Better permission for /api/counter/search/detailed

com/tests/test_views.py

@@ -31,9 +31,8 @@ from pytest_django.asserts import assertNumQueries, assertRedirects
 
 from club.models import Club, ClubRole, Membership
 from com.models import News, NewsDate, Poster, Sith, Weekmail, WeekmailArticle
-from core.baker_recipes import old_subscriber_user, subscriber_user
+from core.baker_recipes import subscriber_user
 from core.models import AnonymousUser, Group, User
-from core.templatetags.renderer import markdown
 from core.utils import RED_PIXEL_PNG
 
 
@@ -43,32 +42,68 @@ def user_community():
 
 
 @pytest.mark.django_db
-def test_com_page_is_working(client, user_community):
+@pytest.mark.parametrize(
+    "url",
+    [
+        reverse("com:alert_edit"),
+        reverse("com:info_edit"),
+    ],
+)
+def test_com_page_is_working(client, url, user_community):
     client.force_login(user_community)
-    response = client.get(reverse("com:banner_edit"))
+    response = client.get(url)
     assert response.status_code == 200
 
 
 class TestCom(TestCase):
     @classmethod
     def setUpTestData(cls):
+        cls.skia = User.objects.get(username="skia")
         cls.com_group = Group.objects.get(id=settings.SITH_GROUP_COM_ADMIN_ID)
-        cls.com_admin = subscriber_user.make(groups=[cls.com_group])
+        cls.skia.groups.set([cls.com_group])
 
-    def test_banner_messages(self):
-        self.client.force_login(self.com_admin)
-        alert_msg = "### ALERTE!\n\n**Caaaataaaapuuuulte!!!!**\n"
-        info_msg = "### INFO:\n\n**Caaaataaaapuuuulte!!!!**\n"
+    def setUp(self):
+        self.client.force_login(self.skia)
+
+    def test_alert_msg(self):
         self.client.post(
-            reverse("com:banner_edit"), {"alert_msg": alert_msg, "info_msg": info_msg}
+            reverse("com:alert_edit"),
+            {
+                "alert_msg": """
+### ALERTE!
+
+**Caaaataaaapuuuulte!!!!**
+"""
+            },
         )
         r = self.client.get(reverse("core:index"))
         assert r.status_code == 200
-        self.assertInHTML(f'<div id="alert_box">{markdown(alert_msg)}</div>', r.text)
-        self.assertInHTML(f'<div id="info_box">{markdown(info_msg)}</div>', r.text)
+        self.assertInHTML(
+            """<div id="alert_box"><div class="markdown"><h3>ALERTE!</h3>
+            <p><strong>Caaaataaaapuuuulte!!!!</strong></p>""",
+            r.content.decode(),
+        )
+
+    def test_info_msg(self):
+        self.client.post(
+            reverse("com:info_edit"),
+            {
+                "info_msg": """
+### INFO: **Caaaataaaapuuuulte!!!!**
+"""
+            },
+        )
+        r = self.client.get(reverse("core:index"))
+
+        assert r.status_code == 200
+        self.assertInHTML(
+            """<div id="info_box"><div class="markdown">
+            <h3>INFO: <strong>Caaaataaaapuuuulte!!!!</strong></h3>""",
+            r.content.decode(),
+        )
 
     def test_birthday_non_subscribed_user(self):
-        self.client.force_login(baker.make(User))
+        self.client.force_login(User.objects.get(username="guy"))
         response = self.client.get(reverse("core:index"))
         self.assertContains(
             response,
@@ -76,7 +111,6 @@ class TestCom(TestCase):
         )
 
     def test_birthday_subscibed_user(self):
-        self.client.force_login(subscriber_user.make())
         response = self.client.get(reverse("core:index"))
 
         self.assertNotContains(
@@ -85,7 +119,7 @@ class TestCom(TestCase):
         )
 
     def test_birthday_old_subscibed_user(self):
-        self.client.force_login(old_subscriber_user.make())
+        self.client.force_login(User.objects.get(username="old_subscriber"))
         response = self.client.get(reverse("core:index"))
 
         self.assertNotContains(

com/urls.py

@@ -16,7 +16,8 @@
 from django.urls import path
 
 from com.views import (
-    BannerMessagesEditView,
+    AlertMsgEditView,
+    InfoMsgEditView,
     NewsAdminListView,
     NewsCreateView,
     NewsDeleteView,
@@ -44,7 +45,8 @@ from com.views import (
 )
 
 urlpatterns = [
-    path("sith/edit/banner/", BannerMessagesEditView.as_view(), name="banner_edit"),
+    path("sith/edit/alert/", AlertMsgEditView.as_view(), name="alert_edit"),
+    path("sith/edit/info/", InfoMsgEditView.as_view(), name="info_edit"),
     path(
         "sith/edit/weekmail_destinations/",
         WeekmailDestinationEditView.as_view(),

com/views.py

@@ -75,9 +75,14 @@ class ComTabsMixin(TabedViewMixin):
                 "name": _("Weekmail destinations"),
             },
             {
-                "url": reverse("com:banner_edit"),
-                "slug": "banner",
-                "name": _("Banner messages"),
+                "url": reverse("com:info_edit"),
+                "slug": "info",
+                "name": _("Info message"),
+            },
+            {
+                "url": reverse("com:alert_edit"),
+                "slug": "alert",
+                "name": _("Alert message"),
             },
             {
                 "url": reverse("com:poster_list"),
@@ -100,14 +105,20 @@ class ComEditView(ComTabsMixin, CanEditPropMixin, UpdateView):
         return Sith.objects.first()
 
 
-class BannerMessagesEditView(ComEditView):
+class AlertMsgEditView(ComEditView):
     form_class = modelform_factory(
-        Sith,
-        fields=["alert_msg", "info_msg"],
-        widgets={"alert_msg": MarkdownInput, "info_msg": MarkdownInput},
+        Sith, fields=["alert_msg"], widgets={"alert_msg": MarkdownInput}
     )
-    current_tab = "banner"
-    success_url = reverse_lazy("com:banner_edit")
+    current_tab = "alert"
+    success_url = reverse_lazy("com:alert_edit")
+
+
+class InfoMsgEditView(ComEditView):
+    form_class = modelform_factory(
+        Sith, fields=["info_msg"], widgets={"info_msg": MarkdownInput}
+    )
+    current_tab = "info"
+    success_url = reverse_lazy("com:info_edit")
 
 
 class WeekmailDestinationEditView(ComEditView):

core/templates/core/user_tools.jinja

@@ -13,7 +13,7 @@
     <h3>{% trans %}User Tools{% endtrans %}</h3>
 
     <div class="container">
-      {% if user.has_perm("subscription.view_userban") or user.has_perm("club.add_club") or user.is_root or user.is_board_member %}
+      {% if user.has_perm("subscription.view_userban") or user.is_root or user.is_board_member %}
         <div>
           <h4>{% trans %}Sith management{% endtrans %}</h4>
           <ul>
@@ -30,7 +30,7 @@
             {% if user.has_perm("core.view_userban") %}
               <li><a href="{{ url("rootplace:ban_list") }}">{% trans %}Bans{% endtrans %}</a></li>
             {% endif %}
-            {% if user.has_perm("club.add_club") %}
+            {% if user.is_board_member or user.is_root %}
               <li><a href="{{ url('club:club_new') }}">{% trans %}New club{% endtrans %}</a></li>
             {% endif %}
           </ul>
@@ -41,7 +41,8 @@
       {% for b in settings.SITH_COUNTER_BARS if user.is_in_group(name=b[1] + " admin") %}
         {% set is_admin_on_a_counter = true %}
       {% endfor %}
-      {% if is_admin_on_a_counter or user.has_perm("counter.view_product") or user.has_perm("counter.view_eticket") %}
+
+      {% if is_admin_on_a_counter or user.is_root or user.is_in_group(pk=settings.SITH_GROUP_COUNTER_ADMIN_ID) %}
         <div>
           <h4>{% trans %}Counters{% endtrans %}</h4>
           <ul>
@@ -51,15 +52,31 @@
                   {% trans %}General counters management{% endtrans %}
                 </a>
               </li>
-            {% endif %}
-            {% if user.has_perm("counter.view_product") %}
               <li>
                 <a href="{{ url('counter:product_list') }}">
                   {% trans %}Products management{% endtrans %}
                 </a>
               </li>
-            {% endif %}
-            {% if user.has_perm("counter.view_eticket") %}
+              <li>
+                <a href="{{ url('counter:product_type_list') }}">
+                  {% trans %}Product types management{% endtrans %}
+                </a>
+              </li>
+              <li>
+                <a href="{{ url("counter:returnable_list") }}">
+                  {% trans %}Returnable products management{% endtrans %}
+                </a>
+              </li>
+              <li>
+                <a href="{{ url('counter:cash_summary_list') }}">
+                  {% trans %}Cash register summaries{% endtrans %}
+                </a>
+              </li>
+              <li>
+                <a href="{{ url('counter:invoices_call') }}">
+                  {% trans %}Invoices call{% endtrans %}
+                </a>
+              </li>
               <li>
                 <a href="{{ url('counter:eticket_list') }}">
                   {% trans %}Etickets{% endtrans %}
@@ -92,17 +109,10 @@
         </div>
       {% endif %}
 
-      {% if user.has_perms(["counter.view_invoicecall", "counter.change_invoicecall"]) or user.is_root or user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID) %}
+      {% if user.is_root or user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID) %}
         <div>
           <h4>{% trans %}Accounting{% endtrans %}</h4>
           <ul>
-            {% if user.has_perms(["counter.view_invoicecall", "counter.change_invoicecall"]) %}
-              <li>
-                <a href="{{ url('counter:invoices_call') }}">
-                  {% trans %}Invoices call{% endtrans %}
-                </a>
-              </li>
-            {% endif %}
             {% if user.is_root or user.is_in_group(pk=settings.SITH_GROUP_ACCOUNTING_ADMIN_ID) %}
               <li><a href="{{ url("counter:account_refound") }}">{% trans %}Refound Account{% endtrans %}</a></li>
             {% endif %}
@@ -110,19 +120,23 @@
         </div>
       {% endif %}
 
-      {% if user.is_root or user.is_com_admin or user.has_perm("sas.moderate_sasfile") %}
+      {% if user.is_root or user.is_com_admin or user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID) %}
         <div>
           <h4>{% trans %}Communication{% endtrans %}</h4>
           <ul>
             {% if user.is_com_admin or user.is_root %}
+              <li><a href="{{ url('com:weekmail_article') }}">{% trans %}Create weekmail article{% endtrans %}</a></li>
               <li><a href="{{ url('com:weekmail') }}">{% trans %}Weekmail{% endtrans %}</a></li>
+              <li><a href="{{ url('com:weekmail_destinations') }}">{% trans %}Weekmail destinations{% endtrans %}</a></li>
               <li><a href="{{ url('com:news_new') }}">{% trans %}Create news{% endtrans %}</a></li>
               <li><a href="{{ url('com:news_admin_list') }}">{% trans %}Moderate news{% endtrans %}</a></li>
-              <li><a href="{{ url('com:banner_edit') }}">{% trans %}Edit banner messages{% endtrans %}</a></li>
+              <li><a href="{{ url('com:alert_edit') }}">{% trans %}Edit alert message{% endtrans %}</a></li>
+              <li><a href="{{ url('com:info_edit') }}">{% trans %}Edit information message{% endtrans %}</a></li>
+              <li><a href="{{ url('core:file_moderation') }}">{% trans %}Moderate files{% endtrans %}</a></li>
               <li><a href="{{ url('com:poster_list') }}">{% trans %}Posters{% endtrans %}</a></li>
               <li><a href="{{ url('com:screen_list') }}">{% trans %}Screens{% endtrans %}</a></li>
             {% endif %}
-            {% if user.has_perm("sas.moderate_sasfile") %}
+            {% if user.is_in_group(pk=settings.SITH_GROUP_SAS_ADMIN_ID) %}
               <li><a href="{{ url('sas:moderation') }}">{% trans %}Moderate pictures{% endtrans %}</a></li>
             {% endif %}
           </ul>
@@ -158,17 +172,12 @@
         </div>
       {% endif %}
 
-      {% set memberships = user.memberships.ongoing().select_related("club")|list %}
-      {% if memberships|length > 0 %}
+      {% if user.memberships.filter(end_date=None).all().count() > 0 %}
         <div>
           <h4>{% trans %}Club tools{% endtrans %}</h4>
           <ul>
-            {% for m in memberships %}
-              {% if m.is_board %}
-                <li><a href="{{ url('club:tools', club_id=m.club_id) }}">{{ m.club }}</a></li>
-              {% else %}
-                <li><a href="{{ url('club:club_view', club_id=m.club_id) }}">{{ m.club }}</a></li>
-              {% endif %}
+            {% for m in user.memberships.filter(end_date=None).all() %}
+              <li><a href="{{ url('club:tools', club_id=m.club.id) }}">{{ m.club }}</a></li>
             {% endfor %}
           </ul>
         </div>
@@ -201,7 +210,7 @@
         <ul>
           <li><a href="{{ url('election:list') }}">{% trans %}See available elections{% endtrans %}</a></li>
           <li><a href="{{ url('election:list_archived') }}">{% trans %}See archived elections{% endtrans %}</a></li>
-          {%- if user.has_perm("election.add_election") -%}
+          {%- if user.is_subscribed -%}
             <li><a href="{{ url('election:create') }}">{% trans %}Create a new election{% endtrans %}</a></li>
           {%- endif -%}
         </ul>

core/tests/test_core.py

@@ -35,7 +35,7 @@ from pytest_django.asserts import assertInHTML, assertRedirects
 
 from antispam.models import ToxicDomain
 from club.models import Club
-from core.baker_recipes import board_user, subscriber_user
+from core.baker_recipes import subscriber_user
 from core.models import AnonymousUser, Group, Page, User, validate_promo
 from core.utils import get_last_promo, get_semester_code, get_start_of_semester
 from core.views import AllowFragment
@@ -398,24 +398,11 @@ class TestUserTools:
             response, expected_url=reverse("core:login", query={"next": url})
         )
 
-    @pytest.mark.parametrize(
-        "user_factory",
-        [
-            lambda: baker.make(User),
-            lambda: baker.make(User, is_superuser=True),
-            board_user.make,
-            lambda: baker.make(
-                User, groups=[Group.objects.get(id=settings.SITH_GROUP_COM_ADMIN_ID)]
-            ),
-            lambda: baker.make(
-                User,
-                groups=[Group.objects.get(id=settings.SITH_GROUP_COUNTER_ADMIN_ID)],
-            ),
-        ],
-    )
-    def test_page_is_working(self, client, user_factory):
+    @pytest.mark.parametrize("username", ["guy", "root", "skia", "comunity"])
+    def test_page_is_working(self, client, username):
         """All existing users should be able to see the test page."""
-        client.force_login(user_factory())
+        # Test for simple user
+        client.force_login(User.objects.get(username=username))
         response = client.get(reverse("core:user_tools"))
         assert response.status_code == 200
 

counter/api.py

@@ -22,7 +22,7 @@ from ninja_extra.pagination import PageNumberPaginationExtra
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.auth import ApiKeyAuth
-from api.permissions import CanAccessLookup, CanView, IsInGroup, IsRoot
+from api.permissions import CanAccessLookup, CanView, HasPerm, IsInGroup, IsRoot
 from counter.models import Counter, Product, ProductType
 from counter.schemas import (
     CounterFilterSchema,
@@ -93,7 +93,7 @@ class ProductController(ControllerBase):
     @route.get(
         "/search/detailed",
         response=PaginatedResponseSchema[ProductSchema],
-        permissions=[IsCounterAdmin],
+        permissions=[HasPerm("counter.view_product")],
         url_name="search_products_detailed",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)

counter/templates/counter/product_form.jinja

@@ -83,6 +83,7 @@
 {% endmacro %}
 
 {% block content %}
+  {% if not user.has_perm("counter.change_product") %}
     <div class="alert alert-yellow">
       <div class="alert-main">
         {%- trans trimmed -%}
@@ -92,6 +93,7 @@
         {%- endtrans -%}
       </div>
     </div>
+  {% endif %}
   {% if object %}
     <h2>{{ object }}</h2>
     <p><i>{% trans %}Creation date{% endtrans %} : {{ object.created_at|date }}</i></p>

counter/views/admin.py

@@ -181,6 +181,9 @@ class ProductEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView
     permission_required = "counter.change_product"
 
     def has_permission(self):
+        # If users can see products but not edit them,
+        # still show them this form, as it is the place where all infos are,
+        # but forbid to save it.
         return self.request.user.has_perm("counter.change_product") or (
             self.request.method == "GET"
             and self.request.user.has_perm("counter.view_product")

election/templates/election/election_list.jinja

@@ -5,13 +5,24 @@
   {%- trans %}Election list{% endtrans %}
 {%- endblock %}
 
+{% block head %}
+  {{ super() -}}
+  <style>
+    small {
+      font-size: smaller;
+    }
+
+    time {
+      font-weight: bolder;
+    }
+  </style>
+{%- endblock %}
+
 {% block content %}
   <h3>{% trans %}Current elections{% endtrans %}</h3>
-  {% if user.has_perm("election.add_election") %}
   <a class="btn btn-blue" href="{{ url("election:create") }}">
     <i class="fa fa-plus"></i>{% trans %}New election{% endtrans %}
   </a>
-  {% endif %}
   {%- for election in object_list %}
     <hr>
     <section>

locale/fr/LC_MESSAGES/django.po

@@ -6,7 +6,7 @@
 msgid ""
 msgstr ""
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-11-06 17:22+0100\n"
+"POT-Creation-Date: 2026-10-27 23:26+0100\n"
 "PO-Revision-Date: 2016-07-18\n"
 "Last-Translator: Maréchal <thomas.girod@utbm.fr\n"
 "Language-Team: AE info <ae.info@utbm.fr>\n"
@@ -20,15 +20,15 @@ msgstr ""
 msgid "Email domain is not allowed."
 msgstr "Le domaine de l'addresse e-mail n'est pas autorisé."
 
-#: antispam/models/models.py
+#: antispam/models.py
 msgid "domain"
 msgstr "domaine"
 
-#: antispam/models/models.py
+#: antispam/models.py
 msgid "is externally managed"
 msgstr "est géré de manière externe"
 
-#: antispam/models/models.py
+#: antispam/models.py
 msgid ""
 "True if kept up-to-date using external toxic domain providers, else False"
 msgstr ""
@@ -1503,13 +1503,17 @@ msgstr "Le mot de la fin"
 msgid "Communication administration"
 msgstr "Administration de la communication"
 
-#: com/views.py
+#: com/views.py core/templates/core/user_tools.jinja
 msgid "Weekmail destinations"
 msgstr "Destinataires du Weekmail"
 
 #: com/views.py
-msgid "Banner messages"
-msgstr "Messages de bannière"
+msgid "Info message"
+msgstr "Message d'info"
+
+#: com/views.py
+msgid "Alert message"
+msgstr "Message d'alerte"
 
 #: com/views.py
 msgid "Posters list"
@@ -2980,6 +2984,24 @@ msgstr "Gestion générale des comptoirs"
 msgid "Products management"
 msgstr "Gestion des produits"
 
+#: core/templates/core/user_tools.jinja
+msgid "Product types management"
+msgstr "Gestion des types de produit"
+
+#: core/templates/core/user_tools.jinja
+msgid "Returnable products management"
+msgstr "Gestion des consignes"
+
+#: core/templates/core/user_tools.jinja
+#: counter/templates/counter/cash_summary_list.jinja counter/views/mixins.py
+msgid "Cash register summaries"
+msgstr "Relevés de caisse"
+
+#: core/templates/core/user_tools.jinja
+#: counter/templates/counter/invoices_call.jinja counter/views/mixins.py
+msgid "Invoices call"
+msgstr "Appels à facture"
+
 #: core/templates/core/user_tools.jinja core/views/user.py
 #: counter/templates/counter/counter_list.jinja
 msgid "Stats"
@@ -2989,11 +3011,6 @@ msgstr "Stats"
 msgid "Accounting"
 msgstr "Comptabilité"
 
-#: core/templates/core/user_tools.jinja
-#: counter/templates/counter/invoices_call.jinja counter/views/mixins.py
-msgid "Invoices call"
-msgstr "Appels à facture"
-
 #: core/templates/core/user_tools.jinja
 msgid "Refound Account"
 msgstr "Rembourser un compte"
@@ -3002,13 +3019,25 @@ msgstr "Rembourser un compte"
 msgid "Communication"
 msgstr "Communication"
 
+#: core/templates/core/user_tools.jinja
+msgid "Create weekmail article"
+msgstr "Rédiger un nouvel article dans le Weekmail"
+
 #: core/templates/core/user_tools.jinja
 msgid "Moderate news"
 msgstr "Modérer les nouvelles"
 
 #: core/templates/core/user_tools.jinja
-msgid "Edit banner messages"
-msgstr "Éditer les messages de bannière"
+msgid "Edit alert message"
+msgstr "Éditer le message d'alerte"
+
+#: core/templates/core/user_tools.jinja
+msgid "Edit information message"
+msgstr "Éditer le message d'informations"
+
+#: core/templates/core/user_tools.jinja
+msgid "Moderate files"
+msgstr "Modérer les fichiers"
 
 #: core/templates/core/user_tools.jinja
 msgid "Moderate pictures"
@@ -3758,10 +3787,6 @@ msgstr "Liste des relevés de caisse"
 msgid "Theoric sums"
 msgstr "Sommes théoriques"
 
-#: counter/templates/counter/cash_summary_list.jinja counter/views/mixins.py
-msgid "Cash register summaries"
-msgstr "Relevés de caisse"
-
 #: counter/templates/counter/cash_summary_list.jinja counter/views/cash.py
 msgid "Emptied"
 msgstr "Coffre vidé"