templates/counter/invoices_call.jinja
 #: counter/templates/counter/product_form.jinja
+#: election/templates/election/role_form.jinja
 #: forum/templates/forum/reply.jinja
 #: subscription/templates/subscription/fragments/creation_form_existing_user.jinja
 #: subscription/templates/subscription/fragments/creation_form_new_user.jinja
@@ -688,6 +680,7 @@ msgstr "Étiquette"
 #: core/templates/core/user_account_detail.jinja
 #: core/templates/core/user_stats.jinja
 #: counter/templates/counter/last_ops.jinja
+#: eboutic/templates/eboutic/eboutic_checkout.jinja
 msgid "Quantity"
 msgstr "Quantité"
 
@@ -760,18 +753,6 @@ msgstr "Nouveau Trombi"
 msgid "Posters"
 msgstr "Affiches"
 
-#: club/templates/club/club_tools.jinja
-msgid "Reservable rooms"
-msgstr "Salles réservables"
-
-#: club/templates/club/club_tools.jinja
-msgid "Add a room"
-msgstr "Ajouter une salle"
-
-#: club/templates/club/club_tools.jinja
-msgid "This club manages no reservable room"
-msgstr "Ce club ne gère pas de salle réservable"
-
 #: club/templates/club/club_tools.jinja
 msgid "Counters:"
 msgstr "Comptoirs : "
@@ -983,7 +964,7 @@ msgstr "rôle de club – membre"
 msgid "Benefit"
 msgstr "Bénéfice"
 
-#: club/views.py
+#: club/views.py eboutic/templates/eboutic/eboutic_checkout.jinja
 msgid "Unit price"
 msgstr "Prix unitaire"
 
@@ -995,7 +976,7 @@ msgstr "Prix d'achat"
 msgid "Format: 16:9 | Resolution: 1920x1080"
 msgstr "Format : 16:9 | Résolution : 1920x1080"
 
-#: com/forms.py election/forms.py subscription/forms.py
+#: com/forms.py subscription/forms.py
 msgid "Start date"
 msgstr "Date de début"
 
@@ -1071,7 +1052,7 @@ msgstr "Une description plus détaillée et exhaustive de l'évènement."
 msgid "The club which organizes the event."
 msgstr "Le club qui organise l'évènement."
 
-#: com/models.py pedagogy/models.py reservation/models.py trombi/models.py
+#: com/models.py pedagogy/models.py trombi/models.py
 msgid "author"
 msgstr "auteur"
 
@@ -1364,11 +1345,6 @@ msgstr "Emploi du temps"
 msgid "Matmatronch"
 msgstr "Matmatronch"
 
-#: com/templates/com/news_list.jinja
-#: reservation/templates/reservation/schedule.jinja
-msgid "Room reservation"
-msgstr "Réservation de salle"
-
 #: com/templates/com/news_list.jinja core/templates/core/base/navbar.jinja
 #: core/templates/core/user_tools.jinja
 msgid "Elections"
@@ -2225,6 +2201,7 @@ msgstr "Êtes-vous sûr de vouloir supprimer \"%(name)s\" ?"
 #: core/templates/core/delete_confirm.jinja
 #: core/templates/core/file_delete_confirm.jinja
 #: counter/templates/counter/fragments/delete_student_card.jinja
+#: counter/templates/counter/fragments/login.jinja
 msgid "Confirm"
 msgstr "Confirmation"
 
@@ -2232,7 +2209,6 @@ msgstr "Confirmation"
 #: core/templates/core/file_delete_confirm.jinja
 #: counter/templates/counter/counter_click.jinja
 #: counter/templates/counter/fragments/delete_student_card.jinja
-#: reservation/templates/reservation/fragments/create_reservation.jinja
 #: sas/templates/sas/ask_picture_removal.jinja
 msgid "Cancel"
 msgstr "Annuler"
@@ -3229,6 +3205,18 @@ msgstr "Cet UID est invalide"
 msgid "User not found"
 msgstr "Utilisateur non trouvé"
 
+#: counter/forms.py
+msgid "You are not a barman of this counter."
+msgstr "Vous n'êtes pas barman sur ce comptoir."
+
+#: counter/forms.py
+msgid "You are already logged in this counter."
+msgstr "Vous êtes déjà connecté à ce comptoir."
+
+#: counter/forms.py
+msgid "You are already logged in another counter."
+msgstr "Vous êtes déjà connecté à un autre comptoir."
+
 #: counter/forms.py
 msgid "Regular barmen"
 msgstr "Barmen réguliers"
@@ -3318,6 +3306,11 @@ msgstr "Saisie de produit dupliquée"
 msgid "Not enough money"
 msgstr "Solde insuffisant"
 
+#: counter/forms.py counter/models.py
+#, python-format
+msgid "There cannot be more than %(money)d€ on an AE account"
+msgstr "Il ne peut pas y avoir plus de %(money)d€ sur un compte AE"
+
 #: counter/forms.py
 #, python-format
 msgid ""
@@ -3394,7 +3387,7 @@ msgstr "Mettre à True si le mail a reçu une erreur"
 msgid "The operation that emptied the account."
 msgstr "L'opération qui a vidé le compte."
 
-#: counter/models.py pedagogy/models.py reservation/models.py
+#: counter/models.py pedagogy/models.py
 msgid "comment"
 msgstr "commentaire"
 
@@ -3431,8 +3424,16 @@ msgid "Buy five, get the sixth free"
 msgstr "Pour cinq achetés, le sixième offert"
 
 #: counter/models.py
-msgid "buying groups"
+msgid "clic limit"
-msgstr "groupe d'achat"
+msgstr "limite de clic"
+
+#: counter/models.py
+msgid ""
+"If a limit is set, the product won't be purchasable anymore on the eboutic "
+"once the latter is reached."
+msgstr ""
+"Si une limite est donnée, le produit ne sera plus achetable sur l'eboutic "
+"une fois celle-ci atteinte."
 
 #: counter/models.py election/models.py
 msgid "archived"
@@ -3499,10 +3500,6 @@ msgstr "Bureau"
 msgid "sellers"
 msgstr "vendeurs"
 
-#: counter/models.py
-msgid "token"
-msgstr "jeton"
-
 #: counter/models.py
 msgid "regular barman"
 msgstr "barman régulier"
@@ -3788,15 +3785,6 @@ msgstr "Confirmer (FIN)"
 msgid "Cancel (ANN)"
 msgstr "Annuler (ANN)"
 
-#: counter/templates/counter/counter_click.jinja
-#: counter/templates/counter/fragments/create_refill.jinja
-#: counter/templates/counter/fragments/create_student_card.jinja
-#: counter/templates/counter/invoices_call.jinja
-#: sas/templates/sas/picture.jinja
-#: subscription/templates/subscription/stats.jinja
-msgid "Go"
-msgstr "Valider"
-
 #: counter/templates/counter/counter_click.jinja
 #: eboutic/templates/eboutic/eboutic_checkout.jinja
 msgid "Basket: "
@@ -3827,7 +3815,7 @@ msgstr ""
 
 #: counter/templates/counter/counter_click.jinja
 msgid "No products available on this counter for this user"
-msgstr "Pas de produits disponnibles dans ce comptoir pour cet utilisateur"
+msgstr "Pas de produits disponibles dans ce comptoir pour cet utilisateur"
 
 #: counter/templates/counter/counter_list.jinja
 msgid "Counter admin list"
@@ -3888,12 +3876,20 @@ msgid "Please, login"
 msgstr "Merci de vous identifier"
 
 #: counter/templates/counter/counter_main.jinja
-msgid "Barman: "
+msgid "Barmen:"
-msgstr "Barman : "
+msgstr "Barmen :"
 
 #: counter/templates/counter/counter_main.jinja
-msgid "login"
+msgid "On this device"
-msgstr "login"
+msgstr "Sur cet appareil"
+
+#: counter/templates/counter/counter_main.jinja
+msgid "Elsewhere"
+msgstr "Ailleurs"
+
+#: counter/templates/counter/counter_main.jinja
+msgid "No barman logged elsewhere"
+msgstr "Pas de barman connecté ailleurs"
 
 #: counter/templates/counter/eticket_list.jinja
 msgid "Eticket list"
@@ -3945,6 +3941,14 @@ msgstr ""
 msgid "New formula"
 msgstr "Nouvelle formule"
 
+#: counter/templates/counter/fragments/create_refill.jinja
+#: counter/templates/counter/fragments/create_student_card.jinja
+#: counter/templates/counter/invoices_call.jinja
+#: sas/templates/sas/picture.jinja
+#: subscription/templates/subscription/stats.jinja
+msgid "Go"
+msgstr "Valider"
+
 #: counter/templates/counter/fragments/create_student_card.jinja
 msgid "No student card registered."
 msgstr "Aucune carte étudiante enregistrée."
@@ -4298,22 +4302,14 @@ msgstr "Montant du chèque"
 msgid "Check quantity"
 msgstr "Nombre de chèque"
 
+#: counter/views/click.py
+msgid "You cannot click users on this counter"
+msgstr "Vous ne pouvez pas cliquer des gens sur ce comptoir"
+
 #: counter/views/eticket.py
 msgid "people(s)"
 msgstr "personne(s)"
 
-#: counter/views/home.py
-msgid "Bad credentials"
-msgstr "Mauvais identifiants"
-
-#: counter/views/home.py
-msgid "User is not barman"
-msgstr "L'utilisateur n'est pas barman."
-
-#: counter/views/home.py
-msgid "Bad location, someone is already logged in somewhere else"
-msgstr "Mauvais comptoir, quelqu'un est déjà connecté ailleurs"
-
 #: counter/views/invoice.py
 msgid "Invoice calls status has been updated."
 msgstr "Le statut des appels à facture a été mis à jour."
@@ -4390,6 +4386,18 @@ msgstr "Solde actuel : "
 msgid "Remaining account amount: "
 msgstr "Solde restant : "
 
+#: eboutic/templates/eboutic/eboutic_checkout.jinja
+msgid "I have read and I accept"
+msgstr "J'ai lu et j'accepte"
+
+#: eboutic/templates/eboutic/eboutic_checkout.jinja
+msgid "the general terms and conditions"
+msgstr "les conditions générales de vente"
+
+#: eboutic/templates/eboutic/eboutic_checkout.jinja
+msgid "of the student association of the UTBM"
+msgstr "de l'Association des étudiants de l'UTBM"
+
 #: eboutic/templates/eboutic/eboutic_checkout.jinja
 msgid "Pay with credit card"
 msgstr "Payer avec une carte bancaire"
@@ -4425,6 +4433,15 @@ msgstr "Payer avec un compte AE"
 msgid "The online shop of the association."
 msgstr "La boutique en ligne de l'association."
 
+#: eboutic/templates/eboutic/eboutic_main.jinja
+#, python-format
+msgid ""
+"You cannot purchase the current basket, because it would put your AE account "
+"balance above the %(limit)s€ limit"
+msgstr ""
+"Vous ne pouvez pas finaliser le panier actuel, parce que le solde de votre "
+"compte AE passerait au-dessus de la limite de %(limit)s€."
+
 #: eboutic/templates/eboutic/eboutic_main.jinja
 msgid "Clear"
 msgstr "Vider"
@@ -4485,6 +4502,10 @@ msgstr ""
 "billets du vendredi, du samedi et du dimanche, ainsi qu'au forfait 3 jours, "
 "du vendredi au dimanche."
 
+#: eboutic/templates/eboutic/eboutic_main.jinja
+msgid "Product sold out"
+msgstr "Produit épuisé"
+
 #: eboutic/templates/eboutic/eboutic_main.jinja
 msgid "There are no items available for sale"
 msgstr "Aucun article n'est disponible à la vente"
@@ -4517,16 +4538,13 @@ msgstr ""
 "par carte bancaire"
 
 #: eboutic/views.py
-msgid ""
+msgid "Basket expired"
-"The Crédit Agricole changed its policy related to the billing information "
+msgstr "Panier expiré"
-"that must be provided in order to pay with a credit card. If you want to pay "
+
-"with your credit card, you must add a phone number to the data you already "
+#: eboutic/views.py
-"provided."
+#, python-format
-msgstr ""
+msgid "Basket available until %(until)s"
-"Le Crédit Agricole a changé  sa politique relative aux informations à "
+msgstr "Panier disponible jusqu'à %(until)s"
-"fournir pour effectuer un paiement par carte bancaire. De ce fait, si vous "
-"souhaitez payer par carte, vous devez rajouter un numéro de téléphone aux "
-"données que vous aviez déjà fourni."
 
 #: eboutic/views.py
 msgid "You can't buy a refilling with sith money"
@@ -4544,17 +4562,13 @@ msgstr "Utilisateur se présentant"
 msgid "Blank vote"
 msgstr "Vote blanc"
 
-#: election/forms.py
+#: election/models.py
-msgid "This role already exists for this election"
+msgid "clubs"
-msgstr "Ce rôle existe déjà pour cette élection"
+msgstr "clubs"
 
-#: election/forms.py
+#: election/models.py
-msgid "Start candidature"
+msgid "The club(s) this election is held for."
-msgstr "Début des candidatures"
+msgstr "Le(s) club(s) pour lequel cette élection est tenue."
-
-#: election/forms.py
-msgid "End candidature"
-msgstr "Fin des candidatures"
 
 #: election/models.py
 msgid "start candidature"
@@ -4592,6 +4606,18 @@ msgstr "élection"
 msgid "max choice"
 msgstr "nombre de choix maxi"
 
+#: election/models.py
+msgid ""
+"A club role. Filling this will allow automatic completion of title and "
+"description, and automatic assignation after the elections."
+msgstr ""
+"Un rôle de club. Remplir ce champ permet l'autocomplétion du titre et de la "
+"description, et l'attribution automatique des rôles après les élections."
+
+#: election/models.py
+msgid "This role already exists for this election"
+msgstr "Ce rôle existe déjà pour cette élection"
+
 #: election/models.py
 msgid "election list"
 msgstr "liste électorale"
@@ -4628,15 +4654,17 @@ msgid "Polls will open "
 msgstr "Les votes ouvriront "
 
 #: election/templates/election/election_detail.jinja
-#: election/templates/election/election_list.jinja
+msgid "at"
-#: forum/templates/forum/macros.jinja
+msgstr "à"
-msgid " at "
-msgstr " à "
 
 #: election/templates/election/election_detail.jinja
 msgid "and will close "
 msgstr "et fermeront"
 
+#: election/templates/election/election_detail.jinja
+msgid "Apply election result"
+msgstr "Appliquer les résultats de l'élection"
+
 #: election/templates/election/election_detail.jinja
 msgid "You already have submitted your vote."
 msgstr "Vous avez déjà soumis votre vote."
@@ -4678,10 +4706,19 @@ msgstr "Liste des élections"
 msgid "Current elections"
 msgstr "Élections actuelles"
 
+#: election/templates/election/election_list.jinja
+msgid "New election"
+msgstr "Nouvelle élection"
+
 #: election/templates/election/election_list.jinja
 msgid "Applications open from"
 msgstr "Candidatures ouvertes à partir du"
 
+#: election/templates/election/election_list.jinja
+#: forum/templates/forum/macros.jinja
+msgid " at "
+msgstr " à "
+
 #: election/templates/election/election_list.jinja
 msgid "to"
 msgstr "au"
@@ -4690,6 +4727,59 @@ msgstr "au"
 msgid "Polls open from"
 msgstr "Votes ouverts du"
 
+#: election/templates/election/fragments/apply_result.jinja
+msgid "No result to apply"
+msgstr "Pas de résultats à appliquer"
+
+#: election/templates/election/fragments/apply_result.jinja
+msgid "This may be because no role of this election was linked to a club role."
+msgstr ""
+"Ceci s'explique peut-être parce qu'aucun poste de cette élection n'était lié "
+"à un rôle de club."
+
+#: election/templates/election/fragments/apply_result.jinja
+msgid "The results of this election have been applied"
+msgstr "Les résultats de cette élection ont été appliqués"
+
+#: election/templates/election/fragments/apply_result.jinja
+#, python-format
+msgid "%(club)s members"
+msgstr "Membres %(club)s"
+
+#: election/templates/election/fragments/apply_result.jinja
+msgid "Warning"
+msgstr "Attention"
+
+#: election/templates/election/fragments/apply_result.jinja
+msgid ""
+"Only election roles linked to a club role will be automatically applied."
+msgstr ""
+"Seuls les postes de cette élection qui sont liés à un rôle de club seront "
+"automatiquement appliqués."
+
+#: election/templates/election/fragments/apply_result.jinja
+msgid "Don't forget to manually apply the eventual remaining roles afterward."
+msgstr ""
+"N'oubliez pas après d'attribuer manuellement les éventuels postes restants."
+
+#: election/templates/election/role_form.jinja
+msgid "Election role"
+msgstr "Rôle d'élection"
+
+#: election/templates/election/role_form.jinja
+#, python-format
+msgid "Create role for election \"%(election)s\""
+msgstr "Création d'un rôle pour l'élection « %(election)s »"
+
+#: election/templates/election/role_form.jinja
+#, python-format
+msgid "Edit role for election \"%(election)s\""
+msgstr "Modification d'un rôle pour l'élection « %(election)s »"
+
+#: election/templates/election/role_form.jinja
+msgid "autofill form"
+msgstr "compléter le formulaire"
+
 #: election/views.py
 msgid "Form is invalid"
 msgstr "Formulaire invalide"
@@ -5173,73 +5263,6 @@ msgstr "Signaler ce commentaire"
 msgid "Edit UE"
 msgstr "Éditer l'UE"
 
-#: reservation/forms.py
-msgid "The start must be set before the end"
-msgstr "Le début doit être placé avant la fin"
-
-#: reservation/models.py
-msgid "room name"
-msgstr "Nom de la salle"
-
-#: reservation/models.py
-msgid "room owner"
-msgstr "propriétaire de la salle"
-
-#: reservation/models.py
-msgid "The club which manages this room"
-msgstr "Le club qui gère cette salle"
-
-#: reservation/models.py
-msgid "site"
-msgstr "site"
-
-#: reservation/models.py
-msgid "reservable room"
-msgstr "salle réservable"
-
-#: reservation/models.py
-msgid "reservable rooms"
-msgstr "salles réservables"
-
-#: reservation/models.py
-msgid "reserved room"
-msgstr "salle réservée"
-
-#: reservation/models.py
-msgid "slot start"
-msgstr "début du créneau"
-
-#: reservation/models.py
-msgid "slot end"
-msgstr "fin du créneau"
-
-#: reservation/models.py
-msgid "reservation slot"
-msgstr "créneau de réservation"
-
-#: reservation/models.py
-msgid "reservation slots"
-msgstr "créneaux de réservation"
-
-#: reservation/models.py
-msgid "There is already a reservation on this slot."
-msgstr "Il y a déjà une réservation sur ce créneau."
-
-#: reservation/templates/reservation/fragments/create_reservation.jinja
-msgid "Book a room"
-msgstr "Réserver une salle"
-
-#: reservation/templates/reservation/schedule.jinja
-msgid "You can book a room by selecting a free slot in the calendar."
-msgstr ""
-"Vous pouvez réserver une salle en sélectionnant un emplacement libre dans le "
-"calendrier."
-
-#: reservation/views.py
-#, python-format
-msgid "%(name)s was updated successfully"
-msgstr "%(name)s a été mis à jour avec succès"
-
 #: rootplace/forms.py
 msgid "User that will be kept"
 msgstr "Utilisateur qui sera conservé"

locale/fr/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-04-17 22:42+0200\n"
+"POT-Creation-Date: 2026-05-17 10:03+0200\n"
 "PO-Revision-Date: 2024-09-17 11:54+0200\n"
 "Last-Translator: Sli <antoine@bartuccio.fr>\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -263,13 +263,9 @@ msgstr "Types de produits réordonnés !"
 msgid "Product type reorganisation failed with status code : %d"
 msgstr "La réorganisation des types de produit a échoué avec le code : %d"
 
-#: reservation/static/bundled/reservation/components/room-scheduler-index.ts
+#: eboutic/static/bundled/eboutic/checkout-index.ts
-msgid "Rooms"
+msgid "Basket expired"
-msgstr "Salles"
+msgstr "Panier expiré"
-
-#: reservation/static/bundled/reservation/slot-reservation-index.ts
-msgid "This slot has been successfully moved"
-msgstr "Ce créneau a été bougé avec succès"
 
 #: sas/static/bundled/sas/pictures-download-index.ts
 msgid "pictures.%(extension)s"

package.json

@@ -21,25 +21,23 @@
     "#core:*": "./core/static/bundled/*",
     "#pedagogy:*": "./pedagogy/static/bundled/*",
     "#counter:*": "./counter/static/bundled/*",
-    "#com:*": "./com/static/bundled/*",
+    "#com:*": "./com/static/bundled/*"
-    "#reservation:*": "./reservation/static/bundled/*"
   },
   "devDependencies": {
-    "@babel/core": "^7.29.0",
+    "@babel/core": "^7.29.7",
-    "@babel/preset-env": "^7.29.5",
+    "@babel/preset-env": "^7.29.7",
-    "@biomejs/biome": "^2.4.15",
+    "@biomejs/biome": "^2.4.16",
-    "@hey-api/openapi-ts": "^0.94.5",
+    "@hey-api/openapi-ts": "^0.98.1",
     "@types/alpinejs": "^3.13.11",
     "@types/alpinejs__sort": "^3.13.0",
     "@types/cytoscape-cxtmenu": "^3.4.5",
     "@types/cytoscape-klay": "^3.1.5",
     "@types/js-cookie": "^3.0.6",
     "rollup-plugin-visualizer": "^7.0.1",
-    "typescript": "^5.9.3",
+    "typescript": "^6.0.3",
-    "vite": "^8.0.13"
+    "vite": "^8.0.16"
   },
   "dependencies": {
-    "@alpinejs/morph": "^3.14.9",
     "@alpinejs/sort": "^3.15.12",
     "@arendjr/text-clipper": "npm:@jsr/arendjr__text-clipper@^3.0.0",
     "@floating-ui/dom": "^1.7.6",
@@ -47,26 +45,22 @@
     "@fullcalendar/core": "^6.1.20",
     "@fullcalendar/daygrid": "^6.1.20",
     "@fullcalendar/icalendar": "^6.1.20",
-    "@fullcalendar/interaction": "^6.1.20",
     "@fullcalendar/list": "^6.1.20",
-    "@fullcalendar/resource": "^6.1.20",
+    "@sentry/browser": "^10.56.0",
-    "@fullcalendar/resource-timeline": "^6.1.20",
-    "@sentry/browser": "^10.53.1",
     "@zip.js/zip.js": "^2.8.26",
     "3d-force-graph": "^1.80.0",
     "alpinejs": "^3.15.12",
     "chart.js": "^4.5.1",
     "country-flag-emoji-polyfill": "^0.1.8",
-    "cytoscape": "^3.33.4",
+    "cytoscape": "^3.34.0",
     "cytoscape-cxtmenu": "^3.5.0",
     "cytoscape-klay": "^3.1.4",
     "d3-force-3d": "^3.0.6",
     "easymde": "^2.21.0",
     "glob": "^13.0.6",
     "html2canvas": "^1.4.1",
-    "htmx-ext-alpine-morph": "^2.0.1",
     "htmx.org": "^2.0.10",
-    "js-cookie": "^3.0.7",
+    "js-cookie": "^3.0.8",
     "lit-html": "^3.3.3",
     "native-file-system-adapter": "^3.0.1",
     "three": "^0.184.0",

pyproject.toml

@@ -19,7 +19,7 @@ authors = [
 license = { text = "GPL-3.0-only" }
 requires-python = "<4.0,>=3.12"
 dependencies = [
-    "django>=5.2.14,<6.0.0",
+    "django>=5.2.15,<6.0.0",
     "django-ninja>=1.6.2,<2.0.0",
     "django-ninja-extra>=0.31.4",
     "Pillow>=12.2.0,<13.0.0",
@@ -27,15 +27,15 @@ dependencies = [
     "django-jinja<3.0.0,>=2.11.0",
     "cryptography>=48.0.0,<49.0.0",
     "django-phonenumber-field>=8.4.0,<9.0.0",
-    "phonenumbers>=9.0.30,<10.0.0",
+    "phonenumbers>=9.0.32,<10.0.0",
     "reportlab>=4.5.1,<5.0.0",
-    "django-haystack>=3.3.0,<4.0.0",
+    "django-haystack>=3.4.0,<4.0.0",
     "xapian-haystack>=4.0.0,<5.0.0",
     "libsass>=0.23.0,<1.0.0",
     "django-ordered-model>=3.7.4,<4.0.0",
     "django-simple-captcha>=0.6.3,<1.0.0",
     "python-dateutil>=2.9.0.post0,<3.0.0.0",
-    "sentry-sdk>=2.60.0,<3.0.0",
+    "sentry-sdk>=2.61.1,<3.0.0",
     "jinja2>=3.1.6,<4.0.0",
     "django-countries>=8.2.0,<9.0.0",
     "dict2xml>=1.7.8,<2.0.0",
@@ -44,8 +44,8 @@ dependencies = [
     "django-honeypot>=1.3.0,<2",
     "pydantic-extra-types>=2.11.1,<3.0.0",
     "ical>=12.0.0,<14.0.0",
-    "redis[hiredis]>=3.3.1,<8.0.0",
+    "redis[hiredis]>=3.4.0,<8.0.0",
-    "environs[django]>=15.0.1,<16",
+    "environs[django]>=6.0.5,<16",
     "requests>=2.34.2,<3.0.0",
     "honcho>=2.0.0",
     "psutil>=7.2.2,<8.0.0",
@@ -64,11 +64,11 @@ prod = [
 ]
 dev = [
     "django-debug-toolbar>=6.3.0,<7",
-    "ipython>=9.13.0,<10.0.0",
+    "ipython>=9.14.1,<10.0.0",
     "pre-commit>=4.6.0,<5.0.0",
-    "ruff>=0.15.13,<1.0.0",
+    "ruff>=0.15.16,<1.0.0",
     "djhtml>=3.0.11,<4.0.0",
-    "faker>=40.18.0,<41.0.0",
+    "faker>=40.21.0,<41.0.0",
     "rjsmin>=1.2.5,<2.0.0",
 ]
 tests = [
@@ -84,7 +84,7 @@ docs = [
     "mkdocs>=1.6.1,<2.0.0",
     "mkdocs-material>=9.7.6,<10.0.0",
     "mkdocstrings>=1.0.4,<2.0.0",
-    "mkdocstrings-python>=2.0.3,<3.0.0",
+    "mkdocstrings-python>=2.0.4,<3.0.0",
     "mkdocs-include-markdown-plugin>=7.3.0,<8.0.0",
 ]
 

reservation/admin.py

@@ -1,19 +0,0 @@
-from django.contrib import admin
-
-from reservation.models import ReservationSlot, Room
-
-
-@admin.register(Room)
-class RoomAdmin(admin.ModelAdmin):
-    list_display = ("name", "club")
-    list_filter = (("club", admin.RelatedOnlyFieldListFilter), "location")
-    autocomplete_fields = ("club",)
-    search_fields = ("name",)
-
-
-@admin.register(ReservationSlot)
-class ReservationSlotAdmin(admin.ModelAdmin):
-    list_display = ("room", "start_at", "end_at", "author")
-    autocomplete_fields = ("author",)
-    list_filter = ("room",)
-    date_hierarchy = "start_at"

reservation/api.py

@@ -1,64 +0,0 @@
-from typing import Any, Literal
-
-from django.core.exceptions import ValidationError
-from ninja import Query
-from ninja_extra import ControllerBase, api_controller, paginate, route
-from ninja_extra.pagination import PageNumberPaginationExtra
-from ninja_extra.schemas import PaginatedResponseSchema
-
-from api.permissions import HasPerm
-from reservation.models import ReservationSlot, Room
-from reservation.schemas import (
-    RoomFilterSchema,
-    RoomSchema,
-    SlotFilterSchema,
-    SlotSchema,
-    UpdateReservationSlotSchema,
-)
-
-
-@api_controller("/reservation/room")
-class ReservableRoomController(ControllerBase):
-    @route.get(
-        "",
-        response=list[RoomSchema],
-        permissions=[HasPerm("reservation.view_room")],
-        url_name="fetch_reservable_rooms",
-    )
-    def fetch_rooms(self, filters: Query[RoomFilterSchema]):
-        return filters.filter(Room.objects.select_related("club"))
-
-
-@api_controller("/reservation/slot")
-class ReservationSlotController(ControllerBase):
-    @route.get(
-        "",
-        response=PaginatedResponseSchema[SlotSchema],
-        permissions=[HasPerm("reservation.view_reservationslot")],
-        url_name="fetch_reservation_slots",
-    )
-    @paginate(PageNumberPaginationExtra)
-    def fetch_slots(self, filters: Query[SlotFilterSchema]):
-        return filters.filter(
-            ReservationSlot.objects.select_related("author").order_by("start_at")
-        )
-
-    @route.patch(
-        "/reservation/slot/{int:slot_id}",
-        permissions=[HasPerm("reservation.change_reservationslot")],
-        response={
-            200: None,
-            409: dict[Literal["detail"], dict[str, list[str]]],
-            422: dict[Literal["detail"], list[dict[str, Any]]],
-        },
-        url_name="change_reservation_slot",
-    )
-    def update_slot(self, slot_id: int, params: UpdateReservationSlotSchema):
-        slot = self.get_object_or_exception(ReservationSlot, id=slot_id)
-        slot.start_at = params.start_at
-        slot.end_at = params.end_at
-        try:
-            slot.full_clean()
-            slot.save()
-        except ValidationError as e:
-            return self.create_response({"detail": dict(e)}, status_code=409)

reservation/apps.py

@@ -1,6 +0,0 @@
-from django.apps import AppConfig
-
-
-class ReservationConfig(AppConfig):
-    default_auto_field = "django.db.models.BigAutoField"
-    name = "reservation"

reservation/forms.py

@@ -1,60 +0,0 @@
-from django import forms
-from django.core.exceptions import NON_FIELD_ERRORS
-from django.utils.translation import gettext_lazy as _
-
-from club.widgets.ajax_select import AutoCompleteSelectClub
-from core.models import User
-from core.views.forms import FutureDateTimeField, SelectDateTime
-from reservation.models import ReservationSlot, Room
-
-
-class RoomCreateForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = Room
-        fields = ["name", "club", "location", "description"]
-        widgets = {"club": AutoCompleteSelectClub}
-
-
-class RoomUpdateForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = Room
-        fields = ["name", "club", "location", "description"]
-        widgets = {"club": AutoCompleteSelectClub}
-
-    def __init__(self, *args, request_user: User, **kwargs):
-        super().__init__(*args, **kwargs)
-        if not request_user.has_perm("reservation.change_room"):
-            # if the user doesn't have the global edition permission
-            # (i.e. it's a club board member, but not a sith admin)
-            # some fields aren't editable
-            del self.fields["club"]
-
-
-class ReservationForm(forms.ModelForm):
-    required_css_class = "required"
-    error_css_class = "error"
-
-    class Meta:
-        model = ReservationSlot
-        fields = ["room", "start_at", "end_at", "comment"]
-        field_classes = {"start_at": FutureDateTimeField, "end_at": FutureDateTimeField}
-        widgets = {"start_at": SelectDateTime(), "end_at": SelectDateTime()}
-        error_messages = {
-            NON_FIELD_ERRORS: {
-                "start_after_end": _("The start must be set before the end")
-            }
-        }
-
-    def __init__(self, *args, author: User, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.author = author
-
-    def save(self, commit: bool = True):  # noqa FBT001
-        self.instance.author = self.author
-        return super().save(commit)

reservation/migrations/0001_initial.py

@@ -1,117 +0,0 @@
-# Generated by Django 5.2.1 on 2025-06-05 10:44
-
-import django.core.validators
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    initial = True
-
-    dependencies = [
-        ("club", "0014_alter_club_options_rename_unix_name_club_slug_name_and_more"),
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Room",
-            fields=[
-                (
-                    "id",
-                    models.BigAutoField(
-                        auto_created=True,
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="ID",
-                    ),
-                ),
-                ("name", models.CharField(max_length=100, verbose_name="room name")),
-                (
-                    "description",
-                    models.TextField(
-                        blank=True, default="", verbose_name="description"
-                    ),
-                ),
-                (
-                    "location",
-                    models.CharField(
-                        blank=True,
-                        choices=[
-                            ("BELFORT", "Belfort"),
-                            ("SEVENANS", "Sévenans"),
-                            ("MONTBELIARD", "Montbéliard"),
-                        ],
-                        verbose_name="site",
-                    ),
-                ),
-                (
-                    "club",
-                    models.ForeignKey(
-                        help_text="The club which manages this room",
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="reservable_rooms",
-                        to="club.club",
-                        verbose_name="room owner",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "reservable room",
-                "verbose_name_plural": "reservable rooms",
-            },
-        ),
-        migrations.CreateModel(
-            name="ReservationSlot",
-            fields=[
-                (
-                    "id",
-                    models.BigAutoField(
-                        auto_created=True,
-                        primary_key=True,
-                        serialize=False,
-                        verbose_name="ID",
-                    ),
-                ),
-                (
-                    "comment",
-                    models.TextField(blank=True, default="", verbose_name="comment"),
-                ),
-                (
-                    "start_at",
-                    models.DateTimeField(db_index=True, verbose_name="slot start"),
-                ),
-                ("end_at", models.DateTimeField(verbose_name="slot end")),
-                ("created_at", models.DateTimeField(auto_now_add=True)),
-                (
-                    "author",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to=settings.AUTH_USER_MODEL,
-                        verbose_name="author",
-                    ),
-                ),
-                (
-                    "room",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        related_name="slots",
-                        to="reservation.room",
-                        verbose_name="reserved room",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "reservation slot",
-                "verbose_name_plural": "reservation slots",
-                "constraints": [
-                    models.CheckConstraint(
-                        condition=models.Q(("end_at__gt", models.F("start_at"))),
-                        name="reservation_slot_end_after_start",
-                        violation_error_code="start_after_end",
-                    )
-                ],
-            },
-        ),
-    ]

reservation/models.py

@@ -1,100 +0,0 @@
-from __future__ import annotations
-
-from typing import Self
-
-from django.core.exceptions import ValidationError
-from django.db import models
-from django.db.models import F, Q
-from django.utils.translation import gettext_lazy as _
-
-from club.models import Club
-from core.models import User
-
-
-class Room(models.Model):
-    name = models.CharField(_("room name"), max_length=100)
-    description = models.TextField(_("description"), blank=True, default="")
-    club = models.ForeignKey(
-        Club,
-        on_delete=models.CASCADE,
-        related_name="reservable_rooms",
-        verbose_name=_("room owner"),
-        help_text=_("The club which manages this room"),
-    )
-    location = models.CharField(
-        _("site"),
-        blank=True,
-        choices=[
-            ("BELFORT", "Belfort"),
-            ("SEVENANS", "Sévenans"),
-            ("MONTBELIARD", "Montbéliard"),
-        ],
-    )
-
-    class Meta:
-        verbose_name = _("reservable room")
-        verbose_name_plural = _("reservable rooms")
-
-    def __str__(self):
-        return self.name
-
-    def can_be_edited_by(self, user: User) -> bool:
-        # a user may edit a room if it has the global perm
-        # or is in the owner club board
-        return user.has_perm("reservation.change_room") or self.club.board_group_id in [
-            g.id for g in user.cached_groups
-        ]
-
-
-class ReservationSlotQuerySet(models.QuerySet):
-    def overlapping_with(self, slot: ReservationSlot) -> Self:
-        return self.filter(
-            Q(start_at__lt=slot.start_at, end_at__gt=slot.start_at)
-            | Q(start_at__lt=slot.end_at, end_at__gt=slot.end_at)
-        )
-
-
-class ReservationSlot(models.Model):
-    room = models.ForeignKey(
-        Room,
-        on_delete=models.CASCADE,
-        related_name="slots",
-        verbose_name=_("reserved room"),
-    )
-    author = models.ForeignKey(User, on_delete=models.CASCADE, verbose_name=_("author"))
-    comment = models.TextField(_("comment"), blank=True, default="")
-    start_at = models.DateTimeField(_("slot start"), db_index=True)
-    end_at = models.DateTimeField(_("slot end"))
-    created_at = models.DateTimeField(auto_now_add=True)
-
-    objects = ReservationSlotQuerySet.as_manager()
-
-    class Meta:
-        verbose_name = _("reservation slot")
-        verbose_name_plural = _("reservation slots")
-        constraints = [
-            models.CheckConstraint(
-                condition=Q(end_at__gt=F("start_at")),
-                name="reservation_slot_end_after_start",
-                violation_error_code="start_after_end",
-            )
-        ]
-
-    def __str__(self):
-        return f"{self.room.name} : {self.start_at} - {self.end_at}"
-
-    def clean(self):
-        super().clean()
-        if self.end_at is None or self.start_at is None:
-            # if there is no start or no end, then there is no
-            # point to check if this perm overlap with another,
-            # so in this case, don't do the overlap check and let
-            # Django manage the non-null constraint error.
-            return
-        overlapping = ReservationSlot.objects.overlapping_with(self).filter(
-            room_id=self.room_id
-        )
-        if self.id is not None:
-            overlapping = overlapping.exclude(id=self.id)
-        if overlapping.exists():
-            raise ValidationError(_("There is already a reservation on this slot."))

reservation/schemas.py

@@ -1,46 +0,0 @@
-from datetime import datetime
-
-from ninja import FilterSchema, ModelSchema, Schema
-from pydantic import Field, FutureDatetime
-
-from club.schemas import SimpleClubSchema
-from core.schemas import SimpleUserSchema
-from reservation.models import ReservationSlot, Room
-
-
-class RoomFilterSchema(FilterSchema):
-    club: set[int] | None = Field(None, q="club_id__in")
-
-
-class RoomSchema(ModelSchema):
-    class Meta:
-        model = Room
-        fields = ["id", "name", "description", "location"]
-
-    club: SimpleClubSchema
-
-    @staticmethod
-    def resolve_location(obj: Room):
-        return obj.get_location_display()
-
-
-class SlotFilterSchema(FilterSchema):
-    after: datetime = Field(default=None, q="end_at__gt")
-    before: datetime = Field(default=None, q="start_at__lt")
-    room: set[int] | None = None
-    club: set[int] | None = None
-
-
-class SlotSchema(ModelSchema):
-    class Meta:
-        model = ReservationSlot
-        fields = ["id", "room", "comment"]
-
-    start: datetime = Field(alias="start_at")
-    end: datetime = Field(alias="end_at")
-    author: SimpleUserSchema
-
-
-class UpdateReservationSlotSchema(Schema):
-    start_at: FutureDatetime
-    end_at: FutureDatetime

reservation/static/bundled/reservation/components/room-scheduler-index.ts

@@ -1,136 +0,0 @@
-import {
-  Calendar,
-  type DateSelectArg,
-  type EventDropArg,
-  type EventSourceFuncArg,
-} from "@fullcalendar/core";
-import enLocale from "@fullcalendar/core/locales/en-gb";
-import frLocale from "@fullcalendar/core/locales/fr";
-import interactionPlugin, { type EventResizeDoneArg } from "@fullcalendar/interaction";
-import resourceTimelinePlugin from "@fullcalendar/resource-timeline";
-import { paginated } from "#core:utils/api";
-import { inheritHtmlElement, registerComponent } from "#core:utils/web-components";
-import {
-  type ReservationslotFetchSlotsData,
-  reservableroomFetchRooms,
-  reservationslotFetchSlots,
-  reservationslotUpdateSlot,
-  type SlotSchema,
-} from "#openapi";
-import type { SlotSelectedEventArg } from "#reservation:reservation/types";
-
-@registerComponent("room-scheduler")
-export class RoomScheduler extends inheritHtmlElement("div") {
-  static observedAttributes = ["locale", "can_edit_slot", "can_create_slot"];
-  private scheduler: Calendar;
-  private locale = "en";
-  private canEditSlot = false;
-  private canBookSlot = false;
-  private canDeleteSlot = false;
-
-  attributeChangedCallback(name: string, _oldValue?: string, newValue?: string) {
-    if (name === "locale") {
-      this.locale = newValue;
-    }
-    if (name === "can_edit_slot") {
-      this.canEditSlot = newValue.toLowerCase() === "true";
-    }
-    if (name === "can_create_slot") {
-      this.canBookSlot = newValue.toLowerCase() === "true";
-    }
-    if (name === "can_delete_slot") {
-      this.canDeleteSlot = newValue.toLowerCase() === "true";
-    }
-  }
-
-  /**
-   * Fetch the events displayed in the timeline.
-   * cf https://fullcalendar.io/docs/events-function
-   */
-  async fetchEvents(fetchInfo: EventSourceFuncArg) {
-    const res: SlotSchema[] = await paginated(reservationslotFetchSlots, {
-      query: { after: fetchInfo.startStr, before: fetchInfo.endStr },
-    } as ReservationslotFetchSlotsData);
-    return res.map((i) =>
-      Object.assign(i, {
-        title: `${i.author.first_name} ${i.author.last_name}`,
-        resourceId: i.room,
-        editable: new Date(i.start) > new Date(),
-      }),
-    );
-  }
-
-  /**
-   * Fetch the resources which events are associated with.
-   * cf https://fullcalendar.io/docs/resources-function
-   */
-  async fetchResources() {
-    const res = await reservableroomFetchRooms();
-    return res.data.map((i) => Object.assign(i, { title: i.name, group: i.location }));
-  }
-
-  /**
-   * Send a request to the API to change
-   * the start and the duration of a reservation slot
-   */
-  async changeReservation(args: EventDropArg | EventResizeDoneArg) {
-    const response = await reservationslotUpdateSlot({
-      // biome-ignore lint/style/useNamingConvention: api is snake_case
-      path: { slot_id: Number.parseInt(args.event.id) },
-      // biome-ignore lint/style/useNamingConvention: api is snake_case
-      body: { start_at: args.event.startStr, end_at: args.event.endStr },
-    });
-    if (response.response.ok) {
-      document.dispatchEvent(new CustomEvent("reservationSlotChanged"));
-      this.scheduler.refetchEvents();
-    }
-  }
-
-  selectFreeSlot(infos: DateSelectArg) {
-    document.dispatchEvent(
-      new CustomEvent<SlotSelectedEventArg>("timeSlotSelected", {
-        detail: {
-          ressource: Number.parseInt(infos.resource.id),
-          start: infos.startStr,
-          end: infos.endStr,
-        },
-      }),
-    );
-  }
-
-  connectedCallback() {
-    super.connectedCallback();
-    this.scheduler = new Calendar(this.node, {
-      schedulerLicenseKey: "GPL-My-Project-Is-Open-Source",
-      initialView: "resourceTimelineDay",
-      headerToolbar: {
-        left: "prev,next today",
-        center: "title",
-        right: "resourceTimelineDay,resourceTimelineWeek",
-      },
-      plugins: [resourceTimelinePlugin, interactionPlugin],
-      locales: [frLocale, enLocale],
-      height: "auto",
-      locale: this.locale,
-      resourceGroupField: "group",
-      resourceAreaHeaderContent: gettext("Rooms"),
-      editable: this.canEditSlot,
-      snapDuration: "00:15",
-      eventConstraint: { start: new Date() }, // forbid edition of past events
-      eventOverlap: false,
-      eventResourceEditable: false,
-      refetchResourcesOnNavigate: true,
-      resourceAreaWidth: "20%",
-      resources: this.fetchResources,
-      events: this.fetchEvents,
-      select: this.selectFreeSlot,
-      selectOverlap: false,
-      selectable: this.canBookSlot,
-      selectConstraint: { start: new Date() },
-      nowIndicator: true,
-      eventDrop: this.changeReservation,
-      eventResize: this.changeReservation,
-    });
-    this.scheduler.render();
-  }
-}

reservation/static/bundled/reservation/slot-reservation-index.ts

@@ -1,39 +0,0 @@
-import { AlertMessage } from "#core:utils/alert-message";
-import type { SlotSelectedEventArg } from "#reservation:reservation/types";
-
-document.addEventListener("alpine:init", () => {
-  Alpine.data("slotReservation", () => ({
-    start: null as string,
-    end: null as string,
-    room: null as number,
-    showForm: false,
-
-    init() {
-      document.addEventListener(
-        "timeSlotSelected",
-        (event: CustomEvent<SlotSelectedEventArg>) => {
-          this.start = event.detail.start.split("+")[0];
-          this.end = event.detail.end.split("+")[0];
-          this.room = event.detail.ressource;
-          this.showForm = true;
-          this.$nextTick(() => this.$el.scrollIntoView({ behavior: "smooth" })).then();
-        },
-      );
-    },
-  }));
-
-  /**
-   * Component that will catch events sent from the scheduler
-   * to display success messages accordingly.
-   */
-  Alpine.data("scheduleMessages", () => ({
-    alertMessage: new AlertMessage({ defaultDuration: 2000 }),
-    init() {
-      document.addEventListener("reservationSlotChanged", (_event: CustomEvent) => {
-        this.alertMessage.display(gettext("This slot has been successfully moved"), {
-          success: true,
-        });
-      });
-    },
-  }));
-});

reservation/static/bundled/reservation/types.d.ts

@@ -1,5 +0,0 @@
-export interface SlotSelectedEventArg {
-  start: string;
-  end: string;
-  ressource: number;
-}

reservation/static/reservation/reservation.scss

@@ -1,39 +0,0 @@
-#slot-reservation {
-  margin-top: 3em;
-
-  display: flex;
-  flex-direction: column;
-  justify-content: center;
-
-  h3 {
-    display: block;
-    margin: auto;
-    text-align: left;
-  }
-
-  .alert, .error {
-    display: block;
-    margin: 1em auto auto;
-    max-width: 400px;
-    word-wrap: break-word;
-    text-wrap: wrap;
-  }
-
-  form {
-    display: flex;
-    flex-direction: column;
-    gap: .5em;
-    justify-content: center;
-
-    .buttons-row {
-      input[type="submit"], button {
-        margin: 0;
-      }
-    }
-    textarea {
-      max-width: unset;
-      width: 100%;
-      margin-top: unset;
-    }
-  }
-}

reservation/templates/reservation/fragments/create_reservation.jinja

@@ -1,51 +0,0 @@
-<section
-  id="slot-reservation"
-  x-data="slotReservation"
-  x-show="showForm"
-  hx-target="this"
-  hx-ext="alpine-morph"
-  hx-swap="morph"
->
-  <h3>{% trans %}Book a room{% endtrans %}</h3>
-  {% set non_field_errors = form.non_field_errors() %}
-  {% if non_field_errors %}
-    <div class="alert alert-red">
-      {% for error in non_field_errors %}
-        <span>{{ error }}</span>
-      {% endfor %}
-    </div>
-  {% endif %}
-  <form
-    id="slot-reservation-form"
-    hx-post="{{ url("reservation:make_reservation") }}"
-    hx-disabled-elt="find input[type='submit']"
-  >
-    {% csrf_token %}
-    <div class="form-group">
-      {{ form.room.errors }}
-      {{ form.room.label_tag() }}
-      {{ form.room|add_attr("x-model=room") }}
-    </div>
-    <div class="form-group">
-      {{ form.start_at.errors }}
-      {{ form.start_at.label_tag() }}
-      {{ form.start_at|add_attr("x-model=start") }}
-    </div>
-    <div class="form-group">
-      {{ form.end_at.errors }}
-      {{ form.end_at.label_tag() }}
-      {{ form.end_at|add_attr("x-model=end") }}
-    </div>
-    <div class="form-group">
-      {{ form.comment.errors }}
-      {{ form.comment.label_tag() }}
-      {{ form.comment }}
-    </div>
-    <div class="row gap buttons-row">
-      <button class="btn btn-grey grow" @click.prevent="showForm = false">
-        {% trans %}Cancel{% endtrans %}
-      </button>
-      <input class="btn btn-blue grow" type="submit">
-    </div>
-  </form>
-</section>

reservation/templates/reservation/macros.jinja

@@ -1,27 +0,0 @@
-{% macro room_detail(room, can_edit, can_delete) %}
-  <div class="card card-row card-row-m">
-    <div class="card-content">
-      <strong class="card-title">{{ room.name }}</strong>
-      <em>{{ room.get_location_display() }}</em>
-      <p>{{ room.description|truncate(250) }}</p>
-    </div>
-    <div class="card-top-left">
-      {% if can_edit %}
-        <a
-          class="btn btn-grey btn-no-text"
-          href="{{ url("reservation:room_edit", room_id=room.id) }}"
-        >
-          <i class="fa fa-edit"></i>
-        </a>
-      {% endif %}
-      {% if can_delete %}
-        <a
-          class="btn btn-red btn-no-text"
-          href="{{ url("reservation:room_delete", room_id=room.id) }}"
-        >
-          <i class="fa fa-trash"></i>
-        </a>
-      {% endif %}
-    </div>
-  </div>
-{% endmacro %}

reservation/templates/reservation/schedule.jinja

@@ -1,33 +0,0 @@
-{% extends "core/base.jinja" %}
-
-{% block additional_js %}
-  <script type="module" src="{{ static("bundled/reservation/components/room-scheduler-index.ts") }}"></script>
-  <script type="module" src="{{ static("bundled/reservation/slot-reservation-index.ts") }}"></script>
-{% endblock %}
-
-{% block additional_css %}
-  <link rel="stylesheet" href="{{ static('core/components/calendar.scss') }}">
-  <link rel="stylesheet" href="{{ static('reservation/reservation.scss') }}">
-{% endblock %}
-
-
-{% block content %}
-  <h2 class="margin-bottom">{% trans %}Room reservation{% endtrans %}</h2>
-  <p
-    x-data="scheduleMessages"
-    class="alert snackbar"
-    :class="alertMessage.success ? 'alert-green' : 'alert-red'"
-    x-show="alertMessage.open"
-    x-transition.duration.500ms
-    x-text="alertMessage.content"
-  ></p>
-  <room-scheduler
-    locale="{{ LANGUAGE_CODE }}"
-    can_edit_slot="{{ user.has_perm("reservation.change_reservationslot") }}"
-    can_create_slot="{{ user.has_perm("reservation.add_reservationslot") }}"
-  ></room-scheduler>
-  {% if user.has_perm("reservation.add_reservationslot") %}
-    <p><em>{% trans %}You can book a room by selecting a free slot in the calendar.{% endtrans %}</em></p>
-    {{ add_slot_fragment }}
-  {% endif %}
-{% endblock %}

reservation/tests/test_room.py

@@ -1,113 +0,0 @@
-import pytest
-from django.contrib.auth.models import Permission
-from django.test import Client
-from django.urls import reverse
-from model_bakery import baker
-from pytest_django.asserts import assertNumQueries, assertRedirects
-
-from club.models import Club
-from core.models import User
-from reservation.forms import RoomUpdateForm
-from reservation.models import Room
-
-
-@pytest.mark.django_db
-class TestFetchRoom:
-    @pytest.fixture
-    def user(self):
-        return baker.make(
-            User,
-            user_permissions=[Permission.objects.get(codename="view_room")],
-        )
-
-    def test_fetch_simple(self, client: Client, user: User):
-        rooms = baker.make(Room, _quantity=3, _bulk_create=True)
-        client.force_login(user)
-        response = client.get(reverse("api:fetch_reservable_rooms"))
-        assert response.status_code == 200
-        assert response.json() == [
-            {
-                "id": room.id,
-                "name": room.name,
-                "description": room.description,
-                "location": room.location,
-                "club": {"id": room.club.id, "name": room.club.name},
-            }
-            for room in rooms
-        ]
-
-    def test_nb_queries(self, client: Client, user: User):
-        client.force_login(user)
-        with assertNumQueries(5):
-            # 4 for authentication
-            # 1 to fetch the actual data
-            client.get(reverse("api:fetch_reservable_rooms"))
-
-
-@pytest.mark.django_db
-class TestCreateRoom:
-    def test_ok(self, client: Client):
-        perm = Permission.objects.get(codename="add_room")
-        club = baker.make(Club)
-        client.force_login(
-            baker.make(User, user_permissions=[perm], groups=[club.board_group])
-        )
-        response = client.post(
-            reverse("reservation:room_create"),
-            data={"club": club.id, "name": "test", "location": "BELFORT"},
-        )
-        assertRedirects(response, reverse("club:tools", kwargs={"club_id": club.id}))
-        room = Room.objects.last()
-        assert room is not None
-        assert room.club == club
-        assert room.name == "test"
-        assert room.location == "BELFORT"
-
-    def test_permission_denied(self, client: Client):
-        club = baker.make(Club)
-        client.force_login(baker.make(User))
-        response = client.get(reverse("reservation:room_create"))
-        assert response.status_code == 403
-        response = client.post(
-            reverse("reservation:room_create"),
-            data={"club": club.id, "name": "test", "location": "BELFORT"},
-        )
-        assert response.status_code == 403
-
-
-@pytest.mark.django_db
-class TestUpdateRoom:
-    def test_ok(self, client: Client):
-        club = baker.make(Club)
-        room = baker.make(Room, club=club)
-        client.force_login(baker.make(User, groups=[club.board_group]))
-        url = reverse("reservation:room_edit", kwargs={"room_id": room.id})
-        response = client.post(url, data={"name": "test", "location": "BELFORT"})
-        assertRedirects(response, url)
-        room.refresh_from_db()
-        assert room.club == club
-        assert room.name == "test"
-        assert room.location == "BELFORT"
-
-    def test_permission_denied(self, client: Client):
-        club = baker.make(Club)
-        room = baker.make(Room, club=club)
-        client.force_login(baker.make(User))
-        url = reverse("reservation:room_edit", kwargs={"room_id": room.id})
-        response = client.get(url)
-        assert response.status_code == 403
-        response = client.post(url, data={"name": "test", "location": "BELFORT"})
-        assert response.status_code == 403
-
-
-@pytest.mark.django_db
-class TestUpdateRoomForm:
-    def test_form_club_edition_rights(self):
-        """The club field should appear only if the request user can edit it."""
-        room = baker.make(Room)
-        perm = Permission.objects.get(codename="change_room")
-        user_authorized = baker.make(User, user_permissions=[perm])
-        assert "club" in RoomUpdateForm(request_user=user_authorized).fields
-
-        user_forbidden = baker.make(User, groups=[room.club.board_group])
-        assert "club" not in RoomUpdateForm(request_user=user_forbidden).fields

reservation/tests/test_slot.py

@@ -1,207 +0,0 @@
-from datetime import timedelta
-
-import pytest
-from django.contrib.auth.models import Permission
-from django.test import Client
-from django.urls import reverse
-from django.utils.timezone import now
-from model_bakery import baker
-from pytest_django.asserts import assertNumQueries
-
-from core.models import User
-from reservation.forms import ReservationForm
-from reservation.models import ReservationSlot, Room
-
-
-@pytest.mark.django_db
-class TestFetchReservationSlotsApi:
-    @pytest.fixture
-    def user(self):
-        perm = Permission.objects.get(codename="view_reservationslot")
-        return baker.make(User, user_permissions=[perm])
-
-    def test_fetch_simple(self, client: Client, user: User):
-        slots = baker.make(ReservationSlot, _quantity=5, _bulk_create=True)
-        client.force_login(user)
-        response = client.get(reverse("api:fetch_reservation_slots"))
-        assert response.json()["results"] == [
-            {
-                "id": slot.id,
-                "room": slot.room_id,
-                "comment": slot.comment,
-                "start": slot.start_at.isoformat(timespec="milliseconds").replace(
-                    "+00:00", "Z"
-                ),
-                "end": slot.end_at.isoformat(timespec="milliseconds").replace(
-                    "+00:00", "Z"
-                ),
-                "author": {
-                    "id": slot.author.id,
-                    "first_name": slot.author.first_name,
-                    "last_name": slot.author.last_name,
-                    "nick_name": slot.author.nick_name,
-                },
-            }
-            for slot in slots
-        ]
-
-    def test_nb_queries(self, client: Client, user: User):
-        client.force_login(user)
-        with assertNumQueries(5):
-            # 4 for authentication
-            # 1 to fetch the actual data
-            client.get(reverse("api:fetch_reservation_slots"))
-
-
-@pytest.mark.django_db
-class TestUpdateReservationSlotApi:
-    @pytest.fixture
-    def user(self):
-        perm = Permission.objects.get(codename="change_reservationslot")
-        return baker.make(User, user_permissions=[perm])
-
-    @pytest.fixture
-    def slot(self):
-        return baker.make(
-            ReservationSlot,
-            start_at=now() + timedelta(hours=2),
-            end_at=now() + timedelta(hours=4),
-        )
-
-    def test_ok(self, client: Client, user: User, slot: ReservationSlot):
-        client.force_login(user)
-        new_start = (slot.start_at + timedelta(hours=1)).replace(microsecond=0)
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {"start_at": new_start, "end_at": new_start + timedelta(hours=2)},
-            content_type="application/json",
-        )
-        assert response.status_code == 200
-        slot.refresh_from_db()
-        assert slot.start_at.replace(microsecond=0) == new_start
-        assert slot.end_at.replace(microsecond=0) == new_start + timedelta(hours=2)
-
-    def test_change_past_event(self, client, user: User, slot: ReservationSlot):
-        """Test that moving a slot that already began is impossible."""
-        client.force_login(user)
-        new_start = now() - timedelta(hours=1)
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {"start_at": new_start, "end_at": new_start + timedelta(hours=2)},
-            content_type="application/json",
-        )
-
-        assert response.status_code == 422
-
-    def test_move_event_to_occupied_slot(
-        self, client: Client, user: User, slot: ReservationSlot
-    ):
-        client.force_login(user)
-        other_slot = baker.make(
-            ReservationSlot,
-            room=slot.room,
-            start_at=slot.end_at + timedelta(hours=1),
-            end_at=slot.end_at + timedelta(hours=3),
-        )
-        response = client.patch(
-            reverse("api:change_reservation_slot", kwargs={"slot_id": slot.id}),
-            {
-                "start_at": other_slot.start_at - timedelta(hours=1),
-                "end_at": other_slot.start_at + timedelta(hours=1),
-            },
-            content_type="application/json",
-        )
-        assert response.status_code == 409
-
-
-@pytest.mark.django_db
-class TestReservationForm:
-    def test_ok(self):
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        form = ReservationForm(
-            author=baker.make(User),
-            data={"room": baker.make(Room), "start_at": start, "end_at": end},
-        )
-        assert form.is_valid()
-
-    @pytest.mark.parametrize(
-        ("start_date", "end_date", "errors"),
-        [
-            (
-                now() - timedelta(hours=2),
-                now() + timedelta(hours=2),
-                {"start_at": ["Assurez-vous que cet horodatage est dans le futur"]},
-            ),
-            (
-                now() + timedelta(hours=3),
-                now() + timedelta(hours=2),
-                {"__all__": ["Le début doit être placé avant la fin"]},
-            ),
-        ],
-    )
-    def test_invalid_timedates(self, start_date, end_date, errors):
-        form = ReservationForm(
-            author=baker.make(User),
-            data={"room": baker.make(Room), "start_at": start_date, "end_at": end_date},
-        )
-        assert not form.is_valid()
-        assert form.errors == errors
-
-    def test_unavailable_room(self):
-        room = baker.make(Room)
-        baker.make(
-            ReservationSlot,
-            room=room,
-            start_at=now() + timedelta(hours=2),
-            end_at=now() + timedelta(hours=4),
-        )
-        form = ReservationForm(
-            author=baker.make(User),
-            data={
-                "room": room,
-                "start_at": now() + timedelta(hours=1),
-                "end_at": now() + timedelta(hours=3),
-            },
-        )
-        assert not form.is_valid()
-        assert form.errors == {
-            "__all__": ["Il y a déjà une réservation sur ce créneau."]
-        }
-
-
-@pytest.mark.django_db
-class TestCreateReservationSlot:
-    @pytest.fixture
-    def user(self):
-        perms = Permission.objects.filter(
-            codename__in=["add_reservationslot", "view_reservationslot"]
-        )
-        return baker.make(User, user_permissions=list(perms))
-
-    def test_ok(self, client: Client, user: User):
-        client.force_login(user)
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        room = baker.make(Room)
-        response = client.post(
-            reverse("reservation:make_reservation"),
-            {"room": room.id, "start_at": start, "end_at": end},
-        )
-        assert response.status_code == 200
-        assert response.headers.get("HX-Redirect", "") == reverse("reservation:main")
-        slot = ReservationSlot.objects.filter(room=room).last()
-        assert slot is not None
-        assert slot.start_at == start
-        assert slot.end_at == end
-        assert slot.author == user
-
-    def test_permissions_denied(self, client: Client):
-        client.force_login(baker.make(User))
-        start = now() + timedelta(hours=2)
-        end = start + timedelta(hours=1)
-        response = client.post(
-            reverse("reservation:make_reservation"),
-            {"room": baker.make(Room), "start_at": start, "end_at": end},
-        )
-        assert response.status_code == 403

reservation/urls.py

@@ -1,19 +0,0 @@
-from django.urls import path
-
-from reservation.views import (
-    ReservationFragment,
-    ReservationScheduleView,
-    RoomCreateView,
-    RoomDeleteView,
-    RoomUpdateView,
-)
-
-urlpatterns = [
-    path("", ReservationScheduleView.as_view(), name="main"),
-    path("room/create/", RoomCreateView.as_view(), name="room_create"),
-    path("room/<int:room_id>/edit", RoomUpdateView.as_view(), name="room_edit"),
-    path("room/<int:room_id>/delete", RoomDeleteView.as_view(), name="room_delete"),
-    path(
-        "fragment/reservation", ReservationFragment.as_view(), name="make_reservation"
-    ),
-]

reservation/views.py

@@ -1,72 +0,0 @@
-# Create your views here.
-
-from django.contrib.auth.mixins import PermissionRequiredMixin
-from django.contrib.messages.views import SuccessMessageMixin
-from django.urls import reverse, reverse_lazy
-from django.utils.translation import gettext_lazy as _
-from django.views.generic import CreateView, DeleteView, TemplateView, UpdateView
-
-from club.models import Club
-from core.auth.mixins import CanEditMixin
-from core.views import UseFragmentsMixin
-from core.views.mixins import FragmentMixin
-from reservation.forms import ReservationForm, RoomCreateForm, RoomUpdateForm
-from reservation.models import ReservationSlot, Room
-
-
-class ReservationFragment(PermissionRequiredMixin, FragmentMixin, CreateView):
-    model = ReservationSlot
-    form_class = ReservationForm
-    permission_required = "reservation.add_reservationslot"
-    template_name = "reservation/fragments/create_reservation.jinja"
-    success_url = reverse_lazy("reservation:main")
-    reload_on_redirect = True
-    object = None
-
-    def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"author": self.request.user}
-
-
-class ReservationScheduleView(PermissionRequiredMixin, UseFragmentsMixin, TemplateView):
-    template_name = "reservation/schedule.jinja"
-    permission_required = "reservation.view_reservationslot"
-    fragments = {"add_slot_fragment": ReservationFragment}
-
-
-class RoomCreateView(PermissionRequiredMixin, CreateView):
-    form_class = RoomCreateForm
-    template_name = "core/create.jinja"
-    permission_required = "reservation.add_room"
-
-    def get_initial(self):
-        init = super().get_initial()
-        if "club" in self.request.GET:
-            club_id = self.request.GET["club"]
-            if club_id.isdigit() and int(club_id) > 0:
-                init["club"] = Club.objects.filter(id=int(club_id)).first()
-        return init
-
-    def get_success_url(self):
-        return reverse("club:tools", kwargs={"club_id": self.object.club_id})
-
-
-class RoomUpdateView(SuccessMessageMixin, CanEditMixin, UpdateView):
-    model = Room
-    pk_url_kwarg = "room_id"
-    form_class = RoomUpdateForm
-    template_name = "core/edit.jinja"
-    success_message = _("%(name)s was updated successfully")
-
-    def get_form_kwargs(self):
-        return super().get_form_kwargs() | {"request_user": self.request.user}
-
-    def get_success_url(self):
-        return self.request.path
-
-
-class RoomDeleteView(PermissionRequiredMixin, DeleteView):
-    model = Room
-    pk_url_kwarg = "room_id"
-    template_name = "core/delete_confirm.jinja"
-    success_url = reverse_lazy("reservation:room_list")
-    permission_required = "reservation.delete_room"

sith/settings.py

@@ -34,6 +34,7 @@ https://docs.djangoproject.com/en/1.8/ref/settings/
 """
 
 import binascii
+import contextlib
 import os
 import sys
 from datetime import timedelta
@@ -41,6 +42,7 @@ from pathlib import Path
 
 import sentry_sdk
 from dateutil.relativedelta import relativedelta
+from django.utils.deprecation import RemovedInDjango60Warning
 from django.utils.translation import gettext_lazy as _
 from environs import Env
 from sentry_sdk.integrations.django import DjangoIntegration
@@ -91,7 +93,8 @@ ALLOWED_HOSTS = ["*"]
 # RemovedInDjango60Warning: It's a transitional setting helpful in early
 # adoption of "https" as the new default value of forms.URLField.assume_scheme.
 # Remove this after upgrading to Django 6.x
-FORMS_URLFIELD_ASSUME_HTTPS = True
+with contextlib.suppress(RemovedInDjango60Warning):
+    FORMS_URLFIELD_ASSUME_HTTPS = True
 
 # Application definition
 
@@ -112,6 +115,7 @@ INSTALLED_APPS = (
     "django_jinja",
     "ninja_extra",
     "haystack",
+    "django_countries",
     "django_celery_results",
     "django_celery_beat",
     "captcha",
@@ -128,7 +132,6 @@ INSTALLED_APPS = (
     "trombi",
     "matmat",
     "pedagogy",
-    "reservation",
     "galaxy",
     "antispam",
     "timetable",
@@ -139,13 +142,13 @@ MIDDLEWARE = (
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
-    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "core.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.locale.LocaleMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "django.middleware.security.SecurityMiddleware",
-    "core.middleware.AuthenticationMiddleware",
     "core.middleware.SignalRequestMiddleware",
+    "counter.middleware.BarmenMiddleware",
 )
 
 ROOT_URLCONF = "sith.urls"
@@ -280,7 +283,7 @@ LOGGING = {
 # Internationalization
 # https://docs.djangoproject.com/en/1.8/topics/i18n/
 
-LANGUAGE_CODE = "fr"
+LANGUAGE_CODE = "fr-FR"
 
 LANGUAGES = [("en", _("English")), ("fr", _("French"))]
 
@@ -292,7 +295,11 @@ USE_TZ = True
 
 LOCALE_PATHS = [BASE_DIR / "locale"]
 
+# for PhoneNumberField
 PHONENUMBER_DEFAULT_REGION = "FR"
+# for CountryField
+COUNTRIES_FIRST = ["FR", "CH", "DE"]
+COUNTRIES_FIRST_BREAK = "───────────"
 
 # Medias
 MEDIA_URL = "/data/"
@@ -496,6 +503,12 @@ SITH_ACCOUNT_INACTIVITY_DELTA = relativedelta(years=2)
 SITH_ACCOUNT_DUMP_DELTA = timedelta(days=30)
 """timedelta between the warning mail and the actual account dump"""
 
+SITH_ACCOUNT_MAX_MONEY = 250  # €
+"""Maximum amount of money a sith account can hold.
+
+This amount is defined by the AE's Terms and Conditions of Sale.
+"""
+
 # Defines which product type is the refilling type,
 # and thus increases the account amount
 SITH_COUNTER_PRODUCTTYPE_REFILLING = env.int(
@@ -572,6 +585,11 @@ SITH_BARMAN_TIMEOUT = 30
 # Minutes to delete the last operations
 SITH_LAST_OPERATIONS_LIMIT = 10
 
+# time before a basket is considered expired
+SITH_EBOUTIC_BASKET_TIMEOUT = timedelta(minutes=10)
+# time that a user can spend on the CB payment page before it to timeout
+SITH_EBOUTIC_ETRANSACTION_TIMEOUT = timedelta(minutes=10)
+
 # ET variables
 SITH_EBOUTIC_CB_ENABLED = env.bool("SITH_EBOUTIC_CB_ENABLED", default=True)
 SITH_EBOUTIC_ET_URL = env.str(

sith/urls.py

@@ -49,10 +49,6 @@ urlpatterns = [
     path("trombi/", include(("trombi.urls", "trombi"), namespace="trombi")),
     path("matmatronch/", include(("matmat.urls", "matmat"), namespace="matmat")),
     path("pedagogy/", include(("pedagogy.urls", "pedagogy"), namespace="pedagogy")),
-    path(
-        "reservation/",
-        include(("reservation.urls", "reservation"), namespace="reservation"),
-    ),
     path("admin/", admin.site.urls),
     path("i18n/", include("django.conf.urls.i18n")),
     path("jsi18n/", JavaScriptCatalog.as_view(), name="javascript-catalog"),

tsconfig.json

@@ -18,8 +18,7 @@
       "#core:*": ["./core/static/bundled/*"],
       "#pedagogy:*": ["./pedagogy/static/bundled/*"],
       "#counter:*": ["./counter/static/bundled/*"],
-      "#com:*": ["./com/static/bundled/*"],
+      "#com:*": ["./com/static/bundled/*"]
-      "#reservation:*": ["./reservation/static/bundled/*"]
     }
   }
 }