Merge branch 'beta' into 'master'

Beta Closes #52, #54, #55, #56 et #57 See merge request bde/nk20!104
2024-11-26 18:37:12 +00:00 · 2020-09-02 10:00:22 +02:00 · 2020-09-02 10:00:22 +02:00 · 9f42ecb97a
commit 9f42ecb97a
parent 1fd7d76412 b5028b9814
460 changed files with 12080 additions and 43648 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1,3 +1,5 @@
 __pycache__
 media
 db.sqlite3
+.tox
+.coverage
--- a/.env_example
+++ b/.env_example
@ -1,6 +1,6 @@
 DJANGO_APP_STAGE=prod
 # Only used in dev mode, change to "postgresql" if you want to use PostgreSQL in dev
-DJANGO_DEV_STORE_METHOD=sqllite
+DJANGO_DEV_STORE_METHOD=sqlite
 DJANGO_DB_HOST=localhost
 DJANGO_DB_NAME=note_db
 DJANGO_DB_USER=note
@ -10,9 +10,15 @@ DJANGO_SECRET_KEY=CHANGE_ME
 DJANGO_SETTINGS_MODULE=note_kfet.settings
 CONTACT_EMAIL=tresorerie.bde@localhost
 NOTE_URL=localhost
+DOMAIN=localhost
+
 # Config for mails. Only used in production
 NOTE_MAIL=notekfet@localhost
 EMAIL_HOST=smtp.localhost
-EMAIL_PORT=465
+EMAIL_PORT=25
 EMAIL_USER=notekfet@localhost
 EMAIL_PASSWORD=CHANGE_ME
+
+# Wiki configuration
+WIKI_USER=NoteKfet2020
+WIKI_PASSWORD=
--- a/.gitignore
+++ b/.gitignore
@ -39,7 +39,9 @@ secrets.py
 .env
 map.json
 *.log
-media/
+backups/
+/static/
+/media/

 # Virtualenv
 env/
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -1,30 +1,59 @@
-image: python:3.8
-
 stages:
+  - build_docker_image
  - test
  - quality-assurance

-before_script:
-  - pip install tox
-
-py36-django22:
-  image: python:3.6
-  stage: test
-  script: tox -e py36-django22
+docker:
+  stage: build_docker_image
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  script:
+    - mkdir -p /kaniko/.docker
+    - echo "{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"$CI_BUILD_TOKEN\"}}}" > /kaniko/.docker/config.json
+    - /kaniko/executor --cache=true --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:latest --destination $CI_REGISTRY_IMAGE:debian
+  only:
+    - master
+    - beta
+  cache:
+    key: one-key-to-rule-them-all
+    paths:
+      - /cache/

+# Debian Buster
 py37-django22:
-  image: python:3.7
  stage: test
+  image:
+    name: $CI_REGISTRY_IMAGE:debian
+    entrypoint: [""]
+  before_script:
+    - apt-get update && apt-get install -y tox
  script: tox -e py37-django22

+# Ubuntu 20.04
 py38-django22:
-  image: python:3.8
  stage: test
+  image: ubuntu:20.04
+  before_script:
+    # Fix tzdata prompt
+    - ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime && echo Europe/Paris > /etc/timezone
+    - >
+        apt-get update &&
+        apt-get install -y python3-django python3-django-crispy-forms
+        python3-django-extensions python3-django-filters python3-django-polymorphic
+        python3-djangorestframework python3-django-cas-server python3-psycopg2 python3-pil
+        python3-babel python3-lockfile python3-pip python3-phonenumbers ipython3
+        gettext libjs-bootstrap4 fonts-font-awesome tox &&
+        rm -rf /var/lib/apt/lists/*
  script: tox -e py38-django22

 linters:
-  image: python:3.8
  stage: quality-assurance
+  image:
+    name: $CI_REGISTRY_IMAGE:debian
+    entrypoint: [""]
+  before_script:
+    - apt-get update && apt-get install -y tox
  script: tox -e linters

  # Be nice to new contributors, but please use `tox`
--- a/43
+++ b/43
@ -1,27 +1,28 @@
-FROM python:3-alpine
+FROM debian:buster-backports

+# Force the stdout and stderr streams to be unbuffered
 ENV PYTHONUNBUFFERED 1

-# Install LaTeX requirements
-RUN apk add --no-cache gettext texlive texmf-dist-latexextra texmf-dist-fontsextra nginx gcc libc-dev libffi-dev postgresql-dev libxml2-dev libxslt-dev jpeg-dev
+# Install Django, external apps, LaTeX and dependencies
+RUN apt-get update && \
+    apt-get install --no-install-recommends -t buster-backports -y \
+    python3-django python3-django-crispy-forms \
+    python3-django-extensions python3-django-filters python3-django-polymorphic \
+    python3-djangorestframework python3-django-cas-server python3-psycopg2 python3-pil \
+    python3-babel python3-lockfile python3-pip python3-phonenumbers ipython3 \
+    python3-bs4 python3-setuptools \
+    uwsgi uwsgi-plugin-python3 \
+    texlive-latex-extra texlive-lang-french lmodern texlive-fonts-recommended \
+    gettext libjs-bootstrap4 fonts-font-awesome && \
+    rm -rf /var/lib/apt/lists/*

-RUN apk add --no-cache bash
+# Instal PyPI requirements
+COPY requirements.txt /var/www/note_kfet/
+RUN pip3 install -r /var/www/note_kfet/requirements.txt --no-cache-dir

-RUN mkdir /code
-WORKDIR /code
-COPY requirements /code/requirements
-RUN pip install gunicorn ptpython --no-cache-dir
-RUN pip install -r requirements/base.txt -r requirements/cas.txt -r requirements/production.txt --no-cache-dir
+# Copy code
+WORKDIR /var/www/note_kfet
+COPY . /var/www/note_kfet/

-COPY . /code/
-
-# Configure nginx
-RUN mkdir /run/nginx
-RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
-RUN ln -sf /code/nginx_note.conf_docker /etc/nginx/conf.d/nginx_note.conf
-RUN rm /etc/nginx/conf.d/default.conf
-
-ENTRYPOINT ["/code/entrypoint.sh"]
-EXPOSE 80
-
-CMD ["./manage.py", "shell_plus", "--ptpython"]
+EXPOSE 8080
+ENTRYPOINT ["/var/www/note_kfet/entrypoint.sh"]
--- a/README.md
+++ b/README.md
@ -1,72 +1,83 @@
 # NoteKfet 2020

 [![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0.txt)
-[![pipeline status](https://gitlab.crans.org/bde/nk20/badges/master/pipeline.svg)](https://gitlab.crans.org/bde/nk20/nk20/commits/master)
+[![pipeline status](https://gitlab.crans.org/bde/nk20/badges/master/pipeline.svg)](https://gitlab.crans.org/bde/nk20/commits/master)
 [![coverage report](https://gitlab.crans.org/bde/nk20/badges/master/coverage.svg)](https://gitlab.crans.org/bde/nk20/commits/master)

 ## Installation sur un serveur

-On supposera pour la suite que vous utilisez Debian/Ubuntu sur un serveur tout nu ou bien configuré.
+On supposera pour la suite que vous utilisez une installation de Debian Buster ou Ubuntu 20.04 fraîche ou bien configuré.

-1. Paquets nécessaires
+Pour aller vite vous pouvez lancer le Playbook Ansible fournit dans ce dépôt en l'adaptant.
+Sinon vous pouvez suivre les étapes ici.

-        $ sudo apt install nginx python3 python3-pip python3-dev uwsgi
-        $ sudo apt install uwsgi-plugin-python3 python3-venv git acl
+### Installation avec Debian/Ubuntu

-    La génération des factures de l'application trésorerie nécessite une installation de LaTeX suffisante :
+0. **Activer Debian Backports.** En effet Django 2.2 LTS n'est que disponible dans les backports.

-        $ sudo apt install texlive-latex-extra texlive-fonts-extra texlive-lang-french
+    ```bash
+    $ echo "deb http://deb.debian.org/debian buster-backports main" | sudo tee /etc/apt/sources.list.d/deb_debian_org_debian.list
+    ```

-2. Clonage du dépot
+1.  **Installation des dépendances APT.**
+    On tire les dépendances le plus possible à partir des dépôts de Debian.
+    On a besoin d'un environnement LaTeX pour générer les factures.

-    on se met au bon endroit :
+    ```bash
+    $ sudo apt update
+    $ sudo apt install -t buster-backports -y python3-django python3-django-crispy-forms \
+        python3-django-extensions python3-django-filters python3-django-polymorphic \
+        python3-djangorestframework python3-django-cas-server python3-psycopg2 python3-pil \
+        python3-babel python3-lockfile python3-pip python3-phonenumbers ipython3 \
+        uwsgi uwsgi-plugin-python3 \
+        texlive-latex-extra texlive-fonts-extra texlive-lang-french \
+        gettext libjs-bootstrap4 fonts-font-awesome \
+        nginx python3-venv git acl
+    ```

-        $ cd /var/www/
-        $ mkdir note_kfet
-        $ sudo chown www-data:www-data note_kfet
-        $ sudo usermod -a -G www-data $USER
-        $ sudo chmod g+ws note_kfet
-        $ sudo setfacl -d -m "g::rwx" note_kfet
-        $ cd note_kfet
-        $ git clone git@gitlab.crans.org:bde/nk20.git .
-3. Environment Virtuel
+2.  **Clonage du dépot** dans `/var/www/note_kfet`,

-   À la racine du projet:
+    ```bash
+    $ sudo mkdir -p /var/www/note_kfet && cd /var/www/note_kfet
+    $ sudo chown www-data:www-data .
+    $ sudo chmod g+rwx .
+    $ sudo -u www-data git clone https://gitlab.crans.org/bde/nk20.git
+    ```

-        $ python3 -m venv env
-        $ source env/bin/activate
-        (env)$ pip3 install -r requirements/base.txt
-        (env)$ pip3 install -r requirements/prod.txt # uniquement en prod, nécessite un base postgres
-        (env)$ deactivate
+3.  **Création d'un environment de travail Python décorrélé du système.**

-4. uwsgi  et Nginx
+    ```bash
+    $ python3 -m venv env --system-site-packages
+    $ source env/bin/activate  # entrer dans l'environnement
+    (env)$ pip3 install -r requirements.txt
+    (env)$ deactivate  # sortir de l'environnement
+    ```

-    Un exemple de conf est disponible :
+4.  **Pour configurer UWSGI et NGINX**, des exemples de conf sont disponibles.
+    **_Modifier le fichier pour être en accord avec le reste de votre config_**

+    ```bash
    $ cp nginx_note.conf_example nginx_note.conf
-
-    ***Modifier le fichier pour être en accord avec le reste de votre config***
-
-    On utilise uwsgi et Nginx pour gérer le coté serveur :
-
    $ sudo ln -sf /var/www/note_kfet/nginx_note.conf /etc/nginx/sites-enabled/
+    ```

    Si l'on a un emperor (plusieurs instance uwsgi):

+    ```bash
    $ sudo ln -sf /var/www/note_kfet/uwsgi_note.ini /etc/uwsgi/sites/
+    ```

-    Sinon:
+    Sinon si on est dans le cas habituel :

+    ```bash
    $ sudo ln -sf /var/www/note_kfet/uwsgi_note.ini /etc/uwsgi/apps-enabled/
+    ```
  
    Le touch-reload est activé par défault, pour redémarrer la note il suffit donc de faire `touch uwsgi_note.ini`.

-5. Base de données
+5.  **Base de données.** En production on utilise PostgreSQL. 

-    En prod on utilise postgresql. 
-        
-        $ sudo apt-get install postgresql postgresql-contrib libpq-dev
-        (env)$ pip3 install psycopg2
+        $ sudo apt-get install postgresql postgresql-contrib

    La config de la base de donnée se fait comme suit:

@ -107,7 +118,7 @@ On supposera pour la suite que vous utilisez Debian/Ubuntu sur un serveur tout n
    et on renseigne des secrets et des paramètres :

        DJANGO_APP_STAGE=dev # ou "prod" 
-        DJANGO_DEV_STORE_METHOD=sqllite # ou "postgres"
+        DJANGO_DEV_STORE_METHOD=sqlite # ou "postgres"
        DJANGO_DB_HOST=localhost
        DJANGO_DB_NAME=note_db
        DJANGO_DB_USER=note
@ -115,15 +126,17 @@ On supposera pour la suite que vous utilisez Debian/Ubuntu sur un serveur tout n
        DJANGO_DB_PORT=
        DJANGO_SECRET_KEY=CHANGE_ME
        DJANGO_SETTINGS_MODULE="note_kfet.settings
+        NOTE_URL=localhost # URL où accéder à la note
        DOMAIN=localhost # note.example.com
        CONTACT_EMAIL=tresorerie.bde@localhost
-        NOTE_URL=localhost # URL où accéder à la note
        # Le reste n'est utile qu'en production, pour configurer l'envoi des mails
        NOTE_MAIL=notekfet@localhost
        EMAIL_HOST=smtp.localhost
-        EMAIL_PORT=465
+        EMAIL_PORT=25
        EMAIL_USER=notekfet@localhost
        EMAIL_PASSWORD=CHANGE_ME
+        WIKI_USER=NoteKfet2020
+        WIKI_PASSWORD=CHANGE_ME


    Ensuite on (re)bascule dans l'environement virtuel et on lance les migrations
@ -133,39 +146,51 @@ On supposera pour la suite que vous utilisez Debian/Ubuntu sur un serveur tout n
        (env)$ ./manage.py makemigrations
        (env)$ ./manage.py migrate

-7. Enjoy
+7.  *Enjoy \o/*

-
-## Installer avec Docker
+### Installation avec Docker

 Il est possible de travailler sur une instance Docker.

-1. Cloner le dépôt là où vous voulez :
+Pour construire l'image Docker `nk20`,

-        $ git clone git@gitlab.crans.org:bde/nk20.git
+```
+git clone https://gitlab.crans.org/bde/nk20/ && cd nk20
+docker build . -t nk20
+```

-2. Copiez le fichier `.env_example` à la racine du projet vers le fichier `.env`,
-et  mettez à jour vos variables d'environnement
+Ensuite pour lancer la note Kfet en tant que vous (option `-u`),
+l'exposer sur son port 80 (option `-p`) et monter le code en écriture (option `-v`),

-3. Dans le fichier `docker_compose.yml`, qu'on suppose déjà configuré,
-   ajouter les lignes suivantes, en les adaptant à la configuration voulue :
+```
+docker run -it --rm -u $(id -u):$(id -g) -v "$(pwd):/var/www/note_kfet/" -p 80:8080 nk20
+```

-        nk20:
-          build: /chemin/vers/nk20
+Si vous souhaitez lancer une commande spéciale, vous pouvez l'ajouter à la fin, par exemple,
+
+```
+docker run -it --rm -u $(id -u):$(id -g) -v "$(pwd):/var/www/note_kfet/" -p 80:8080 nk20 python3 ./manage.py createsuperuser
+```
+
+#### Avec Docker Compose
+
+On vous conseilles de faire un fichier d'environnement `.env` en prenant exemple sur `.env_example`.
+
+Pour par exemple utiliser le Docker de la note Kfet avec Traefik pour réaliser le HTTPS,
+
+```YAML
+nk20:
+  build: /chemin/vers/le/code/nk20
  volumes:
-            - /chemin/vers/nk20:/code/
-          env_file: /chemin/vers/nk20/.env
+    - /chemin/vers/le/code/nk20:/var/www/note_kfet/
+  env_file: /chemin/vers/le/code/nk20/.env
  restart: always
  labels:
-            - traefik.domain=ndd.example.com
-            - traefik.frontend.rule=Host:ndd.example.com
-            - traefik.port=8000
+    - "traefik.http.routers.nk20.rule=Host(`ndd.example.com`)"
+    - "traefik.http.services.nk20.loadbalancer.server.port=8080"
+```

-3. Enjoy :
-
-        $ docker-compose up -d nk20
-
-## Installer un serveur de développement
+### Lancer un serveur de développement

 Avec `./manage.py runserver` il est très rapide de mettre en place
 un serveur de développement par exemple sur son ordinateur.
@ -179,10 +204,10 @@ un serveur de développement par exemple sur son ordinateur.

         $ python3 -m venv venv
         $ source venv/bin/activate
-        (env)$ pip install -r requirements/base.txt
+         (env)$ pip install -r requirements.txt

 3.  Copier le fichier `.env_example` vers `.env` à la racine du projet et mettre à jour
-ce qu'il faut
+    ce qu'il faut

 4.  Migrations et chargement des données initiales :

@ -202,11 +227,27 @@ En mettant `0.0.0.0:8000` après `runserver`, vous rendez votre instance Django
 accessible depuis l'ensemble de votre réseau, pratique pour tester le rendu
 de la note sur un téléphone !

-## Cahier des Charges 
-
-Il est disponible [ici](https://wiki.crans.org/NoteKfet/NoteKfet2018/CdC). 
-
 ## Documentation

-La documentation est générée par django et son module admindocs.
+Le cahier des charges initial est disponible [sur le Wiki Crans](https://wiki.crans.org/NoteKfet/NoteKfet2018/CdC).
+
+La documentation des classes et fonctions est directement dans le code et est explorable à partir de la partie documentation de l'interface d'administration de Django.
 **Commentez votre code !**
+
+La documentation plus haut niveau sur le développement est disponible sur [le Wiki associé au dépôt Git](https://gitlab.crans.org/bde/nk20/-/wikis/home).
+
+## FAQ
+
+### Regénérer les fichiers de traduction
+
+Pour regénérer les traductions vous pouvez vous placer à la racine du projet et lancer le script `makemessages`. Il faut penser à ignorer les dossiers ne contenant pas notre code, dont le virtualenv.
+
+```bash
+django-admin makemessages -i env
+```
+
+Une fois les fichiers édités, vous pouvez compiler les nouvelles traductions avec
+
+```bash
+django-admin compilemessages
+```
--- a/ansible/base.yml
+++ b/ansible/base.yml
@ -6,6 +6,8 @@
    - name: DB_PASSWORD
      prompt: "Password of the database"
      private: yes
+  vars:
+    mirror: deb.debian.org
  roles:
    - 1-apt-basic
    - 2-nk20
--- a/ansible/roles/1-apt-basic/tasks/main.yml
+++ b/ansible/roles/1-apt-basic/tasks/main.yml
@ -1,21 +1,47 @@
 ---
- name: Install basic APT packages
+- name: Add buster-backports to apt sources
+  apt_repository:
+    repo: deb http://{{ mirror }}/debian buster-backports main
+    state: present
+
+- name: Install note_kfet APT dependencies
  apt:
    update_cache: true
+    default_release: buster-backports
    name:
-      - nginx
-      - python3
-      - python3-pip
-      - python3-dev
-      - uwsgi
-      - uwsgi-plugin-python3
-      - python3-venv
-      - git
-      - acl
+      # Common tools
      - gettext
-      - texlive-latex-extra
+      - git
+      - ipython3
+
+      # Front-end dependencies
+      - fonts-font-awesome
+      - libjs-bootstrap4
+
+      # Python dependencies
+      - python3-babel
+      - python3-django
+      - python3-django-cas-server
+      - python3-django-crispy-forms
+      - python3-django-extensions
+      - python3-django-filters
+      - python3-django-polymorphic
+      - python3-djangorestframework
+      - python3-lockfile
+      - python3-phonenumbers
+      - python3-pil
+      - python3-pip
+      - python3-psycopg2
+      - python3-venv
+
+      # LaTeX (PDF generation)
      - texlive-fonts-extra
      - texlive-lang-french
+      - texlive-latex-extra
+
+      # WSGI server
+      - uwsgi
+      - uwsgi-plugin-python3
  register: pkg_result
  retries: 3
  until: pkg_result is succeeded
--- a/ansible/roles/2-nk20/tasks/main.yml
+++ b/ansible/roles/2-nk20/tasks/main.yml
@ -11,7 +11,7 @@
  git:
    repo: https://gitlab.crans.org/bde/nk20.git
    dest: /var/www/note_kfet
-    version: master
+    version: beta
    force: true

 - name: Use default env vars (should be updated!)
@ -28,3 +28,10 @@
    recurse: yes
    owner: www-data
    group: www-data
+
+- name: Setup cron jobs
+  template:
+    src: note.cron.j2
+    dest: /etc/cron.d/note
+    owner: root
+    group: root
--- a/ansible/roles/2-nk20/templates/note.cron.j2
+++ b/ansible/roles/2-nk20/templates/note.cron.j2
@ -0,0 +1,22 @@
+# {{ ansible_managed }}
+# Les cronjobs dont a besoin la Note Kfet
+
+# m  h   dom mon dow     user   command
+# Envoyer les mails en attente
+ *   *     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py send_mail >> /var/www/note_kfet/cron_mail.log
+ *   *     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py retry_deferred >> /var/www/note_kfet/cron_mail_deferred.log
+ 00  0     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py purge_mail_log 7 >> /var/www/note_kfet/cron_mail_purge.log
+# Faire une sauvegarde de la base de données
+ 00  2     *   *   *     root   cd /var/www/note_kfet && apps/scripts/shell/backup_db
+# Vérifier la cohérence de la base et mailer en cas de problème
+ 00  4     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py check_consistency --sum-all --check-all --mail
+# Mettre à jour le wiki (modification sans (dé)validation, activités passées)
+#30  5     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py refresh_activities --raw --comment refresh
+# Spammer les gens en négatif
+ 00  5     *   *   2     root   cd /var/www/note_kfet && env/bin/python manage.py send_mail_to_negative_balances --spam
+# Envoyer le rapport mensuel aux trésoriers et respos info
+ 00  8     6   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py send_mail_to_negative_balances --report
+# Envoyer les rapports aux gens
+ 55  6     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py send_reports
+# Envoyer les rapports aux gens
+ 00  9     *   *   *     root   cd /var/www/note_kfet && env/bin/python manage.py refresh_highlighted_buttons
--- a/ansible/roles/3-pip/tasks/main.yml
+++ b/ansible/roles/3-pip/tasks/main.yml
@ -1,14 +1,8 @@
 ---
 - name: Install PIP basic dependencies
  pip:
-    requirements: /var/www/note_kfet/requirements/base.txt
-    virtualenv: /var/www/note_kfet/env
-    virtualenv_command: /usr/bin/python3 -m venv
-  become_user: www-data
-
- name: Install PIP production dependencies
-  pip:
-    requirements: /var/www/note_kfet/requirements/production.txt
+    requirements: /var/www/note_kfet/requirements.txt
    virtualenv: /var/www/note_kfet/env
    virtualenv_command: /usr/bin/python3 -m venv
+    virtualenv_site_packages: true
  become_user: www-data
--- a/ansible/roles/4-nginx/tasks/main.yml
+++ b/ansible/roles/4-nginx/tasks/main.yml
@ -1,4 +1,11 @@
 ---
+- name: Install NGINX
+  apt:
+    name: nginx
+  register: pkg_result
+  retries: 3
+  until: pkg_result is succeeded
+
 - name: Copy conf of Nginx
  template:
    src: "nginx_note.conf"
--- a/ansible/roles/4-nginx/templates/nginx_note.conf
+++ b/ansible/roles/4-nginx/templates/nginx_note.conf
@ -53,7 +53,7 @@ server {
    # Finally, send all non-media requests to the Django server.
    location / {
        uwsgi_pass note;
-        include     /var/www/note_kfet/uwsgi_params; # the uwsgi_params file you installed
+        include /etc/nginx/uwsgi_params;
    }

    ssl_certificate /etc/letsencrypt/live/nk20-beta.crans.org/fullchain.pem;
--- a/apps/activity/admin.py
+++ b/apps/activity/admin.py
@ -2,9 +2,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later

 from django.contrib import admin
-
 from note_kfet.admin import admin_site
-from .models import Activity, ActivityType, Guest, Entry
+
+from .forms import GuestForm
+from .models import Activity, ActivityType, Entry, Guest


@admin.register(Activity, site=admin_site)
@ -35,6 +36,7 @@ class GuestAdmin(admin.ModelAdmin):
    Admin customisation for Guest
    """
    list_display = ('last_name', 'first_name', 'activity', 'inviter')
+    form = GuestForm


@admin.register(Entry, site=admin_site)
--- a/apps/activity/api/serializers.py
+++ b/apps/activity/api/serializers.py
@ -3,7 +3,7 @@

 from rest_framework import serializers

-from ..models import ActivityType, Activity, Guest, Entry, GuestTransaction
+from ..models import Activity, ActivityType, Entry, Guest, GuestTransaction


 class ActivityTypeSerializer(serializers.ModelSerializer):
--- a/apps/activity/api/urls.py
+++ b/apps/activity/api/urls.py
@ -1,7 +1,7 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

-from .views import ActivityTypeViewSet, ActivityViewSet, GuestViewSet, EntryViewSet
+from .views import ActivityTypeViewSet, ActivityViewSet, EntryViewSet, GuestViewSet


 def register_activity_urls(router, path):
--- a/apps/activity/api/views.py
+++ b/apps/activity/api/views.py
@ -1,12 +1,12 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

+from api.viewsets import ReadProtectedModelViewSet
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework.filters import SearchFilter
-from api.viewsets import ReadProtectedModelViewSet

-from .serializers import ActivityTypeSerializer, ActivitySerializer, GuestSerializer, EntrySerializer
-from ..models import ActivityType, Activity, Guest, Entry
+from .serializers import ActivitySerializer, ActivityTypeSerializer, EntrySerializer, GuestSerializer
+from ..models import Activity, ActivityType, Entry, Guest


 class ActivityTypeViewSet(ReadProtectedModelViewSet):
--- a/apps/activity/fixtures/initial.json
+++ b/apps/activity/fixtures/initial.json
@ -4,6 +4,7 @@
        "pk": 1,
        "fields": {
            "name": "Pot",
+            "manage_entries": true,
            "can_invite": true,
            "guest_entry_fee": 500
        }
@ -13,6 +14,17 @@
        "pk": 2,
        "fields": {
            "name": "Soir\u00e9e de club",
+            "manage_entries": false,
+            "can_invite": false,
+            "guest_entry_fee": 0
+        }
+    },
+    {
+        "model": "activity.activitytype",
+        "pk": 3,
+        "fields": {
+            "name": "Autre",
+            "manage_entries": false,
            "can_invite": false,
            "guest_entry_fee": 0
        }
--- a/apps/activity/forms.py
+++ b/apps/activity/forms.py
@ -1,18 +1,40 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-from datetime import timedelta, datetime
+
+from datetime import timedelta
+from random import shuffle

 from django import forms
 from django.contrib.contenttypes.models import ContentType
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from member.models import Club
-from note.models import NoteUser, Note
-from note_kfet.inputs import DateTimePickerInput, Autocomplete
+from note.models import Note, NoteUser
+from note_kfet.inputs import Autocomplete, DateTimePickerInput
+from note_kfet.middlewares import get_current_authenticated_user
+from permission.backends import PermissionBackend

 from .models import Activity, Guest


 class ActivityForm(forms.ModelForm):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # By default, the Kfet club is attended
+        self.fields["attendees_club"].initial = Club.objects.get(name="Kfet")
+        self.fields["attendees_club"].widget.attrs["placeholder"] = "Kfet"
+        clubs = list(Club.objects.filter(PermissionBackend
+                                         .filter_queryset(get_current_authenticated_user(), Club, "view")).all())
+        shuffle(clubs)
+        self.fields["organizer"].widget.attrs["placeholder"] = ", ".join(club.name for club in clubs[:4]) + ", ..."
+
+    def clean_date_end(self):
+        date_end = self.cleaned_data["date_end"]
+        date_start = self.cleaned_data["date_start"]
+        if date_end < date_start:
+            self.add_error("date_end", _("The end date must be after the start date."))
+        return date_end
+
    class Meta:
        model = Activity
        exclude = ('creater', 'valid', 'open', )
@ -39,9 +61,18 @@ class ActivityForm(forms.ModelForm):

 class GuestForm(forms.ModelForm):
    def clean(self):
+        """
+        Someone can be invited as a Guest to an Activity if:
+        - the activity has not already started.
+        - the activity is validated.
+        - the Guest has not already been invited more than 5 times.
+        - the Guest is already invited.
+        - the inviter already invited 3 peoples.
+        """
+
        cleaned_data = super().clean()

-        if self.activity.date_start > datetime.now():
+        if timezone.now() > timezone.localtime(self.activity.date_start):
            self.add_error("inviter", _("You can't invite someone once the activity is started."))

        if not self.activity.valid:
@ -50,19 +81,19 @@ class GuestForm(forms.ModelForm):
        one_year = timedelta(days=365)

        qs = Guest.objects.filter(
-            first_name=cleaned_data["first_name"],
-            last_name=cleaned_data["last_name"],
+            first_name__iexact=cleaned_data["first_name"],
+            last_name__iexact=cleaned_data["last_name"],
            activity__date_start__gte=self.activity.date_start - one_year,
        )
-        if len(qs) >= 5:
+        if qs.filter(entry__isnull=False).count() >= 5:
            self.add_error("last_name", _("This person has been already invited 5 times this year."))

        qs = qs.filter(activity=self.activity)
        if qs.exists():
            self.add_error("last_name", _("This person is already invited."))

-        qs = Guest.objects.filter(inviter=cleaned_data["inviter"], activity=self.activity)
-        if len(qs) >= 3:
+        if "inviter" in cleaned_data:
+            if Guest.objects.filter(inviter=cleaned_data["inviter"], activity=self.activity).count() >= 3:
                self.add_error("inviter", _("You can't invite more than 3 people to this activity."))

        return cleaned_data
--- a/apps/activity/models.py
+++ b/apps/activity/models.py
@ -1,14 +1,17 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-from datetime import timedelta, datetime

+from datetime import timedelta
+from threading import Thread
+
+from django.conf import settings
 from django.contrib.auth.models import User
 from django.db import models
 from django.db.models import Q
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
-from rest_framework.exceptions import ValidationError
 from note.models import NoteUser, Transaction
+from rest_framework.exceptions import ValidationError


 class ActivityType(models.Model):
@ -24,11 +27,21 @@ class ActivityType(models.Model):
        verbose_name=_('name'),
        max_length=255,
    )
+
+    manage_entries = models.BooleanField(
+        verbose_name=_('manage entries'),
+        help_text=_('Enable the support of entries for this activity.'),
+        default=False,
+    )
+
    can_invite = models.BooleanField(
        verbose_name=_('can invite'),
+        default=False,
    )
+
    guest_entry_fee = models.PositiveIntegerField(
        verbose_name=_('guest entry fee'),
+        default=0,
    )

    class Meta:
@ -54,6 +67,14 @@ class Activity(models.Model):
        verbose_name=_('description'),
    )

+    location = models.CharField(
+        verbose_name=_('location'),
+        max_length=255,
+        blank=True,
+        default="",
+        help_text=_("Place where the activity is organized, eg. Kfet."),
+    )
+
    activity_type = models.ForeignKey(
        ActivityType,
        on_delete=models.PROTECT,
@ -72,6 +93,7 @@ class Activity(models.Model):
        on_delete=models.PROTECT,
        related_name='+',
        verbose_name=_('organizer'),
+        help_text=_("Club that organizes the activity. The entry fees will go to this club."),
    )

    attendees_club = models.ForeignKey(
@ -79,6 +101,7 @@ class Activity(models.Model):
        on_delete=models.PROTECT,
        related_name='+',
        verbose_name=_('attendees club'),
+        help_text=_("Club that is authorized to join the activity. Mostly the Kfet club."),
    )

    date_start = models.DateTimeField(
@ -99,12 +122,29 @@ class Activity(models.Model):
        verbose_name=_('open'),
    )

+    def save(self, *args, **kwargs):
+        """
+        Update the activity wiki page each time the activity is updated (validation, change description, ...)
+        """
+        if self.date_end < self.date_start:
+            raise ValidationError(_("The end date must be after the start date."))
+
+        ret = super().save(*args, **kwargs)
+        if settings.DEBUG and self.pk and "scripts" in settings.INSTALLED_APPS:
+            def refresh_activities():
+                from scripts.management.commands.refresh_activities import Command as RefreshActivitiesCommand
+                RefreshActivitiesCommand.refresh_human_readable_wiki_page("Modification de l'activité " + self.name)
+                RefreshActivitiesCommand.refresh_raw_wiki_page("Modification de l'activité " + self.name)
+            Thread(daemon=True, target=refresh_activities).start()
+        return ret
+
    def __str__(self):
        return self.name

    class Meta:
        verbose_name = _("activity")
        verbose_name_plural = _("activities")
+        unique_together = ("name", "date_start", "date_end",)


 class Entry(models.Model):
@ -213,18 +253,18 @@ class Guest(models.Model):
        one_year = timedelta(days=365)

        if not force_insert:
-            if self.activity.date_start > datetime.now():
+            if timezone.now() > timezone.localtime(self.activity.date_start):
                raise ValidationError(_("You can't invite someone once the activity is started."))

            if not self.activity.valid:
                raise ValidationError(_("This activity is not validated yet."))

            qs = Guest.objects.filter(
-                first_name=self.first_name,
-                last_name=self.last_name,
+                first_name__iexact=self.first_name,
+                last_name__iexact=self.last_name,
                activity__date_start__gte=self.activity.date_start - one_year,
            )
-            if len(qs) >= 5:
+            if qs.filter(entry__isnull=False).count() >= 5:
                raise ValidationError(_("This person has been already invited 5 times this year."))

            qs = qs.filter(activity=self.activity)
@ -232,7 +272,7 @@ class Guest(models.Model):
                raise ValidationError(_("This person is already invited."))

            qs = Guest.objects.filter(inviter=self.inviter, activity=self.activity)
-            if len(qs) >= 3:
+            if qs.count() >= 3:
                raise ValidationError(_("You can't invite more than 3 people to this activity."))

        return super().save(force_insert, force_update, using, update_fields)
--- a/apps/activity/tables.py
+++ b/apps/activity/tables.py
@ -1,13 +1,13 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-
+from django.utils import timezone
 from django.utils.html import format_html
 from django.utils.translation import gettext_lazy as _
 import django_tables2 as tables
 from django_tables2 import A
 from note.templatetags.pretty_money import pretty_money

-from .models import Activity, Guest, Entry
+from .models import Activity, Entry, Guest


 class ActivityTable(tables.Table):
@ -20,6 +20,11 @@ class ActivityTable(tables.Table):
        attrs = {
            'class': 'table table-condensed table-striped table-hover'
        }
+        row_attrs = {
+            'class': lambda record: 'bg-success' if record.open else ('' if record.valid else 'bg-warning'),
+            'title': lambda record: _("The activity is currently open.") if record.open else
+            ('' if record.valid else _("The validation of the activity is pending.")),
+        }
        model = Activity
        template_name = 'django_tables2/bootstrap4.html'
        fields = ('name', 'activity_type', 'organizer', 'attendees_club', 'date_start', 'date_end', )
@ -28,22 +33,17 @@ class ActivityTable(tables.Table):
 class GuestTable(tables.Table):
    inviter = tables.LinkColumn(
        'member:user_detail',
-        args=[A('inviter.user.pk'), ],
+        args=[A('inviter__user__pk'), ],
    )

    entry = tables.Column(
        empty_values=(),
-        attrs={
-            "td": {
-                "class": lambda record: "" if record.has_entry else "validate btn btn-danger",
-                "onclick": lambda record: "" if record.has_entry else "remove_guest(" + str(record.pk) + ")"
-            }
-        }
+        verbose_name=_("Remove"),
    )

    class Meta:
        attrs = {
-            'class': 'table table-condensed table-striped table-hover'
+            'class': 'table table-condensed table-striped'
        }
        model = Guest
        template_name = 'django_tables2/bootstrap4.html'
@ -52,7 +52,8 @@ class GuestTable(tables.Table):
    def render_entry(self, record):
        if record.has_entry:
            return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(record.entry.time, )))
-        return _("remove").capitalize()
+        return format_html('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
+                           '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))


 def get_row_class(record):
@ -66,6 +67,10 @@ def get_row_class(record):
        qs = Entry.objects.filter(note=record.note, activity=record.activity, guest=None)
        if qs.exists():
            c += " table-success"
+        elif not record.note.user.memberships.filter(club=record.activity.attendees_club,
+                                                     date_start__lte=timezone.now(),
+                                                     date_end__gte=timezone.now()).exists():
+            c += " table-info"
        elif record.note.balance < 0:
            c += " table-danger"
    return c
--- a/apps/activity/templates/activity/activity_detail.html
+++ b/apps/activity/templates/activity/activity_detail.html
@ -0,0 +1,77 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms %}
+{% load render_table from django_tables2 %}
+
+{% block content %}
+<h1 class="text-white">{{ title }}</h1>
+{% include "activity/includes/activity_info.html" %}
+
+{% if guests.data %}
+<div class="card bg-white mb-3">
+    <h3 class="card-header text-center">
+        {% trans "Guests list" %}
+    </h3>
+    <div id="guests_table">
+        {% render_table guests %}
+    </div>
+</div>
+{% endif %}
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    function remove_guest(guest_id) {
+        $.ajax({
+         url:"/api/activity/guest/" + guest_id + "/",
+         method:"DELETE",
+         headers: {"X-CSRFTOKEN": CSRF_TOKEN}
+     })
+      .done(function() {
+          addMsg('Invité supprimé','success');
+          $("#guests_table").load(location.pathname + " #guests_table");
+      })
+      .fail(function(xhr, textStatus, error) {
+          errMsg(xhr.responseJSON);
+      });
+    }
+
+    $("#open_activity").click(function() {
+        $.ajax({
+            url: "/api/activity/activity/{{ activity.pk }}/",
+            type: "PATCH",
+            dataType: "json",
+            headers: {
+                "X-CSRFTOKEN": CSRF_TOKEN
+            },
+            data: {
+                open: {{ activity.open|yesno:'false,true' }}
+            }
+        }).done(function () {
+            reloadWithTurbolinks();
+        }).fail(function (xhr) {
+            errMsg(xhr.responseJSON);
+        });
+    });
+
+    $("#validate_activity").click(function () {
+        $.ajax({
+            url: "/api/activity/activity/{{ activity.pk }}/",
+            type: "PATCH",
+            dataType: "json",
+            headers: {
+                "X-CSRFTOKEN": CSRF_TOKEN
+            },
+            data: {
+                valid: {{ activity.valid|yesno:'false,true' }}
+            }
+        }).done(function () {
+            reloadWithTurbolinks();
+        }).fail(function (xhr) {
+            errMsg(xhr.responseJSON);
+        });
+    });
+</script>
+{% endblock %}
--- a/apps/activity/templates/activity/activity_entry.html
+++ b/apps/activity/templates/activity/activity_entry.html
@ -0,0 +1,166 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load static i18n pretty_money perms %}
+{% load render_table from django_tables2 %}
+
+{% block content %}
+<h1 class="text-white">{{ title }}</h1>
+<div class="row">
+    <div class="col-xl-12">
+        <div class="btn-group btn-group-toggle bg-light" style="width: 100%" data-toggle="buttons">
+            <a href="{% url "note:transfer" %}#transfer" class="btn btn-sm btn-outline-primary">
+                {% trans "Transfer" %}
+            </a>
+            {% if "note.notespecial"|not_empty_model_list %}
+            <a href="{% url "note:transfer" %}#credit" class="btn btn-sm btn-outline-primary">
+                {% trans "Credit" %}
+            </a>
+            <a href="{% url "note:transfer" %}#debit" class="btn btn-sm btn-outline-primary">
+                {% trans "Debit" %}
+            </a>
+            {% endif %}
+            {% for a in activities_open %}
+            <a href="{% url "activity:activity_entry" pk=a.pk %}"
+                class="btn btn-sm btn-outline-primary{% if a.pk == activity.pk %} active{% endif %}">
+                {% trans "Entries" %} {{ a.name }}
+            </a>
+            {% endfor %}
+        </div>
+    </div>
+</div>
+
+<hr>
+
+<a href="{% url "activity:activity_detail" pk=activity.pk %}">
+    <button class="btn btn-light">{% trans "Return to activity page" %}</button>
+</a>
+
+<input id="alias" type="text" class="form-control" placeholder="Nom/note ...">
+
+<hr>
+
+<div class="card" id="entry_table">
+    <h2 class="text-center">{{ entries.count }}
+        {% if entries.count >= 2 %}{% trans "entries" %}{% else %}{% trans "entry" %}{% endif %}</h2>
+    {% render_table table %}
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    old_pattern = null;
+    alias_obj = $("#alias");
+
+    function reloadTable(force = false) {
+        let pattern = alias_obj.val();
+
+        if ((pattern === old_pattern || pattern === "") && !force)
+            return;
+
+        $("#entry_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + " #entry_table", init);
+        refreshBalance();
+    }
+
+    alias_obj.keyup(reloadTable);
+
+    $(document).ready(init);
+
+    function init() {
+        $(".table-row").click(function (e) {
+            let target = e.target.parentElement;
+            target = $("#" + target.id);
+
+            let type = target.attr("data-type");
+            let id = target.attr("data-id");
+            let last_name = target.attr("data-last-name");
+            let first_name = target.attr("data-first-name");
+
+            if (type === "membership") {
+                $.post("/api/activity/entry/?format=json", {
+                    csrfmiddlewaretoken: CSRF_TOKEN,
+                    activity: {{ activity.id }},
+                    note: id,
+                    guest: null
+                }).done(function () {
+                    if (target.hasClass("table-info"))
+                        addMsg(
+                            "Entrée effectuée, mais attention : la personne n'est plus adhérente Kfet.",
+                            "warning", 10000);
+                    else
+                        addMsg("Entrée effectuée !", "success", 4000);
+                    reloadTable(true);
+                }).fail(function (xhr) {
+                    errMsg(xhr.responseJSON, 4000);
+                });
+            } else {
+                let line_obj = $("#buttons_guest_" + id);
+                if (line_obj.length || target.attr('class').includes("table-success")) {
+                    line_obj.remove();
+                    return;
+                }
+
+                let tr = "<tr class='text-center'>" +
+                    "<td id='buttons_guest_" + id + "' style='table-danger center' colspan='5'>" +
+                    "<button id='transaction_guest_" + id +
+                    "' class='btn btn-secondary'>Payer avec la note de l'hôte</button> " +
+                    "<button id='transaction_guest_" + id +
+                    "_especes' class='btn btn-secondary'>Payer en espèces</button> " +
+                    "<button id='transaction_guest_" + id +
+                    "_cb' class='btn btn-secondary'>Payer en CB</button></td>" +
+                    "<tr>";
+                $(tr).insertAfter(target);
+
+                let makeTransaction = function () {
+                    $.post("/api/activity/entry/?format=json", {
+                        csrfmiddlewaretoken: CSRF_TOKEN,
+                        activity: {{ activity.id }},
+                        note: target.attr("data-inviter"),
+                        guest: id
+                    }).done(function () {
+                        if (target.hasClass("table-info"))
+                            addMsg(
+                                "Entrée effectuée, mais attention : la personne n'est plus adhérente Kfet.",
+                                "warning", 10000);
+                        else
+                            addMsg("Entrée effectuée !", "success", 4000);
+                        reloadTable(true);
+                    }).fail(function (xhr) {
+                        errMsg(xhr.responseJSON, 4000);
+                    });
+                };
+
+                let credit = function (credit_id, credit_name) {
+                    return function () {
+                        $.post("/api/note/transaction/transaction/", {
+                            "csrfmiddlewaretoken": CSRF_TOKEN,
+                            "quantity": 1,
+                            "amount": {{ activity.activity_type.guest_entry_fee }},
+                            "reason": "Crédit " + credit_name +
+                                " (invitation {{ activity.name }})",
+                            "valid": true,
+                            "polymorphic_ctype": {{ notespecial_ctype }},
+                            "resourcetype": "SpecialTransaction",
+                            "source": credit_id,
+                            "destination": target.attr('data-inviter'),
+                            "last_name": last_name,
+                            "first_name": first_name,
+                            "bank": ""
+                        }).done(function () {
+                            makeTransaction();
+                            reset();
+                        }).fail(function (xhr) {
+                            errMsg(xhr.responseJSON, 4000);
+                        });
+                    };
+                };
+
+                $("#transaction_guest_" + id).click(makeTransaction);
+                $("#transaction_guest_" + id + "_especes").click(credit(1, "espèces"));
+                $("#transaction_guest_" + id + "_cb").click(credit(2, "carte bancaire"));
+            }
+        });
+    }
+</script>
+{% endblock %}
--- a/apps/activity/templates/activity/activity_form.html
+++ b/apps/activity/templates/activity/activity_form.html
@ -0,0 +1,20 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body">
+    <form method="post">
+      {% csrf_token %}
+      {{ form|crispy }}
+      <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
+    </form>
+  </div>
+</div>
+{% endblock %}
--- a/apps/activity/templates/activity/activity_list.html
+++ b/apps/activity/templates/activity/activity_list.html
@ -0,0 +1,49 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+{% block content %}
+{% if started_activities %}
+<div class="card bg-secondary text-white mb-3">
+    <h3 class="card-header text-center">
+        {% trans "Current activity" %}
+    </h3>
+    <div class="card-body text-dark">
+        {% for activity in started_activities %}
+        {% include "activity/includes/activity_info.html" %}
+        {% endfor %}
+    </div>
+</div>
+{% endif %}
+
+<div class="card bg-light mb-3">
+    <h3 class="card-header text-center">
+        {% trans "Upcoming activities" %}
+    </h3>
+    {% if upcoming.data %}
+    {% render_table upcoming %}
+    {% else %}
+    <div class="card-body">
+        <div class="alert alert-warning">
+            {% trans "There is no planned activity." %}
+        </div>
+    </div>
+    {% endif %}
+    <div class="card-footer">
+        <a class="btn btn-sm btn-success" href="{% url 'activity:activity_create' %}" data-turbolinks="false">
+            <i class="fa fa-calendar-plus-o" aria-hidden="true"></i>
+            {% trans 'New activity' %}
+        </a>
+    </div>
+</div>
+
+<div class="card bg-light mb-3">
+    <h3 class="card-header text-center">
+        {% trans "All activities" %}
+    </h3>
+    {% render_table table %}
+</div>
+{% endblock %}
--- a/apps/activity/templates/activity/includes/activity_info.html
+++ b/apps/activity/templates/activity/includes/activity_info.html
@ -0,0 +1,78 @@
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms pretty_money %}
+{% url 'activity:activity_detail' activity.pk as activity_detail_url %}
+
+<div id="activity_info" class="card bg-light shadow mb-3">
+    <div class="card-header text-center">
+        <h4>
+            {% if request.path_info != activity_detail_url %}
+                <a href="{{ activity_detail_url }}">{{ activity.name }}</a>
+            {% else %}
+                {{ activity.name }}
+            {% endif %}
+        </h4>
+    </div>
+    <div class="card-body" id="profile_infos">
+        <dl class="row">
+            <dt class="col-xl-6">{% trans 'description'|capfirst %}</dt>
+            <dd class="col-xl-6"> {{ activity.description|linebreaks }}</dd>
+
+            <dt class="col-xl-6">{% trans 'type'|capfirst %}</dt>
+            <dd class="col-xl-6"> {{ activity.activity_type }}</dd>
+
+            <dt class="col-xl-6">{% trans 'start date'|capfirst %}</dt>
+            <dd class="col-xl-6">{{ activity.date_start }}</dd>
+
+            <dt class="col-xl-6">{% trans 'end date'|capfirst %}</dt>
+            <dd class="col-xl-6">{{ activity.date_end }}</dd>
+
+            {% if "activity.change_activity_valid"|has_perm:activity %}
+                <dt class="col-xl-6">{% trans 'creater'|capfirst %}</dt>
+                <dd class="col-xl-6"><a href="{% url "member:user_detail" pk=activity.creater.pk %}">{{ activity.creater }}</a></dd>
+            {% endif %}
+
+            <dt class="col-xl-6">{% trans 'organizer'|capfirst %}</dt>
+            <dd class="col-xl-6"><a href="{% url "member:club_detail" pk=activity.organizer.pk %}">{{ activity.organizer }}</a></dd>
+
+            <dt class="col-xl-6">{% trans 'attendees club'|capfirst %}</dt>
+            <dd class="col-xl-6"><a href="{% url "member:club_detail" pk=activity.attendees_club.pk %}">{{ activity.attendees_club }}</a></dd>
+
+            <dt class="col-xl-6">{% trans 'can invite'|capfirst %}</dt>
+            <dd class="col-xl-6">{{ activity.activity_type.can_invite|yesno }}</dd>
+
+            {% if activity.activity_type.can_invite %}
+                <dt class="col-xl-6">{% trans 'guest entry fee'|capfirst %}</dt>
+                <dd class="col-xl-6">{{ activity.activity_type.guest_entry_fee|pretty_money }}</dd>
+            {% endif %}
+
+            <dt class="col-xl-6">{% trans 'valid'|capfirst %}</dt>
+            <dd class="col-xl-6">{{ activity.valid|yesno }}</dd>
+
+            <dt class="col-xl-6">{% trans 'opened'|capfirst %}</dt>
+            <dd class="col-xl-6">{{ activity.open|yesno }}</dd>
+        </dl>
+    </div>
+
+    <div class="card-footer text-center">
+        {% if activity.open and activity.activity_type.manage_entries and ".change__open"|has_perm:activity %}
+            <a class="btn btn-warning btn-sm my-1" href="{% url 'activity:activity_entry' pk=activity.pk %}"> {% trans "Entry page" %}</a>
+        {% endif %}
+
+        {% if request.path_info == activity_detail_url %}
+            {% if activity.valid and ".change__open"|has_perm:activity %}
+                <a class="btn btn-warning btn-sm my-1" id="open_activity"> {% if activity.open %}{% trans "close"|capfirst %}{% else %}{% trans "open"|capfirst %}{% endif %}</a>
+            {% endif %}
+            {% if not activity.open and ".change__valid"|has_perm:activity %}
+                <a class="btn btn-success btn-sm my-1" id="validate_activity"> {% if activity.valid %}{% trans "invalidate"|capfirst %}{% else %}{% trans "validate"|capfirst %}{% endif %}</a>
+            {% endif %}
+            {% if ".change_"|has_perm:activity %}
+                <a class="btn btn-primary btn-sm my-1" href="{% url 'activity:activity_update' pk=activity.pk %}" data-turbolinks="false"> {% trans "edit"|capfirst %}</a>
+            {% endif %}
+            {% if activity.activity_type.can_invite and not activity_started %}
+                <a class="btn btn-primary btn-sm my-1" href="{% url 'activity:activity_invite' pk=activity.pk %}" data-turbolinks="false"> {% trans "Invite" %}</a>
+            {% endif %}
+        {% endif %}
+    </div>
+</div>
--- a/apps/activity/views.py
+++ b/apps/activity/views.py
@ -1,30 +1,45 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

-from datetime import datetime, timezone
-
 from django.conf import settings
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.contenttypes.models import ContentType
+from django.core.exceptions import PermissionDenied
 from django.db.models import F, Q
 from django.urls import reverse_lazy
-from django.views.generic import CreateView, DetailView, UpdateView, TemplateView
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
+from django.views.generic import DetailView, TemplateView, UpdateView
 from django_tables2.views import SingleTableView
-from note.models import NoteUser, Alias, NoteSpecial
+from note.models import Alias, NoteSpecial, NoteUser
 from permission.backends import PermissionBackend
-from permission.views import ProtectQuerysetMixin
+from permission.views import ProtectQuerysetMixin, ProtectedCreateView

 from .forms import ActivityForm, GuestForm
-from .models import Activity, Guest, Entry
-from .tables import ActivityTable, GuestTable, EntryTable
+from .models import Activity, Entry, Guest
+from .tables import ActivityTable, EntryTable, GuestTable


-class ActivityCreateView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
+class ActivityCreateView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    View to create a new Activity
+    """
    model = Activity
    form_class = ActivityForm
    extra_context = {"title": _("Create new activity")}

+    def get_sample_object(self):
+        return Activity(
+            name="",
+            description="",
+            creater=self.request.user,
+            activity_type_id=1,
+            organizer_id=1,
+            attendees_club_id=1,
+            date_start=timezone.now(),
+            date_end=timezone.now(),
+        )
+
    def form_valid(self, form):
        form.instance.creater = self.request.user
        return super().form_valid(form)
@ -35,6 +50,9 @@ class ActivityCreateView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):


 class ActivityListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
+    """
+    Displays all Activities, and classify if they are on-going or upcoming ones.
+    """
    model = Activity
    table_class = ActivityTable
    ordering = ('-date_start',)
@ -46,16 +64,24 @@ class ActivityListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView
    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)

-        upcoming_activities = Activity.objects.filter(date_end__gt=datetime.now())
+        upcoming_activities = Activity.objects.filter(date_end__gt=timezone.now())
        context['upcoming'] = ActivityTable(
            data=upcoming_activities.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view")),
            prefix='upcoming-',
        )

+        started_activities = Activity.objects\
+            .filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
+            .filter(open=True, valid=True).all()
+        context["started_activities"] = started_activities
+
        return context


 class ActivityDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
+    """
+    Shows details about one activity. Add guest to context
+    """
    model = Activity
    context_object_name = "activity"
    extra_context = {"title": _("Activity detail")}
@ -67,12 +93,15 @@ class ActivityDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
                           .filter(PermissionBackend.filter_queryset(self.request.user, Guest, "view")))
        context["guests"] = table

-        context["activity_started"] = datetime.now(timezone.utc) > self.object.date_start
+        context["activity_started"] = timezone.now() > timezone.localtime(self.object.date_start)

        return context


 class ActivityUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+    """
+    Updates one Activity
+    """
    model = Activity
    form_class = ActivityForm
    extra_context = {"title": _("Update activity")}
@ -81,10 +110,23 @@ class ActivityUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
        return reverse_lazy('activity:activity_detail', kwargs={"pk": self.kwargs["pk"]})


-class ActivityInviteView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
+class ActivityInviteView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    Invite a Guest, The rules to invites someone are defined in `forms:activity.GuestForm`
+    """
    model = Guest
    form_class = GuestForm
-    template_name = "activity/activity_invite.html"
+    template_name = "activity/activity_form.html"
+
+    def get_sample_object(self):
+        """ Creates a standart Guest binds to the Activity"""
+        activity = Activity.objects.get(pk=self.kwargs["pk"])
+        return Guest(
+            activity=activity,
+            first_name="",
+            last_name="",
+            inviter=self.request.user.note,
+        )

    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
@ -96,6 +138,7 @@ class ActivityInviteView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
        form = super().get_form(form_class)
        form.activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
            .get(pk=self.kwargs["pk"])
+        form.fields["inviter"].initial = self.request.user.note
        return form

    def form_valid(self, form):
@ -108,57 +151,115 @@ class ActivityInviteView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):


 class ActivityEntryView(LoginRequiredMixin, TemplateView):
+    """
+    Manages entry to an activity
+    """
    template_name = "activity/activity_entry.html"

-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
+    def dispatch(self, request, *args, **kwargs):
+        """
+        Don't display the entry interface if the user has no right to see it (no right to add an entry for itself),
+        it is closed or doesn't manage entries.
+        """
+        activity = Activity.objects.get(pk=self.kwargs["pk"])

-        activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
-            .get(pk=self.kwargs["pk"])
-        context["activity"] = activity
+        sample_entry = Entry(activity=activity, note=self.request.user.note)
+        if not PermissionBackend.check_perm(self.request.user, "activity.add_entry", sample_entry):
+            raise PermissionDenied(_("You are not allowed to display the entry interface for this activity."))

-        matched = []
+        if not activity.activity_type.manage_entries:
+            raise PermissionDenied(_("This activity does not support activity entries."))

-        pattern = "^$"
-        if "search" in self.request.GET:
-            pattern = self.request.GET["search"]
+        if not activity.open:
+            raise PermissionDenied(_("This activity is closed."))
+        return super().dispatch(request, *args, **kwargs)

-        if not pattern:
-            pattern = "^$"
-
-        if pattern[0] != "^":
-            pattern = "^" + pattern
+    def get_invited_guest(self, activity):
+        """
+        Retrieves all Guests to the activity
+        """

        guest_qs = Guest.objects\
            .annotate(balance=F("inviter__balance"), note_name=F("inviter__user__username"))\
-            .filter(Q(first_name__regex=pattern) | Q(last_name__regex=pattern)
-                    | Q(inviter__alias__name__regex=pattern)
-                    | Q(inviter__alias__normalized_name__regex=Alias.normalize(pattern))) \
+            .filter(activity=activity)\
            .filter(PermissionBackend.filter_queryset(self.request.user, Guest, "view"))\
-            .distinct()[:20]
-        for guest in guest_qs:
-            guest.type = "Invité"
-            matched.append(guest)
+            .order_by('last_name', 'first_name').distinct()

+        if "search" in self.request.GET and self.request.GET["search"]:
+            pattern = self.request.GET["search"]
+            if pattern[0] != "^":
+                pattern = "^" + pattern
+            guest_qs = guest_qs.filter(
+                Q(first_name__regex=pattern)
+                | Q(last_name__regex=pattern)
+                | Q(inviter__alias__name__regex=pattern)
+                | Q(inviter__alias__normalized_name__regex=Alias.normalize(pattern))
+            )
+        else:
+            guest_qs = guest_qs.none()
+        return guest_qs
+
+    def get_invited_note(self, activity):
+        """
+        Retrieves all Note that can attend the activity,
+        they need to have an up-to-date membership in the attendees_club.
+        """
        note_qs = Alias.objects.annotate(last_name=F("note__noteuser__user__last_name"),
                                         first_name=F("note__noteuser__user__first_name"),
                                         username=F("note__noteuser__user__username"),
                                         note_name=F("name"),
-                                         balance=F("note__balance"))\
-            .filter(Q(note__polymorphic_ctype__model="noteuser")
-                    & (Q(note__noteuser__user__first_name__regex=pattern)
+                                         balance=F("note__balance"))
+
+        # Keep only users that have a note
+        note_qs = note_qs.filter(note__noteuser__isnull=False)
+
+        # Keep only members
+        note_qs = note_qs.filter(
+            note__noteuser__user__memberships__club=activity.attendees_club,
+            note__noteuser__user__memberships__date_start__lte=timezone.now(),
+            note__noteuser__user__memberships__date_end__gte=timezone.now(),
+        )
+
+        # Filter with permission backend
+        note_qs = note_qs.filter(PermissionBackend.filter_queryset(self.request.user, Alias, "view"))
+
+        if "search" in self.request.GET and self.request.GET["search"]:
+            pattern = self.request.GET["search"]
+            note_qs = note_qs.filter(
+                Q(note__noteuser__user__first_name__regex=pattern)
                | Q(note__noteuser__user__last_name__regex=pattern)
                | Q(name__regex=pattern)
-                    | Q(normalized_name__regex=Alias.normalize(pattern)))) \
-            .filter(PermissionBackend.filter_queryset(self.request.user, Alias, "view"))
-        if settings.DATABASES[note_qs.db]["ENGINE"] == 'django.db.backends.postgresql_psycopg2':
+                | Q(normalized_name__regex=Alias.normalize(pattern))
+            )
+        else:
+            note_qs = note_qs.none()
+
+        if settings.DATABASES[note_qs.db]["ENGINE"] == 'django.db.backends.postgresql':
            note_qs = note_qs.distinct('note__pk')[:20]
        else:
            # SQLite doesn't support distinct fields. For compatibility reason (in dev mode), the note list will only
            # have distinct aliases rather than distinct notes with a SQLite DB, but it can fill the result page.
            # In production mode, please use PostgreSQL.
            note_qs = note_qs.distinct()[:20]
-        for note in note_qs:
+        return note_qs
+
+    def get_context_data(self, **kwargs):
+        """
+        Query the list of Guest and Note to the activity and add information to makes entry with JS.
+        """
+        context = super().get_context_data(**kwargs)
+
+        activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
+            .distinct().get(pk=self.kwargs["pk"])
+        context["activity"] = activity
+
+        matched = []
+
+        for guest in self.get_invited_guest(activity):
+            guest.type = "Invité"
+            matched.append(guest)
+
+        for note in self.get_invited_note(activity):
            note.type = "Adhérent"
            note.activity = activity
            matched.append(note)
@ -172,8 +273,11 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
        context["noteuser_ctype"] = ContentType.objects.get_for_model(NoteUser).pk
        context["notespecial_ctype"] = ContentType.objects.get_for_model(NoteSpecial).pk

-        context["activities_open"] = Activity.objects.filter(open=True).filter(
-            PermissionBackend.filter_queryset(self.request.user, Activity, "view")).filter(
-            PermissionBackend.filter_queryset(self.request.user, Activity, "change")).all()
+        activities_open = Activity.objects.filter(open=True).filter(
+            PermissionBackend.filter_queryset(self.request.user, Activity, "view")).distinct().all()
+        context["activities_open"] = [a for a in activities_open
+                                      if PermissionBackend.check_perm(self.request.user,
+                                                                      "activity.add_entry",
+                                                                      Entry(activity=a, note=self.request.user.note,))]

        return context
--- a/apps/api/urls.py
+++ b/apps/api/urls.py
@ -1,21 +1,16 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

+from django.conf import settings
 from django.conf.urls import url, include
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
+from django.db.models import Q
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework import routers, serializers
-from rest_framework.filters import SearchFilter
 from rest_framework.viewsets import ReadOnlyModelViewSet
-from activity.api.urls import register_activity_urls
 from api.viewsets import ReadProtectedModelViewSet
-from member.api.urls import register_members_urls
-from note.api.urls import register_note_urls
-from treasury.api.urls import register_treasury_urls
-from logs.api.urls import register_logs_urls
-from permission.api.urls import register_permission_urls
-from wei.api.urls import register_wei_urls
+from note.models import Alias


 class UserSerializer(serializers.ModelSerializer):
@ -52,9 +47,47 @@ class UserViewSet(ReadProtectedModelViewSet):
    """
    queryset = User.objects.all()
    serializer_class = UserSerializer
-    filter_backends = [DjangoFilterBackend, SearchFilter]
+    filter_backends = [DjangoFilterBackend]
    filterset_fields = ['id', 'username', 'first_name', 'last_name', 'email', 'is_superuser', 'is_staff', 'is_active', ]
-    search_fields = ['$username', '$first_name', '$last_name', ]
+
+    def get_queryset(self):
+        queryset = super().get_queryset().order_by("username")
+
+        if "search" in self.request.GET:
+            pattern = self.request.GET["search"]
+
+            # We match first a user by its username, then if an alias is matched without normalization
+            # And finally if the normalized pattern matches a normalized alias.
+            queryset = queryset.filter(
+                username__iregex="^" + pattern
+            ).union(
+                queryset.filter(
+                    Q(note__alias__name__iregex="^" + pattern)
+                    & ~Q(username__iregex="^" + pattern)
+                ), all=True).union(
+                queryset.filter(
+                    Q(note__alias__normalized_name__iregex="^" + Alias.normalize(pattern))
+                    & ~Q(note__alias__name__iregex="^" + pattern)
+                    & ~Q(username__iregex="^" + pattern)
+                ),
+                all=True).union(
+                queryset.filter(
+                    Q(note__alias__normalized_name__iregex="^" + pattern.lower())
+                    & ~Q(note__alias__normalized_name__iregex="^" + Alias.normalize(pattern))
+                    & ~Q(note__alias__name__iregex="^" + pattern)
+                    & ~Q(username__iregex="^" + pattern)
+                ),
+                all=True).union(
+                queryset.filter(
+                    (Q(last_name__iregex="^" + pattern) | Q(first_name__iregex="^" + pattern))
+                    & ~Q(note__alias__normalized_name__iregex="^" + pattern.lower())
+                    & ~Q(note__alias__normalized_name__iregex="^" + Alias.normalize(pattern))
+                    & ~Q(note__alias__name__iregex="^" + pattern)
+                    & ~Q(username__iregex="^" + pattern)
+                ),
+                all=True)
+
+        return queryset


 # This ViewSet is the only one that is accessible from all authenticated users!
@ -73,13 +106,34 @@ class ContentTypeViewSet(ReadOnlyModelViewSet):
 router = routers.DefaultRouter()
 router.register('models', ContentTypeViewSet)
 router.register('user', UserViewSet)
-register_members_urls(router, 'members')
-register_activity_urls(router, 'activity')
-register_note_urls(router, 'note')
-register_treasury_urls(router, 'treasury')
-register_permission_urls(router, 'permission')
-register_logs_urls(router, 'logs')
-register_wei_urls(router, 'wei')
+
+if "member" in settings.INSTALLED_APPS:
+    from member.api.urls import register_members_urls
+    register_members_urls(router, 'members')
+
+if "member" in settings.INSTALLED_APPS:
+    from activity.api.urls import register_activity_urls
+    register_activity_urls(router, 'activity')
+
+if "note" in settings.INSTALLED_APPS:
+    from note.api.urls import register_note_urls
+    register_note_urls(router, 'note')
+
+if "treasury" in settings.INSTALLED_APPS:
+    from treasury.api.urls import register_treasury_urls
+    register_treasury_urls(router, 'treasury')
+
+if "permission" in settings.INSTALLED_APPS:
+    from permission.api.urls import register_permission_urls
+    register_permission_urls(router, 'permission')
+
+if "logs" in settings.INSTALLED_APPS:
+    from logs.api.urls import register_logs_urls
+    register_logs_urls(router, 'logs')
+
+if "wei" in settings.INSTALLED_APPS:
+    from wei.api.urls import register_wei_urls
+    register_wei_urls(router, 'wei')

 app_name = 'api'

--- a/apps/api/viewsets.py
+++ b/apps/api/viewsets.py
@ -4,7 +4,7 @@
 from django.contrib.contenttypes.models import ContentType
 from permission.backends import PermissionBackend
 from rest_framework import viewsets
-from note_kfet.middlewares import get_current_authenticated_user
+from note_kfet.middlewares import get_current_session


 class ReadProtectedModelViewSet(viewsets.ModelViewSet):
@ -17,8 +17,9 @@ class ReadProtectedModelViewSet(viewsets.ModelViewSet):
        self.model = ContentType.objects.get_for_model(self.serializer_class.Meta.model).model_class()

    def get_queryset(self):
-        user = get_current_authenticated_user()
-        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view"))
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view")).distinct()


 class ReadOnlyProtectedModelViewSet(viewsets.ReadOnlyModelViewSet):
@ -31,5 +32,6 @@ class ReadOnlyProtectedModelViewSet(viewsets.ReadOnlyModelViewSet):
        self.model = ContentType.objects.get_for_model(self.serializer_class.Meta.model).model_class()

    def get_queryset(self):
-        user = get_current_authenticated_user()
-        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view"))
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view")).distinct()
--- a/apps/logs/api/views.py
+++ b/apps/logs/api/views.py
@ -19,5 +19,5 @@ class ChangelogViewSet(ReadOnlyProtectedModelViewSet):
    serializer_class = ChangelogSerializer
    filter_backends = [DjangoFilterBackend, OrderingFilter]
    filterset_fields = ['model', 'action', "instance_pk", 'user', 'ip', ]
-    ordering_fields = ['timestamp', ]
-    ordering = ['-timestamp', ]
+    ordering_fields = ['timestamp', 'id', ]
+    ordering = ['-id', ]
--- a/apps/logs/signals.py
+++ b/apps/logs/signals.py
@ -23,6 +23,9 @@ EXCLUDED = [
    'cas_server.userattributes',
    'contenttypes.contenttype',
    'logs.changelog',  # Never remove this line
+    'mailer.dontsendentry',
+    'mailer.message',
+    'mailer.messagelog',
    'migrations.migration',
    'note.note'  # We only store the subclasses
    'note.transaction',
@ -78,19 +81,30 @@ def save_object(sender, instance, **kwargs):
        if instance.last_login != previous.last_login:
            return

-    # On crée notre propre sérialiseur JSON pour pouvoir sauvegarder les modèles
+    changed_fields = '__all__'
+    if previous:
+        # On ne garde que les champs modifiés
+        changed_fields = []
+        for field in instance._meta.fields:
+            if field.name.endswith("_ptr"):
+                # A field ending with _ptr is a OneToOneRel with a subclass, e.g. NoteClub.note_ptr -> Note
+                continue
+            if getattr(instance, field.name) != getattr(previous, field.name):
+                changed_fields.append(field.name)
+
+    if len(changed_fields) == 0:
+        # Pas de log s'il n'y a pas de modification
+        return
+
+    # On crée notre propre sérialiseur JSON pour pouvoir sauvegarder les modèles avec uniquement les champs modifiés
    class CustomSerializer(ModelSerializer):
        class Meta:
            model = instance.__class__
-            fields = '__all__'
+            fields = changed_fields

    previous_json = JSONRenderer().render(CustomSerializer(previous).data).decode("UTF-8") if previous else None
    instance_json = JSONRenderer().render(CustomSerializer(instance).data).decode("UTF-8")

-    if previous_json == instance_json:
-        # Pas de log s'il n'y a pas de modification
-        return
-
    Changelog.objects.create(user=user,
                             ip=ip,
                             model=ContentType.objects.get_for_model(instance),
--- a/apps/member/admin.py
+++ b/apps/member/admin.py
@ -17,6 +17,7 @@ class ProfileInline(admin.StackedInline):
    Inline user profile in user admin
    """
    model = Profile
+    form = ProfileForm
    can_delete = False


@ -25,7 +26,6 @@ class CustomUserAdmin(UserAdmin):
    inlines = (ProfileInline,)
    list_display = ('username', 'email', 'first_name', 'last_name', 'is_staff')
    list_select_related = ('profile',)
-    form = ProfileForm

    def get_inline_instances(self, request, obj=None):
        """
--- a/apps/member/forms.py
+++ b/apps/member/forms.py
@ -4,6 +4,8 @@
 from django import forms
 from django.contrib.auth.forms import AuthenticationForm
 from django.contrib.auth.models import User
+from django.forms import CheckboxSelectMultiple
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from note.models import NoteSpecial, Alias
 from note_kfet.inputs import Autocomplete, AmountInput, DatePickerInput
@ -36,6 +38,20 @@ class ProfileForm(forms.ModelForm):
    """
    A form for the extras field provided by the :model:`member.Profile` model.
    """
+    report_frequency = forms.IntegerField(required=False, initial=0, label=_("Report frequency"))
+
+    last_report = forms.DateTimeField(required=False, disabled=True, label=_("Last report date"))
+
+    def clean_promotion(self):
+        promotion = self.cleaned_data["promotion"]
+        if promotion > timezone.now().year:
+            self.add_error("promotion", _("You can't register to the note if you come from the future."))
+        return promotion
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['address'].widget.attrs.update({"placeholder": "4 avenue des Sciences, 91190 GIF-SUR-YVETTE"})
+        self.fields['promotion'].widget.attrs.update({"max": timezone.now().year})

    def save(self, commit=True):
        if not self.instance.section or (("department" in self.changed_data
@ -49,6 +65,19 @@ class ProfileForm(forms.ModelForm):
        exclude = ('user', 'email_confirmed', 'registration_valid', )


+class ImageForm(forms.Form):
+    """
+    Form used for the js interface for profile picture
+    """
+    image = forms.ImageField(required=False,
+                             label=_('select an image'),
+                             help_text=_('Maximal size: 2MB'))
+    x = forms.FloatField(widget=forms.HiddenInput())
+    y = forms.FloatField(widget=forms.HiddenInput())
+    width = forms.FloatField(widget=forms.HiddenInput())
+    height = forms.FloatField(widget=forms.HiddenInput())
+
+
 class ClubForm(forms.ModelForm):
    def clean(self):
        cleaned_data = super().clean()
@ -151,6 +180,7 @@ class MembershipRolesForm(forms.ModelForm):
    roles = forms.ModelMultipleChoiceField(
        queryset=Role.objects.filter(weirole=None).all(),
        label=_("Roles"),
+        widget=CheckboxSelectMultiple(),
    )

    class Meta:
--- a/apps/member/models.py
+++ b/apps/member/models.py
@ -8,11 +8,15 @@ from django.conf import settings
 from django.contrib.auth.models import User
 from django.core.exceptions import ValidationError
 from django.db import models
+from django.db.models import Q
 from django.template import loader
 from django.urls import reverse, reverse_lazy
+from django.utils import timezone
 from django.utils.encoding import force_bytes
 from django.utils.http import urlsafe_base64_encode
 from django.utils.translation import gettext_lazy as _
+from phonenumber_field.modelfields import PhoneNumberField
+from permission.models import Role
 from registration.tokens import email_validation_token
 from note.models import MembershipTransaction

@ -30,7 +34,7 @@ class Profile(models.Model):
        on_delete=models.CASCADE,
    )

-    phone_number = models.CharField(
+    phone_number = PhoneNumberField(
        verbose_name=_('phone number'),
        max_length=50,
        blank=True,
@ -68,7 +72,7 @@ class Profile(models.Model):
        ]
    )

-    promotion = models.PositiveIntegerField(
+    promotion = models.PositiveSmallIntegerField(
        null=True,
        default=datetime.date.today().year,
        verbose_name=_("promotion"),
@ -88,6 +92,39 @@ class Profile(models.Model):
        default=False,
    )

+    ml_events_registration = models.CharField(
+        blank=True,
+        null=True,
+        default=None,
+        max_length=2,
+        choices=[
+            (None, _("No")),
+            ('fr', _("Yes (receive them in french)")),
+            ('en', _("Yes (receive them in english)")),
+        ],
+        verbose_name=_("Register on the mailing list to stay informed of the events of the campus (1 mail/week)"),
+    )
+
+    ml_sport_registration = models.BooleanField(
+        default=False,
+        verbose_name=_("Register on the mailing list to stay informed of the sport events of the campus (1 mail/week)"),
+    )
+
+    ml_art_registration = models.BooleanField(
+        default=False,
+        verbose_name=_("Register on the mailing list to stay informed of the art events of the campus (1 mail/week)"),
+    )
+
+    report_frequency = models.PositiveSmallIntegerField(
+        verbose_name=_("report frequency (in days)"),
+        default=0,
+    )
+
+    last_report = models.DateTimeField(
+        verbose_name=_("last report date"),
+        default=timezone.now,
+    )
+
    email_confirmed = models.BooleanField(
        verbose_name=_("email confirmed"),
        default=False,
@ -128,18 +165,28 @@ class Profile(models.Model):
        indexes = [models.Index(fields=['user'])]

    def get_absolute_url(self):
-        return reverse('user_detail', args=(self.pk,))
+        return reverse('member:user_detail', args=(self.user_id,))
+
+    def __str__(self):
+        return str(self.user)

    def send_email_validation_link(self):
-        subject = _("Activate your Note Kfet account")
-        message = loader.render_to_string('registration/mails/email_validation_email.html',
+        subject = "[Note Kfet] " + str(_("Activate your Note Kfet account"))
+        message = loader.render_to_string('registration/mails/email_validation_email.txt',
                                          {
                                              'user': self.user,
                                              'domain': os.getenv("NOTE_URL", "note.example.com"),
                                              'token': email_validation_token.make_token(self.user),
                                              'uid': urlsafe_base64_encode(force_bytes(self.user.pk)),
                                          })
-        self.user.email_user(subject, message)
+        html = loader.render_to_string('registration/mails/email_validation_email.html',
+                                       {
+                                           'user': self.user,
+                                           'domain': os.getenv("NOTE_URL", "note.example.com"),
+                                           'token': email_validation_token.make_token(self.user),
+                                           'uid': urlsafe_base64_encode(force_bytes(self.user.pk)),
+                                       })
+        self.user.email_user(subject, message, html_message=html)


 class Club(models.Model):
@ -195,17 +242,14 @@ class Club(models.Model):
        blank=True,
        null=True,
        verbose_name=_('membership start'),
-        help_text=_('How long after January 1st the members can renew '
-                    'their membership.'),
+        help_text=_('Date from which the members can renew their membership.'),
    )

    membership_end = models.DateField(
        blank=True,
        null=True,
        verbose_name=_('membership end'),
-        help_text=_('How long the membership can last after January 1st '
-                    'of the next year after members can renew their '
-                    'membership.'),
+        help_text=_('Maximal date of a membership, after which members must renew it.'),
    )

    def update_membership_dates(self):
@ -294,13 +338,33 @@ class Membership(models.Model):
        else:
            return self.date_start.toordinal() <= datetime.datetime.now().toordinal()

+    def renew(self):
+        if Membership.objects.filter(
+                user=self.user,
+                club=self.club,
+                date_start__gte=self.club.membership_start,
+        ).exists():
+            # Membership is already renewed
+            return
+        new_membership = Membership(
+            user=self.user,
+            club=self.club,
+            date_start=max(self.date_end + datetime.timedelta(days=1), self.club.membership_start),
+        )
+        if hasattr(self, '_force_renew_parent') and self._force_renew_parent:
+            new_membership._force_renew_parent = True
+        if hasattr(self, '_soge') and self._soge:
+            new_membership._soge = True
+        if hasattr(self, '_force_save') and self._force_save:
+            new_membership._force_save = True
+        new_membership.save()
+        new_membership.roles.set(self.roles.all())
+        new_membership.save()
+
    def save(self, *args, **kwargs):
        """
        Calculate fee and end date before saving the membership and creating the transaction if needed.
        """
-        if self.club.parent_club is not None:
-            if not Membership.objects.filter(user=self.user, club=self.club.parent_club).exists():
-                raise ValidationError(_('User is not a member of the parent club') + ' ' + self.club.parent_club.name)

        if self.pk:
            for role in self.roles.all():
@ -320,6 +384,55 @@ class Membership(models.Model):
            ).exists():
                raise ValidationError(_('User is already a member of the club'))

+            if self.club.parent_club is not None and not self.pk:
+                # Check that the user is already a member of the parent club if the membership is created
+                if not Membership.objects.filter(
+                    user=self.user,
+                    club=self.club.parent_club,
+                    date_start__gte=self.club.parent_club.membership_start,
+                ).exists():
+                    if hasattr(self, '_force_renew_parent') and self._force_renew_parent:
+                        parent_membership = Membership.objects.filter(
+                            user=self.user,
+                            club=self.club.parent_club,
+                        ).order_by("-date_start")
+                        if parent_membership.exists():
+                            # Renew the previous membership of the parent club
+                            parent_membership = parent_membership.first()
+                            parent_membership._force_renew_parent = True
+                            if hasattr(self, '_soge'):
+                                parent_membership._soge = True
+                            if hasattr(self, '_force_save'):
+                                parent_membership._force_save = True
+                            parent_membership.renew()
+                        else:
+                            # Create a new membership in the parent club
+                            parent_membership = Membership(
+                                user=self.user,
+                                club=self.club.parent_club,
+                                date_start=self.date_start,
+                            )
+                            parent_membership._force_renew_parent = True
+                            if hasattr(self, '_soge'):
+                                parent_membership._soge = True
+                            if hasattr(self, '_force_save'):
+                                parent_membership._force_save = True
+                            parent_membership.save()
+                            parent_membership.refresh_from_db()
+
+                            if self.club.parent_club.name == "BDE":
+                                parent_membership.roles.set(
+                                    Role.objects.filter(Q(name="Adhérent BDE") | Q(name="Membre de club")).all())
+                            elif self.club.parent_club.name == "Kfet":
+                                parent_membership.roles.set(
+                                    Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all())
+                            else:
+                                parent_membership.roles.set(Role.objects.filter(name="Membre de club").all())
+                            parent_membership.save()
+                    else:
+                        raise ValidationError(_('User is not a member of the parent club')
+                                              + ' ' + self.club.parent_club.name)
+
            if self.user.profile.paid:
                self.fee = self.club.membership_fee_paid
            else:
@ -353,8 +466,9 @@ class Membership(models.Model):
                reason="Adhésion " + self.club.name,
            )
            transaction._force_save = True
-            print(hasattr(self, '_soge'))
-            if hasattr(self, '_soge') and "treasury" in settings.INSTALLED_APPS:
+            if hasattr(self, '_soge') and "treasury" in settings.INSTALLED_APPS\
+                    and (self.club.name == "BDE" or self.club.name == "Kfet"
+                         or ("wei" in settings.INSTALLED_APPS and hasattr(self.club, "weiclub") and self.club.weiclub)):
                # If the soge pays, then the transaction is unvalidated in a first time, then submitted for control
                # to treasurers.
                transaction.valid = False
--- a/apps/member/static/member/js/alias.js
+++ b/apps/member/static/member/js/alias.js
@ -0,0 +1,43 @@
+/**
+ * On form submit, create a new alias
+ */
+function create_alias (e) {
+    // Do not submit HTML form
+    e.preventDefault();
+
+    // Get data and send to API
+    const formData = new FormData(e.target);
+    $.post("/api/note/alias/", {
+        "csrfmiddlewaretoken": formData.get("csrfmiddlewaretoken"),
+        "name": formData.get("name"),
+        "note": formData.get("note")
+    }).done(function () {
+        // Reload table
+        $("#alias_table").load(location.pathname + " #alias_table");
+        addMsg("Alias ajouté", "success");
+    }).fail(function (xhr, _textStatus, _error) {
+        errMsg(xhr.responseJSON);
+    });
+}
+
+/**
+ * On click of "delete", delete the alias
+ * @param Integer button_id Alias id to remove
+ */
+function delete_button (button_id) {
+    $.ajax({
+        url: "/api/note/alias/" + button_id + "/",
+        method: "DELETE",
+        headers: { "X-CSRFTOKEN": CSRF_TOKEN }
+    }).done(function () {
+        addMsg('Alias supprimé', 'success');
+        $("#alias_table").load(location.pathname + " #alias_table");
+    }).fail(function (xhr, _textStatus, _error) {
+        errMsg(xhr.responseJSON);
+    });
+}
+
+$(document).ready(function () {
+    // Attach event
+    document.getElementById("form_alias").addEventListener("submit", create_alias); 
+})
--- a/apps/member/tables.py
+++ b/apps/member/tables.py
@ -1,6 +1,7 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-from datetime import datetime
+
+from datetime import date

 import django_tables2 as tables
 from django.contrib.auth.models import User
@ -38,19 +39,22 @@ class UserTable(tables.Table):
    """
    List all users.
    """
-    section = tables.Column(accessor='profile.section')
+    alias = tables.Column()

-    balance = tables.Column(accessor='note.balance', verbose_name=_("Balance"))
+    section = tables.Column(accessor='profile__section')

-    def render_balance(self, value):
-        return pretty_money(value)
+    balance = tables.Column(accessor='note__balance', verbose_name=_("Balance"))
+
+    def render_balance(self, record, value):
+        return pretty_money(value)\
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", record.note) else "—"

    class Meta:
        attrs = {
            'class': 'table table-condensed table-striped table-hover'
        }
        template_name = 'django_tables2/bootstrap4.html'
-        fields = ('last_name', 'first_name', 'username', 'email')
+        fields = ('last_name', 'first_name', 'username', 'alias', 'email')
        model = User
        row_attrs = {
            'class': 'table-row',
@ -92,8 +96,8 @@ class MembershipTable(tables.Table):
        t = pretty_money(value)

        # If it is required and if the user has the right, the renew button is displayed.
-        if record.club.membership_start is not None:
-            if record.date_start < record.club.membership_start:  # If the renew is available
+        if record.club.membership_start is not None \
+                and record.date_start < record.club.membership_start:
            if not Membership.objects.filter(
                    club=record.club,
                    user=record.user,
@ -103,15 +107,19 @@ class MembershipTable(tables.Table):
                empty_membership = Membership(
                    club=record.club,
                    user=record.user,
-                        date_start=datetime.now().date(),
-                        date_end=datetime.now().date(),
+                    date_start=date.today(),
+                    date_end=date.today(),
                    fee=0,
                )
                if PermissionBackend.check_perm(get_current_authenticated_user(),
                                                "member:add_membership", empty_membership):  # If the user has right
-                        t = format_html(t + ' <a class="btn btn-warning" href="{url}">{text}</a>',
-                                        url=reverse_lazy('member:club_renew_membership',
-                                                         kwargs={"pk": record.pk}), text=_("Renew"))
+                    renew_url = reverse_lazy('member:club_renew_membership',
+                                             kwargs={"pk": record.pk})
+                    t = format_html(
+                        t + ' <a class="btn btn-sm btn-warning" title="{text}"'
+                        ' href="{renew_url}"><i class="fa fa-repeat"></i></a>',
+                        renew_url=renew_url, text=_("Renew")
+                    )
        return t

    def render_roles(self, record):
@ -125,7 +133,7 @@ class MembershipTable(tables.Table):

    class Meta:
        attrs = {
-            'class': 'table table-condensed table-striped table-hover',
+            'class': 'table table-condensed table-striped',
            'style': 'table-layout: fixed;'
        }
        template_name = 'django_tables2/bootstrap4.html'
@ -157,5 +165,5 @@ class ClubManagerTable(tables.Table):
            'style': 'table-layout: fixed;'
        }
        template_name = 'django_tables2/bootstrap4.html'
-        fields = ('user', 'user.first_name', 'user.last_name', 'roles', )
+        fields = ('user', 'user__first_name', 'user__last_name', 'roles', )
        model = Membership
--- a/apps/member/templates/member/add_members.html
+++ b/apps/member/templates/member/add_members.html
@ -0,0 +1,75 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load crispy_forms_tags i18n pretty_money %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        {% if additional_fee_renewal %}
+        <div class="alert alert-warning">
+            {% if renewal %}
+            {% blocktrans trimmed with clubs=clubs_renewal|join:", " pretty_fee=additional_fee_renewal|pretty_money %}
+            The user is not a member of the club·s {{ clubs }}. An additional fee of {{ pretty_fee }}
+            will be charged to renew automatically the membership in this/these club·s.
+            {% endblocktrans %}
+            {% else %}
+            {% blocktrans trimmed with clubs=clubs_renewal|join:", " pretty_fee=additional_fee_renewal|pretty_money %}
+            This club has parents {{ clubs }}. An additional fee of {{ pretty_fee }}
+            will be charged to adhere automatically to this/these club·s.
+            {% endblocktrans %}
+            {% endif %}
+        </div>
+        {% endif %}
+
+        <form method="post" action="">
+            {% csrf_token %}
+            {{ form|crispy }}
+            <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
+        </form>
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    function autocompleted(user) {
+        $("#id_last_name").val(user.last_name);
+        $("#id_first_name").val(user.first_name);
+        $.getJSON("/api/members/profile/" + user.id + "/", function (profile) {
+            let fee = profile.paid ? "{{ club.membership_fee_paid }}" : "{{ club.membership_fee_unpaid }}";
+            $("#id_credit_amount").val((Number(fee) / 100).toFixed(2));
+        });
+    }
+
+    soge_field = $("#id_soge");
+
+    function fillFields() {
+        let checked = soge_field.is(':checked');
+        if (!checked) {
+            $("input").attr('disabled', false);
+            $("#id_user").attr('disabled', true);
+            $("select").attr('disabled', false);
+            return;
+        }
+
+        let credit_type = $("#id_credit_type");
+        credit_type.attr('disabled', true);
+        credit_type.val(4);
+
+        let credit_amount = $("#id_credit_amount");
+        credit_amount.attr('disabled', true);
+        credit_amount.val('{{ total_fee }}');
+
+        let bank = $("#id_bank");
+        bank.attr('disabled', true);
+        bank.val('Société générale');
+    }
+
+    soge_field.change(fillFields);
+</script>
+{% endblock %}
--- a/apps/member/templates/member/base.html
+++ b/apps/member/templates/member/base.html
@ -0,0 +1,184 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms %}
+
+{# Use a fluid-width container #}
+{% block containertype %}container-fluid{% endblock %}
+
+{% block content %}
+<div class="row mt-4">
+    <div class="col-xl-4">
+        {% block profile_info %}
+        <div class="card bg-light" id="card-infos">
+            <h4 class="card-header text-center">
+                {% if user_object %}
+                {% trans "Account #" %}{{ user_object.pk }}
+                {% elif club %}
+                Club {{ club.name }}
+                {% endif %}
+            </h4>
+            <div class="text-center">
+                {% if user_object %}
+                <a href="{% url 'member:user_update_pic' user_object.pk  %}">
+                    <img src="{{ user_object.note.display_image.url }}" class="img-thumbnail mt-2">
+                </a>
+                {% elif club %}
+                <a href="{% url 'member:club_update_pic' club.pk  %}">
+                    <img src="{{ club.note.display_image.url }}" class="img-thumbnail mt-2">
+                </a>
+                {% endif %}
+            </div>
+            {% if note.inactivity_reason %}
+                <div class="alert alert-danger polymorphic-add-choice">
+                    {{ note.get_inactivity_reason_display }}
+                </div>
+            {% endif %}
+            <div class="card-body" id="profile_infos">
+                {% if user_object %}
+                {% include "member/includes/profile_info.html" %}
+                {% elif club %}
+                {% include "member/includes/club_info.html" %}
+                {% endif %}
+            </div>
+            <div class="card-footer">
+                {% if user_object %}
+                <a class="btn btn-sm btn-secondary" href="{% url 'member:user_update_profile' user_object.pk %}">
+                    <i class="fa fa-edit"></i> {% trans 'Update Profile' %}
+                </a>
+                {% url 'member:user_detail' user_object.pk as user_profile_url %}
+                {% if request.path_info != user_profile_url %}
+                <a class="btn btn-sm btn-primary" href="{{ user_profile_url }}">{% trans 'View Profile' %}</a>
+                {% endif %}
+                {% elif club and not club.weiclub %}
+                {% if can_add_members %}
+                <a class="btn btn-sm btn-success" href="{% url 'member:club_add_member' club_pk=club.pk %}"
+                   data-turbolinks="false"> {% trans "Add member" %}</a>
+                {% endif %}
+                {% if ".change_"|has_perm:club %}
+                <a class="btn btn-sm btn-secondary" href="{% url 'member:club_update' pk=club.pk %}"
+                   data-turbolinks="false">
+                    <i class="fa fa-edit"></i> {% trans 'Update Profile' %}
+                </a>
+                {% endif %}
+                {% url 'member:club_detail' club.pk as club_detail_url %}
+                {% if request.path_info != club_detail_url %}
+                <a class="btn btn-sm btn-primary" href="{{ club_detail_url }}">{% trans 'View Profile' %}</a>
+                {% endif %}
+                {% endif %}
+                {% if can_lock_note %}
+                <button class="btn btn-sm btn-danger" data-toggle="modal" data-target="#lock-note-modal">
+                    <i class="fa fa-ban"></i> {% trans 'Lock note' %}
+                </button>
+                {% elif can_unlock_note %}
+                <button class="btn btn-sm btn-success" data-toggle="modal" data-target="#unlock-note-modal">
+                    <i class="fa fa-check-circle"></i> {% trans 'Unlock note' %}
+                </button>
+                {% endif %}
+            </div>
+        </div>
+        {% endblock %}
+    </div>
+    <div class="col-xl-8">
+        {% block profile_content %}{% endblock %}
+    </div>
+
+    {# Popup to confirm the action of locking the note. Managed by a button #}
+    <div class="modal fade" id="lock-note-modal" tabindex="-1" role="dialog" aria-labelledby="lockNote"
+         aria-hidden="true">
+        <div class="modal-dialog" role="document">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h5 class="modal-title" id="lockNote">{% trans "Lock note" %}</h5>
+                    <button type="button" class="close btn-modal" data-dismiss="modal" aria-label="Close">
+                        <span aria-hidden="true">&times;</span>
+                    </button>
+                </div>
+                <div class="modal-body">
+                    {% blocktrans trimmed %}
+                        Are you sure you want to lock this note? This will prevent any transaction that would be performed,
+                        until the note is unlocked.
+                    {% endblocktrans %}
+                    {% if can_force_lock %}
+                    {% blocktrans trimmed %}
+                        If you use the force mode, the user won't be able to unlock the note by itself.
+                    {% endblocktrans %}
+                    {% endif %}
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-secondary btn-modal" data-dismiss="modal">{% trans "Close" %}</button>
+                    {% if can_force_lock %}
+                    <button type="button" class="btn btn-danger btn-modal" onclick="lock_note(true, 'forced')">{% trans "Force mode" %}</button>
+                    {% endif %}
+                    <button type="button" class="btn btn-warning btn-modal" onclick="lock_note(true, 'manual')">{% trans "Lock note" %}</button>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    {# Popup to confirm the action of unlocking the note. Managed by a button #}
+    <div class="modal fade" id="unlock-note-modal" tabindex="-1" role="dialog" aria-labelledby="unlockNote"
+         aria-hidden="true">
+        <div class="modal-dialog" role="document">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h5 class="modal-title" id="unlockNote">{% trans "Unlock note" %}</h5>
+                    <button type="button" class="close btn-modal" data-dismiss="modal" aria-label="Close">
+                        <span aria-hidden="true">&times;</span>
+                    </button>
+                </div>
+                <div class="modal-body">
+                    {% blocktrans trimmed %}
+                        Are you sure you want to unlock this note? Transactions will be re-enabled.
+                    {% endblocktrans %}
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-secondary btn-modal" data-dismiss="modal">{% trans "Close" %}</button>
+                    <button type="button" class="btn btn-success btn-modal" onclick="lock_note(false, null)">{% trans "Unlock note" %}</button>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    function refreshHistory() {
+        {% if user_object %}
+        $("#history_list").load("{% url 'member:user_detail' pk=user_object.pk %} #history_list");
+        $("#profile_infos").load("{% url 'member:user_detail' pk=user_object.pk %} #profile_infos");
+        {% else %}
+        $("#history_list").load("{% url 'member:club_detail' pk=club.pk %} #history_list");
+        $("#profile_infos").load("{% url 'member:club_detail' pk=club.pk %} #profile_infos");
+        {% endif %}
+    }
+
+    function lock_note(locked, mode) {
+        $("button.btn-modal").attr("disabled", "disabled");
+        $.ajax({
+            url: "/api/note/note/{{ note.pk }}/",
+            type: "PATCH",
+            dataType: "json",
+            headers: {
+                "X-CSRFTOKEN": CSRF_TOKEN
+            },
+            data: {
+                is_active: !locked,
+                inactivity_reason: mode,
+                resourcetype: "{% if user_object %}NoteUser{% else %}NoteClub{% endif %}"
+            }
+        }).done(function () {
+            $("#card-infos").load("#card-infos #card-infos", function () {
+                $(".modal").modal("hide");
+                $("button.btn-modal").removeAttr("disabled");
+            });
+        }).fail(function(xhr, textStatus, error) {
+            $(".modal").modal("hide");
+            $("button.btn-modal").removeAttr("disabled");
+            errMsg(xhr.responseJSON);
+        });
+    }
+</script>
+{% endblock %}
--- a/apps/member/templates/member/club_alias.html
+++ b/apps/member/templates/member/club_alias.html
@ -0,0 +1,31 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load static django_tables2 i18n %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {% trans "Note aliases" %}
+    </h3>
+
+    <div class="card-body">
+        {% if can_create %}
+            <form class="input-group" method="POST" id="form_alias">
+                {% csrf_token %}
+                <input type="hidden" name="note" value="{{ object.note.pk }}">
+                <input type="text" name="name" class="form-control">
+                <div class="input-group-append">
+                    <input type="submit" class="btn btn-success" value="{% trans "Add" %}">
+                </div>
+            </form>
+        {% endif %}
+    </div>
+    {% render_table aliases %}
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script src="{% static "member/js/alias.js" %}"></script>
+{% endblock%}
--- a/apps/member/templates/member/club_detail.html
+++ b/apps/member/templates/member/club_detail.html
@ -0,0 +1,48 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n perms %}
+
+{% block profile_content %}
+{% if managers.data %}
+<div class="card">
+    <div class="card-header position-relative" id="clubListHeading">
+        <a class="font-weight-bold">
+            <i class="fa fa-users"></i> {% trans "Club managers" %}
+        </a>
+    </div>
+    {% render_table managers %}
+</div>
+
+<hr>
+{% endif %}
+
+{% if member_list.data %}
+<div class="card">
+    <div class="card-header position-relative" id="clubListHeading">
+        <a class="stretched-link font-weight-bold" href="{% url 'member:club_members' pk=club.pk %}">
+            <i class="fa fa-users"></i> {% trans "Club members" %}
+        </a>
+    </div>
+    {% render_table member_list %}
+</div>
+
+<hr>
+{% endif %}
+
+{% if history_list.data %}
+<div class="card">
+    <div class="card-header position-relative" id="historyListHeading">
+        <a class="stretched-link font-weight-bold" {% if "note.view_note"|has_perm:club.note %}
+            href="{% url 'note:transactions' pk=club.note.pk %}" {% endif %}>
+            <i class="fa fa-euro"></i> {% trans "Transaction history" %}
+        </a>
+    </div>
+    <div id="history_list">
+        {% render_table history_list %}
+    </div>
+</div>
+{% endif %}
+{% endblock %}
--- a/apps/member/templates/member/club_form.html
+++ b/apps/member/templates/member/club_form.html
@ -0,0 +1,42 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        <form method="post">
+            {% csrf_token %}
+            {{ form|crispy }}
+            <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
+        </form>
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    require_memberships_obj = $("#id_require_memberships");
+
+    if (!require_memberships_obj.is(":checked")) {
+        $("#div_id_membership_fee_paid").toggle();
+        $("#div_id_membership_fee_unpaid").toggle();
+        $("#div_id_membership_duration").toggle();
+        $("#div_id_membership_start").toggle();
+        $("#div_id_membership_end").toggle();
+    }
+
+    require_memberships_obj.change(function () {
+        $("#div_id_membership_fee_paid").toggle();
+        $("#div_id_membership_fee_unpaid").toggle();
+        $("#div_id_membership_duration").toggle();
+        $("#div_id_membership_start").toggle();
+        $("#div_id_membership_end").toggle();
+    });
+</script>
+{% endblock %}
--- a/apps/member/templates/member/club_list.html
+++ b/apps/member/templates/member/club_list.html
@ -0,0 +1,16 @@
+{% extends "base_search.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms %}
+
+{% block content %}
+{% if can_add_club %}
+<a class="btn btn-block btn-success mb-3" href="{% url 'member:club_create' %}" data-turbolinks="false">
+    {% trans "Create club" %}
+</a>
+{% endif %}
+
+{# Search panel #}
+{{ block.super }}
+{% endblock %}
--- a/apps/member/templates/member/club_members.html
+++ b/apps/member/templates/member/club_members.html
@ -0,0 +1,69 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n %}
+{% load render_table from django_tables2 %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        <input id="searchbar" type="text" class="form-control" placeholder="Nom/prénom/note…">
+        <div class="form-check">
+            <label class="form-check-label" for="only_active">
+                <input type="checkbox" class="checkboxinput form-check-input" id="only_active"
+                    {% if only_active %}checked{% endif %}>
+                {% trans "Display only active memberships" %}
+            </label>
+        </div>
+        <div id="div_id_roles">
+            <label for="roles" class="col-form-label">{% trans "Filter roles:" %}</label>
+            <select name="roles" class="selectmultiple form-control" id="roles" multiple="">
+                {% for role in applicable_roles %}
+                <option value="{{ role.id }}" selected>{{ role.name }}</option>
+                {% endfor %}
+            </select>
+        </div>
+    </div>
+    <div id="memberships_table">
+        {% if table.data %}
+        {% render_table table %}
+        {% else %}
+        <div class="alert alert-warning">
+            {% trans "There is no membership found with this pattern." %}
+        </div>
+        {% endif %}
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script type="text/javascript">
+    $(document).ready(function () {
+        let searchbar_obj = $("#searchbar");
+        let only_active_obj = $("#only_active");
+        let roles_obj = $("#roles");
+
+        function reloadTable() {
+            let pattern = searchbar_obj.val();
+
+            let roles = [];
+            $("#roles option:selected").each(function () {
+                roles.push($(this).val());
+            });
+            let roles_str = roles.join(',');
+
+            $("#memberships_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") +
+                "&only_active=" + (only_active_obj.is(':checked') ? '1' : '0') +
+                "&roles=" + roles_str + " #memberships_table");
+        }
+
+        searchbar_obj.keyup(reloadTable);
+        only_active_obj.change(reloadTable);
+        roles_obj.change(reloadTable);
+    });
+</script>
+{% endblock %}
--- a/apps/member/templates/member/includes/club_info.html
+++ b/apps/member/templates/member/includes/club_info.html
@ -0,0 +1,57 @@
+{% load i18n pretty_money perms %}
+
+<dl class="row">
+    <dt class="col-xl-6">{% trans 'name'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.name }}</dd>
+
+    {% if club.parent_club %}
+    <dt class="col-xl-6">
+        <a href="{% url 'member:club_detail' club.parent_club.pk %}">{% trans 'Club Parent'|capfirst %}</a>
+    </dt>
+    <dd class="col-xl-6"> {{ club.parent_club.name }}</dd>
+    {% endif %}
+
+    {% if club.require_memberships %}
+    {% if club.membership_start %}
+    <dt class="col-xl-6">{% trans 'membership start'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_start }}</dd>
+    {% endif %}
+
+    {% if club.membership_end %}
+    <dt class="col-xl-6">{% trans 'membership end'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_end }}</dd>
+    {% endif %}
+
+    {% if club.membership_duration %}
+    <dt class="col-xl-6">{% trans 'membership duration'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_duration }} {% trans "days" %}</dd>
+    {% endif %}
+
+    {% if club.membership_fee_paid == club.membership_fee_unpaid %}
+    <dt class="col-xl-6">{% trans 'membership fee'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_fee_paid|pretty_money }}</dd>
+    {% else %}
+    <dt class="col-xl-6">{% trans 'membership fee (paid students)'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_fee_paid|pretty_money }}</dd>
+
+    <dt class="col-xl-6">{% trans 'membership fee (unpaid students)'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.membership_fee_unpaid|pretty_money }}</dd>
+    {% endif %}
+    {% endif %}
+
+    {% if "note.view_note"|has_perm:club.note %}
+    <dt class="col-xl-6">{% trans 'balance'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ club.note.balance | pretty_money }}</dd>
+    {% endif %}
+
+    <dt class="col-xl-6">{% trans 'aliases'|capfirst %}</dt>
+    <dd class="col-xl-6">
+        <a class="badge badge-secondary" href="{% url 'member:club_alias' club.pk %}">
+            <i class="fa fa-edit"></i>
+            {% trans 'Manage aliases' %} ({{ user_object.note.alias_set.all|length }})
+        </a>
+    </dd>
+
+    <dt class="col-xl-4">{% trans 'email'|capfirst %}</dt>
+    <dd class="col-xl-8"><a href="mailto:{{ club.email }}">{{ club.email }}</a></dd>
+</dl>
--- a/apps/member/templates/member/includes/profile_info.html
+++ b/apps/member/templates/member/includes/profile_info.html
@ -0,0 +1,54 @@
+{% load i18n pretty_money perms %}
+
+<dl class="row">
+    <dt class="col-xl-6">{% trans 'name'|capfirst %}, {% trans 'first name' %}</dt>
+    <dd class="col-xl-6">{{ user_object.last_name }} {{ user_object.first_name }}</dd>
+
+    <dt class="col-xl-6">{% trans 'username'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ user_object.username }}</dd>
+
+    {% if user_object.pk == user.pk %}
+    <dt class="col-xl-6">{% trans 'password'|capfirst %}</dt>
+    <dd class="col-xl-6">
+        <a class="badge badge-secondary" href="{% url 'password_change' %}">
+            <i class="fa fa-lock"></i>
+            {% trans 'Change password' %}
+        </a>
+    </dd>
+    {% endif %}
+
+    <dt class="col-xl-6">{% trans 'aliases'|capfirst %}</dt>
+    <dd class="col-xl-6">
+        <a class="badge badge-secondary" href="{% url 'member:user_alias' user_object.pk %}">
+            <i class="fa fa-edit"></i>
+            {% trans 'Manage aliases' %} ({{ user_object.note.alias_set.all|length }})
+        </a>
+    </dd>
+
+    <dt class="col-xl-6">{% trans 'section'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ user_object.profile.section }}</dd>
+
+    <dt class="col-xl-6">{% trans 'email'|capfirst %}</dt>
+    <dd class="col-xl-6"><a href="mailto:{{ user_object.email }}">{{ user_object.email }}</a></dd>
+
+    <dt class="col-xl-6">{% trans 'phone number'|capfirst %}</dt>
+    <dd class="col-xl-6"><a href="tel:{{ user_object.profile.phone_number }}">{{ user_object.profile.phone_number }}</a>
+    </dd>
+
+    <dt class="col-xl-6">{% trans 'address'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ user_object.profile.address }}</dd>
+
+    {% if "note.view_note"|has_perm:user_object.note %}
+    <dt class="col-xl-6">{% trans 'balance'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ user_object.note.balance | pretty_money }}</dd>
+
+    <dt class="col-xl-6">{% trans 'paid'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ user_object.profile.paid|yesno }}</dd>
+    {% endif %}
+</dl>
+
+{% if user_object.pk == user_object.pk %}
+<a class="small float-right text-decoration-none" href="{% url 'member:auth_token' %}">
+    {% trans 'Manage auth token' %}
+</a>
+{% endif %}
--- a/apps/member/templates/member/manage_auth_tokens.html
+++ b/apps/member/templates/member/manage_auth_tokens.html
@ -0,0 +1,36 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n %}
+
+{% block content %}
+<div class="alert alert-info">
+    <h4>À quoi sert un jeton d'authentification ?</h4>
+
+    Un jeton vous permet de vous connecter à <a href="/api/">l'API de la Note Kfet</a>.<br />
+    Il suffit pour cela d'ajouter en en-tête de vos requêtes <code>Authorization: Token &lt;TOKEN&gt;</code>
+    pour pouvoir vous identifier.<br /><br />
+
+    Une documentation de l'API arrivera ultérieurement.
+</div>
+
+<div class="alert alert-info">
+    <strong>{%trans  'Token' %} :</strong>
+    {% if 'show' in request.GET %}
+    {{ token.key }} (<a href="?">cacher</a>)
+    {% else %}
+    <em>caché</em> (<a href="?show">montrer</a>)
+    {% endif %}
+    <br />
+    <strong>{%trans  'Created' %} :</strong> {{ token.created }}
+</div>
+
+<div class="alert alert-warning">
+    <strong>Attention :</strong> regénérer le jeton va révoquer tout accès autorisé à l'API via ce jeton !
+</div>
+
+<a href="?regenerate">
+    <button class="btn btn-primary">{% trans 'Regenerate token' %}</button>
+</a>
+{% endblock %}
--- a/apps/member/templates/member/picture_update.html
+++ b/apps/member/templates/member/picture_update.html
@ -0,0 +1,107 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block profile_content %}
+<div class="card bg-light">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body">
+    <div class="text-center">
+      <form method="post" enctype="multipart/form-data" id="formUpload">
+        {% csrf_token %}
+        {{ form |crispy }}
+      </form>
+    </div>
+    <!-- MODAL TO CROP THE IMAGE -->
+    <div class="modal fade" id="modalCrop">
+      <div class="modal-dialog">
+        <div class="modal-content">
+          <div class="modal-body">
+            <img src="" id="modal-image" style="max-width: 100%;">
+          </div>
+          <div class="modal-footer">
+            <div class="btn-group pull-left" role="group">
+              <button type="button" class="btn btn-default" id="js-zoom-in">
+                <span class="glyphicon glyphicon-zoom-in"></span>
+              </button>
+              <button type="button" class="btn btn-default js-zoom-out">
+                <span class="glyphicon glyphicon-zoom-out"></span>
+              </button>
+            </div>
+            <button type="button" class="btn btn-default" data-dismiss="modal">Nevermind</button>
+            <button type="button" class="btn btn-primary js-crop-and-upload">Crop and upload</button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+{% endblock %}
+
+{% block extracss %}
+<link href="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.6/cropper.min.css" rel="stylesheet">
+{% endblock %}
+
+{% block extrajavascript%}
+<script src="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.6/cropper.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/jquery-cropper@1.0.1/dist/jquery-cropper.min.js"></script>
+<script>
+  $(function () {
+
+    /* SCRIPT TO OPEN THE MODAL WITH THE PREVIEW */
+    $("#id_image").change(function (e) {
+      if (this.files && this.files[0]) {
+        var reader = new FileReader();
+        reader.onload = function (e) {
+          $("#modal-image").attr("src", e.target.result);
+          $("#modalCrop").modal("show");
+        }
+        reader.readAsDataURL(this.files[0]);
+      }
+    });
+
+    /* SCRIPTS TO HANDLE THE CROPPER BOX */
+    var $image = $("#modal-image");
+    var cropBoxData;
+    var canvasData;
+    $("#modalCrop").on("shown.bs.modal", function () {
+      $image.cropper({
+        viewMode: 1,
+        aspectRatio: 1 / 1,
+        minCropBoxWidth: 200,
+        minCropBoxHeight: 200,
+        ready: function () {
+          $image.cropper("setCanvasData", canvasData);
+          $image.cropper("setCropBoxData", cropBoxData);
+        }
+      });
+    }).on("hidden.bs.modal", function () {
+      cropBoxData = $image.cropper("getCropBoxData");
+      canvasData = $image.cropper("getCanvasData");
+      $image.cropper("destroy");
+    });
+
+    $(".js-zoom-in").click(function () {
+      $image.cropper("zoom", 0.1);
+    });
+
+    $(".js-zoom-out").click(function () {
+      $image.cropper("zoom", -0.1);
+    });
+
+    /* SCRIPT TO COLLECT THE DATA AND POST TO THE SERVER */
+    $(".js-crop-and-upload").click(function () {
+      var cropData = $image.cropper("getData");
+      $("#id_x").val(cropData["x"]);
+      $("#id_y").val(cropData["y"]);
+      $("#id_height").val(cropData["height"]);
+      $("#id_width").val(cropData["width"]);
+      $("#formUpload").submit();
+    });
+  });
+</script>
+{% endblock %}
--- a/apps/member/templates/member/profile_alias.html
+++ b/apps/member/templates/member/profile_alias.html
@ -0,0 +1,30 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load static django_tables2 i18n %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {% trans "Note aliases" %}
+    </h3>
+    <div class="card-body">
+        {% if can_create %}
+            <form class="input-group" method="POST" id="form_alias">
+                {% csrf_token %}
+                <input type="hidden" name="note" value="{{ object.note.pk }}">
+                <input type="text" name="name" class="form-control">
+                <div class="input-group-append">
+                    <input type="submit" class="btn btn-success" value="{% trans "Add" %}">
+                </div>
+            </form>
+        {% endif %}
+    </div>
+    {% render_table aliases %}
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script src="{% static "member/js/alias.js" %}"></script>
+{% endblock%}
--- a/apps/member/templates/member/profile_detail.html
+++ b/apps/member/templates/member/profile_detail.html
@ -0,0 +1,39 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n perms %}
+
+{% block profile_content %}
+{% if not object.profile.email_confirmed and "member.change_profile_email_confirmed"|has_perm:user_object.profile %}
+<div class="alert alert-warning">
+    {% trans "This user doesn't have confirmed his/her e-mail address." %}
+    <a href="{% url "registration:email_validation_resend" pk=user_object.pk %}">
+        {% trans "Click here to resend a validation link." %}
+    </a>
+</div>
+{% endif %}
+
+<div class="card bg-light mb-3">
+    <div class="card-header position-relative" id="clubListHeading">
+        <a class="font-weight-bold">
+            <i class="fa fa-users"></i> {% trans "View my memberships" %}
+        </a>
+    </div>
+    {% render_table club_list %}
+</div>
+
+<div class="card bg-light">
+    <div class="card-header position-relative" id="historyListHeading">
+        <a class="stretched-link font-weight-bold text-decoration-none"
+            {% if "note.view_note"|has_perm:user_object.note %}
+            href="{% url 'note:transactions' pk=user_object.note.pk %}" {% endif %}>
+            <i class="fa fa-euro"></i> {% trans "Transaction history" %}
+        </a>
+    </div>
+    <div id="history_list">
+        {% render_table history_list %}
+    </div>
+</div>
+{% endblock %}
--- a/apps/member/templates/member/profile_update.html
+++ b/apps/member/templates/member/profile_update.html
@ -0,0 +1,23 @@
+{% extends "member/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        <form method="post">
+            {% csrf_token %}
+            {{ form | crispy }}
+            {{ profile_form | crispy }}
+            <button class="btn btn-primary" type="submit">
+                {% trans "Save Changes" %}
+            </button>
+        </form>
+    </div>
+</div>
+{% endblock %}
--- a/apps/member/templates/member/user_list.html
+++ b/apps/member/templates/member/user_list.html
@ -0,0 +1,16 @@
+{% extends "base_search.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms %}
+
+{% block content %}
+{% if "member.change_profile_registration_valid"|has_perm:user %}
+<a class="btn btn-block btn-secondary mb-3" href="{% url 'registration:future_user_list' %}">
+    <i class="fa fa-user-plus"></i> {% trans "Registrations" %}
+</a>
+{% endif %}
+
+{# Search panel #}
+{{ block.super }}
+{% endblock %}
--- a/apps/member/tests/test_login.py
+++ b/apps/member/tests/test_login.py
@ -0,0 +1,62 @@
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.contrib.auth.models import User
+from django.test import TestCase
+from note.models import TransactionTemplate, TemplateCategory
+
+"""
+Test that login page still works
+"""
+
+
+class TemplateLoggedOutTests(TestCase):
+    def test_login_page(self):
+        response = self.client.get('/accounts/login/')
+        self.assertEqual(response.status_code, 200)
+
+
+class TemplateLoggedInTests(TestCase):
+    fixtures = ('initial', )
+
+    def setUp(self):
+        self.user = User.objects.create_superuser(
+            username="admin",
+            password="adminadmin",
+            email="admin@example.com",
+        )
+        self.client.force_login(self.user)
+        sess = self.client.session
+        sess["permission_mask"] = 42
+        sess.save()
+
+    def test_login_page(self):
+        response = self.client.get('/accounts/login/')
+        self.assertEqual(response.status_code, 200)
+
+    def test_admin_index(self):
+        response = self.client.get('/admin/')
+        self.assertEqual(response.status_code, 200)
+
+    def test_accounts_password_reset(self):
+        response = self.client.get('/accounts/password_reset/')
+        self.assertEqual(response.status_code, 200)
+
+    def test_logout_page(self):
+        response = self.client.get('/accounts/logout/')
+        self.assertEqual(response.status_code, 200)
+
+    def test_transfer_page(self):
+        response = self.client.get('/note/transfer/')
+        self.assertEqual(response.status_code, 200)
+
+    def test_consos_page(self):
+        # Create one button and ensure that it is visible
+        cat = TemplateCategory.objects.create()
+        TransactionTemplate.objects.create(
+            destination_id=5,
+            category=cat,
+            amount=0,
+        )
+        response = self.client.get('/note/consos/')
+        self.assertEqual(response.status_code, 200)
--- a/apps/member/views.py
+++ b/apps/member/views.py
@ -2,7 +2,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later

 import io
-from datetime import datetime, timedelta
+from datetime import timedelta, date

 from PIL import Image
 from django.conf import settings
@ -10,25 +10,26 @@ from django.contrib.auth import logout
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.models import User
 from django.contrib.auth.views import LoginView
-from django.db.models import Q
+from django.db import transaction
+from django.db.models import Q, F
 from django.shortcuts import redirect
 from django.urls import reverse_lazy
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
-from django.views.generic import CreateView, DetailView, UpdateView, TemplateView
+from django.views.generic import DetailView, UpdateView, TemplateView
 from django.views.generic.edit import FormMixin
 from django_tables2.views import SingleTableView
 from rest_framework.authtoken.models import Token
-from note.forms import ImageForm
 from note.models import Alias, NoteUser
 from note.models.transactions import Transaction, SpecialTransaction
 from note.tables import HistoryTable, AliasTable
 from note_kfet.middlewares import _set_current_user_and_ip
 from permission.backends import PermissionBackend
 from permission.models import Role
-from permission.views import ProtectQuerysetMixin
+from permission.views import ProtectQuerysetMixin, ProtectedCreateView

-from .forms import ProfileForm, ClubForm, MembershipForm, CustomAuthenticationForm, UserForm, MembershipRolesForm
+from .forms import UserForm, ProfileForm, ImageForm, ClubForm, MembershipForm,\
+    CustomAuthenticationForm, MembershipRolesForm
 from .models import Club, Membership
 from .tables import ClubTable, UserTable, MembershipTable, ClubManagerTable

@ -49,6 +50,7 @@ class CustomLoginView(LoginView):
 class UserUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
    """
    Update the user information.
+    On this view both `:models:member.User` and `:models:member.Profile` are updated through forms
    """
    model = User
    form_class = UserForm
@ -69,48 +71,56 @@ class UserUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
        form.fields['email'].required = True
        form.fields['email'].help_text = _("This address must be valid.")

-        context['profile_form'] = self.profile_form(instance=context['user_object'].profile)
+        context['profile_form'] = self.profile_form(instance=context['user_object'].profile,
+                                                    data=self.request.POST if self.request.POST else None)
+        if not self.object.profile.report_frequency:
+            del context['profile_form'].fields["last_report"]
+
        return context

    def form_valid(self, form):
+        """
+        Check if ProfileForm is correct
+        then check if username is not already taken by someone else or by the user,
+        then check if email has changed, and if so ask for new validation.
+        """
+
+        profile_form = ProfileForm(
+            data=self.request.POST,
+            instance=self.object.profile,
+        )
+        profile_form.full_clean()
+        if not profile_form.is_valid():
+            return super().form_invalid(form)
        new_username = form.data['username']
-        # Si l'utilisateur cherche à modifier son pseudo, le nouveau pseudo ne doit pas être proche d'un alias existant
+        # Check if the new username is not already taken as an alias of someone else.
        note = NoteUser.objects.filter(
            alias__normalized_name=Alias.normalize(new_username))
        if note.exists() and note.get().user != self.object:
            form.add_error('username',
                           _("An alias with a similar name already exists."))
            return super().form_invalid(form)
-
-        profile_form = ProfileForm(
-            data=self.request.POST,
-            instance=self.object.profile,
-        )
-        if form.is_valid() and profile_form.is_valid():
-            new_username = form.data['username']
+        # Check if the username is one of user's aliases.
        alias = Alias.objects.filter(name=new_username)
-            # Si le nouveau pseudo n'est pas un de nos alias,
-            # on supprime éventuellement un alias similaire pour le remplacer
        if not alias.exists():
            similar = Alias.objects.filter(
                normalized_name=Alias.normalize(new_username))
            if similar.exists():
                similar.delete()
-
        olduser = User.objects.get(pk=form.instance.pk)

        user = form.save(commit=False)
-            profile = profile_form.save(commit=False)
-            profile.user = user
-            profile.save()
-            user.save()

        if olduser.email != user.email:
            # If the user changed her/his email, then it is unvalidated and a confirmation link is sent.
            user.profile.email_confirmed = False
-                user.profile.save()
            user.profile.send_email_validation_link()

+        profile = profile_form.save(commit=False)
+        profile.user = user
+        profile.save()
+        user.save()
+
        return super().form_valid(form)

    def get_success_url(self, **kwargs):
@ -120,7 +130,7 @@ class UserUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):

 class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
    """
-    Affiche les informations sur un utilisateur, sa note, ses clubs...
+    Display all information about a user.
    """
    model = User
    context_object_name = "user_object"
@ -131,11 +141,18 @@ class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
        """
        We can't display information of a not registered user.
        """
-        return super().get_queryset().filter(profile__registration_valid=True)
+        qs = super().get_queryset()
+        if self.request.user.is_superuser and self.request.session.get("permission_mask", -1) >= 42:
+            return qs
+        return qs.filter(profile__registration_valid=True)

    def get_context_data(self, **kwargs):
+        """
+        Add history of transaction and list of membership of user.
+        """
        context = super().get_context_data(**kwargs)
        user = context['user_object']
+        context["note"] = user.note
        history_list = \
            Transaction.objects.all().filter(Q(source=user.note) | Q(destination=user.note))\
            .order_by("-created_at")\
@ -144,11 +161,33 @@ class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
        history_table.paginate(per_page=20, page=self.request.GET.get("transaction-page", 1))
        context['history_list'] = history_table

-        club_list = Membership.objects.filter(user=user, date_end__gte=datetime.today())\
+        club_list = Membership.objects.filter(user=user, date_end__gte=date.today())\
            .filter(PermissionBackend.filter_queryset(self.request.user, Membership, "view"))
        membership_table = MembershipTable(data=club_list, prefix='membership-')
        membership_table.paginate(per_page=10, page=self.request.GET.get("membership-page", 1))
        context['club_list'] = membership_table
+
+        # Check permissions to see if the authenticated user can lock/unlock the note
+        with transaction.atomic():
+            modified_note = NoteUser.objects.get(pk=user.note.pk)
+            modified_note.is_active = True
+            modified_note.inactivity_reason = 'manual'
+            context["can_lock_note"] = user.note.is_active and PermissionBackend\
+                                           .check_perm(self.request.user, "note.change_noteuser_is_active",
+                                                       modified_note)
+            old_note = NoteUser.objects.select_for_update().get(pk=user.note.pk)
+            modified_note.inactivity_reason = 'forced'
+            modified_note._force_save = True
+            modified_note.save()
+            context["can_force_lock"] = user.note.is_active and PermissionBackend\
+                .check_perm(self.request.user, "note.change_note_is_active", modified_note)
+            old_note._force_save = True
+            old_note.save()
+            modified_note.refresh_from_db()
+            modified_note.is_active = True
+            context["can_unlock_note"] = not user.note.is_active and PermissionBackend\
+                .check_perm(self.request.user, "note.change_note_is_active", modified_note)
+
        return context


@ -165,7 +204,9 @@ class UserListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
        """
        Filter the user list with the given pattern.
        """
-        qs = super().get_queryset().distinct().filter(profile__registration_valid=True)
+        qs = super().get_queryset().distinct("username").annotate(alias=F("note__alias__name"))\
+            .annotate(normalized_alias=F("note__alias__normalized_name"))\
+            .filter(profile__registration_valid=True).order_by("username")
        if "search" in self.request.GET:
            pattern = self.request.GET["search"]

@ -173,17 +214,20 @@ class UserListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
                return qs.none()

            qs = qs.filter(
-                Q(first_name__iregex=pattern)
-                | Q(last_name__iregex=pattern)
-                | Q(profile__section__iregex=pattern)
-                | Q(username__iregex="^" + pattern)
-                | Q(note__alias__name__iregex="^" + pattern)
-                | Q(note__alias__normalized_name__iregex=Alias.normalize("^" + pattern))
-            )
+                username__iregex="^" + pattern
+            ).union(
+                qs.filter(
+                    (Q(alias__iregex="^" + pattern)
+                     | Q(normalized_alias__iregex="^" + Alias.normalize(pattern))
+                     | Q(last_name__iregex="^" + pattern)
+                     | Q(first_name__iregex="^" + pattern)
+                     | Q(email__istartswith=pattern))
+                    & ~Q(username__iregex="^" + pattern)
+                ), all=True)
        else:
            qs = qs.none()

-        return qs[:20]
+        return qs


 class ProfileAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
@ -198,7 +242,13 @@ class ProfileAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
        note = context['object'].note
-        context["aliases"] = AliasTable(note.alias_set.all())
+        context["aliases"] = AliasTable(note.alias_set.filter(PermissionBackend
+                                                              .filter_queryset(self.request.user, Alias, "view")).all())
+        context["can_create"] = PermissionBackend.check_perm(self.request.user, "note.add_alias", Alias(
+            note=context["object"].note,
+            name="",
+            normalized_name="",
+        ))
        return context


@ -255,7 +305,7 @@ class PictureUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, FormMixin, Det

 class ProfilePictureUpdateView(PictureUpdateView):
    model = User
-    template_name = 'member/profile_picture_update.html'
+    template_name = 'member/picture_update.html'
    context_object_name = 'user_object'


@ -286,7 +336,7 @@ class ManageAuthTokens(LoginRequiredMixin, TemplateView):
 # ******************************* #


-class ClubCreateView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
+class ClubCreateView(ProtectQuerysetMixin, ProtectedCreateView):
    """
    Create Club
    """
@ -295,6 +345,12 @@ class ClubCreateView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
    success_url = reverse_lazy('member:club_list')
    extra_context = {"title": _("Create new club")}

+    def get_sample_object(self):
+        return Club(
+            name="",
+            email="",
+        )
+
    def form_valid(self, form):
        return super().form_valid(form)

@ -317,12 +373,20 @@ class ClubListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):

            qs = qs.filter(
                Q(name__iregex=pattern)
-                | Q(note__alias__name__iregex="^" + pattern)
-                | Q(note__alias__normalized_name__iregex=Alias.normalize("^" + pattern))
+                | Q(note__alias__name__iregex=pattern)
+                | Q(note__alias__normalized_name__iregex=Alias.normalize(pattern))
            )

        return qs

+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context["can_add_club"] = PermissionBackend.check_perm(self.request.user, "member.add_club", Club(
+            name="",
+            email="club@example.com",
+        ))
+        return context
+

 class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
    """
@ -333,25 +397,29 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
    extra_context = {"title": _("Club detail")}

    def get_context_data(self, **kwargs):
+        """
+        Add list of managers (peoples with Permission/Roles in this club), history of transactions and members list
+        """
        context = super().get_context_data(**kwargs)

        club = context["club"]
        if PermissionBackend.check_perm(self.request.user, "member.change_club_membership_start", club):
            club.update_membership_dates()
-
+        # managers list
        managers = Membership.objects.filter(club=self.object, roles__name="Bureau de club")\
            .order_by('user__last_name').all()
        context["managers"] = ClubManagerTable(data=managers, prefix="managers-")
-
+        # transaction history
        club_transactions = Transaction.objects.all().filter(Q(source=club.note) | Q(destination=club.note))\
            .filter(PermissionBackend.filter_queryset(self.request.user, Transaction, "view"))\
            .order_by('-created_at')
        history_table = HistoryTable(club_transactions, prefix="history-")
        history_table.paginate(per_page=20, page=self.request.GET.get('history-page', 1))
        context['history_list'] = history_table
+        # member list
        club_member = Membership.objects.filter(
            club=club,
-            date_end__gte=datetime.today(),
+            date_end__gte=date.today(),
        ).filter(PermissionBackend.filter_queryset(self.request.user, Membership, "view"))

        membership_table = MembershipTable(data=club_member, prefix="membership-")
@ -362,8 +430,8 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
        empty_membership = Membership(
            club=club,
            user=User.objects.first(),
-            date_start=datetime.now().date(),
-            date_end=datetime.now().date(),
+            date_start=date.today(),
+            date_end=date.today(),
            fee=0,
        )
        context["can_add_members"] = PermissionBackend()\
@ -384,7 +452,13 @@ class ClubAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
        note = context['object'].note
-        context["aliases"] = AliasTable(note.alias_set.all())
+        context["aliases"] = AliasTable(note.alias_set.filter(PermissionBackend
+                                                              .filter_queryset(self.request.user, Alias, "view")).all())
+        context["can_create"] = PermissionBackend.check_perm(self.request.user, "note.add_alias", Alias(
+            note=context["object"].note,
+            name="",
+            normalized_name="",
+        ))
        return context


@ -416,14 +490,14 @@ class ClubPictureUpdateView(PictureUpdateView):
    Update the profile picture of a club.
    """
    model = Club
-    template_name = 'member/club_picture_update.html'
+    template_name = 'member/picture_update.html'
    context_object_name = 'club'

    def get_success_url(self):
        return reverse_lazy('member:club_detail', kwargs={'pk': self.object.id})


-class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
+class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
    """
    Add a membership to a club.
    """
@ -432,15 +506,42 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
    template_name = 'member/add_members.html'
    extra_context = {"title": _("Add new member to the club")}

+    def get_sample_object(self):
+        if "club_pk" in self.kwargs:
+            club = Club.objects.get(pk=self.kwargs["club_pk"])
+        else:
+            club = Membership.objects.get(pk=self.kwargs["pk"]).club
+        return Membership(
+            user=self.request.user,
+            club=club,
+            fee=0,
+            date_start=timezone.now(),
+            date_end=timezone.now() + timedelta(days=1),
+        )
+
    def get_context_data(self, **kwargs):
+        """
+        Membership can be created, or renewed
+        In case of creation the url is /club/<club_pk>/add_member
+        For a renewal it will be `club/renew_membership/<pk>`
+        """
        context = super().get_context_data(**kwargs)
        form = context['form']

-        if "club_pk" in self.kwargs:
-            # We create a new membership.
+        if "club_pk" in self.kwargs:  # We create a new membership.
            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request.user, Club, "view"))\
                .get(pk=self.kwargs["club_pk"], weiclub=None)
            form.fields['credit_amount'].initial = club.membership_fee_paid
+            # Ensure that the user is member of the parent club and all its the family tree.
+            c = club
+            clubs_renewal = []
+            additional_fee_renewal = 0
+            while c.parent_club is not None:
+                c = c.parent_club
+                clubs_renewal.append(c)
+                additional_fee_renewal += c.membership_fee_paid
+            context["clubs_renewal"] = clubs_renewal
+            context["additional_fee_renewal"] = additional_fee_renewal

            # If the concerned club is the BDE, then we add the option that Société générale pays the membership.
            if club.name != "BDE":
@ -452,27 +553,55 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
                kfet = Club.objects.get(name="Kfet")
                fee += kfet.membership_fee_paid
                context["total_fee"] = "{:.02f}".format(fee / 100, )
-        else:
-            # This is a renewal. Fields can be pre-completed.
+        else:  # This is a renewal. Fields can be pre-completed.
+            context["renewal"] = True
+
            old_membership = self.get_queryset().get(pk=self.kwargs["pk"])
            club = old_membership.club
            user = old_membership.user
+
+            c = club
+            clubs_renewal = []
+            additional_fee_renewal = 0
+            while c.parent_club is not None:
+                c = c.parent_club
+                # check if a valid membership exists for the parent club
+                if c.membership_start and not Membership.objects.filter(
+                        club=c,
+                        user=user,
+                        date_start__gte=c.membership_start,
+                ).exists():
+                    clubs_renewal.append(c)
+                    additional_fee_renewal += c.membership_fee_paid if user.profile.paid else c.membership_fee_unpaid
+            context["clubs_renewal"] = clubs_renewal
+            context["additional_fee_renewal"] = additional_fee_renewal
+
            form.fields['user'].initial = user
            form.fields['user'].disabled = True
            form.fields['date_start'].initial = old_membership.date_end + timedelta(days=1)
-            form.fields['credit_amount'].initial = club.membership_fee_paid if user.profile.paid \
-                else club.membership_fee_unpaid
+            form.fields['credit_amount'].initial = (club.membership_fee_paid if user.profile.paid
+                                                    else club.membership_fee_unpaid) + additional_fee_renewal
            form.fields['last_name'].initial = user.last_name
            form.fields['first_name'].initial = user.first_name

-            # If this is a renewal of a BDE membership, Société générale can pays, if it is not yet done
-            if club.name != "BDE" or user.profile.soge:
+            # If this is a renewal of a BDE membership, Société générale can pays, if it has not been already done.
+            if (club.name != "BDE" and club.name != "Kfet") or user.profile.soge:
                del form.fields['soge']
            else:
                fee = 0
                bde = Club.objects.get(name="BDE")
+                if not Membership.objects.filter(
+                    club=bde,
+                    user=user,
+                    date_start__gte=bde.membership_start,
+                ).exists():
                    fee += bde.membership_fee_paid if user.profile.paid else bde.membership_fee_unpaid
                kfet = Club.objects.get(name="Kfet")
+                if not Membership.objects.filter(
+                    club=kfet,
+                    user=user,
+                    date_start__gte=bde.membership_start,
+                ).exists():
                    fee += kfet.membership_fee_paid if user.profile.paid else kfet.membership_fee_unpaid
                context["total_fee"] = "{:.02f}".format(fee / 100, )

@ -485,11 +614,11 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
        Create membership, check that all is good, make transactions
        """
        # Get the club that is concerned by the membership
-        if "club_pk" in self.kwargs:
+        if "club_pk" in self.kwargs:  # get from url of new membership
            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request.user, Club, "view")) \
                .get(pk=self.kwargs["club_pk"])
            user = form.instance.user
-        else:
+        else:  # get from url for renewal
            old_membership = self.get_queryset().get(pk=self.kwargs["pk"])
            club = old_membership.club
            user = old_membership.user
@ -498,11 +627,12 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):

        # Get form data
        credit_type = form.cleaned_data["credit_type"]
+        # but with this way users can customize their section as they want.
        credit_amount = form.cleaned_data["credit_amount"]
        last_name = form.cleaned_data["last_name"]
        first_name = form.cleaned_data["first_name"]
        bank = form.cleaned_data["bank"]
-        soge = form.cleaned_data["soge"] and not user.profile.soge and club.name == "BDE"
+        soge = form.cleaned_data["soge"] and not user.profile.soge and (club.name == "BDE" or club.name == "Kfet")

        # If Société générale pays, then we store that information but the payment must be controlled by treasurers
        # later. The membership transaction will be invalidated.
@ -513,28 +643,30 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
        if credit_type is None:
            credit_amount = 0

-        if user.profile.paid:
-            fee = club.membership_fee_paid
-        else:
-            fee = club.membership_fee_unpaid
+        fee = 0
+        c = club
+        # collect the fees required to be paid
+        while c is not None and c.membership_start:
+            if not Membership.objects.filter(
+                    club=c,
+                    user=user,
+                    date_start__gte=c.membership_start,
+            ).exists():
+                fee += c.membership_fee_paid if user.profile.paid else c.membership_fee_unpaid
+            c = c.parent_club
+
        if user.note.balance + credit_amount < fee and not Membership.objects.filter(
                club__name="Kfet",
                user=user,
-                date_start__lte=datetime.now().date(),
-                date_end__gte=datetime.now().date(),
+                date_start__lte=date.today(),
+                date_end__gte=date.today(),
        ).exists():
            # Users without a valid Kfet membership can't have a negative balance.
-            # Club 2 = Kfet (hard-code :'( )
            # TODO Send a notification to the user (with a mail?) to tell her/him to credit her/his note
            form.add_error('user',
                           _("This user don't have enough money to join this club, and can't have a negative balance."))
            return super().form_invalid(form)

-        if club.parent_club is not None:
-            if not Membership.objects.filter(user=form.instance.user, club=club.parent_club).exists():
-                form.add_error('user', _('User is not a member of the parent club') + ' ' + club.parent_club.name)
-                return super().form_invalid(form)
-
        if Membership.objects.filter(
                user=form.instance.user,
                club=club,
@ -556,10 +688,9 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):

        # Now, all is fine, the membership can be created.

-        if club.name == "BDE":
-            # When we renew the BDE membership, we update the profile section.
-            # We could automate that and remove the section field from the Profile model,
-            # but with this way users can customize their section as they want.
+        if club.name == "BDE" or club.name == "Kfet":
+            # When we renew the BDE membership, we update the profile section
+            # that should happens at least once a year.
            user.profile.section = user.profile.section_generated
            user.profile.save()

@ -588,8 +719,15 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
            transaction._force_save = True
            transaction.save()

+        form.instance._force_renew_parent = True
+
        ret = super().form_valid(form)

+        if club.name == "BDE":
+            member_role = Role.objects.filter(Q(name="Adhérent BDE") | Q(name="Membre de club")).all()
+        elif club.name == "Kfet":
+            member_role = Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all()
+        else:
            member_role = Role.objects.filter(name="Membre de club").all()
        form.instance.roles.set(member_role)
        form.instance._force_save = True
@ -598,22 +736,29 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
        # If Société générale pays, then we assume that this is the BDE membership, and we auto-renew the
        # Kfet membership.
        if soge:
+            # If not already done, create BDE and Kfet memberships
+            bde = Club.objects.get(name="BDE")
            kfet = Club.objects.get(name="Kfet")
-            kfet_fee = kfet.membership_fee_paid if user.profile.paid else kfet.membership_fee_unpaid
+
+            soge_clubs = [bde, kfet]
+            for club in soge_clubs:
+                fee = club.membership_fee_paid if user.profile.paid else club.membership_fee_unpaid

                # Get current membership, to get the end date
                old_membership = Membership.objects.filter(
-                club__name="Kfet",
+                    club=club,
                    user=user,
-                date_start__lte=datetime.today(),
-                date_end__gte=datetime.today(),
-            )
+                ).order_by("-date_start")
+
+                if old_membership.filter(date_start__gte=club.membership_start).exists():
+                    # Membership is already renewed
+                    continue

                membership = Membership(
-                club=kfet,
+                    club=club,
                    user=user,
-                fee=kfet_fee,
-                date_start=old_membership.get().date_end + timedelta(days=1)
+                    fee=fee,
+                    date_start=max(old_membership.first().date_end + timedelta(days=1), club.membership_start)
                    if old_membership.exists() else form.instance.date_start,
                )
                membership._force_save = True
@ -622,8 +767,10 @@ class ClubAddMemberView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
                membership.refresh_from_db()
                if old_membership.exists():
                    membership.roles.set(old_membership.get().roles.all())
-            else:
-                membership.roles.add(Role.objects.get(name="Adhérent Kfet"))
+                elif c.name == "BDE":
+                    membership.roles.set(Role.objects.filter(Q(name="Adhérent BDE") | Q(name="Membre de club")).all())
+                elif c.name == "Kfet":
+                    membership.roles.set(Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all())
                membership.save()

        return ret
--- a/apps/note/admin.py
+++ b/apps/note/admin.py
@ -119,10 +119,6 @@ class TransactionAdmin(PolymorphicParentModelAdmin):
    list_display = ('created_at', 'poly_source', 'poly_destination',
                    'quantity', 'amount', 'valid')
    list_filter = ('valid',)
-    readonly_fields = (
-        'source',
-        'destination',
-    )

    def poly_source(self, obj):
        """
@ -145,10 +141,7 @@ class TransactionAdmin(PolymorphicParentModelAdmin):
        Only valid can be edited after creation
        Else the amount of money would not be transferred
        """
-        if obj:  # user is editing an existing object
-            return 'created_at', 'source', 'destination', 'quantity', \
-                   'amount'
-        return []
+        return 'created_at', 'source', 'destination', 'quantity', 'amount' if obj else ()


@admin.register(MembershipTransaction, site=admin_site)
@ -157,6 +150,13 @@ class MembershipTransactionAdmin(PolymorphicChildModelAdmin):
    Admin customisation for MembershipTransaction
    """

+    def get_readonly_fields(self, request, obj=None):
+        """
+        Only valid can be edited after creation
+        Else the amount of money would not be transferred
+        """
+        return ('created_at', 'source', 'destination', 'quantity', 'amount') if obj else ()
+

@admin.register(RecurrentTransaction, site=admin_site)
 class RecurrentTransactionAdmin(PolymorphicChildModelAdmin):
@ -164,6 +164,13 @@ class RecurrentTransactionAdmin(PolymorphicChildModelAdmin):
    Admin customisation for RecurrentTransaction
    """

+    def get_readonly_fields(self, request, obj=None):
+        """
+        Only valid can be edited after creation
+        Else the amount of money would not be transferred
+        """
+        return ('created_at', 'source', 'destination', 'quantity', 'amount') if obj else ()
+

@admin.register(SpecialTransaction, site=admin_site)
 class SpecialTransactionAdmin(PolymorphicChildModelAdmin):
@ -171,6 +178,13 @@ class SpecialTransactionAdmin(PolymorphicChildModelAdmin):
    Admin customisation for SpecialTransaction
    """

+    def get_readonly_fields(self, request, obj=None):
+        """
+        Only valid can be edited after creation
+        Else the amount of money would not be transferred
+        """
+        return ('created_at', 'source', 'destination', 'quantity', 'amount') if obj else ()
+

@admin.register(TransactionTemplate, site=admin_site)
 class TransactionTemplateAdmin(admin.ModelAdmin):
--- a/apps/note/api/serializers.py
+++ b/apps/note/api/serializers.py
@ -1,10 +1,16 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

+from django.conf import settings
+from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
 from rest_polymorphic.serializers import PolymorphicSerializer
+from member.api.serializers import MembershipSerializer
+from member.models import Membership
 from note_kfet.middlewares import get_current_authenticated_user
 from permission.backends import PermissionBackend
+from rest_framework.utils import model_meta

 from ..models.notes import Note, NoteClub, NoteSpecial, NoteUser, Alias
 from ..models.transactions import TransactionTemplate, Transaction, MembershipTransaction, TemplateCategory, \
@ -20,7 +26,7 @@ class NoteSerializer(serializers.ModelSerializer):
    class Meta:
        model = Note
        fields = '__all__'
-        read_only_fields = [f.name for f in model._meta.get_fields()]  # Notes are read-only protected
+        read_only_fields = ('balance', 'last_negative', 'created_at', )  # Note balances are read-only protected


 class NoteClubSerializer(serializers.ModelSerializer):
@ -33,7 +39,7 @@ class NoteClubSerializer(serializers.ModelSerializer):
    class Meta:
        model = NoteClub
        fields = '__all__'
-        read_only_fields = ('note', 'club', )
+        read_only_fields = ('note', 'club', 'balance', 'last_negative', 'created_at', )

    def get_name(self, obj):
        return str(obj)
@ -49,7 +55,7 @@ class NoteSpecialSerializer(serializers.ModelSerializer):
    class Meta:
        model = NoteSpecial
        fields = '__all__'
-        read_only_fields = ('note', )
+        read_only_fields = ('note', 'balance', 'last_negative', 'created_at', )

    def get_name(self, obj):
        return str(obj)
@ -65,7 +71,7 @@ class NoteUserSerializer(serializers.ModelSerializer):
    class Meta:
        model = NoteUser
        fields = '__all__'
-        read_only_fields = ('note', 'user', )
+        read_only_fields = ('note', 'user', 'balance', 'last_negative', 'created_at', )

    def get_name(self, obj):
        return str(obj)
@ -108,6 +114,8 @@ class ConsumerSerializer(serializers.ModelSerializer):

    email_confirmed = serializers.SerializerMethodField()

+    membership = serializers.SerializerMethodField()
+
    class Meta:
        model = Alias
        fields = '__all__'
@ -117,15 +125,26 @@ class ConsumerSerializer(serializers.ModelSerializer):
        Display information about the associated note
        """
        # If the user has no right to see the note, then we only display the note identifier
-        if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", obj.note):
-            return NotePolymorphicSerializer().to_representation(obj.note)
-        return dict(id=obj.note.id, name=str(obj.note))
+        return NotePolymorphicSerializer().to_representation(obj.note)\
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", obj.note)\
+            else dict(id=obj.note.id, name=str(obj.note))

    def get_email_confirmed(self, obj):
        if isinstance(obj.note, NoteUser):
            return obj.note.user.profile.email_confirmed
        return True

+    def get_membership(self, obj):
+        if isinstance(obj.note, NoteUser):
+            memberships = Membership.objects.filter(
+                PermissionBackend.filter_queryset(get_current_authenticated_user(), Membership, "view")).filter(
+                user=obj.note.user,
+                club=2,  # Kfet
+            ).order_by("-date_start")
+            if memberships.exists():
+                return MembershipSerializer().to_representation(memberships.first())
+        return None
+

 class TemplateCategorySerializer(serializers.ModelSerializer):
    """
@ -154,13 +173,24 @@ class TransactionSerializer(serializers.ModelSerializer):
    REST API Serializer for Transactions.
    The djangorestframework plugin will analyse the model `Transaction` and parse all fields in the API.
    """
+    def validate_source(self, value):
+        if not value.is_active:
+            raise ValidationError(_("The transaction can't be saved since the source note "
+                                    "or the destination note is not active."))
+        return value
+
+    def validate_destination(self, value):
+        if not value.is_active:
+            raise ValidationError(_("The transaction can't be saved since the source note "
+                                    "or the destination note is not active."))
+        return value

    class Meta:
        model = Transaction
        fields = '__all__'


-class RecurrentTransactionSerializer(serializers.ModelSerializer):
+class RecurrentTransactionSerializer(TransactionSerializer):
    """
    REST API Serializer for Transactions.
    The djangorestframework plugin will analyse the model `RecurrentTransaction` and parse all fields in the API.
@ -171,7 +201,7 @@ class RecurrentTransactionSerializer(serializers.ModelSerializer):
        fields = '__all__'


-class MembershipTransactionSerializer(serializers.ModelSerializer):
+class MembershipTransactionSerializer(TransactionSerializer):
    """
    REST API Serializer for Membership transactions.
    The djangorestframework plugin will analyse the model `MembershipTransaction` and parse all fields in the API.
@ -182,7 +212,7 @@ class MembershipTransactionSerializer(serializers.ModelSerializer):
        fields = '__all__'


-class SpecialTransactionSerializer(serializers.ModelSerializer):
+class SpecialTransactionSerializer(TransactionSerializer):
    """
    REST API Serializer for Special transactions.
    The djangorestframework plugin will analyse the model `SpecialTransaction` and parse all fields in the API.
@ -202,12 +232,28 @@ class TransactionPolymorphicSerializer(PolymorphicSerializer):
        SpecialTransaction: SpecialTransactionSerializer,
    }

-    try:
+    if "activity" in settings.INSTALLED_APPS:
        from activity.models import GuestTransaction
        from activity.api.serializers import GuestTransactionSerializer
        model_serializer_mapping[GuestTransaction] = GuestTransactionSerializer
-    except ImportError:  # Activity app is not loaded
-        pass
+
+    def validate(self, attrs):
+        resource_type = attrs.pop(self.resource_type_field_name)
+        serializer = self._get_serializer_from_resource_type(resource_type)
+        if self.instance:
+            instance = self.instance
+            info = model_meta.get_field_info(instance)
+            for attr, value in attrs.items():
+                if attr in info.relations and info.relations[attr].to_many:
+                    field = getattr(instance, attr)
+                    field.set(value)
+                else:
+                    setattr(instance, attr, value)
+            instance.validate()
+        else:
+            serializer.Meta.model(**attrs).validate()
+        attrs[self.resource_type_field_name] = resource_type
+        return super().validate(attrs)

    class Meta:
        model = Transaction
--- a/apps/note/api/views.py
+++ b/apps/note/api/views.py
@ -9,6 +9,8 @@ from rest_framework import viewsets
 from rest_framework.response import Response
 from rest_framework import status
 from api.viewsets import ReadProtectedModelViewSet, ReadOnlyProtectedModelViewSet
+from note_kfet.middlewares import get_current_session
+from permission.backends import PermissionBackend

 from .serializers import NotePolymorphicSerializer, AliasSerializer, ConsumerSerializer,\
    TemplateCategorySerializer, TransactionTemplateSerializer, TransactionPolymorphicSerializer
@ -16,7 +18,7 @@ from ..models.notes import Note, Alias
 from ..models.transactions import TransactionTemplate, Transaction, TemplateCategory


-class NotePolymorphicViewSet(ReadOnlyProtectedModelViewSet):
+class NotePolymorphicViewSet(ReadProtectedModelViewSet):
    """
    REST API View set.
    The djangorestframework plugin will get all `Note` objects (with polymorhism), serialize it to JSON with the given serializer,
@ -34,15 +36,16 @@ class NotePolymorphicViewSet(ReadOnlyProtectedModelViewSet):
        Parse query and apply filters.
        :return: The filtered set of requested notes
        """
-        queryset = super().get_queryset()
+        queryset = super().get_queryset().distinct()

        alias = self.request.query_params.get("alias", ".*")
        queryset = queryset.filter(
-            Q(alias__name__regex="^" + alias)
-            | Q(alias__normalized_name__regex="^" + Alias.normalize(alias))
-            | Q(alias__normalized_name__regex="^" + alias.lower()))
+            Q(alias__name__iregex="^" + alias)
+            | Q(alias__normalized_name__iregex="^" + Alias.normalize(alias))
+            | Q(alias__normalized_name__iregex="^" + alias.lower())
+        )

-        return queryset.distinct()
+        return queryset.order_by("id")


 class AliasViewSet(ReadProtectedModelViewSet):
@ -69,7 +72,6 @@ class AliasViewSet(ReadProtectedModelViewSet):
        try:
            self.perform_destroy(instance)
        except ValidationError as e:
-            print(e)
            return Response({e.code: e.message}, status.HTTP_400_BAD_REQUEST)
        return Response(status=status.HTTP_204_NO_CONTENT)

@ -79,15 +81,26 @@ class AliasViewSet(ReadProtectedModelViewSet):
        :return: The filtered set of requested aliases
        """

-        queryset = super().get_queryset()
+        queryset = super().get_queryset().distinct()

-        alias = self.request.query_params.get("alias", ".*")
+        alias = self.request.query_params.get("alias", None)
+        if alias:
            queryset = queryset.filter(
-            Q(name__regex="^" + alias)
-            | Q(normalized_name__regex="^" + Alias.normalize(alias))
-            | Q(normalized_name__regex="^" + alias.lower()))
+                name__iregex="^" + alias
+            ).union(
+                queryset.filter(
+                    Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                    & ~Q(name__iregex="^" + alias)
+                ),
+                all=True).union(
+                queryset.filter(
+                    Q(normalized_name__iregex="^" + alias.lower())
+                    & ~Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                    & ~Q(name__iregex="^" + alias)
+                ),
+                all=True)

-        return queryset
+        return queryset.order_by("name")


 class ConsumerViewSet(ReadOnlyProtectedModelViewSet):
@ -106,13 +119,25 @@ class ConsumerViewSet(ReadOnlyProtectedModelViewSet):
        queryset = super().get_queryset()

        alias = self.request.query_params.get("alias", ".*")
+        queryset = queryset.prefetch_related('note')
+        # We match first an alias if it is matched without normalization,
+        # then if the normalized pattern matches a normalized alias.
        queryset = queryset.filter(
-            Q(name__regex="^" + alias)
-            | Q(normalized_name__regex="^" + Alias.normalize(alias))
-            | Q(normalized_name__regex="^" + alias.lower()))\
-            .order_by('name').prefetch_related('note')
+            name__iregex="^" + alias
+        ).union(
+            queryset.filter(
+                Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                & ~Q(name__iregex="^" + alias)
+            ),
+            all=True).union(
+            queryset.filter(
+                Q(normalized_name__iregex="^" + alias.lower())
+                & ~Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                & ~Q(name__iregex="^" + alias)
+            ),
+            all=True)

-        return queryset
+        return queryset.order_by('name').distinct()


 class TemplateCategoryViewSet(ReadProtectedModelViewSet):
@ -121,7 +146,7 @@ class TemplateCategoryViewSet(ReadProtectedModelViewSet):
    The djangorestframework plugin will get all `TemplateCategory` objects, serialize it to JSON with the given serializer,
    then render it on /api/note/transaction/category/
    """
-    queryset = TemplateCategory.objects.all()
+    queryset = TemplateCategory.objects.order_by("name").all()
    serializer_class = TemplateCategorySerializer
    filter_backends = [SearchFilter]
    search_fields = ['$name', ]
@ -133,7 +158,7 @@ class TransactionTemplateViewSet(viewsets.ModelViewSet):
    The djangorestframework plugin will get all `TransactionTemplate` objects, serialize it to JSON with the given serializer,
    then render it on /api/note/transaction/template/
    """
-    queryset = TransactionTemplate.objects.all()
+    queryset = TransactionTemplate.objects.order_by("name").all()
    serializer_class = TransactionTemplateSerializer
    filter_backends = [SearchFilter, DjangoFilterBackend]
    filterset_fields = ['name', 'amount', 'display', 'category', ]
@ -146,7 +171,13 @@ class TransactionViewSet(ReadProtectedModelViewSet):
    The djangorestframework plugin will get all `Transaction` objects, serialize it to JSON with the given serializer,
    then render it on /api/note/transaction/transaction/
    """
-    queryset = Transaction.objects.all()
+    queryset = Transaction.objects.order_by("-created_at").all()
    serializer_class = TransactionPolymorphicSerializer
    filter_backends = [SearchFilter]
    search_fields = ['$reason', ]
+
+    def get_queryset(self):
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view"))\
+            .order_by("created_at", "id")
--- a/apps/note/forms.py
+++ b/apps/note/forms.py
@ -1,22 +1,15 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
+from datetime import datetime

 from django import forms
 from django.contrib.contenttypes.models import ContentType
+from django.forms import CheckboxSelectMultiple
+from django.utils.timezone import make_aware
 from django.utils.translation import gettext_lazy as _
-from note_kfet.inputs import Autocomplete, AmountInput
+from note_kfet.inputs import Autocomplete, AmountInput, DateTimePickerInput

-from .models import TransactionTemplate, NoteClub
-
-
-class ImageForm(forms.Form):
-    image = forms.ImageField(required=False,
-                             label=_('select an image'),
-                             help_text=_('Maximal size: 2MB'))
-    x = forms.FloatField(widget=forms.HiddenInput())
-    y = forms.FloatField(widget=forms.HiddenInput())
-    width = forms.FloatField(widget=forms.HiddenInput())
-    height = forms.FloatField(widget=forms.HiddenInput())
+from .models import TransactionTemplate, NoteClub, Alias


 class TransactionTemplateForm(forms.ModelForm):
@ -38,3 +31,80 @@ class TransactionTemplateForm(forms.ModelForm):
                ),
            'amount': AmountInput(),
        }
+
+
+class SearchTransactionForm(forms.Form):
+    source = forms.ModelChoiceField(
+        queryset=Alias.objects.all(),
+        label=_("Source"),
+        required=False,
+        widget=Autocomplete(
+            Alias,
+            resetable=True,
+            attrs={
+                'api_url': '/api/note/alias/',
+                'placeholder': 'Note ...',
+            },
+        ),
+    )
+
+    destination = forms.ModelChoiceField(
+        queryset=Alias.objects.all(),
+        label=_("Destination"),
+        required=False,
+        widget=Autocomplete(
+            Alias,
+            resetable=True,
+            attrs={
+                'api_url': '/api/note/alias/',
+                'placeholder': 'Note ...',
+            },
+        ),
+    )
+
+    type = forms.ModelMultipleChoiceField(
+        queryset=ContentType.objects.filter(app_label="note", model__endswith="transaction"),
+        initial=ContentType.objects.filter(app_label="note", model__endswith="transaction"),
+        label=_("Type"),
+        required=False,
+        widget=CheckboxSelectMultiple(),
+    )
+
+    reason = forms.CharField(
+        label=_("Reason"),
+        required=False,
+    )
+
+    valid = forms.BooleanField(
+        label=_("Valid"),
+        initial=False,
+        required=False,
+    )
+
+    amount_gte = forms.Field(
+        label=_("Total amount greater than"),
+        initial=0,
+        required=False,
+        widget=AmountInput(),
+    )
+
+    amount_lte = forms.Field(
+        initial=2 ** 31 - 1,
+        label=_("Total amount less than"),
+        required=False,
+        widget=AmountInput(),
+    )
+
+    created_after = forms.DateTimeField(
+        label=_("Created after"),
+        initial=make_aware(datetime(year=2000, month=1, day=1, hour=0, minute=0)),
+        required=False,
+        widget=DateTimePickerInput(),
+    )
+
+    created_before = forms.DateTimeField(
+        label=_("Created before"),
+        initial=make_aware(datetime(year=2042, month=12, day=31, hour=21, minute=42)),
+        required=False,
+        widget=DateTimePickerInput(),
+    )
--- a/apps/note/models/notes.py
+++ b/apps/note/models/notes.py
@ -4,9 +4,12 @@
 import unicodedata

 from django.conf import settings
+from django.conf.global_settings import DEFAULT_FROM_EMAIL
 from django.core.exceptions import ValidationError
+from django.core.mail import send_mail
 from django.core.validators import RegexValidator
 from django.db import models
+from django.template.loader import render_to_string
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from polymorphic.models import PolymorphicModel
@ -24,24 +27,20 @@ class Note(PolymorphicModel):
    A Note can be searched find throught an :model:`note.Alias`

    """
-    balance = models.IntegerField(
+
+    balance = models.BigIntegerField(
        verbose_name=_('account balance'),
        help_text=_('in centimes, money credited for this instance'),
        default=0,
    )
+
    last_negative = models.DateTimeField(
        verbose_name=_('last negative date'),
        help_text=_('last time the balance was negative'),
        null=True,
        blank=True,
    )
-    is_active = models.BooleanField(
-        _('active'),
-        default=True,
-        help_text=_(
-            'Designates whether this note should be treated as active. '
-            'Unselect this instead of deleting notes.'),
-    )
+
    display_image = models.ImageField(
        verbose_name=_('display image'),
        max_length=255,
@ -50,11 +49,31 @@ class Note(PolymorphicModel):
        upload_to='pic/',
        default='pic/default.png'
    )
+
    created_at = models.DateTimeField(
        verbose_name=_('created at'),
        default=timezone.now,
    )

+    is_active = models.BooleanField(
+        _('active'),
+        default=True,
+        help_text=_(
+            'Designates whether this note should be treated as active. '
+            'Unselect this instead of deleting notes.'),
+    )
+
+    inactivity_reason = models.CharField(
+        max_length=255,
+        choices=[
+            ('manual', _("The user blocked his/her note manually, eg. when he/she left the school for holidays. "
+                         "It can be reactivated at any time.")),
+            ('forced', _("The note is blocked by the the BDE and can't be manually reactivated.")),
+        ],
+        null=True,
+        default=None,
+    )
+
    class Meta:
        verbose_name = _("note")
        verbose_name_plural = _("notes")
@ -67,26 +86,27 @@ class Note(PolymorphicModel):

    pretty.short_description = _('Note')

+    @property
+    def last_negative_duration(self):
+        if self.balance >= 0 or self.last_negative is None:
+            return None
+        delta = timezone.now() - self.last_negative
+        return "{:d} jours".format(delta.days)
+
    def save(self, *args, **kwargs):
        """
        Save note with it's alias (called in polymorphic children)
        """
-        aliases = Alias.objects.filter(name=str(self))
-        if aliases.exists():
-            # Alias exists, so check if it is linked to this note
-            if aliases.first().note != self:
-                raise ValidationError(_('This alias is already taken.'),
-                                      code="same_alias")
+        # Check that we can save the alias
+        self.clean()

-            # Save note
        super().save(*args, **kwargs)
-        else:
-            # Alias does not exist yet, so check if it can exist
+
+        if not Alias.objects.filter(name=str(self)).exists():
            a = Alias(name=str(self))
            a.clean()

-            # Save note and alias
-            super().save(*args, **kwargs)
+            # Save alias
            a.note = self
            a.save(force_insert=True)

@ -128,6 +148,25 @@ class NoteUser(Note):
    def pretty(self):
        return _("%(user)s's note") % {'user': str(self.user)}

+    def save(self, *args, **kwargs):
+        if self.pk and self.balance < 0:
+            old_note = NoteUser.objects.get(pk=self.pk)
+            super().save(*args, **kwargs)
+            if old_note.balance >= 0:
+                # Passage en négatif
+                self.last_negative = timezone.now()
+                self._force_save = True
+                self.save(*args, **kwargs)
+                self.send_mail_negative_balance()
+        else:
+            super().save(*args, **kwargs)
+
+    def send_mail_negative_balance(self):
+        plain_text = render_to_string("note/mails/negative_balance.txt", dict(note=self))
+        html = render_to_string("note/mails/negative_balance.html", dict(note=self))
+        self.user.email_user("[Note Kfet] Passage en négatif (compte n°{:d})"
+                             .format(self.user.pk), plain_text, html_message=html)
+

 class NoteClub(Note):
    """
@ -150,6 +189,25 @@ class NoteClub(Note):
    def pretty(self):
        return _("Note of %(club)s club") % {'club': str(self.club)}

+    def save(self, *args, **kwargs):
+        if self.pk and self.balance < 0:
+            old_note = NoteClub.objects.get(pk=self.pk)
+            super().save(*args, **kwargs)
+            if old_note.balance >= 0:
+                # Passage en négatif
+                self.last_negative = timezone.now()
+                self._force_save = True
+                self.save(*args, **kwargs)
+                self.send_mail_negative_balance()
+        else:
+            super().save(*args, **kwargs)
+
+    def send_mail_negative_balance(self):
+        plain_text = render_to_string("note/mails/negative_balance.txt", dict(note=self))
+        html = render_to_string("note/mails/negative_balance.html", dict(note=self))
+        send_mail("[Note Kfet] Passage en négatif (club {})".format(self.club.name), plain_text, DEFAULT_FROM_EMAIL,
+                  [self.club.email], html_message=html)
+

 class NoteSpecial(Note):
    """
@ -199,7 +257,7 @@ class Alias(models.Model):
    normalized_name = models.CharField(
        max_length=255,
        unique=True,
-        default='',
+        blank=False,
        editable=False,
    )
    note = models.ForeignKey(
@ -221,18 +279,21 @@ class Alias(models.Model):
    @staticmethod
    def normalize(string):
        """
-        Normalizes a string: removes most diacritics and does casefolding
+        Normalizes a string: removes most diacritics, does casefolding and ignore non-ASCII characters
        """
        return ''.join(
-            char for char in unicodedata.normalize('NFKD', string.casefold())
+            char for char in unicodedata.normalize('NFKD', string.casefold().replace('æ', 'ae').replace('œ', 'oe'))
            if all(not unicodedata.category(char).startswith(cat)
-                   for cat in {'M', 'P', 'Z', 'C'})).casefold()
+                   for cat in {'M', 'Pc', 'Pe', 'Pf', 'Pi', 'Po', 'Ps', 'Z', 'C'}))\
+            .casefold().encode('ascii', 'ignore').decode('ascii')

    def clean(self):
        normalized_name = self.normalize(self.name)
        if len(normalized_name) >= 255:
            raise ValidationError(_('Alias is too long.'),
                                  code='alias_too_long')
+        if not normalized_name:
+            raise ValidationError(_('This alias contains only complex character. Please use a more simple alias.'))
        try:
            sim_alias = Alias.objects.get(normalized_name=normalized_name)
            if self != sim_alias:
@ -244,7 +305,7 @@ class Alias(models.Model):
        self.normalized_name = normalized_name

    def save(self, *args, **kwargs):
-        self.normalized_name = self.normalize(self.name)
+        self.clean()
        super().save(*args, **kwargs)

    def delete(self, using=None, keep_parents=False):
--- a/apps/note/models/transactions.py
+++ b/apps/note/models/transactions.py
@ -1,7 +1,8 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
+
 from django.core.exceptions import ValidationError
-from django.db import models
+from django.db import models, transaction
 from django.urls import reverse
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
@ -57,7 +58,6 @@ class TransactionTemplate(models.Model):

    amount = models.PositiveIntegerField(
        verbose_name=_('amount'),
-        help_text=_('in centimes'),
    )
    category = models.ForeignKey(
        TemplateCategory,
@ -164,14 +164,63 @@ class Transaction(PolymorphicModel):
            models.Index(fields=['destination']),
        ]

+    def validate(self):
+        previous_source_balance = self.source.balance
+        previous_dest_balance = self.destination.balance
+
+        source_balance = self.source.balance
+        dest_balance = self.destination.balance
+
+        created = self.pk is None
+        to_transfer = self.amount * self.quantity
+        if not created:
+            # Revert old transaction
+            old_transaction = Transaction.objects.get(pk=self.pk)
+            # Check that nothing important changed
+            for field_name in ["source_id", "destination_id", "quantity", "amount"]:
+                if getattr(self, field_name) != getattr(old_transaction, field_name):
+                    raise ValidationError(_("You can't update the {field} on a Transaction. "
+                                            "Please invalidate it and create one other.").format(field=field_name))
+
+            if old_transaction.valid == self.valid:
+                # Don't change anything
+                return 0, 0
+            if old_transaction.valid:
+                source_balance += to_transfer
+                dest_balance -= to_transfer
+
+        if self.valid:
+            source_balance -= to_transfer
+            dest_balance += to_transfer
+
+            # When a transaction is declared valid, we ensure that the invalidity reason is null, if it was
+            # previously invalid
+            self.invalidity_reason = None
+
+        if source_balance > 9223372036854775807 or source_balance < -9223372036854775808\
+                or dest_balance > 9223372036854775807 or dest_balance < -9223372036854775808:
+            raise ValidationError(_("The note balances must be between - 92 233 720 368 547 758.08 € "
+                                    "and 92 233 720 368 547 758.07 €."))
+
+        return source_balance - previous_source_balance, dest_balance - previous_dest_balance
+
+    @transaction.atomic
    def save(self, *args, **kwargs):
        """
        When saving, also transfer money between two notes
        """
+        if self.source.pk == self.destination.pk:
+            # When source == destination, no money is transferred and no transaction is created
+            return
+
+        # We refresh the notes with the "select for update" tag to avoid concurrency issues
+        self.source = Note.objects.filter(pk=self.source_id).select_for_update().get()
+        self.destination = Note.objects.filter(pk=self.destination_id).select_for_update().get()
+
+        # Check that the amounts stay between big integer bounds
+        diff_source, diff_dest = self.validate()

        if not self.source.is_active or not self.destination.is_active:
-            if 'force_insert' not in kwargs or not kwargs['force_insert']:
-                if 'force_update' not in kwargs or not kwargs['force_update']:
            raise ValidationError(_("The transaction can't be saved since the source note "
                                    "or the destination note is not active."))

@ -182,34 +231,14 @@ class Transaction(PolymorphicModel):
        if not self.destination_alias:
            self.destination_alias = str(self.destination)

-        if self.source.pk == self.destination.pk:
-            # When source == destination, no money is transferred
-            super().save(*args, **kwargs)
-            return
-
-        created = self.pk is None
-        to_transfer = self.amount * self.quantity
-        if not created:
-            # Revert old transaction
-            old_transaction = Transaction.objects.get(pk=self.pk)
-            if old_transaction.valid:
-                self.source.balance += to_transfer
-                self.destination.balance -= to_transfer
-
-        if self.valid:
-            self.source.balance -= to_transfer
-            self.destination.balance += to_transfer
-
-            # When a transaction is declared valid, we ensure that the invalidity reason is null, if it was
-            # previously invalid
-            self.invalidity_reason = None
-
        # We save first the transaction, in case of the user has no right to transfer money
        super().save(*args, **kwargs)

        # Save notes
+        self.source.balance += diff_source
        self.source._force_save = True
        self.source.save()
+        self.destination.balance += diff_dest
        self.destination._force_save = True
        self.destination.save()

@ -243,15 +272,25 @@ class RecurrentTransaction(Transaction):
        TransactionTemplate,
        on_delete=models.PROTECT,
    )
-    category = models.ForeignKey(
-        TemplateCategory,
-        on_delete=models.PROTECT,
-    )
+
+    def clean(self):
+        if self.template.destination != self.destination:
+            raise ValidationError(
+                _("The destination of this transaction must equal to the destination of the template."))
+        return super().clean()
+
+    def save(self, *args, **kwargs):
+        self.clean()
+        return super().save(*args, **kwargs)

    @property
    def type(self):
        return _('Template')

+    class Meta:
+        verbose_name = _("recurrent transaction")
+        verbose_name_plural = _("recurrent transactions")
+

 class SpecialTransaction(Transaction):
    """
@ -290,6 +329,14 @@ class SpecialTransaction(Transaction):
            raise(ValidationError(_("A special transaction is only possible between a"
                                    " Note associated to a payment method and a User or a Club")))

+    def save(self, *args, **kwargs):
+        self.clean()
+        super().save(*args, **kwargs)
+
+    class Meta:
+        verbose_name = _("Special transaction")
+        verbose_name_plural = _("Special transactions")
+

 class MembershipTransaction(Transaction):
    """
--- a/apps/note/signals.py
+++ b/apps/note/signals.py
@ -6,11 +6,7 @@ def save_user_note(instance, raw, **_kwargs):
    """
    Hook to create and save a note when an user is updated
    """
-    if raw:
-        # When provisionning data, do not try to autocreate
-        return
-
-    if instance.is_superuser or instance.profile.registration_valid:
+    if not raw and (instance.is_superuser or instance.profile.registration_valid):
        # Create note only when the registration is validated
        from note.models import NoteUser
        NoteUser.objects.get_or_create(user=instance)
--- a/apps/note/tables.py
+++ b/apps/note/tables.py
@ -4,7 +4,6 @@
 import html

 import django_tables2 as tables
-from django.db.models import F
 from django.utils.html import format_html
 from django_tables2.utils import A
 from django.utils.translation import gettext_lazy as _
@ -19,8 +18,7 @@ from .templatetags.pretty_money import pretty_money
 class HistoryTable(tables.Table):
    class Meta:
        attrs = {
-            'class':
-                'table table-condensed table-striped table-hover'
+            'class': 'table table-condensed table-striped'
        }
        model = Transaction
        exclude = ("id", "polymorphic_ctype", "invalidity_reason", "source_alias", "destination_alias",)
@ -56,34 +54,27 @@ class HistoryTable(tables.Table):
                "id": lambda record: "validate_" + str(record.id),
                "class": lambda record:
                str(record.valid).lower()
-                + (' validate' if PermissionBackend.check_perm(get_current_authenticated_user(),
-                                                               "note.change_transaction_invalidity_reason",
-                                                               record) else ''),
+                + (' validate' if record.source.is_active and record.destination.is_active and PermissionBackend
+                   .check_perm(get_current_authenticated_user(), "note.change_transaction_invalidity_reason", record)
+                   else ''),
                "data-toggle": "tooltip",
                "title": lambda record: (_("Click to invalidate") if record.valid else _("Click to validate"))
                if PermissionBackend.check_perm(get_current_authenticated_user(),
-                                                "note.change_transaction_invalidity_reason", record) else None,
-                "onclick": lambda record: 'de_validate(' + str(record.id) + ', ' + str(record.valid).lower() + ')'
+                                                "note.change_transaction_invalidity_reason", record)
+                and record.source.is_active and record.destination.is_active else None,
+                "onclick": lambda record: 'de_validate(' + str(record.id) + ', ' + str(record.valid).lower()
+                                          + ', "' + str(record.__class__.__name__) + '")'
                if PermissionBackend.check_perm(get_current_authenticated_user(),
-                                                "note.change_transaction_invalidity_reason", record) else None,
+                                                "note.change_transaction_invalidity_reason", record)
+                and record.source.is_active and record.destination.is_active else None,
                "onmouseover": lambda record: '$("#invalidity_reason_'
                                              + str(record.id) + '").show();$("#invalidity_reason_'
-                                              + str(record.id) + '").focus();'
-                if PermissionBackend.check_perm(get_current_authenticated_user(),
-                                                "note.change_transaction_invalidity_reason", record) else None,
-                "onmouseout": lambda record: '$("#invalidity_reason_' + str(record.id) + '").hide()'
-                if PermissionBackend.check_perm(get_current_authenticated_user(),
-                                                "note.change_transaction_invalidity_reason", record) else None,
+                                              + str(record.id) + '").focus();',
+                "onmouseout": lambda record: '$("#invalidity_reason_' + str(record.id) + '").hide()',
            }
        }
    )

-    def order_total(self, queryset, is_descending):
-        # needed for rendering
-        queryset = queryset.annotate(total=F('amount') * F('quantity')) \
-            .order_by(('-' if is_descending else '') + 'total')
-        return queryset, True
-
    def render_amount(self, value):
        return pretty_money(value)

@ -101,15 +92,18 @@ class HistoryTable(tables.Table):
        """
        When the validation status is hovered, an input field is displayed to let the user specify an invalidity reason
        """
+        has_perm = PermissionBackend \
+            .check_perm(get_current_authenticated_user(), "note.change_transaction_invalidity_reason", record)
+
        val = "✔" if value else "✖"
-        if not PermissionBackend\
-                .check_perm(get_current_authenticated_user(), "note.change_transaction_invalidity_reason", record):
+
+        if value and not has_perm:
            return val

        val += "<input type='text' class='form-control' id='invalidity_reason_" + str(record.id) \
               + "' value='" + (html.escape(record.invalidity_reason)
                                if record.invalidity_reason else ("" if value else str(_("No reason specified")))) \
-               + "'" + ("" if value else " disabled") \
+               + "'" + ("" if value and record.source.is_active and record.destination.is_active else " disabled") \
               + " placeholder='" + html.escape(_("invalidity reason").capitalize()) + "'" \
               + " style='position: absolute; width: 15em; margin-left: -15.5em; margin-top: -2em; display: none;'>"
        return format_html(val)
@ -124,7 +118,7 @@ DELETE_TEMPLATE = """
 class AliasTable(tables.Table):
    class Meta:
        attrs = {
-            'class': 'table table condensed table-striped table-hover',
+            'class': 'table table condensed table-striped',
            'id': "alias_table"
        }
        model = Alias
@ -136,15 +130,16 @@ class AliasTable(tables.Table):

    delete_col = tables.TemplateColumn(template_code=DELETE_TEMPLATE,
                                       extra_context={"delete_trans": _('delete')},
-                                       attrs={'td': {'class': 'col-sm-1'}},
-                                       verbose_name=_("Delete"),)
+                                       attrs={'td': {'class': lambda record: 'col-sm-1' + (
+                                           ' d-none' if not PermissionBackend.check_perm(
+                                               get_current_authenticated_user(), "note.delete_alias",
+                                               record) else '')}}, verbose_name=_("Delete"), )


 class ButtonTable(tables.Table):
    class Meta:
        attrs = {
-            'class':
-                'table table-bordered condensed table-hover'
+            'class': 'table table-bordered condensed'
        }
        row_attrs = {
            'class': lambda record: 'table-row ' + ('table-success' if record.display else 'table-danger'),
@ -154,18 +149,25 @@ class ButtonTable(tables.Table):
        model = TransactionTemplate
        exclude = ('id',)

-    edit = tables.LinkColumn('note:template_update',
+    edit = tables.LinkColumn(
+        'note:template_update',
        args=[A('pk')],
-                             attrs={'td': {'class': 'col-sm-1'},
-                                    'a': {'class': 'btn btn-sm btn-primary'}},
+        attrs={
+            'td': {'class': 'col-sm-1'},
+            'a': {
+                'class': 'btn btn-sm btn-primary',
+                'data-turbolinks': 'false',
+            }
+        },
        text=_('edit'),
        accessor='pk',
-                             verbose_name=_("Edit"),)
+        verbose_name=_("Edit"),
+    )

    delete_col = tables.TemplateColumn(template_code=DELETE_TEMPLATE,
                                       extra_context={"delete_trans": _('delete')},
                                       attrs={'td': {'class': 'col-sm-1'}},
-                                       verbose_name=_("Delete"),)
+                                       verbose_name=_("Delete"), )

    def render_amount(self, value):
        return pretty_money(value)
--- a/apps/note/templates/note/amount_input.html
+++ b/apps/note/templates/note/amount_input.html
@ -1,7 +1,13 @@
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+
+{# Select amount to transfert in € #}
 <div class="input-group">
-    <input class="form-control mx-auto d-block" type="number" min="0" step="0.01"
+    <input class="form-control mx-auto d-block" type="number" {% if not widget.attrs.negative %}min="0"{% endif %} step="0.01"
           {% if widget.value != None and widget.value != "" %}value="{{ widget.value }}"{% endif %}
           name="{{ widget.name }}"
+           {# Other attributes are loaded  #}
           {% for name, value in widget.attrs.items %}
                {% ifnotequal value False %}{{ name }}{% ifnotequal value True %}="{{ value|stringformat:'s' }}"{% endifnotequal %}{% endifnotequal %}
            {% endfor %}>
--- a/apps/note/templates/note/conso_form.html
+++ b/apps/note/templates/note/conso_form.html
@ -1,9 +1,11 @@
 {% extends "base.html" %}
-
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
 {% load i18n static pretty_money django_tables2 %}

-{# Remove page title #}
-{% block contenttitle %}{% endblock %}
+{# Use a fluid-width container #}
+{% block containertype %}container-fluid{% endblock %}

 {% block content %}
    <div class="row mt-4">
@ -11,10 +13,12 @@
            <div class="row">
                {# User details column #}
                <div class="col">
-                    <div class="card border-success shadow mb-4 text-center">
+                    <div class="card bg-light border-success mb-4 text-center">
+                        <a id="profile_pic_link" href="#">
                            <img src="/media/pic/default.png"
                                 id="profile_pic" alt="" class="card-img-top">
-                        <div class="card-body text-center">
+                        </a>
+                        <div class="card-body text-center text-break">
                            <span id="user_note"></span>
                        </div>
                    </div>
@ -22,7 +26,7 @@

                {# User selection column #}
                <div class="col-xl-7" id="user_select_div">
-                    <div class="card border-success shadow mb-4">
+                    <div class="card bg-light border-success mb-4">
                        <div class="card-header">
                            <p class="card-text font-weight-bold">
                                {% trans "Consum" %}
@ -40,9 +44,9 @@
                        </div>
                    </div>
                </div>
-
+                {# Summary of consumption and consume button #}
                <div class="col-xl-5 d-none" id="consos_list_div">
-                    <div class="card border-info shadow mb-4">
+                    <div class="card bg-light border-info mb-4">
                        <div class="card-header">
                            <p class="card-text font-weight-bold">
                                {% trans "Select consumptions" %}
@ -53,19 +57,17 @@
                            </ul>
                        </div>
                        <div class="card-footer text-center">
-                            <a id="consume_all" href="#" class="btn btn-primary">
+                            <span id="consume_all" class="btn btn-primary">
                                {% trans "Consume!" %}
-                            </a>
-                        </div>
+                            </span>
                        </div>
                    </div>
                </div>
            </div>

-        {# Buttons column #}
-        <div class="col">
+
            {# Show last used buttons #}
-            <div class="card shadow mb-4">
+            <div class="card bg-light mb-4">
                <div class="card-header">
                    <p class="card-text font-weight-bold">
                        {% trans "Highlighted buttons" %}
@ -84,11 +86,13 @@
                    </div>
                </div>
            </div>
+        </div>

+        {# Buttons column #}
+        <div class="col">
            {# Regroup buttons under categories #}
-	    {# {% regroup transaction_templates by category as categories %} #}

-            <div class="card border-primary text-center shadow mb-4">
+            <div class="card bg-light border-primary text-center mb-4">
                {# Tabs for button categories #}
                <div class="card-header">
                    <ul class="nav nav-tabs nav-fill card-header-tabs">
@ -143,7 +147,7 @@
            </div>
        </div>
    </div>
-
+    {# history of transaction #}
    <div class="card shadow mb-4" id="history">
        <div class="card-header">
            <p class="card-text font-weight-bold">
--- a/apps/note/templates/note/mails/negative_balance.html
+++ b/apps/note/templates/note/mails/negative_balance.html
@ -0,0 +1,46 @@
+{% load pretty_money %}
+{% load getenv %}
+{% load i18n %}
+
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8">
+    <title>Passage en négatif (compte n°{{ note.pk }})</title>
+</head>
+<body>
+<p>
+    Bonjour {% if note.user %}{{ note.user }}{% else %}{{ note.club.name }}{% endif %},
+</p>
+
+<p>
+    Ce mail t'a été envoyé parce que le solde de ta Note Kfet {{ note }} est négatif !
+</p>
+
+<p>
+    Ton solde actuel est de {{ note.balance|pretty_money }}.
+</p>
+
+<p>
+    Par ailleurs, le BDE ne sert pas d'alcool aux adhérents dont le solde
+    est inférieur à 0 € depuis plus de 24h.
+</p>
+
+<p>
+    Si tu ne comprends pas ton solde, tu peux consulter ton historique
+    sur <a href="https://{{ "NOTE_URL"|getenv }}{% if note.user %}{% url "member:user_detail" pk=note.user.pk %}{% else %}{% url "member:club_detail" pk=note.club.pk %}{% endif %}">ton compte</a>.
+</p>
+
+<p>
+    Tu peux venir recharger ta note rapidement à la Kfet, ou envoyer un mail à
+    la trésorerie du BdE (<a href="mailto:tresorerie.bde@lists.crans.org">tresorerie.bde@lists.crans.org</a>)
+    pour payer par virement bancaire.
+</p>
+
+--
+<p>
+    Le BDE<br>
+    {% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
+</p>
+</body>
+</html>
--- a/apps/note/templates/note/mails/negative_balance.txt
+++ b/apps/note/templates/note/mails/negative_balance.txt
@ -0,0 +1,25 @@
+{% load pretty_money %}
+{% load getenv %}
+{% load i18n %}
+
+Bonjour {% if note.user %}{{ note.user }}{% else %}{{ note.club.name }}{% endif %},
+
+Ce mail t'a été envoyé parce que le solde de ta Note Kfet
+{{ note }} est négatif !
+
+Ton solde actuel est de {{ note.balance|pretty_money }}.
+
+Par ailleurs, le BDE ne sert pas d'alcool aux adhérents dont le solde
+est inférieur à 0 € depuis plus de 24h.
+
+Si tu ne comprends pas ton solde, tu peux consulter ton historique
+sur ton compte {{ "NOTE_URL"|getenv }}{% if note.user %}{% url "member:user_detail" pk=note.user.pk %}{% else %}{% url "member:club_detail" pk=note.club.pk %}{% endif %}
+
+Tu peux venir recharger ta note rapidement à la Kfet, ou envoyer un mail à
+la trésorerie du BdE (tresorerie.bde@lists.crans.org) pour payer par
+virement bancaire.
+
+--
+Le BDE
+
+{% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
--- a/apps/note/templates/note/mails/negative_notes_report.html
+++ b/apps/note/templates/note/mails/negative_notes_report.html
@ -0,0 +1,49 @@
+{% load pretty_money %}
+{% load i18n %}
+
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8">
+    <title>[Note Kfet] Liste des négatifs</title>
+</head>
+<body>
+<table>
+<thead>
+<tr>
+    <th>Nom</th>
+    <th>Prénom</th>
+    <th>Pseudo</th>
+    <th>Email</th>
+    <th>Solde</th>
+    <th>Durée</th>
+</tr>
+</thead>
+<tbody>
+    {% for note in notes %}
+        <tr>
+            {% if note.user %}
+                <td>{{ note.user.last_name }}</td>
+                <td>{{ note.user.first_name }}</td>
+                <td>{{ note.user.username }}</td>
+                <td>{{ note.user.email }}</td>
+            {% else %}
+                <td></td>
+                <td></td>
+                <td>{{ note.club.name }}</td>
+                <td>{{ note.club.email }}</td>
+            {% endif %}
+            <td>{{ note.balance|pretty_money }}</td>
+            <td>{{ note.last_negative_duration }}</td>
+        </tr>
+    {% endfor %}
+</tbody>
+</table>
+
+--
+<p>
+    Le BDE<br>
+    {% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
+</p>
+</body>
+</html>
--- a/apps/note/templates/note/mails/negative_notes_report.txt
+++ b/apps/note/templates/note/mails/negative_notes_report.txt
@ -0,0 +1,13 @@
+{% load pretty_money %}
+{% load i18n %}
+
+         Nom         |   Prénom   |     Pseudo      |               Email               |  Solde   |   Durée
+---------------------+------------+-----------------+-----------------------------------+----------+-----------
+{% for note in notes %}
+{% if note.user %}{{ note.user.last_name }} | {{ note.user.first_name }} | {{ note.user.username }} | {{ note.user.email }} | {{ note.balance|pretty_money }} | {{ note.last_negative_duration }}{% else %}                     |            | {{ note.club.name }} | {{ note.club.email }} | {{ note.balance|pretty_money }} | {{ note.last_negative_duration }}{% endif %}
+{% endfor %}
+
+--
+Le BDE
+
+{% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
--- a/apps/note/templates/note/mails/weekly_report.html
+++ b/apps/note/templates/note/mails/weekly_report.html
@ -0,0 +1,57 @@
+{% load pretty_money %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8">
+    <title>[Note Kfet] Rapport de la Note Kfet</title>
+
+    <link rel="stylesheet"
+          href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css"
+          integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh"
+          crossorigin="anonymous">
+    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js"
+            integrity="sha384-wfSDF2E50Y2D1uUdj0O3uMBJnjuUD4Ih7YwaYd1iqfktj0Uod8GCExl3Og8ifwB6"
+            crossorigin="anonymous"></script>
+</head>
+<body>
+<p>
+    Bonjour,
+</p>
+
+<p>
+    Vous recevez ce mail car vous avez défini une « Fréquence des rapports » dans la Note.<br>
+    Le premier rapport récapitule toutes vos consommations depuis la création de votre compte.<br>
+    Ensuite, un rapport vous est envoyé à la fréquence demandée seulement si vous avez consommé
+    depuis le dernier rapport.<br>
+    Pour arrêter de recevoir des rapports, il vous suffit de modifier votre profil Note et de
+    mettre la fréquence des rapports à 0 ou -1.<br>
+    Pour toutes suggestions par rapport à ce service, contactez
+    <a href="mailto:notekfet2020@lists.crans.org">notekfet2020@lists.crans.org</a>.
+</p>
+
+<p>
+    Rapport d'activité de {{ user.first_name }} {{ user.last_name }} (note : {{ user }})
+    depuis le {{ last_report }} jusqu'au {{ now }}.
+</p>
+
+<p>
+    Dépenses totales : {{ outcoming|pretty_money }}<br>
+    Apports totaux : {{ incoming|pretty_money }}<br>
+    Différentiel : {{ diff|pretty_money }}<br>
+    Nouveau solde : {{ user.note.balance|pretty_money }}
+</p>
+
+<h4>Rapport détaillé</h4>
+
+{% render_table table %}
+
+--
+<p>
+    Le BDE<br>
+    {% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
+</p>
+</body>
+</html>
--- a/apps/note/templates/note/search_transactions.html
+++ b/apps/note/templates/note/search_transactions.html
@ -0,0 +1,66 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load crispy_forms_tags %}
+
+{# Use a fluid-width container #}
+{% block containertype %}container-fluid{% endblock %}
+
+{% block content %}
+<div class="row mt-4">
+    <div class="col-xl-4">
+        <div class="card bg-light mb-3">
+            <h3 class="card-header text-center">
+                {{ title }}
+            </h3>
+            <div class="card-body">
+                {% crispy form %}
+            </div>
+        </div>
+    </div>
+    <div class="col-xl-8">
+        <div class="card bg-light">
+            <div id="table">
+                {% render_table table %}
+            </div>
+        </div>
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    function refreshHistory() {
+        $("#history_list").load("{% url 'note:transactions' pk=object.pk %} #history_list");
+        $("#profile_infos").load("{% url 'note:transactions' pk=object.pk %} #profile_infos");
+    }
+
+    function refreshFilters() {
+        let filters = "";
+        filters += "source=" + $("#id_source_pk").val();
+        filters += "&destination=" + $("#id_destination_pk").val();
+        filters += $("input[name='type']:checked").map(function () {
+            return "&type=" + $(this).val();
+        }).toArray().join("");
+        filters += "&reason=" + $("#id_reason").val();
+        filters += "&valid=" + ($("#id_valid").is(":checked") ? "1" : "");
+        filters += "&amount_gte=" + $("#id_amount_gte").val();
+        filters += "&amount_lte=" + $("#id_amount_lte").val();
+        filters += "&created_after=" + $("#id_created_after").val();
+        filters += "&created_before=" + $("#id_created_before").val();
+        console.log(filters.replace(" ", "%20"));
+        $("#table").load(location.pathname + "?" + filters.replaceAll(" ", "%20") + " #table");
+    }
+
+    function autocompleted() {
+        refreshFilters();
+    }
+
+    $(document).ready(function () {
+        $("input").change(refreshFilters);
+        $("input").keyup(refreshFilters);
+    });
+</script>
+{% endblock %}
--- a/apps/note/templates/note/transaction_form.html
+++ b/apps/note/templates/note/transaction_form.html
@ -2,14 +2,15 @@
 {% comment %}
 SPDX-License-Identifier: GPL-2.0-or-later
 {% endcomment %}
-
 {% load i18n static django_tables2 perms %}

 {% block content %}
+<h1 class="text-white">{{ title }}</h1>

+{# bandeau transfert/crédit/débit/activité #}
    <div class="row">
        <div class="col-xl-12">
-            <div class="btn-group btn-group-toggle" style="width: 100%; padding: 0 0 2em 0" data-toggle="buttons">
+            <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons">
                <label for="type_transfer" class="btn btn-sm btn-outline-primary active">
                    <input type="radio" name="transaction_type" id="type_transfer">
                    {% trans "Transfer" %}
@ -19,7 +20,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
                        <input type="radio" name="transaction_type" id="type_credit">
                        {% trans "Credit" %}
                    </label>
-                    <label type="type_debit" class="btn btn-sm btn-outline-primary">
+                    <label for="type_debit" class="btn btn-sm btn-outline-primary">
                        <input type="radio" name="transaction_type" id="type_debit">
                        {% trans "Debit" %}
                    </label>
@ -32,32 +33,39 @@ SPDX-License-Identifier: GPL-2.0-or-later
            </div>
        </div>
    </div>
-
+    <hr>
    <div class="row">
+        {#  Preview note profile (picture, username and balance) #}
        <div class="col-md-3" id="note_infos_div">
-            <div class="card border-success shadow mb-4">
-                <img src="/media/pic/default.png"
-                    id="profile_pic" alt="" class="img-fluid rounded mx-auto d-block">
+            <div class="card bg-light border-success shadow mb-4">
+                <a id="profile_pic_link" href="#"><img src="/media/pic/default.png"
+                        id="profile_pic" alt="" class="img-fluid rounded mx-auto"></a>
                <div class="card-body text-center">
                    <span id="user_note"></span>
                </div>
            </div>
        </div>

+        {# list of emitters #}
        <div class="col-md-3" id="emitters_div">
-            <div class="card border-success shadow mb-4">
+            <div class="card bg-light border-success shadow mb-4">
                <div class="card-header">
                    <p class="card-text font-weight-bold">
-                        {% trans "Select emitters" %}
+                        <label for="source_note" id="source_note_label">{% trans "Select emitters" %}</label>
                    </p>
                </div>
                <ul class="list-group list-group-flush" id="source_note_list">
                </ul>
                <div class="card-body">
-                    <input class="form-control mx-auto d-block" type="text" id="source_note" placeholder="{% trans "Name or alias..." %}" />
+                    <select id="credit_type" class="custom-select d-none">
+                        {% for special_type in special_types %}
+                            <option value="{{ special_type.id }}">{{ special_type.special_type }}</option>
+                        {% endfor %}
+                    </select>
+                    <input class="form-control mx-auto" type="text" id="source_note" placeholder="{% trans "Name or alias..." %}" />
                    <div id="source_me_div">
                        <hr>
-                        <span class="form-control mx-auto d-block btn btn-secondary" id="source_me">
+                        <span class="form-control mx-auto btn btn-secondary" id="source_me">
                            {% trans "I am the emitter" %}
                        </span>
                    </div>
@ -65,25 +73,32 @@ SPDX-License-Identifier: GPL-2.0-or-later
            </div>
        </div>

+        {# list of receiver #}
        <div class="col-md-3" id="dests_div">
-            <div class="card border-info shadow mb-4">
+            <div class="card bg-light border-info shadow mb-4">
                <div class="card-header">
                    <p class="card-text font-weight-bold" id="dest_title">
-                        {% trans "Select receivers" %}
+                        <label for="dest_note" id="dest_note_label">{% trans "Select receivers" %}</label>
                    </p>
                </div>
                <ul class="list-group list-group-flush" id="dest_note_list">
                </ul>
                <div class="card-body">
-                    <input class="form-control mx-auto d-block" type="text" id="dest_note" placeholder="{% trans "Name or alias..." %}" />
+                    <select id="debit_type" class="custom-select d-none">
+                        {% for special_type in special_types %}
+                            <option value="{{ special_type.id }}">{{ special_type.special_type }}</option>
+                        {% endfor %}
+                    </select>
+                    <input class="form-control mx-auto" type="text" id="dest_note" placeholder="{% trans "Name or alias..." %}" />
                    <ul class="list-group list-group-flush" id="dest_alias_matched">
                    </ul>
                </div>
            </div>
        </div>

+        {# Information on transaction (amount, reason, name,...) #}
        <div class="col-md-3" id="external_div">
-            <div class="card border-warning shadow mb-4">
+            <div class="card bg-light border-warning shadow mb-4">
                <div class="card-header">
                    <p class="card-text font-weight-bold">
                        {% trans "Action" %}
@ -102,22 +117,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
                    <div class="form-row">
                        <div class="col-md-12">
                            <label for="reason">{% trans "Reason" %} :</label>
-                            <input class="form-control mx-auto d-block" type="text" id="reason" />
+                            <input class="form-control mx-auto" type="text" id="reason" />
                            <p id="reason-required" class="invalid-feedback"></p>
                        </div>
                    </div>
-
+                    {# in case of special transaction add identity information #}
                    <div class="d-none" id="special_transaction_div">
-                        <div class="form-row">
-                            <div class="col-md-12">
-                                <label for="credit_type">{% trans "Transfer type" %} :</label>
-                                <select id="credit_type" class="custom-select">
-                                    {% for special_type in special_types %}
-                                        <option value="{{ special_type.id }}">{{ special_type.special_type }}</option>
-                                    {% endfor %}
-                                </select>
-                            </div>
-                        </div>
                        <div class="form-row">
                            <div class="col-md-12">
                                <label for="last_name">{% trans "Name" %} :</label>
@ -147,7 +152,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
            </div>
        </div>
    </div>
-
+{# transaction history #}
    <div class="card shadow mb-4" id="history">
        <div class="card-header">
            <p class="card-text font-weight-bold">
@ -164,6 +169,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
        SPECIAL_TRANSFER_POLYMORPHIC_CTYPE = {{ special_polymorphic_ctype }};
        user_id = {{ user.note.pk }};
        username = "{{ user.username|escapejs }}";
+
+        select_emitter_label = "{% trans "Select emitter" %}";
+        select_emitters_label = "{% trans "Select emitters" %}";
+        select_receveir_label = "{% trans "Select receiver" %}";
+        select_receveirs_label = "{% trans "Select receivers" %}";
+        transfer_type_label = "{% trans "Transfer type" %}";
    </script>
    <script src="/static/js/transfer.js"></script>
 {% endblock %}
--- a/apps/note/templates/note/transactiontemplate_form.html
+++ b/apps/note/templates/note/transactiontemplate_form.html
@ -0,0 +1,34 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load static i18n crispy_forms_tags pretty_money %}
+
+{% block content %}
+<a class="btn btn-secondary mb-3" href="{% url 'note:template_list' %}">{% trans "Buttons list" %}</a>
+
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        <form method="post">
+            {% csrf_token %}
+            {{form|crispy}}
+            <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
+        </form>
+
+        {% if price_history and price_history.1 %}
+            <hr>
+
+            <h4>{% trans "Price history" %}</h4>
+            <ul>
+            {% for price in price_history %}
+                <li>{{ price.price|pretty_money }} {% if price.time %}({% trans "Obsolete since" %} {{ price.time }}){% else %}({% trans "Current price" %}){% endif %}</li>
+            {% endfor %}
+            </ul>
+        {% endif %}
+    </div>
+</div>
+
+{% endblock %}
--- a/apps/note/templates/note/transactiontemplate_list.html
+++ b/apps/note/templates/note/transactiontemplate_list.html
@ -1,17 +1,22 @@
 {% extends "base.html" %}
-{% load pretty_money %}
-{% load i18n %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load pretty_money i18n %}
 {% load render_table from django_tables2 %}
+
 {% block content %}
+<h1 class="text-white">{{ title }}</h1>
 <div class="row justify-content-center mb-4">
    <div class="col-md-10 text-center">
-        <input class="form-control mx-auto w-25" type="text" id="search_field" placeholder="{% trans "Name of the button..." %}">
+        {# Search field , see js #}
+        <input class="form-control mx-auto w-25" type="text" id="search_field" placeholder="{% trans "Name of the button..." %}" value="{{ request.GET.search }}">
        <hr>
-        <a class="btn btn-primary text-center my-1" href="{% url 'note:template_create' %}">{% trans "New button" %}</a>
+        <a class="btn btn-primary text-center my-1" href="{% url 'note:template_create' %}" data-turbolinks="false">{% trans "New button" %}</a>
    </div>
 </div>
 <div class="row justify-content-center">   
-    <div class="col-md-10">
+    <div class="col-md-12">
        <div class="card card-border shadow">
            <div class="card-header text-center">
                <h5> {% trans "buttons listing "%}</h5>
@ -28,12 +33,25 @@
 <script type="text/javascript">
    $(document).ready(function() {
        let searchbar_obj = $("#search_field");
-        var timer_on = false;
-        var timer;
+        let timer_on = false;
+        let timer;
+
+        function refreshMatchedWords() {
+            $("tr").each(function() {
+                let pattern = searchbar_obj.val();
+                if (pattern) {
+                    $(this).find("td:eq(0), td:eq(1), td:eq(3), td:eq(6)").each(function () {
+                        $(this).html($(this).text().replace(new RegExp(pattern, 'i'), "<mark>$&</mark>"));
+                    });
+                }
+            });
+        }
+
+        refreshMatchedWords();

        function reloadTable() {
            let pattern = searchbar_obj.val();
-            $("#buttons_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + " #buttons_table");
+            $("#buttons_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + " #buttons_table", refreshMatchedWords);
        }

        searchbar_obj.keyup(function() {
--- a/apps/note/templatetags/pretty_money.py
+++ b/apps/note/templatetags/pretty_money.py
@ -5,6 +5,7 @@ from django import template


 def pretty_money(value):
+    try:
        if value % 100 == 0:
            return "{:s}{:d} €".format(
                "- " if value < 0 else "",
@ -16,6 +17,8 @@ def pretty_money(value):
                abs(value) // 100,
                abs(value) % 100,
            )
+    except (ValueError, TypeError):
+        return "0 €"


 register = template.Library()
--- a/apps/note/tests/test_transactions.py
+++ b/apps/note/tests/test_transactions.py
@ -0,0 +1,365 @@
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.contrib.auth.models import User
+from django.contrib.contenttypes.models import ContentType
+from django.test import TestCase
+from django.urls import reverse
+from member.models import Club, Membership
+from note.models import NoteUser, Transaction, TemplateCategory, TransactionTemplate, RecurrentTransaction, \
+    MembershipTransaction, SpecialTransaction, NoteSpecial, Alias
+from permission.models import Role
+
+
+class TestTransactions(TestCase):
+    fixtures = ('initial', )
+
+    def setUp(self) -> None:
+        self.user = User.objects.create_superuser(
+            username="toto",
+            password="totototo",
+            email="toto@example.com",
+        )
+
+        sess = self.client.session
+        sess["permission_mask"] = 42
+        sess.save()
+        self.client.force_login(self.user)
+
+        membership = Membership.objects.create(club=Club.objects.get(name="BDE"), user=self.user)
+        membership.roles.add(Role.objects.get(name="Respo info"))
+        membership.save()
+        Membership.objects.create(club=Club.objects.get(name="Kfet"), user=self.user)
+        self.user.note.refresh_from_db()
+
+        self.second_user = User.objects.create(
+            username="toto2",
+        )
+        # Non superusers have no note until the registration get validated
+        NoteUser.objects.create(user=self.second_user)
+
+        self.club = Club.objects.create(
+            name="clubtoto",
+        )
+
+        self.transaction = Transaction.objects.create(
+            source=self.second_user.note,
+            destination=self.user.note,
+            amount=4200,
+            reason="Test transaction",
+        )
+        self.user.note.refresh_from_db()
+        self.second_user.note.refresh_from_db()
+
+        self.category = TemplateCategory.objects.create(name="Test")
+        self.template = TransactionTemplate.objects.create(
+            name="Test",
+            destination=self.club.note,
+            category=self.category,
+            amount=100,
+            description="Test template",
+        )
+
+    def test_admin_pages(self):
+        """
+        Load some admin pages to check that they render successfully.
+        """
+        response = self.client.get(reverse("admin:index") + "note/note/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/" + str(self.transaction.pk) + "/change/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/add/?ct_id="
+                                   + str(ContentType.objects.get_for_model(Transaction).id))
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/add/?ct_id="
+                                   + str(ContentType.objects.get_for_model(RecurrentTransaction).id))
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/add/?ct_id="
+                                   + str(ContentType.objects.get_for_model(MembershipTransaction).id))
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transaction/add/?ct_id="
+                                   + str(ContentType.objects.get_for_model(SpecialTransaction).id))
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/transactiontemplate/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get(reverse("admin:index") + "note/templatecategory/")
+        self.assertEqual(response.status_code, 200)
+
+    def test_render_transfer_page(self):
+        response = self.client.get(reverse("note:transfer"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_transfer_api(self):
+        old_user_balance = self.user.note.balance
+        old_second_user_balance = self.second_user.note.balance
+        quantity = 3
+        amount = 314
+        total = quantity * amount
+        response = self.client.post("/api/note/transaction/transaction/", data=dict(
+            quantity=quantity,
+            amount=amount,
+            reason="Transaction through API",
+            valid=True,
+            polymorphic_ctype=ContentType.objects.get_for_model(Transaction).id,
+            resourcetype="Transaction",
+            source=self.user.note.id,
+            source_alias=self.user.username,
+            destination=self.second_user.note.id,
+            destination_alias=self.second_user.username,
+        ))
+        self.assertEqual(response.status_code, 201)  # 201 = Created
+        self.assertTrue(Transaction.objects.filter(reason="Transaction through API").exists())
+
+        self.user.note.refresh_from_db()
+        self.second_user.note.refresh_from_db()
+
+        self.assertTrue(self.user.note.balance == old_user_balance - total)
+        self.assertTrue(self.second_user.note.balance == old_second_user_balance + total)
+
+        self.test_render_transfer_page()
+
+    def test_credit_api(self):
+        old_user_balance = self.user.note.balance
+        amount = 4242
+        special_type = NoteSpecial.objects.first()
+        response = self.client.post("/api/note/transaction/transaction/", data=dict(
+            quantity=1,
+            amount=amount,
+            reason="Credit through API",
+            valid=True,
+            polymorphic_ctype=ContentType.objects.get_for_model(SpecialTransaction).id,
+            resourcetype="SpecialTransaction",
+            source=special_type.id,
+            source_alias=str(special_type),
+            destination=self.user.note.id,
+            destination_alias=self.user.username,
+            last_name="TOTO",
+            first_name="Toto",
+        ))
+
+        self.assertEqual(response.status_code, 201)  # 201 = Created
+        self.assertTrue(Transaction.objects.filter(reason="Credit through API").exists())
+        self.user.note.refresh_from_db()
+        self.assertTrue(self.user.note.balance == old_user_balance + amount)
+
+        self.test_render_transfer_page()
+
+    def test_debit_api(self):
+        old_user_balance = self.user.note.balance
+        amount = 4242
+        special_type = NoteSpecial.objects.first()
+        response = self.client.post("/api/note/transaction/transaction/", data=dict(
+            quantity=1,
+            amount=amount,
+            reason="Debit through API",
+            valid=True,
+            polymorphic_ctype=ContentType.objects.get_for_model(SpecialTransaction).id,
+            resourcetype="SpecialTransaction",
+            source=self.user.note.id,
+            source_alias=self.user.username,
+            destination=special_type.id,
+            destination_alias=str(special_type),
+            last_name="TOTO",
+            first_name="Toto",
+        ))
+        self.assertEqual(response.status_code, 201)  # 201 = Created
+        self.assertTrue(Transaction.objects.filter(reason="Debit through API").exists())
+        self.user.note.refresh_from_db()
+        self.assertTrue(self.user.note.balance == old_user_balance - amount)
+
+        self.test_render_transfer_page()
+
+    def test_render_consos_page(self):
+        response = self.client.get(reverse("note:consos"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_consumption_api(self):
+        old_user_balance = self.user.note.balance
+        old_club_balance = self.club.note.balance
+        quantity = 2
+        template = self.template
+        total = quantity * template.amount
+        response = self.client.post("/api/note/transaction/transaction/", data=dict(
+            quantity=quantity,
+            amount=template.amount,
+            reason="Consumption through API (" + template.name + ")",
+            valid=True,
+            polymorphic_ctype=ContentType.objects.get_for_model(RecurrentTransaction).id,
+            resourcetype="RecurrentTransaction",
+            source=self.user.note.id,
+            source_alias=self.user.username,
+            destination=self.club.note.id,
+            destination_alias=self.second_user.username,
+            template=template.id,
+        ))
+        self.assertEqual(response.status_code, 201)  # 201 = Created
+        self.assertTrue(Transaction.objects.filter(destination=self.club.note).exists())
+
+        self.user.note.refresh_from_db()
+        self.club.note.refresh_from_db()
+
+        self.assertTrue(self.user.note.balance == old_user_balance - total)
+        self.assertTrue(self.club.note.balance == old_club_balance + total)
+
+        self.test_render_consos_page()
+
+    def test_invalidate_transaction(self):
+        old_second_user_balance = self.second_user.note.balance
+        old_user_balance = self.user.note.balance
+        total = self.transaction.total
+        response = self.client.patch("/api/note/transaction/transaction/" + str(self.transaction.pk) + "/", data=dict(
+            valid=False,
+            resourcetype="Transaction",
+            invalidity_reason="Test invalidate",
+        ), content_type="application/json")
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Transaction.objects.filter(valid=False, invalidity_reason="Test invalidate").exists())
+
+        self.second_user.note.refresh_from_db()
+        self.user.note.refresh_from_db()
+
+        self.assertTrue(self.second_user.note.balance == old_second_user_balance + total)
+        self.assertTrue(self.user.note.balance == old_user_balance - total)
+
+        self.test_render_transfer_page()
+        self.test_render_consos_page()
+
+        # Now we check if we can revalidate
+        old_second_user_balance = self.second_user.note.balance
+        old_user_balance = self.user.note.balance
+        total = self.transaction.total
+        response = self.client.patch("/api/note/transaction/transaction/" + str(self.transaction.pk) + "/", data=dict(
+            valid=True,
+            resourcetype="Transaction",
+        ), content_type="application/json")
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Transaction.objects.filter(valid=True, pk=self.transaction.pk).exists())
+
+        self.second_user.note.refresh_from_db()
+        self.user.note.refresh_from_db()
+
+        self.assertTrue(self.second_user.note.balance == old_second_user_balance - total)
+        self.assertTrue(self.user.note.balance == old_user_balance + total)
+
+        self.test_render_transfer_page()
+        self.test_render_consos_page()
+
+    def test_render_template_list(self):
+        response = self.client.get(reverse("note:template_list") + "?search=test")
+        self.assertEqual(response.status_code, 200)
+
+    def test_render_template_create(self):
+        response = self.client.get(reverse("note:template_create"))
+        self.assertEqual(response.status_code, 200)
+        response = self.client.post(reverse("note:template_create"), data=dict(
+            name="Test create button",
+            destination=self.club.note.pk,
+            category=self.category.pk,
+            amount=4200,
+            description="We have created a button",
+            highlighted=True,
+            display=True,
+        ))
+        self.assertRedirects(response, reverse("note:template_list"), 302, 200)
+        self.assertTrue(TransactionTemplate.objects.filter(name="Test create button").exists())
+
+    def test_render_template_update(self):
+        response = self.client.get(self.template.get_absolute_url())
+        self.assertEqual(response.status_code, 200)
+        response = self.client.post(self.template.get_absolute_url(), data=dict(
+            name="Test update button",
+            destination=self.club.note.pk,
+            category=self.category.pk,
+            amount=4200,
+            description="We have updated a button",
+            highlighted=True,
+            display=True,
+        ))
+        self.assertRedirects(response, reverse("note:template_list"), 302, 200)
+        self.assertTrue(TransactionTemplate.objects.filter(name="Test update button", pk=self.template.pk).exists())
+
+        # Check that the price history renders properly
+        response = self.client.post(self.template.get_absolute_url(), data=dict(
+            name="Test price history",
+            destination=self.club.note.pk,
+            category=self.category.pk,
+            amount=4200,
+            description="We have updated a button",
+            highlighted=True,
+            display=True,
+        ))
+        self.assertRedirects(response, reverse("note:template_list"), 302, 200)
+        self.assertTrue(TransactionTemplate.objects.filter(name="Test price history", pk=self.template.pk).exists())
+        response = self.client.get(reverse("note:template_update", args=(self.template.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+    def test_render_search_transactions(self):
+        response = self.client.get(reverse("note:transactions", args=(self.user.note.pk,)), data=dict(
+            source=self.second_user.note.alias_set.first().id,
+            destination=self.user.note.alias_set.first().id,
+            type=[ContentType.objects.get_for_model(Transaction).id],
+            reason="test",
+            valid=True,
+            amount_gte=0,
+            amount_lte=42424242,
+            created_after="2000-01-01 00:00",
+            created_before="2042-12-31 21:42",
+        ))
+        self.assertEqual(response.status_code, 200)
+
+    def test_delete_transaction(self):
+        # Transactions can't be deleted with a normal usage, but it is possible through the admin interface.
+        old_second_user_balance = self.second_user.note.balance
+        old_user_balance = self.user.note.balance
+        total = self.transaction.total
+
+        self.transaction.delete()
+        self.second_user.note.refresh_from_db()
+        self.user.note.refresh_from_db()
+
+        self.assertTrue(self.second_user.note.balance == old_second_user_balance + total)
+        self.assertTrue(self.user.note.balance == old_user_balance - total)
+
+    def test_calculate_last_negative_duration(self):
+        self.assertIsNone(self.user.note.last_negative_duration)
+        self.assertIsNotNone(self.second_user.note.last_negative_duration)
+        self.assertIsNone(self.club.note.last_negative_duration)
+
+        Transaction.objects.create(
+            source=self.club.note,
+            destination=self.user.note,
+            amount=2 * self.club.note.balance + 100,
+            reason="Club balance is negative",
+        )
+
+        self.club.note.refresh_from_db()
+        self.assertIsNotNone(self.club.note.last_negative_duration)
+
+    def test_api_search(self):
+        response = self.client.get("/api/note/note/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get("/api/note/alias/?alias=.*")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get("/api/note/consumer/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get("/api/note/transaction/transaction/")
+        self.assertEqual(response.status_code, 200)
+        response = self.client.get("/api/note/transaction/template/")
+        self.assertEqual(response.status_code, 200)
+
+    def test_api_alias(self):
+        response = self.client.post("/api/note/alias/", data=dict(
+            name="testalias",
+            note=self.user.note.id,
+        ))
+        self.assertEqual(response.status_code, 201)
+        self.assertTrue(Alias.objects.filter(name="testalias").exists())
+        alias = Alias.objects.get(name="testalias")
+        response = self.client.patch("/api/note/alias/" + str(alias.pk) + "/", dict(name="test_updated_alias"),
+                                     content_type="application/json")
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(Alias.objects.filter(name="test_updated_alias").exists())
+        response = self.client.delete("/api/note/alias/" + str(alias.pk) + "/")
+        self.assertEqual(response.status_code, 204)
--- a/apps/note/urls.py
+++ b/apps/note/urls.py
@ -12,4 +12,5 @@ urlpatterns = [
    path('buttons/update/<int:pk>/', views.TransactionTemplateUpdateView.as_view(), name='template_update'),
    path('buttons/', views.TransactionTemplateListView.as_view(), name='template_list'),
    path('consos/', views.ConsoView.as_view(), name='consos'),
+    path('transactions/<int:pk>/', views.TransactionSearchView.as_view(), name='transactions'),
 ]
--- a/apps/note/views.py
+++ b/apps/note/views.py
@ -1,21 +1,24 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
+
 import json

 from django.conf import settings
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.contenttypes.models import ContentType
-from django.db.models import Q
+from django.core.exceptions import PermissionDenied
+from django.db.models import Q, F
 from django.utils.translation import gettext_lazy as _
-from django.views.generic import CreateView, UpdateView
+from django.views.generic import CreateView, UpdateView, DetailView
 from django_tables2 import SingleTableView
 from django.urls import reverse_lazy
+from activity.models import Entry
 from note_kfet.inputs import AmountInput
 from permission.backends import PermissionBackend
 from permission.views import ProtectQuerysetMixin

-from .forms import TransactionTemplateForm
-from .models import TemplateCategory, Transaction, TransactionTemplate, RecurrentTransaction, NoteSpecial
+from .forms import TransactionTemplateForm, SearchTransactionForm
+from .models import TemplateCategory, Transaction, TransactionTemplate, RecurrentTransaction, NoteSpecial, Note
 from .models.transactions import SpecialTransaction
 from .tables import HistoryTable, ButtonTable

@ -26,19 +29,19 @@ class TransactionCreateView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTabl
    e.g. for donation/transfer between people and clubs or for credit/debit with :models:`note.NoteSpecial`
    """
    template_name = "note/transaction_form.html"
-
+    # SingleTableView creates `context["table"]` we will  load it with transaction history
    model = Transaction
    # Transaction history table
    table_class = HistoryTable
    extra_context = {"title": _("Transfer money")}

    def get_queryset(self, **kwargs):
-        return super().get_queryset(**kwargs).order_by("-created_at").all()[:20]
+        # retrieves only Transaction that user has the right to see.
+        return Transaction.objects.filter(
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view")
+        ).order_by("-created_at").all()[:20]

    def get_context_data(self, **kwargs):
-        """
-        Add some context variables in template such as page title
-        """
        context = super().get_context_data(**kwargs)
        context['amount_widget'] = AmountInput(attrs={"id": "amount"})
        context['polymorphic_ctype'] = ContentType.objects.get_for_model(Transaction).pk
@ -50,9 +53,13 @@ class TransactionCreateView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTabl
        # Add a shortcut for entry page for open activities
        if "activity" in settings.INSTALLED_APPS:
            from activity.models import Activity
-            context["activities_open"] = Activity.objects.filter(open=True).filter(
-                PermissionBackend.filter_queryset(self.request.user, Activity, "view")).filter(
-                PermissionBackend.filter_queryset(self.request.user, Activity, "change")).all()
+            activities_open = Activity.objects.filter(open=True).filter(
+                PermissionBackend.filter_queryset(self.request.user, Activity, "view")).distinct().all()
+            context["activities_open"] = [a for a in activities_open
+                                          if PermissionBackend.check_perm(self.request.user,
+                                                                          "activity.add_entry",
+                                                                          Entry(activity=a,
+                                                                                note=self.request.user.note, ))]

        return context

@ -82,7 +89,12 @@ class TransactionTemplateListView(ProtectQuerysetMixin, LoginRequiredMixin, Sing
        qs = super().get_queryset().distinct()
        if "search" in self.request.GET:
            pattern = self.request.GET["search"]
-            qs = qs.filter(Q(name__iregex="^" + pattern) | Q(destination__club__name__iregex="^" + pattern))
+            qs = qs.filter(
+                Q(name__iregex="^" + pattern)
+                | Q(destination__club__name__iregex="^" + pattern)
+                | Q(category__name__iregex="^" + pattern)
+                | Q(description__iregex=pattern)
+            )

        qs = qs.order_by('-display', 'category__name', 'destination__club__name', 'name')

@ -112,6 +124,9 @@ class TransactionTemplateUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, Up
            for log in update_logs.all():
                old_dict = json.loads(log.previous)
                new_dict = json.loads(log.data)
+                if "amount" not in old_dict:
+                    # The amount price of the button was not modified in this changelog
+                    continue
                old_price = old_dict["amount"]
                new_price = new_dict["amount"]
                if old_price != new_price:
@ -129,7 +144,7 @@ class TransactionTemplateUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, Up
 class ConsoView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
    """
    The Magic View that make people pay their beer and burgers.
-    (Most of the magic happens in the dark world of Javascript see consos.js)
+    (Most of the magic happens in the dark world of Javascript see `note_kfet/static/js/consos.js`)
    """
    model = Transaction
    template_name = "note/conso_form.html"
@ -138,26 +153,86 @@ class ConsoView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
    # Transaction history table
    table_class = HistoryTable

+    def dispatch(self, request, *args, **kwargs):
+        # Check that the user is authenticated
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        templates = TransactionTemplate.objects.filter(
+            PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
+        )
+        if not templates.exists():
+            raise PermissionDenied(_("You can't see any button."))
+        return super().dispatch(request, *args, **kwargs)
+
    def get_queryset(self, **kwargs):
-        return super().get_queryset(**kwargs).order_by("-created_at")[:20]
+        """
+        restrict to the transaction history the user can see.
+        """
+        return Transaction.objects.filter(
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view")
+        ).order_by("-created_at").all()[:20]

    def get_context_data(self, **kwargs):
-        """
-        Add some context variables in template such as page title
-        """
        context = super().get_context_data(**kwargs)
+
        categories = TemplateCategory.objects.order_by('name').all()
+        # for each category, find which transaction templates the user can see.
        for category in categories:
            category.templates_filtered = category.templates.filter(
                PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
            ).filter(display=True).order_by('name').all()
+
        context['categories'] = [cat for cat in categories if cat.templates_filtered]
+        # some transactiontemplate are put forward to find them easily
        context['highlighted'] = TransactionTemplate.objects.filter(highlighted=True).filter(
            PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
        ).order_by('name').all()
        context['polymorphic_ctype'] = ContentType.objects.get_for_model(RecurrentTransaction).pk

-        # select2 compatibility
-        context['no_cache'] = True
+        return context
+
+
+class TransactionSearchView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
+    model = Note
+    context_object_name = "note"
+    template_name = "note/search_transactions.html"
+    extra_context = {"title": _("Search transactions")}
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        form = SearchTransactionForm(data=self.request.GET if self.request.GET else None)
+        context["form"] = form
+
+        form.full_clean()
+        data = form.cleaned_data if form.is_valid() else {}
+
+        transactions = Transaction.objects.annotate(total_amount=F("quantity") * F("amount")).filter(
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view"))\
+            .filter(Q(source=self.object) | Q(destination=self.object)).order_by('-created_at')
+
+        if "source" in data and data["source"]:
+            transactions = transactions.filter(source_id=data["source"].note_id)
+        if "destination" in data and data["destination"]:
+            transactions = transactions.filter(destination_id=data["destination"].note_id)
+        if "type" in data and data["type"]:
+            transactions = transactions.filter(polymorphic_ctype__in=data["type"])
+        if "reason" in data and data["reason"]:
+            transactions = transactions.filter(reason__iregex=data["reason"])
+        if "valid" in data and data["valid"]:
+            transactions = transactions.filter(valid=data["valid"])
+        if "amount_gte" in data and data["amount_gte"]:
+            transactions = transactions.filter(total_amount__gte=data["amount_gte"])
+        if "amount_lte" in data and data["amount_lte"]:
+            transactions = transactions.filter(total_amount__lte=data["amount_lte"])
+        if "created_after" in data and data["created_after"]:
+            transactions = transactions.filter(created_at__gte=data["created_after"])
+        if "created_before" in data and data["created_before"]:
+            transactions = transactions.filter(created_at__lte=data["created_before"])
+
+        table = HistoryTable(transactions)
+        table.paginate(per_page=100, page=self.request.GET.get("page", 1))
+        context["table"] = table

        return context
--- a/apps/permission/backends.py
+++ b/apps/permission/backends.py
@ -1,6 +1,8 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

+from datetime import date
+
 from django.contrib.auth.backends import ModelBackend
 from django.contrib.auth.models import User, AnonymousUser
 from django.contrib.contenttypes.models import ContentType
@ -43,7 +45,7 @@ class PermissionBackend(ModelBackend):
            for role in membership.roles.all():
                for perm in role.permissions.filter(type=t, mask__rank__lte=get_current_session().get("permission_mask", -1)).all():
                    if not perm.permanent:
-                        if membership.date_start > timezone.now().date() or membership.date_end < timezone.now().date():
+                        if membership.date_start > date.today() or membership.date_end < date.today():
                            continue
                    perm.membership = membership
                    perms.append(perm)
@ -80,7 +82,7 @@ class PermissionBackend(ModelBackend):
                F=F,
                Q=Q,
                now=timezone.now(),
-                today=timezone.now().date(),
+                today=date.today(),
            )
            yield permission

--- a/apps/permission/fixtures/initial.json
+++ b/apps/permission/fixtures/initial.json
@ -61,14 +61,14 @@
 		"fields": {
 			"model": [
 				"note",
-				"noteuser"
+				"note"
 			],
 			"query": "{\"pk\": [\"user\", \"note\", \"pk\"]}",
 			"type": "view",
 			"mask": 1,
 			"field": "",
 			"permanent": true,
-			"description": "Vioir sa propre note d'utilisateur"
+			"description": "Voir sa propre note d'utilisateur"
 		}
 	},
 	{
@ -287,7 +287,7 @@
 				"note",
 				"transaction"
 			],
-			"query": "[\"AND\", {\"source\": [\"user\", \"note\"]}, [\"OR\", {\"amount__lte\": [\"user\", \"note\", \"balance\"]}, {\"valid\": false}]]",
+			"query": "[\"AND\", {\"source\": [\"user\", \"note\"]}, [\"OR\", {\"source__balance__gte\": {\"F\": [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]]}}, {\"valid\": false}]]",
 			"type": "add",
 			"mask": 1,
 			"field": "",
@ -319,7 +319,7 @@
 				"note",
 				"transaction"
 			],
-			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"amount__lte\": {\"F\": [\"ADD\", [\"F\", \"source__balance\"], 5000]}}, {\"valid\": false}]]",
+			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"source__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}}, {\"valid\": false}]]",
 			"type": "add",
 			"mask": 2,
 			"field": "",
@ -335,7 +335,7 @@
 				"note",
 				"recurrenttransaction"
 			],
-			"query": "[\"AND\", {\"destination\": [\"club\", \"note\"]}, [\"OR\", {\"amount__lte\": {\"F\": [\"ADD\", [\"F\", \"source__balance\"], 5000]}}, {\"valid\": false}]]",
+			"query": "[\"AND\", {\"destination\": [\"club\", \"note\"]}, [\"OR\", {\"source__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}}, {\"valid\": false}]]",
 			"type": "add",
 			"mask": 2,
 			"field": "",
@ -353,7 +353,7 @@
 			],
 			"query": "{\"pk\": [\"club\", \"pk\"]}",
 			"type": "view",
-			"mask": 3,
+			"mask": 1,
 			"field": "",
 			"permanent": false,
 			"description": "Voir les informations d'un club"
@ -551,22 +551,6 @@
 			"description": "Voir toutes les activités valides"
 		}
 	},
-	{
-		"model": "permission.permission",
-		"pk": 35,
-		"fields": {
-			"model": [
-				"activity",
-				"activity"
-			],
-			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
-			"type": "change",
-			"mask": 1,
-			"field": "",
-			"permanent": false,
-			"description": "Modifier les activités non validées dont on est l'auteur"
-		}
-	},
 	{
 		"model": "permission.permission",
 		"pk": 36,
@ -868,7 +852,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Modifier n'import quel utilisateur"
+			"description": "Modifier n'importe quel utilisateur"
 		}
 	},
 	{
@ -1572,7 +1556,7 @@
 			"mask": 1,
 			"field": "emergency_contact_phone",
 			"permanent": false,
-			"description": "Modifier le nom du contact en cas d'urgence de mon inscription WEI"
+			"description": "Modifier le téléphone du contact en cas d'urgence de mon inscription WEI"
 		}
 	},
 	{
@ -1983,7 +1967,7 @@
 				"note",
 				"transaction"
 			],
-			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"amount__lte\": {\"F\": [\"ADD\", [\"F\", \"source__balance\"], 5000]}}, {\"valid\": true}]]",
+			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"source__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}, \"valid\": true}, {\"destination__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}, \"valid\": false}]]",
 			"type": "change",
 			"mask": 2,
 			"field": "valid",
@ -2079,9 +2063,9 @@
 				"note",
 				"transaction"
 			],
-			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"amount__lte\": {\"F\": [\"ADD\", [\"F\", \"source__balance\"], 5000]}}, {\"valid\": true}]]",
+			"query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"source__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}, \"valid\": true}, {\"destination__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}, \"valid\": false}]]",
 			"type": "change",
-			"mask": 1,
+			"mask": 2,
 			"field": "invalidity_reason",
 			"permanent": false,
 			"description": "Modifier la raison d'invalidité d'une transaction de club"
@ -2207,7 +2191,7 @@
 				"auth",
 				"user"
 			],
-			"query": "{\"memberships__club\": [\"club\"], \"memberships__date__start__lte\": [\"today\"], \"memberships__date__end__gte\": [\"today\"]}",
+			"query": "{\"memberships__club\": [\"club\"], \"memberships__date_start__lte\": [\"today\"], \"memberships__date_end__gte\": [\"today\"]}",
 			"type": "view",
 			"mask": 3,
 			"field": "",
@ -2221,9 +2205,9 @@
 		"fields": {
 			"model": [
 				"note",
-				"noteclub"
+				"note"
 			],
-			"query": "{\"club\": [\"club\"]}",
+			"query": "{\"noteclub__club\": [\"club\"]}",
 			"type": "view",
 			"mask": 2,
 			"field": "",
@ -2247,6 +2231,342 @@
 			"description": "Créer une note d'utilisateur"
 		}
 	},
+	{
+		"model": "permission.permission",
+		"pk": 144,
+		"fields": {
+			"model": [
+				"wei",
+				"weiregistration"
+			],
+			"query": "[\"AND\", {\"user\": [\"user\"], \"wei__membership_start__lte\": [\"today\"], \"wei__membership_end__gte\": [\"today\"], \"first_year\": false, \"membership\": null}]",
+			"type": "change",
+			"mask": 1,
+			"field": "information_json",
+			"permanent": false,
+			"description": "Modifier mes préférences en terme de bus et d'équipe si mon inscription n'est pas validée et que je suis en 2A+"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 145,
+		"fields": {
+			"model": [
+				"note",
+				"noteclub"
+			],
+			"query": "{}",
+			"type": "view",
+			"mask": 1,
+			"field": "",
+			"permanent": false,
+			"description": "Voir toutes les notes de club"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 146,
+		"fields": {
+			"model": [
+				"member",
+				"membership"
+			],
+			"query": "{}",
+			"type": "view",
+			"mask": 3,
+			"field": "",
+			"permanent": false,
+			"description": "Voir tous les adhérents du club"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 147,
+		"fields": {
+			"model": [
+				"member",
+				"membership"
+			],
+			"query": "{}",
+			"type": "add",
+			"mask": 3,
+			"field": "",
+			"permanent": false,
+			"description": "Ajouter un membre à n'importe quel club"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 148,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "{\"valid\": false}",
+			"type": "change",
+			"mask": 2,
+			"field": "",
+			"permanent": false,
+			"description": "Modifier une activité non validée"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 149,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "{\"valid\": false}",
+			"type": "delete",
+			"mask": 2,
+			"field": "",
+			"permanent": false,
+			"description": "Supprimer une activité non validée"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 150,
+		"fields": {
+			"model": [
+				"note",
+				"note"
+			],
+			"query": "{}",
+			"type": "view",
+			"mask": 2,
+			"field": "",
+			"permanent": false,
+			"description": "Voir toutes les notes"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 151,
+		"fields": {
+			"model": [
+				"treasury",
+				"invoice"
+			],
+			"query": "{}",
+			"type": "delete",
+			"mask": 3,
+			"field": "",
+			"permanent": false,
+			"description": "Supprimer une facture"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 152,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "name",
+			"permanent": false,
+			"description": "Modifier le nom d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 153,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "description",
+			"permanent": false,
+			"description": "Modifier la description d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 154,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "location",
+			"permanent": false,
+			"description": "Modifier le lieu d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 155,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "activity_type",
+			"permanent": false,
+			"description": "Modifier le type d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 156,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "organizer",
+			"permanent": false,
+			"description": "Modifier l'organisateur d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 157,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "attendees_club",
+			"permanent": false,
+			"description": "Modifier le club attendu d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 158,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "date_start",
+			"permanent": false,
+			"description": "Modifier la date de début d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 159,
+		"fields": {
+			"model": [
+				"activity",
+				"activity"
+			],
+			"query": "[\"AND\", {\"valid\": false}, {\"creater\": [\"user\"]}]",
+			"type": "change",
+			"mask": 1,
+			"field": "date_end",
+			"permanent": false,
+			"description": "Modifier la date de fin d'une activité non validée dont on est l'auteur"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 160,
+		"fields": {
+			"model": [
+				"activity",
+				"guest"
+			],
+			"query": "{\"inviter\": [\"user\", \"note\"], \"entry\": null}",
+			"type": "delete",
+			"mask": 1,
+			"field": "",
+			"permanent": false,
+			"description": "Supprimer ses propres invitations non validées à une activité"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 161,
+		"fields": {
+			"model": [
+				"note",
+				"noteuser"
+			],
+			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"inactivity_reason\": null}]]",
+			"type": "change",
+			"mask": 1,
+			"field": "is_active",
+			"permanent": true,
+			"description": "(Dé)bloquer sa propre note manuellement"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 162,
+		"fields": {
+			"model": [
+				"note",
+				"noteuser"
+			],
+			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"inactivity_reason\": null}]]",
+			"type": "change",
+			"mask": 1,
+			"field": "inactivity_reason",
+			"permanent": true,
+			"description": "(Dé)bloquer sa propre note et indiquer que cela a été fait manuellement"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 163,
+		"fields": {
+			"model": [
+				"note",
+				"note"
+			],
+			"query": "{}",
+			"type": "change",
+			"mask": 3,
+			"field": "is_active",
+			"permanent": false,
+			"description": "(Dé)bloquer n'importe quelle note, y compris en mode forcé"
+		}
+	},
+	{
+		"model": "permission.permission",
+		"pk": 164,
+		"fields": {
+			"model": [
+				"note",
+				"note"
+			],
+			"query": "{}",
+			"type": "change",
+			"mask": 3,
+			"field": "inactivity_reason",
+			"permanent": false,
+			"description": "(Dé)bloquer sa propre note et modifier la raison"
+		}
+	},
 	{
 		"model": "permission.role",
 		"pk": 1,
@ -2266,9 +2586,12 @@
 				11,
 				12,
 				13,
+				22,
 				48,
 				52,
-				126
+				126,
+				161,
+				162
 			]
 		}
 	},
@ -2279,20 +2602,21 @@
 			"for_club": 2,
 			"name": "Adh\u00e9rent Kfet",
 			"permissions": [
-				34,
-				35,
-				36,
 				6,
-				39,
-				40,
-				70,
 				14,
 				15,
 				16,
 				17,
+				22,
+				34,
+				36,
+				39,
+				40,
+				70,
 				78,
 				79,
 				83,
+				87,
 				90,
 				93,
 				95,
@ -2300,7 +2624,19 @@
 				99,
 				101,
 				108,
-				109
+				109,
+				129,
+				131,
+				144,
+				152,
+				153,
+				154,
+				155,
+				156,
+				157,
+				158,
+				159,
+				160
 			]
 		}
 	},
@ -2310,7 +2646,9 @@
 		"fields": {
 			"for_club": null,
 			"name": "Membre de club",
-			"permissions": []
+			"permissions": [
+				22
+			]
 		}
 	},
 	{
@ -2320,11 +2658,10 @@
 			"for_club": null,
 			"name": "Bureau de club",
 			"permissions": [
-				22,
 				47,
 				49,
 				50,
-				140
+				141
 			]
 		}
 	},
@ -2420,7 +2757,13 @@
 				137,
 				138,
 				139,
-				143
+				143,
+				146,
+				147,
+				150,
+				151,
+				163,
+				164
 			]
 		}
 	},
@ -2464,7 +2807,6 @@
 				32,
 				33,
 				34,
-				35,
 				36,
 				37,
 				38,
@ -2569,7 +2911,28 @@
 				140,
 				141,
 				142,
-				143
+				143,
+				144,
+				145,
+				146,
+				147,
+				148,
+				149,
+				150,
+				151,
+				152,
+				153,
+				154,
+				155,
+				156,
+				157,
+				158,
+				159,
+				160,
+				161,
+				162,
+				163,
+				164
 			]
 		}
 	},
@ -2587,8 +2950,6 @@
 				55,
 				57,
 				52,
-				53,
-				54,
 				23,
 				24,
 				25,
@ -2616,7 +2977,9 @@
 				43,
 				44,
 				45,
-				46
+				46,
+				148,
+				149
 			]
 		}
 	},
@ -2627,6 +2990,7 @@
 			"for_club": null,
 			"name": "GC WEI",
 			"permissions": [
+				22,
 				76,
 				85,
 				86,
@ -2660,6 +3024,7 @@
 			"for_club": null,
 			"name": "Chef de bus",
 			"permissions": [
+				22,
 				84,
 				117,
 				118,
@ -2677,6 +3042,7 @@
 			"for_club": null,
 			"name": "Chef d'\u00e9quipe",
 			"permissions": [
+				22,
 				84,
 				116,
 				123,
@ -2692,6 +3058,7 @@
 			"for_club": null,
 			"name": "\u00c9lectron libre",
 			"permissions": [
+				22,
 				84
 			]
 		}
@ -2703,6 +3070,7 @@
 			"for_club": null,
 			"name": "\u00c9lectron libre (avec perm)",
 			"permissions": [
+				22,
 				84
 			]
 		}
@ -2739,6 +3107,31 @@
 			]
 		}
 	},
+	{
+		"model": "permission.role",
+		"pk": 19,
+		"fields": {
+			"for_club": 1,
+			"name": "Secrétaire BDE",
+			"permissions": [
+				54,
+				55,
+				56,
+				57,
+				58,
+				135,
+				136,
+				137,
+				138,
+				139,
+				140,
+				145,
+				146,
+				147,
+				150
+			]
+		}
+	},
 	{
 		"model": "wei.weirole",
 		"pk": 12,
--- a/apps/permission/models.py
+++ b/apps/permission/models.py
@ -4,12 +4,14 @@
 import functools
 import json
 import operator
-from time import sleep
+from copy import copy

 from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import ValidationError
-from django.db import models
+from django.core.mail import mail_admins
+from django.db import models, transaction
 from django.db.models import F, Q, Model
+from django.forms import model_to_dict
 from django.utils.translation import gettext_lazy as _


@ -38,36 +40,31 @@ class InstancedPermission:
            if permission_type == self.type:
                self.update_query()

-                # Don't increase indexes, if the primary key is an AutoField
-                if not hasattr(obj, "pk") or not obj.pk:
+                obj = copy(obj)
                obj.pk = 0
-                    oldpk = None
-                else:
-                    oldpk = obj.pk
-                # Ensure previous models are deleted
-                count = 0
-                while count < 1000:
-                    if self.model.model_class().objects.filter(pk=obj.pk).exists():
-                        # If the object exists, that means that one permission is currently checked.
-                        # We wait before the other permission, at most 1 second.
-                        sleep(1)
-                        continue
-                    break
-                for o in self.model.model_class().objects.filter(pk=obj.pk).all():
+                with transaction.atomic():
+                    for o in self.model.model_class().objects.filter(pk=0).all():
                        o._force_delete = True
                        Model.delete(o)
+                        # An object with pk 0 wouldn't deleted. That's not normal, we alert admins.
+                        msg = "Lors de la vérification d'une permission d'ajout, un objet de clé primaire nulle était "\
+                              "encore présent.\n"\
+                              "Type de permission : " + self.type + "\n"\
+                              "Modèle : " + str(self.model) + "\n"\
+                              "Objet trouvé : " + str(model_to_dict(o)) + "\n\n"\
+                              "--\nLe BDE"
+                        mail_admins("[Note Kfet] Un objet a été supprimé de force", msg)
+
                    # Force insertion, no data verification, no trigger
                    obj._force_save = True
-                Model.save(obj, force_insert=True)
                    # We don't want log anything
                    obj._no_log = True
-                ret = self.model.model_class().objects.filter(self.query & Q(pk=obj.pk)).exists()
+                    Model.save(obj, force_insert=True)
+                    ret = self.model.model_class().objects.filter(self.query & Q(pk=0)).exists()
                    # Delete testing object
                    obj._force_delete = True
                    Model.delete(obj)

-                # If the primary key was specified, we restore it
-                obj.pk = oldpk
                return ret

        if permission_type == self.type:
--- a/apps/permission/signals.py
+++ b/apps/permission/signals.py
@ -70,7 +70,7 @@ def pre_save_object(sender, instance, **kwargs):

        if not has_perm:
            raise PermissionDenied(
-                _("You don't have the permission to add this instance of model {app_label}.{model_name}.")
+                _("You don't have the permission to add an instance of model {app_label}.{model_name}.")
                .format(app_label=app_label, model_name=model_name, ))


--- a/apps/permission/tables.py
+++ b/apps/permission/tables.py
@ -0,0 +1,72 @@
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import django_tables2 as tables
+from django.contrib.auth.models import User
+from django.db.models import Q
+from django.urls import reverse_lazy
+from django.utils.html import format_html
+from django_tables2 import A
+from member.models import Membership
+from note_kfet.middlewares import get_current_authenticated_user
+from permission.backends import PermissionBackend
+
+
+class RightsTable(tables.Table):
+    """
+    List managers of a club.
+    """
+
+    def render_user(self, value):
+        # If the user has the right, link the displayed user with the page of its detail.
+        s = value.username
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "auth.view_user", value):
+            s = format_html("<a href={url}>{name}</a>",
+                            url=reverse_lazy('member:user_detail', kwargs={"pk": value.pk}), name=s)
+        return s
+
+    def render_club(self, value):
+        # If the user has the right, link the displayed user with the page of its detail.
+        s = value.name
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "member.view_club", value):
+            s = format_html("<a href={url}>{name}</a>",
+                            url=reverse_lazy('member:club_detail', kwargs={"pk": value.pk}), name=s)
+
+        return s
+
+    def render_roles(self, record):
+        # If the user has the right to manage the roles, display the link to manage them
+        roles = record.roles.filter((~(Q(name="Adhérent BDE")
+                                     | Q(name="Adhérent Kfet")
+                                     | Q(name="Membre de club")
+                                     | Q(name="Bureau de club"))
+                                     & Q(weirole__isnull=True))).all()
+        s = ", ".join(str(role) for role in roles)
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "member.change_membership_roles", record):
+            s = format_html("<a href='" + str(reverse_lazy("member:club_manage_roles", kwargs={"pk": record.pk}))
+                            + "'>" + s + "</a>")
+        return s
+
+    class Meta:
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover',
+            'style': 'table-layout: fixed;'
+        }
+        template_name = 'django_tables2/bootstrap4.html'
+        fields = ('user__last_name', 'user__first_name', 'user', 'club', 'roles', )
+        model = Membership
+
+
+class SuperuserTable(tables.Table):
+    username = tables.LinkColumn(
+        "member:user_detail",
+        args=[A("pk")],
+    )
+
+    class Meta:
+        model = User
+        fields = ('last_name', 'first_name', 'username', )
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover',
+            'style': 'table-layout: fixed;'
+        }
--- a/apps/permission/templates/permission/all_rights.html
+++ b/apps/permission/templates/permission/all_rights.html
@ -0,0 +1,119 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n %}
+{% load render_table from django_tables2 %}
+
+{% block content %}
+    {% if user.is_authenticated %}
+        <div class="card bg-light mb-3">
+            <h3 class="card-header text-center">
+                {% trans "Users that have surnormal rights" %}
+            </h3>
+            <div class="card-body">
+                <div class="alert alert-info">
+                    <i class="fa fa-info-circle"></i> {% trans "Superusers have all rights on everything, to manage the website." %}
+                </div>
+                <div class="card">
+                    <div class="card-head">
+                        <h4 class="card-header text-center">
+                            <a href="#" data-toggle="collapse" data-target="#card-superusers">{% trans "Superusers" %}</a>
+                        </h4>
+                    </div>
+                    <div class="card-body collapse show" id="card-superusers">
+                        {% render_table superusers %}
+                    </div>
+                </div>
+                <hr>
+                <div class="card">
+                    <div class="card-head">
+                        <h4 class="card-header text-center">
+                            <a href="#" data-toggle="collapse" data-target="#card-clubs">{% trans "Club managers" %}</a>
+                        </h4>
+                    </div>
+                    <div class="card-body collapse show" id="card-clubs">
+                        {% render_table special_memberships_table %}
+                    </div>
+                </div>
+            </div>
+        </div>
+    {% endif %}
+
+    <div class="card bg-light">
+        <h3 class="card-header text-center">
+            {% trans "Roles description" %}
+        </h3>
+        <div class="card-body">
+            {% if user.is_authenticated %}
+                <div class="form-check">
+                    <label for="owned_only" class="form-check-label">
+                        <input id="owned_only" name="owned_only" type="checkbox" class="checkboxinput form-check-input">
+                        {% trans "Filter with roles that I have in at least one club" %}
+                    </label>
+                </div>
+            {% endif %}
+        </div>
+        <div class="accordion" id="accordionRoles">
+            {% regroup active_memberships by roles as memberships_per_role %}
+            {% for role in roles %}
+                <div class="card {% if not role.clubs %}no-club{% endif %}">
+                    <div class="card-header py-1" id="{{ role|slugify }} ">
+                        <a href="#" class="text-decoration-none" data-toggle="collapse"
+                           data-target="#collapse{{ role|slugify }}"
+                           aria-expanded="true" aria-controls="collapse{{ role|slugify }}">
+                            {{ role }}
+                            {% if role.weirole %}(<em>Pour le WEI</em>){% endif %}
+                            {% if role.for_club %}(<em>Pour le club {{ role.for_club }} uniquement</em>){% endif %}
+                            {% if role.clubs %}
+                                <small><span class="badge badge-success">{% trans "Owned" %} :
+                                    {{ role.clubs|join:", " }}</span></small>
+                            {% endif %}
+                        </a>
+                    </div>
+
+                    <div id="collapse{{ role|slugify }}" class="collapse" aria-labelledby="{{ role|slugify }}"
+                         data-parent="#accordionRoles">
+                        <div class="card-body">
+                            {% if role.clubs %}
+                                <div class="alert alert-success">
+                                    {% trans "Own this role in the clubs" %} {{ role.clubs|join:", " }}
+                                </div>
+                            {% endif %}
+                            <ul>
+                                {% for permission in role.permissions.all %}
+                                    <li data-toggle="tooltip"
+                                        title="{% trans "Mask:" %} {{ permission.mask }}, {% trans "Query:" %} {{ permission.query }}">
+                                        <b>{{ permission }}</b> ({{ permission.get_type_display }}
+                                        {{ permission.model }}{% if permission.permanent %},
+                                            {% trans "permanent" %}{% endif %})
+                                    </li>
+                                    {% empty %}
+                                    <em>{% trans "No associated permission" %}</em>
+                                {% endfor %}
+                            </ul>
+                        </div>
+                    </div>
+                </div>
+            {% endfor %}
+        </div>
+    </div>
+{% endblock %}
+
+{% block extrajavascript %}
+    <script>
+        $(document).ready(function () {
+            let checkbox = $("#owned_only");
+
+            function update() {
+                if (checkbox.is(":checked"))
+                    $(".no-club").addClass('d-none');
+                else
+                    $(".no-club").removeClass('d-none');
+            }
+
+            checkbox.change(update);
+            update();
+        });
+    </script>
+{% endblock %}
--- a/apps/permission/tests/init.py
+++ b/apps/permission/tests/init.py
--- a/apps/permission/tests/test_permission_denied.py
+++ b/apps/permission/tests/test_permission_denied.py
@ -0,0 +1,157 @@
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from datetime import timedelta, date
+
+from django.contrib.auth.models import User
+from django.test import TestCase
+from django.urls import reverse
+from django.utils import timezone
+from django.utils.crypto import get_random_string
+from activity.models import Activity
+from member.models import Club, Membership
+from note.models import NoteUser
+from wei.models import WEIClub, Bus, WEIRegistration
+
+
+class TestPermissionDenied(TestCase):
+    """
+    Load some protected pages and check that we have 403 errors.
+    """
+    fixtures = ('initial',)
+
+    def setUp(self) -> None:
+        # Create sample user with no rights
+        self.user = User.objects.create(
+            username="toto",
+        )
+        NoteUser.objects.create(user=self.user)
+        self.client.force_login(self.user)
+
+    def test_consos(self):
+        response = self.client.get(reverse("note:consos"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_activity(self):
+        response = self.client.get(reverse("activity:activity_create"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_activity_entries(self):
+        activity = Activity.objects.create(
+            name="",
+            description="",
+            creater=self.user,
+            activity_type_id=1,
+            organizer_id=1,
+            attendees_club_id=1,
+            date_start=timezone.now(),
+            date_end=timezone.now(),
+        )
+        response = self.client.get(reverse("activity:activity_entry", kwargs=dict(pk=activity.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_invite_activity(self):
+        activity = Activity.objects.create(
+            name="",
+            description="",
+            creater=self.user,
+            activity_type_id=1,
+            organizer_id=1,
+            attendees_club_id=1,
+            date_start=timezone.now(),
+            date_end=timezone.now(),
+        )
+        response = self.client.get(reverse("activity:activity_invite", kwargs=dict(pk=activity.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_club(self):
+        response = self.client.get(reverse("member:club_create"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_add_member_club(self):
+        club = Club.objects.create(name=get_random_string(127))
+        response = self.client.get(reverse("member:club_add_member", kwargs=dict(club_pk=club.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_renew_membership(self):
+        club = Club.objects.create(name=get_random_string(127))
+        membership = Membership.objects.create(user=self.user, club=club)
+        response = self.client.get(reverse("member:club_renew_membership", kwargs=dict(pk=membership.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_weiclub(self):
+        response = self.client.get(reverse("wei:wei_create"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_wei_bus(self):
+        wei = WEIClub.objects.create(
+            membership_start=date.today(),
+            date_start=date.today() + timedelta(days=1),
+            date_end=date.today() + timedelta(days=1),
+        )
+        response = self.client.get(reverse("wei:add_bus", kwargs=dict(pk=wei.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_wei_team(self):
+        wei = WEIClub.objects.create(
+            membership_start=date.today(),
+            date_start=date.today() + timedelta(days=1),
+            date_end=date.today() + timedelta(days=1),
+        )
+        bus = Bus.objects.create(wei=wei)
+        response = self.client.get(reverse("wei:add_team", kwargs=dict(pk=bus.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_1a_weiregistration(self):
+        wei = WEIClub.objects.create(
+            membership_start=date.today(),
+            date_start=date.today() + timedelta(days=1),
+            date_end=date.today() + timedelta(days=1),
+        )
+        response = self.client.get(reverse("wei:wei_register_1A", kwargs=dict(wei_pk=wei.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_old_weiregistration(self):
+        wei = WEIClub.objects.create(
+            membership_start=date.today(),
+            date_start=date.today() + timedelta(days=1),
+            date_end=date.today() + timedelta(days=1),
+        )
+        response = self.client.get(reverse("wei:wei_register_2A", kwargs=dict(wei_pk=wei.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_validate_weiregistration(self):
+        wei = WEIClub.objects.create(
+            membership_start=date.today(),
+            date_start=date.today() + timedelta(days=1),
+            date_end=date.today() + timedelta(days=1),
+        )
+        registration = WEIRegistration.objects.create(wei=wei, user=self.user, birth_date="2000-01-01")
+        response = self.client.get(reverse("wei:validate_registration", kwargs=dict(pk=registration.pk)))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_invoice(self):
+        response = self.client.get(reverse("treasury:invoice_create"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_list_invoices(self):
+        response = self.client.get(reverse("treasury:invoice_list"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_create_remittance(self):
+        response = self.client.get(reverse("treasury:remittance_create"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_list_remittance(self):
+        response = self.client.get(reverse("treasury:remittance_list"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_list_soge_credits(self):
+        response = self.client.get(reverse("treasury:soge_credits"))
+        self.assertEqual(response.status_code, 403)
+
+
+class TestLoginRedirect(TestCase):
+    def test_consos_page(self):
+        response = self.client.get(reverse("note:consos"))
+        self.assertRedirects(response, reverse("login") + "?next=" + reverse("note:consos"), 302, 200)
--- a/apps/permission/tests/test_permission_queries.py
+++ b/apps/permission/tests/test_permission_queries.py
@ -1,6 +1,8 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later

+from datetime import date
+
 from django.contrib.auth.models import User
 from django.core.exceptions import FieldError
 from django.db.models import F, Q
@ -10,7 +12,7 @@ from member.models import Club, Membership
 from note.models import NoteUser, Note, NoteClub, NoteSpecial
 from wei.models import WEIMembership, WEIRegistration, WEIClub, Bus, BusTeam

-from .models import Permission
+from ..models import Permission


 class PermissionQueryTestCase(TestCase):
@ -22,14 +24,14 @@ class PermissionQueryTestCase(TestCase):
        NoteUser.objects.create(user=user)
        wei = WEIClub.objects.create(
            name="wei",
-            date_start=timezone.now().date(),
-            date_end=timezone.now().date(),
+            date_start=date.today(),
+            date_end=date.today(),
        )
        NoteClub.objects.create(club=wei)
        weiregistration = WEIRegistration.objects.create(
            user=user,
            wei=wei,
-            birth_date=timezone.now().date(),
+            birth_date=date.today(),
        )
        bus = Bus.objects.create(
            name="bus",
@ -68,7 +70,7 @@ class PermissionQueryTestCase(TestCase):
                F=F,
                Q=Q,
                now=timezone.now(),
-                today=timezone.now().date(),
+                today=date.today(),
            )
            try:
                instanced.update_query()
@ -82,5 +84,3 @@ class PermissionQueryTestCase(TestCase):
                if instanced.query:
                    print("Compiled query:", instanced.query)
                raise
-
-        print("All permission queries are well formed")
--- a/apps/permission/views.py
+++ b/apps/permission/views.py
@ -1,14 +1,20 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
+
 from datetime import date

+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.models import User
+from django.core.exceptions import PermissionDenied
+from django.db.models import Q
 from django.forms import HiddenInput
 from django.utils.translation import gettext_lazy as _
-from django.views.generic import UpdateView, TemplateView
+from django.views.generic import UpdateView, TemplateView, CreateView
 from member.models import Membership

 from .backends import PermissionBackend
 from .models import Role
+from .tables import RightsTable, SuperuserTable


 class ProtectQuerysetMixin:
@ -20,7 +26,7 @@ class ProtectQuerysetMixin:
    """
    def get_queryset(self, **kwargs):
        qs = super().get_queryset(**kwargs)
-        return qs.filter(PermissionBackend.filter_queryset(self.request.user, qs.model, "view"))
+        return qs.filter(PermissionBackend.filter_queryset(self.request.user, qs.model, "view")).distinct()

    def get_form(self, form_class=None):
        form = super().get_form(form_class)
@ -38,6 +44,52 @@ class ProtectQuerysetMixin:

        return form

+    def form_valid(self, form):
+        """
+        Submit the form, if the page is a FormView.
+        If a PermissionDenied exception is raised, catch the error and display it at the top of the form.
+        """
+        try:
+            return super().form_valid(form)
+        except PermissionDenied:
+            if isinstance(self, UpdateView):
+                form.add_error(None, _("You don't have the permission to update this instance of the model \"{model}\""
+                                       " with these parameters. Please correct your data and retry.")
+                               .format(model=self.model._meta.verbose_name))
+            else:
+                form.add_error(None, _("You don't have the permission to create an instance of the model \"{model}\""
+                                       " with these parameters. Please correct your data and retry.")
+                               .format(model=self.model._meta.verbose_name))
+            return self.form_invalid(form)
+
+
+class ProtectedCreateView(LoginRequiredMixin, CreateView):
+    """
+    Extends a CreateView to check is the user has the right to create a sample instance of the given Model.
+    If not, a 403 error is displayed.
+    """
+
+    def get_sample_object(self):
+        """
+        return a sample instance of the Model.
+        It should be valid (can be stored properly in database), but must not collide with existing data.
+        """
+        raise NotImplementedError
+
+    def dispatch(self, request, *args, **kwargs):
+        # Check that the user is authenticated before that he/she has the permission to access here
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        model_class = self.model
+        # noinspection PyProtectedMember
+        app_label, model_name = model_class._meta.app_label, model_class._meta.model_name.lower()
+        perm = app_label + ".add_" + model_name
+        if not PermissionBackend.check_perm(request.user, perm, self.get_sample_object()):
+            raise PermissionDenied(_("You don't have the permission to add an instance of model "
+                                     "{app_label}.{model_name}.").format(app_label=app_label, model_name=model_name))
+        return super().dispatch(request, *args, **kwargs)
+

 class RightsView(TemplateView):
    template_name = "permission/all_rights.html"
@ -59,4 +111,19 @@ class RightsView(TemplateView):
        for role in roles:
            role.clubs = [membership.club for membership in active_memberships if role in membership.roles.all()]

+        if self.request.user.is_authenticated:
+            special_memberships = Membership.objects.filter(
+                date_start__lte=date.today(),
+                date_end__gte=date.today(),
+            ).filter(roles__in=Role.objects.filter((~(Q(name="Adhérent BDE")
+                                                      | Q(name="Adhérent Kfet")
+                                                      | Q(name="Membre de club")
+                                                      | Q(name="Bureau de club"))
+                                                    & Q(weirole__isnull=True))))\
+                .order_by("club__name", "user__last_name")\
+                .distinct().all()
+            context["special_memberships_table"] = RightsTable(special_memberships, prefix="clubs-")
+            context["superusers"] = SuperuserTable(User.objects.filter(is_superuser=True).order_by("last_name").all(),
+                                                   prefix="superusers-")
+
        return context
--- a/apps/registration/forms.py
+++ b/apps/registration/forms.py
@ -5,7 +5,7 @@ from django import forms
 from django.contrib.auth.forms import UserCreationForm
 from django.contrib.auth.models import User
 from django.utils.translation import gettext_lazy as _
-from note.models import NoteSpecial
+from note.models import NoteSpecial, Alias
 from note_kfet.inputs import AmountInput


@ -22,6 +22,23 @@ class SignUpForm(UserCreationForm):
        self.fields['email'].required = True
        self.fields['email'].help_text = _("This address must be valid.")

+        # Give some example
+        self.fields['first_name'].widget.attrs.update({"placeholder": "Sacha"})
+        self.fields['last_name'].widget.attrs.update({"placeholder": "Ketchum"})
+        self.fields['email'].widget.attrs.update({"placeholder": "mail@example.com"})
+
+    def clean_username(self):
+        value = self.cleaned_data["username"]
+        if Alias.objects.filter(normalized_name=Alias.normalize(value)).exists():
+            self.add_error("username", _("An alias with a similar name already exists."))
+        return value
+
+    def clean_email(self):
+        email = self.cleaned_data["email"]
+        if User.objects.filter(email=email).exists():
+            self.add_error("email", _("This email address is already used."))
+        return email
+
    class Meta:
        model = User
        fields = ('first_name', 'last_name', 'username', 'email', )
--- a/apps/registration/static/registration/css/login.css
+++ b/apps/registration/static/registration/css/login.css
@ -0,0 +1,19 @@
+/*
+Add icons to login form 
+Font-Awesome attribution is already done inside SVG files
+*/
+
+#login-form input[type="text"] {
+    background: #fff right 1rem top 50% / 5% no-repeat url('../img/fa-user.svg');
+    padding-right: 3rem;
+}
+
+#login-form input[type="password"] {
+    background: #fff right 1rem top 50% / 5% no-repeat url('../img/fa-lock.svg');
+    padding-right: 3rem;
+}
+
+#login-form select {
+    -moz-appearance: none;
+    cursor: pointer;
+}
--- a/apps/registration/static/registration/img/fa-lock.svg
+++ b/apps/registration/static/registration/img/fa-lock.svg
@ -0,0 +1,2 @@
+<!-- Icon by Font Awesome, https://fontawesome.com/, Creative Common 4.0 Attribution -->
+<svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="lock" class="svg-inline--fa fa-lock fa-w-14" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path fill="currentColor" d="M400 224h-24v-72C376 68.2 307.8 0 224 0S72 68.2 72 152v72H48c-26.5 0-48 21.5-48 48v192c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48V272c0-26.5-21.5-48-48-48zm-104 0H152v-72c0-39.7 32.3-72 72-72s72 32.3 72 72v72z"></path></svg>
--- a/apps/registration/static/registration/img/fa-user.svg
+++ b/apps/registration/static/registration/img/fa-user.svg
@ -0,0 +1,2 @@
+<!-- Icon by Font Awesome, https://fontawesome.com/, Creative Common 4.0 Attribution -->
+<svg aria-hidden="true" focusable="false" data-prefix="fas" data-icon="user" class="svg-inline--fa fa-user fa-w-14" role="img" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path fill="currentColor" d="M224 256c70.7 0 128-57.3 128-128S294.7 0 224 0 96 57.3 96 128s57.3 128 128 128zm89.6 32h-16.7c-22.2 10.2-46.9 16-72.9 16s-50.6-5.8-72.9-16h-16.7C60.2 288 0 348.2 0 422.4V464c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48v-41.6c0-74.2-60.2-134.4-134.4-134.4z"></path></svg>
--- a/apps/registration/tables.py
+++ b/apps/registration/tables.py
@ -9,9 +9,9 @@ class FutureUserTable(tables.Table):
    """
    Display the list of pre-registered users
    """
-    phone_number = tables.Column(accessor='profile.phone_number')
+    phone_number = tables.Column(accessor='profile__phone_number')

-    section = tables.Column(accessor='profile.section')
+    section = tables.Column(accessor='profile__section')

    class Meta:
        attrs = {
--- a/apps/registration/templates/registration/email_validation_complete.html
+++ b/apps/registration/templates/registration/email_validation_complete.html
@ -1,4 +1,7 @@
 {% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
 {% load i18n %}

 {% block content %}
--- a/apps/registration/templates/registration/email_validation_email_sent.html
+++ b/apps/registration/templates/registration/email_validation_email_sent.html
@ -0,0 +1,17 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n %}
+
+{% block content %}
+<h2>{% trans "Account activation" %}</h2>
+
+<p>
+    {% trans "An email has been sent. Please click on the link to activate your account." %}
+</p>
+
+<p>
+    {% trans "You must also go to the Kfet to pay your membership. The WEI registration includes the BDE membership." %}
+</p>
+{% endblock %}
--- a/apps/registration/templates/registration/future_profile_detail.html
+++ b/apps/registration/templates/registration/future_profile_detail.html
@ -1,8 +1,8 @@
 {% extends "base.html" %}
-{% load static %}
-{% load i18n %}
-{% load crispy_forms_tags %}
-{% load perms %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags perms %}

 {% block content %}
    <div class="row mt-4">
--- a/apps/registration/templates/registration/future_user_list.html
+++ b/apps/registration/templates/registration/future_user_list.html
@ -0,0 +1,14 @@
+{% extends "base_search.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n %}
+
+{% block content %}
+<a class="btn btn-block btn-success mb-3" href="{% url 'registration:signup' %}">
+    {% trans "New user" %}
+</a>
+
+{# Search panel #}
+{{ block.super }}
+{% endblock %}
--- a/apps/registration/templates/registration/mails/email_validation_email.html
+++ b/apps/registration/templates/registration/mails/email_validation_email.html
@ -0,0 +1,41 @@
+{% load i18n %}
+
+<!DOCTYPE html>
+<html lang="fr">
+<head>
+    <meta charset="UTF-8">
+    <title>Passage en négatif (compte n°{{ note.user.pk }})</title>
+</head>
+<body>
+
+<p>
+    {% trans "Hi" %} {{ user.username }},
+</p>
+
+<p>
+    {% trans "You recently registered on the Note Kfet. Please click on the link below to confirm your registration." %}
+</p>
+
+<p>
+    <a href="https://{{ domain }}{% url 'registration:email_validation' uidb64=uid token=token %}">
+        https://{{ domain }}{% url 'registration:email_validation' uidb64=uid token=token %}
+    </a>
+</p>
+
+<p>
+    {% trans "This link is only valid for a couple of days, after that you will need to contact us to validate your email." %}
+</p>
+
+<p>
+    {% trans "After that, you'll have to wait that someone validates your account before you can log in. You will need to pay your membership in the Kfet. Note that the WEI registration includes the Kfet membership." %}
+</p>
+
+<p>
+    {% trans "Thanks" %},
+</p>
+
+--
+<p>
+    {% trans "The Note Kfet team." %}<br>
+    {% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
+</p>
--- a/apps/registration/templates/registration/mails/email_validation_email.txt
+++ b/apps/registration/templates/registration/mails/email_validation_email.txt
@ -8,8 +8,9 @@ https://{{ domain }}{% url 'registration:email_validation' uidb64=uid token=toke

 {% trans "This link is only valid for a couple of days, after that you will need to contact us to validate your email." %}

-{% trans "After that, you'll have to wait that someone validates your account before you can log in. You will need to pay your membership in the Kfet." %}
+{% trans "After that, you'll have to wait that someone validates your account before you can log in. You will need to pay your membership in the Kfet. Note that the WEI registration includes the Kfet membership." %}

 {% trans "Thanks" %},

 {% trans "The Note Kfet team." %}
+{% trans "Mail generated by the Note Kfet on the" %} {% now "j F Y à H:i:s" %}
--- a/apps/registration/views.py
+++ b/apps/registration/views.py
@ -29,7 +29,7 @@ from .tokens import email_validation_token

 class UserCreateView(CreateView):
    """
-    Une vue pour inscrire un utilisateur et lui créer un profil
+    A view to create a User and add a Profile
    """

    form_class = SignUpForm
@ -39,8 +39,10 @@ class UserCreateView(CreateView):

    def get_context_data(self, **kwargs):
        context = super().get_context_data(**kwargs)
-        context["profile_form"] = self.second_form()
+        context["profile_form"] = self.second_form(self.request.POST if self.request.POST else None)
        del context["profile_form"].fields["section"]
+        del context["profile_form"].fields["report_frequency"]
+        del context["profile_form"].fields["last_report"]

        return context

@ -179,8 +181,6 @@ class FutureUserListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableVi
                | Q(profile__section__iregex=pattern)
                | Q(username__iregex="^" + pattern)
            )
-        else:
-            qs = qs.none()

        return qs[:20]

--- a/apps/scripts
+++ b/apps/scripts
@ -1 +1 @@
-Subproject commit dce51ad26134d396d7cbfca7c63bd2ed391dd969
+Subproject commit c1c0a8797179d110ad919912378f05b030f44f61
--- a/apps/treasury/admin.py
+++ b/apps/treasury/admin.py
@ -4,7 +4,8 @@
 from django.contrib import admin
 from note_kfet.admin import admin_site

-from .models import RemittanceType, Remittance, SogeCredit
+from .forms import ProductForm
+from .models import RemittanceType, Remittance, SogeCredit, Invoice, Product


@admin.register(RemittanceType, site=admin_site)
@ -39,3 +40,20 @@ class SogeCreditAdmin(admin.ModelAdmin):
    def has_add_permission(self, request):
        # Don't create a credit manually
        return False
+
+
+class ProductInline(admin.StackedInline):
+    """
+    Inline product in invoice admin
+    """
+    model = Product
+    form = ProductForm
+
+
+@admin.register(Invoice, site=admin_site)
+class InvoiceAdmin(admin.ModelAdmin):
+    """
+    Admin customisation for Invoice
+    """
+    list_display = ('object', 'id', 'bde', 'name', 'date', 'acquitted',)
+    inlines = (ProductInline,)
--- a/Show More
+++ b/Show More