Get rid of activity and guests duplicates

Phone input

See merge request bde/nk20!351

.env_example

@@ -21,3 +21,6 @@ EMAIL_PASSWORD=CHANGE_ME
 # Wiki configuration
 WIKI_USER=NoteKfet2020
 WIKI_PASSWORD=
+
+# OIDC
+OIDC_RSA_PRIVATE_KEY=CHANGE_ME

.gitignore

@@ -48,6 +48,7 @@ backups/
 env/
 venv/
 db.sqlite3
+shell.nix
 
 # ansibles customs host
 ansible/host_vars/*.yaml

.gitlab-ci.yml

@@ -8,7 +8,7 @@ variables:
   GIT_SUBMODULE_STRATEGY: recursive
 
 # Ubuntu 22.04
-py310-django42:
+py310-django52:
   stage: test
   image: ubuntu:22.04
   before_script:
@@ -22,10 +22,10 @@ py310-django42:
         python3-djangorestframework python3-django-oauth-toolkit python3-psycopg2 python3-pil
         python3-babel python3-lockfile python3-pip python3-phonenumbers python3-memcache
         python3-bs4 python3-setuptools tox texlive-xetex
-  script: tox -e py310-django42
+  script: tox -e py310-django52
 
 # Debian Bookworm
-py311-django42:
+py311-django52:
   stage: test
   image: debian:bookworm
   before_script:
@@ -37,7 +37,7 @@ py311-django42:
         python3-djangorestframework python3-django-oauth-toolkit python3-psycopg2 python3-pil
         python3-babel python3-lockfile python3-pip python3-phonenumbers python3-memcache
         python3-bs4 python3-setuptools tox texlive-xetex
-  script: tox -e py311-django42
+  script: tox -e py311-django52
 
 linters:
   stage: quality-assurance

README.md

@@ -61,8 +61,8 @@ Bien que cela permette de créer une instance sur toutes les distributions,
 6. (Optionnel) **Création d'une clé privée OpenID Connect**
 
 Pour activer le support d'OpenID Connect, il faut générer une clé privée, par
-exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et renseigner son
-emplacement dans `OIDC_RSA_PRIVATE_KEY` (par défaut `/var/secrets/oidc.key`).
+exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et copier la clé dans .env dans le champ
+`OIDC_RSA_PRIVATE_KEY`.
 
 7.  Enjoy :
 
@@ -237,8 +237,8 @@ Sinon vous pouvez suivre les étapes décrites ci-dessous.
 7. **Création d'une clé privée OpenID Connect**
 
 Pour activer le support d'OpenID Connect, il faut générer une clé privée, par
-exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et renseigner son
-emplacement dans `OIDC_RSA_PRIVATE_KEY` (par défaut `/var/secrets/oidc.key`).
+exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et renseigner le champ
+`OIDC_RSA_PRIVATE_KEY` dans le .env (par défaut `/var/secrets/oidc.key`).
 
 8.  *Enjoy \o/*
 

apps/activity/admin.py

@@ -35,7 +35,7 @@ class GuestAdmin(admin.ModelAdmin):
     """
     Admin customisation for Guest
     """
-    list_display = ('last_name', 'first_name', 'activity', 'inviter')
+    list_display = ('last_name', 'first_name', 'school', 'activity', 'inviter')
     form = GuestForm
 
 

apps/activity/api/views.py

@@ -51,9 +51,9 @@ class GuestViewSet(ReadProtectedModelViewSet):
     queryset = Guest.objects.order_by('id')
     serializer_class = GuestSerializer
     filter_backends = [DjangoFilterBackend, RegexSafeSearchFilter]
-    filterset_fields = ['activity', 'activity__name', 'last_name', 'first_name', 'inviter', 'inviter__alias__name',
+    filterset_fields = ['activity', 'activity__name', 'last_name', 'first_name', 'school', 'inviter', 'inviter__alias__name',
                         'inviter__alias__normalized_name', ]
-    search_fields = ['$activity__name', '$last_name', '$first_name', '$inviter__user__email', '$inviter__alias__name',
+    search_fields = ['$activity__name', '$last_name', '$first_name', '$school', '$inviter__user__email', '$inviter__alias__name',
                      '$inviter__alias__normalized_name', ]
 
 

apps/activity/forms.py

@@ -32,7 +32,7 @@ class ActivityForm(forms.ModelForm):
     def clean_organizer(self):
         organizer = self.cleaned_data['organizer']
         if not organizer.note.is_active:
-            self.add_error('organiser', _('The note of this club is inactive.'))
+            self.add_error('organizer', _('The note of this club is inactive.'))
         return organizer
 
     def clean_date_end(self):
@@ -107,7 +107,7 @@ class GuestForm(forms.ModelForm):
 
     class Meta:
         model = Guest
-        fields = ('last_name', 'first_name', 'inviter', )
+        fields = ('last_name', 'first_name', 'school', 'inviter', )
         widgets = {
             "inviter": Autocomplete(
                 NoteUser,

apps/activity/migrations/0006_guest_school.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.20 on 2025-03-25 09:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("activity", "0005_alter_opener_options_alter_opener_opener"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="guest",
+            name="school",
+            field=models.CharField(default="", max_length=255, verbose_name="school"),
+            preserve_default=False,
+        ),
+    ]

apps/activity/migrations/0007_alter_guest_activity.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.20 on 2025-05-08 19:07
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('activity', '0006_guest_school'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='guest',
+            name='activity',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='+', to='activity.activity'),
+        ),
+    ]

apps/activity/models.py

@@ -201,7 +201,8 @@ class Entry(models.Model):
     def save(self, *args, **kwargs):
         qs = Entry.objects.filter(~Q(pk=self.pk), activity=self.activity, note=self.note, guest=self.guest)
         if qs.exists():
-            raise ValidationError(_("Already entered on ") + _("{:%Y-%m-%d %H:%M:%S}").format(qs.get().time, ))
+            raise ValidationError(_("Already entered on ")
+                                  + _("{:%Y-%m-%d %H:%M:%S}").format(timezone.localtime(qs.get().time), ))
 
         if self.guest:
             self.note = self.guest.inviter
@@ -233,7 +234,7 @@ class Guest(models.Model):
     """
     activity = models.ForeignKey(
         Activity,
-        on_delete=models.PROTECT,
+        on_delete=models.CASCADE,
         related_name='+',
     )
 
@@ -247,6 +248,11 @@ class Guest(models.Model):
         verbose_name=_("first name"),
     )
 
+    school = models.CharField(
+        max_length=255,
+        verbose_name=_("school"),
+    )
+
     inviter = models.ForeignKey(
         NoteUser,
         on_delete=models.PROTECT,

apps/activity/tables.py

@@ -51,11 +51,11 @@ class GuestTable(tables.Table):
         }
         model = Guest
         template_name = 'django_tables2/bootstrap4.html'
-        fields = ("last_name", "first_name", "inviter", )
+        fields = ("last_name", "first_name", "inviter", "school")
 
     def render_entry(self, record):
         if record.has_entry:
-            return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(record.entry.time, )))
+            return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(timezone.localtime(record.entry.time))))
         return mark_safe('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
                          '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))
 

apps/activity/templates/activity/activity_detail.html

@@ -37,6 +37,11 @@ SPDX-License-Identifier: GPL-3.0-or-later
     <div id="guests_table">
         {% render_table guests %}
     </div>
+    <div class="card-footer text-center">
+        <button class="btn btn-block btn-primary mb-3" onclick="window.location.href='?_export=1&table=guests'">
+            {% trans "Export to CSV" %}
+        </button>
+    </div>
 </div>
 {% endif %}
 {% endblock %}
@@ -95,5 +100,23 @@ SPDX-License-Identifier: GPL-3.0-or-later
             errMsg(xhr.responseJSON);
         });
     });
+    $("#delete_activity").click(function () {
+        if (!confirm("{% trans 'Are you sure you want to delete this activity?' %}")) {
+            return;
+        }
+
+        $.ajax({
+            url: "/api/activity/activity/{{ activity.pk }}/",
+            type: "DELETE",
+            headers: {
+                "X-CSRFTOKEN": CSRF_TOKEN
+            }
+        }).done(function () {
+            addMsg("{% trans 'Activity deleted' %}", "success");
+            window.location.href = "/activity/";  // Redirige vers la liste des activités
+        }).fail(function (xhr) {
+            errMsg(xhr.responseJSON);
+        });
+    });
 </script>
 {% endblock %}

apps/activity/templates/activity/activity_list.html

@@ -1,4 +1,4 @@
-{% extends "base.html" %}
+{% extends "base_search.html" %}
 {% comment %}
 SPDX-License-Identifier: GPL-3.0-or-later
 {% endcomment %}
@@ -44,6 +44,8 @@ SPDX-License-Identifier: GPL-3.0-or-later
     <h3 class="card-header text-center">
         {% trans "All activities" %}
     </h3>
-    {% render_table table %}
+    {% render_table all %}
 </div>
+
+{{ block.super }}
 {% endblock %}

apps/activity/templates/activity/includes/activity_info.html

@@ -1,7 +1,7 @@
 {% comment %}
 SPDX-License-Identifier: GPL-3.0-or-later
 {% endcomment %}
-{% load i18n perms pretty_money %}
+{% load i18n perms pretty_money dict_get %}
 {% url 'activity:activity_detail' activity.pk as activity_detail_url %}
 
 <div id="activity_info" class="card bg-light shadow mb-3">
@@ -53,6 +53,12 @@ SPDX-License-Identifier: GPL-3.0-or-later
             <dt class="col-xl-6">{% trans 'opened'|capfirst %}</dt>
             <dd class="col-xl-6">{{ activity.open|yesno }}</dd>
         </dl>
+        {% if show_entries|dict_get:activity %}
+            <h2 class="text-center">
+                {{ entries_count|dict_get:activity }}
+                {% if entries_count|dict_get:activity >= 2 %}{% trans "entries" %}{% else %}{% trans "entry" %}{% endif %}
+            </h2>
+        {% endif %}
     </div>
 
     <div class="card-footer text-center">
@@ -70,7 +76,10 @@ SPDX-License-Identifier: GPL-3.0-or-later
             {% if ".change_"|has_perm:activity %}
                 <a class="btn btn-primary btn-sm my-1" href="{% url 'activity:activity_update' pk=activity.pk %}" data-turbolinks="false"> {% trans "edit"|capfirst %}</a>
             {% endif %}
-            {% if activity.activity_type.can_invite and not activity_started %}
+            {% if not activity.valid and ".delete_"|has_perm:activity %}
+                <a class="btn btn-danger btn-sm my-1" id="delete_activity"> {% trans "delete"|capfirst %} </a>
+            {% endif %}
+            {% if activity.activity_type.can_invite and not activity_started and activity.valid %}
                 <a class="btn btn-primary btn-sm my-1" href="{% url 'activity:activity_invite' pk=activity.pk %}" data-turbolinks="false"> {% trans "Invite" %}</a>
             {% endif %}
         {% endif %}

apps/activity/templatetags/dict_get.py

@@ -0,0 +1,12 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django import template
+
+
+def dict_get(d, key):
+    return d.get(key)
+
+
+register = template.Library()
+register.filter('dict_get', dict_get)

apps/activity/tests/test_activities.py

@@ -50,6 +50,7 @@ class TestActivities(TestCase):
             inviter=self.user.note,
             last_name="GUEST",
             first_name="Guest",
+            school="School",
         )
 
     def test_activity_list(self):
@@ -156,6 +157,7 @@ class TestActivities(TestCase):
             inviter=self.user.note.id,
             last_name="GUEST2",
             first_name="Guest",
+            school="School",
         ))
         self.assertEqual(response.status_code, 200)
 
@@ -167,6 +169,7 @@ class TestActivities(TestCase):
             inviter=self.user.note.id,
             last_name="GUEST2",
             first_name="Guest",
+            school="School",
         ))
         self.assertRedirects(response, reverse("activity:activity_detail", args=(self.activity.pk,)), 302, 200)
 
@@ -200,6 +203,7 @@ class TestActivityAPI(TestAPI):
             inviter=self.user.note,
             last_name="GUEST",
             first_name="Guest",
+            school="School",
         )
 
         self.entry = Entry.objects.create(

apps/activity/urls.py

@@ -15,4 +15,5 @@ urlpatterns = [
     path('<int:pk>/update/', views.ActivityUpdateView.as_view(), name='activity_update'),
     path('new/', views.ActivityCreateView.as_view(), name='activity_create'),
     path('calendar.ics', views.CalendarView.as_view(), name='calendar_ics'),
+    path('<int:pk>/delete', views.ActivityDeleteView.as_view(), name='delete_activity'),
 ]

apps/activity/views.py

@@ -9,7 +9,7 @@ from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.db.models import F, Q
-from django.http import HttpResponse
+from django.http import HttpResponse, JsonResponse
 from django.urls import reverse_lazy
 from django.utils import timezone
 from django.utils.decorators import method_decorator
@@ -67,32 +67,65 @@ class ActivityListView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMixin
     tables = [
         lambda data: ActivityTable(data, prefix="all-"),
         lambda data: ActivityTable(data, prefix="upcoming-"),
+        lambda data: ActivityTable(data, prefix="search-"),
     ]
     extra_context = {"title": _("Activities")}
 
     def get_queryset(self, **kwargs):
-        return super().get_queryset(**kwargs).distinct()
+        """
+        Filter the user list with the given pattern.
+        """
+        return super().get_queryset().distinct()
 
     def get_tables_data(self):
-        # first table = all activities, second table = upcoming
+        # first table = all activities, second table = upcoming, third table = search
+
+        # table search
+        qs = self.get_queryset().order_by('-date_start')
+        if "search" in self.request.GET and self.request.GET['search']:
+            pattern = self.request.GET['search']
+
+            # check regex
+            valid_regex = is_regex(pattern)
+            suffix = '__iregex' if valid_regex else '__istartswith'
+            prefix = '^' if valid_regex else ''
+            qs = qs.filter(Q(**{f'name{suffix}': prefix + pattern})
+                           | Q(**{f'organizer__name{suffix}': prefix + pattern})
+                           | Q(**{f'organizer__note__alias__name{suffix}': prefix + pattern}))
+        else:
+            qs = qs.none()
+        search_table = qs.filter(PermissionBackend.filter_queryset(self.request, Activity, 'view'))
+
         return [
             self.get_queryset().order_by("-date_start"),
             Activity.objects.filter(date_end__gt=timezone.now())
                             .filter(PermissionBackend.filter_queryset(self.request, Activity, "view"))
                             .distinct()
-                            .order_by("date_start")
+                            .order_by("date_start"),
+            search_table,
         ]
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
 
         tables = context["tables"]
-        for name, table in zip(["table", "upcoming"], tables):
+        for name, table in zip(["all", "upcoming", "table"], tables):
             context[name] = table
 
         started_activities = self.get_queryset().filter(open=True, valid=True).distinct().all()
         context["started_activities"] = started_activities
 
+        entries_count = {}
+        show_entries = {}
+        for activity in started_activities:
+            if activity.activity_type.manage_entries:
+                entries = Entry.objects.filter(activity=activity)
+                entries_count[activity] = entries.count()
+
+                show_entries[activity] = True
+        context["entries_count"] = entries_count
+        context["show_entries"] = show_entries
+
         return context
 
 
@@ -103,20 +136,74 @@ class ActivityDetailView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMix
     model = Activity
     context_object_name = "activity"
     extra_context = {"title": _("Activity detail")}
+    export_formats = ["csv"]
 
     tables = [
-        lambda data: GuestTable(data, prefix="guests-"),
-        lambda data: OpenerTable(data, prefix="opener-"),
+        GuestTable,
+        OpenerTable,
     ]
 
+    def get_tables(self):
+        tables = super().get_tables()
+        tables[0].prefix = "guests"
+        tables[1].prefix = "opener"
+        return tables
+
     def get_tables_data(self):
         return [
             Guest.objects.filter(activity=self.object)
-                         .filter(PermissionBackend.filter_queryset(self.request, Guest, "view")),
+                         .filter(PermissionBackend.filter_queryset(self.request, Guest, "view"))
+                         .distinct(),
             self.object.opener.filter(activity=self.object)
-                              .filter(PermissionBackend.filter_queryset(self.request, Opener, "view")),
+                              .filter(PermissionBackend.filter_queryset(self.request, Opener, "view"))
+                              .distinct(),
         ]
 
+    def render_to_response(self, context, **response_kwargs):
+        """
+        Gère l'export CSV manuel pour MultiTableMixin.
+        """
+        if "_export" in self.request.GET:
+            import tablib
+            table_name = self.request.GET.get("table")
+            if table_name:
+                tables = self.get_tables()
+                data_list = self.get_tables_data()
+
+                for t, d in zip(tables, data_list):
+                    if t.prefix == table_name:
+                        # Préparer le CSV
+                        dataset = tablib.Dataset()
+                        columns = list(t.base_columns)  # noms des colonnes
+                        dataset.headers = columns
+
+                        for row in d:
+                            values = []
+                            for col in columns:
+                                try:
+                                    val = getattr(row, col, "")
+                                    # Gestion spéciale pour la colonne 'entry'
+                                    if col == "entry":
+                                        if getattr(row, "has_entry", False):
+                                            val = timezone.localtime(row.entry.time).strftime("%Y-%m-%d %H:%M:%S")
+                                        else:
+                                            val = ""
+                                    values.append(str(val) if val is not None else "")
+                                except Exception:  # RelatedObjectDoesNotExist ou autre
+                                    values.append("")
+                            dataset.append(values)
+
+                        csv_bytes = dataset.export("csv")
+                        if isinstance(csv_bytes, str):
+                            csv_bytes = csv_bytes.encode("utf-8")
+
+                        response = HttpResponse(csv_bytes, content_type="text/csv")
+                        response["Content-Disposition"] = f'attachment; filename="{table_name}.csv"'
+                        return response
+
+        # Sinon rendu normal
+        return super().render_to_response(context, **response_kwargs)
+
     def get_context_data(self, **kwargs):
         context = super().get_context_data()
 
@@ -137,6 +224,14 @@ class ActivityDetailView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMix
                 "placeholder": ""
             }
         }
+        if self.object.activity_type.manage_entries:
+            entries = Entry.objects.filter(activity=self.object)
+            context["entries_count"] = {self.object: entries.count()}
+
+            context["show_entries"] = {self.object: timezone.now() > timezone.localtime(self.object.date_start)}
+        else:
+            context["entries_count"] = {self.object: 0}
+            context["show_entries"] = {self.object: False}
 
         return context
 
@@ -153,6 +248,34 @@ class ActivityUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
         return reverse_lazy('activity:activity_detail', kwargs={"pk": self.kwargs["pk"]})
 
 
+class ActivityDeleteView(View):
+    """
+    Deletes an Activity
+    """
+    def delete(self, request, pk):
+        try:
+            activity = Activity.objects.get(pk=pk)
+            activity.delete()
+            return JsonResponse({"message": "Activity deleted"})
+        except Activity.DoesNotExist:
+            return JsonResponse({"error": "Activity not found"}, status=404)
+
+    def dispatch(self, *args, **kwargs):
+        """
+        Don't display the delete button if the user has no right to delete.
+        """
+        if not self.request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        activity = Activity.objects.get(pk=self.kwargs["pk"])
+        if not PermissionBackend.check_perm(self.request, "activity.delete_activity", activity):
+            raise PermissionDenied(_("You are not allowed to delete this activity."))
+
+        if activity.valid:
+            raise PermissionDenied(_("This activity is valid."))
+        return super().dispatch(*args, **kwargs)
+
+
 class ActivityInviteView(ProtectQuerysetMixin, ProtectedCreateView):
     """
     Invite a Guest, The rules to invites someone are defined in `forms:activity.GuestForm`
@@ -168,6 +291,7 @@ class ActivityInviteView(ProtectQuerysetMixin, ProtectedCreateView):
             activity=activity,
             first_name="",
             last_name="",
+            school="",
             inviter=self.request.user.note,
         )
 
@@ -187,7 +311,7 @@ class ActivityInviteView(ProtectQuerysetMixin, ProtectedCreateView):
     @transaction.atomic
     def form_valid(self, form):
         form.instance.activity = Activity.objects\
-            .filter(PermissionBackend.filter_queryset(self.request, Activity, "view")).get(pk=self.kwargs["pk"])
+            .filter(PermissionBackend.filter_queryset(self.request, Activity, "view")).distinct().get(pk=self.kwargs["pk"])
         return super().form_valid(form)
 
     def get_success_url(self, **kwargs):

apps/api/urls.py

@@ -19,6 +19,10 @@ if "activity" in settings.INSTALLED_APPS:
     from activity.api.urls import register_activity_urls
     register_activity_urls(router, 'activity')
 
+if "family" in settings.INSTALLED_APPS:
+    from family.api.urls import register_family_urls
+    register_family_urls(router, 'family')
+
 if "food" in settings.INSTALLED_APPS:
     from food.api.urls import register_food_urls
     register_food_urls(router, 'food')

apps/family/api/serializers.py

@@ -0,0 +1,46 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from rest_framework import serializers
+
+from ..models import Family, FamilyMembership, Challenge, Achievement
+
+
+class FamilySerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for Family.
+    The djangorestframework plugin will analyse the model `Family` and parse all fields in the API.
+    """
+    class Meta:
+        model = Family
+        fields = '__all__'
+
+
+class FamilyMembershipSerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for FamilyMembership.
+    The djangorestframework plugin will analyse the model `FamilyMembership` and parse all fields in the API.
+    """
+    class Meta:
+        model = FamilyMembership
+        fields = '__all__'
+
+
+class ChallengeSerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for Challenge.
+    The djangorestframework plugin will analyse the model `Challenge` and parse all fields in the API.
+    """
+    class Meta:
+        model = Challenge
+        fields = '__all__'
+
+
+class AchievementSerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for Achievement.
+    The djangorestframework plugin will analyse the model `Achievement` and parse all fields in the API.
+    """
+    class Meta:
+        model = Achievement
+        fields = '__all__'

apps/family/api/urls.py

@@ -0,0 +1,20 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+from django.urls import path
+
+from .views import FamilyViewSet, FamilyMembershipViewSet, ChallengeViewSet, AchievementViewSet, BatchAchievementsAPIView
+
+
+def register_family_urls(router, path):
+    """
+    Configure router for Family REST API
+    """
+    router.register(path + '/family', FamilyViewSet)
+    router.register(path + '/familymembership', FamilyMembershipViewSet)
+    router.register(path + '/challenge', ChallengeViewSet)
+    router.register(path + '/achievement', AchievementViewSet)
+
+
+urlpatterns = [
+    path('achievements/batch/', BatchAchievementsAPIView.as_view(), name='batch_achievements')
+]

apps/family/api/views.py

@@ -0,0 +1,98 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from api.viewsets import ReadProtectedModelViewSet
+from django_filters.rest_framework import DjangoFilterBackend
+from api.filters import RegexSafeSearchFilter
+from rest_framework.views import APIView
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+from rest_framework import status
+
+from .serializers import FamilySerializer, FamilyMembershipSerializer, ChallengeSerializer, AchievementSerializer
+from ..models import Family, FamilyMembership, Challenge, Achievement
+
+
+class FamilyViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `Family` objects, serialize it to JSON with the given serializer,
+    then render it on /api/family/family/
+    """
+    queryset = Family.objects.order_by('id')
+    serializer_class = FamilySerializer
+    filter_backends = [DjangoFilterBackend, RegexSafeSearchFilter]
+    filterset_fields = ['name', 'description', 'score', 'rank', ]
+    search_fields = ['$name', '$description', ]
+
+
+class FamilyMembershipViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `FamilyMembership` objects, serialize it to JSON with the given serializer,
+    then render it on /api/family/familymembership/
+    """
+    queryset = FamilyMembership.objects.order_by('id')
+    serializer_class = FamilyMembershipSerializer
+    filter_backends = [DjangoFilterBackend, RegexSafeSearchFilter]
+    filterset_fields = ['user__username', 'user__first_name', 'user__last_name', 'user__email', 'user__note__alias__name',
+                        'user__note__alias__normalized_name', 'family__name', 'family__description', 'year', ]
+    search_fields = ['$user__username', '$user__first_name', '$user__last_name', '$user__email', '$user__note__alias__name',
+                     '$user__note__alias__normalized_name', '$family__name', '$family__description', '$year', ]
+
+
+class ChallengeViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `Challenge` objects, serialize it to JSON with the given serializer,
+    then render it on /api/family/challenge/
+    """
+    queryset = Challenge.objects.order_by('id')
+    serializer_class = ChallengeSerializer
+    filter_backends = [DjangoFilterBackend, RegexSafeSearchFilter]
+    filterset_fields = ['name', 'description', 'points', ]
+    search_fields = ['$name', '$description', '$points', ]
+
+
+class AchievementViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `Achievement` objects, serialize it to JSON with the given serializer,
+    then render it on /api/family/achievement/
+    """
+    queryset = Achievement.objects.order_by('id')
+    serializer_class = AchievementSerializer
+    filter_backends = [DjangoFilterBackend, RegexSafeSearchFilter]
+    filterset_fields = ['family__name', 'family__description', 'challenge__name', 'challenge__description', 'obtained_at', 'valid', ]
+    search_fields = ['$family__name', '$family__description', '$challenge__name', '$challenge__description', ]
+
+
+class BatchAchievementsAPIView(APIView):
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, format=None):
+        family_ids = request.data.get('families')
+        challenge_ids = request.data.get('challenges')
+        families = Family.objects.filter(id__in=family_ids)
+        challenges = Challenge.objects.filter(id__in=challenge_ids)
+        results = []
+        for family in families:
+            for challenge in challenges:
+                a, created = Achievement.objects.get_or_create(family=family, challenge=challenge)
+                if created:
+                    results.append({
+                        'family': family.name,
+                        'challenge': challenge.name,
+                        'status': 'created'
+                    })
+                else:
+                    results.append({
+                        'family': family.name,
+                        'challenge': challenge.name,
+                        'status': 'existed',
+                    })
+        for family in families:
+            family.update_score()
+        Family.update_ranking()
+
+        return Response({'results': results}, status=status.HTTP_201_CREATED)

apps/family/apps.py

@@ -0,0 +1,11 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+
+from django.utils.translation import gettext_lazy as _
+from django.apps import AppConfig
+
+
+class FamilyConfig(AppConfig):
+    name = 'family'
+    verbose_name = _('family')

apps/family/forms.py

@@ -0,0 +1,44 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django import forms
+from django.forms.widgets import NumberInput
+from note_kfet.inputs import Autocomplete
+
+from .models import Challenge, FamilyMembership, User, Family
+
+
+class ChallengeForm(forms.ModelForm):
+    """
+    To update a challenge
+    """
+    class Meta:
+        model = Challenge
+        fields = ('name', 'description', 'points',)
+        widgets = {
+            "points": NumberInput()
+        }
+
+
+class FamilyForm(forms.ModelForm):
+    class Meta:
+        model = Family
+        fields = ('name', 'description', )
+
+
+class FamilyMembershipForm(forms.ModelForm):
+    class Meta:
+        model = FamilyMembership
+        fields = ('user', )
+
+        widgets = {
+            "user":
+                Autocomplete(
+                    User,
+                    attrs={
+                        'api_url': '/api/user/',
+                        'name_field': 'username',
+                        'placeholder': 'Nom ...',
+                    },
+                )
+        }

apps/family/migrations/0001_initial.py

@@ -0,0 +1,73 @@
+# Generated by Django 4.2.21 on 2025-07-06 16:07
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Challenge',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=255, verbose_name='name')),
+                ('description', models.CharField(max_length=255, verbose_name='description')),
+                ('points', models.PositiveIntegerField(verbose_name='points')),
+                ('obtained', models.PositiveIntegerField(default=0, verbose_name='obtained')),
+            ],
+            options={
+                'verbose_name': 'challenge',
+                'verbose_name_plural': 'challenges',
+            },
+        ),
+        migrations.CreateModel(
+            name='Family',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=255, unique=True, verbose_name='name')),
+                ('description', models.CharField(max_length=255, verbose_name='description')),
+                ('score', models.PositiveIntegerField(default=0, verbose_name='score')),
+                ('rank', models.PositiveIntegerField(verbose_name='rank')),
+            ],
+            options={
+                'verbose_name': 'Family',
+                'verbose_name_plural': 'Families',
+            },
+        ),
+        migrations.CreateModel(
+            name='Achievement',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('obtained_at', models.DateTimeField(default=django.utils.timezone.now, verbose_name='obtained at')),
+                ('challenge', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='family.challenge')),
+                ('family', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='family.family', verbose_name='family')),
+            ],
+            options={
+                'verbose_name': 'achievement',
+                'verbose_name_plural': 'achievements',
+            },
+        ),
+        migrations.CreateModel(
+            name='FamilyMembership',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('year', models.PositiveIntegerField(default=2025, verbose_name='year')),
+                ('family', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='members', to='family.family', verbose_name='family')),
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.PROTECT, related_name='family_memberships', to=settings.AUTH_USER_MODEL, verbose_name='user')),
+            ],
+            options={
+                'verbose_name': 'family membership',
+                'verbose_name_plural': 'family memberships',
+                'unique_together': {('user', 'year')},
+            },
+        ),
+    ]

apps/family/migrations/0002_family_display_image.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.23 on 2025-07-17 15:28
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('family', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='family',
+            name='display_image',
+            field=models.ImageField(default='pic/default.png', max_length=255, upload_to='pic/', verbose_name='display image'),
+        ),
+    ]

apps/family/migrations/0003_achievement_valid_alter_familymembership_family.py

@@ -0,0 +1,24 @@
+# Generated by Django 5.2.4 on 2025-07-21 21:02
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('family', '0002_family_display_image'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='achievement',
+            name='valid',
+            field=models.BooleanField(default=False, verbose_name='valid'),
+        ),
+        migrations.AlterField(
+            model_name='familymembership',
+            name='family',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='memberships', to='family.family', verbose_name='family'),
+        ),
+    ]

apps/family/migrations/0004_remove_challenge_obtained.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.4 on 2025-07-22 14:33
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('family', '0003_achievement_valid_alter_familymembership_family'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='challenge',
+            name='obtained',
+        ),
+    ]

apps/family/migrations/0005_alter_achievement_unique_together.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.4 on 2025-08-13 20:26
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('family', '0004_remove_challenge_obtained'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='achievement',
+            unique_together={('challenge', 'family')},
+        ),
+    ]

apps/family/models.py

@@ -0,0 +1,207 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.db import models, transaction
+from django.utils import timezone
+from django.contrib.auth.models import User
+from django.urls import reverse_lazy
+from django.utils.translation import gettext_lazy as _
+
+
+class Family(models.Model):
+    name = models.CharField(
+        max_length=255,
+        verbose_name=_('name'),
+        unique=True,
+    )
+
+    description = models.CharField(
+        max_length=255,
+        verbose_name=_('description'),
+    )
+
+    score = models.PositiveIntegerField(
+        verbose_name=_('score'),
+        default=0,
+    )
+
+    rank = models.PositiveIntegerField(
+        verbose_name=_('rank'),
+    )
+
+    display_image = models.ImageField(
+        verbose_name=_('display image'),
+        max_length=255,
+        blank=False,
+        null=False,
+        upload_to='pic/',
+        default='pic/default.png'
+    )
+
+    class Meta:
+        verbose_name = _('Family')
+        verbose_name_plural = _('Families')
+
+    def __str__(self):
+        return self.name
+
+    def get_absolute_url(self):
+        return reverse_lazy('family:family_detail', args=(self.pk,))
+
+    def update_score(self, *args, **kwargs):
+        challenge_set = Challenge.objects.select_for_update().filter(achievement__family=self, achievement__valid=True)
+        points_sum = challenge_set.aggregate(models.Sum("points"))
+        self.score = points_sum["points__sum"] if points_sum["points__sum"] else 0
+        self.save()
+        self.update_ranking()
+
+    @staticmethod
+    def update_ranking(*args, **kwargs):
+        """
+        Update ranking when adding or removing points
+        """
+        family_set = Family.objects.select_for_update().all().order_by("-score")
+        for i in range(family_set.count()):
+            if i == 0 or family_set[i].score != family_set[i - 1].score:
+                new_rank = i + 1
+            family = family_set[i]
+            family.rank = new_rank
+            family._force_save = True
+            family.save()
+
+    def save(self, *args, **kwargs):
+        if self.rank is None:
+            last_family = Family.objects.order_by("rank").last()
+            if last_family is None or last_family.score > self.score:
+                self.rank = Family.objects.count() + 1
+            else:
+                self.rank = last_family.rank
+        super().save(*args, **kwargs)
+
+
+class FamilyMembership(models.Model):
+    user = models.OneToOneField(
+        User,
+        on_delete=models.PROTECT,
+        related_name=_('family_memberships'),
+        verbose_name=_('user'),
+    )
+
+    family = models.ForeignKey(
+        Family,
+        on_delete=models.PROTECT,
+        related_name=_('memberships'),
+        verbose_name=_('family'),
+    )
+
+    year = models.PositiveIntegerField(
+        verbose_name=_('year'),
+        default=timezone.now().year,
+    )
+
+    class Meta:
+        unique_together = ('user', 'year',)
+        verbose_name = _('family membership')
+        verbose_name_plural = _('family memberships')
+
+    def __str__(self):
+        return _('Family membership of {user} to {family}').format(user=self.user.username, family=self.family.name, )
+
+
+class Challenge(models.Model):
+    name = models.CharField(
+        max_length=255,
+        verbose_name=_('name'),
+    )
+
+    description = models.CharField(
+        max_length=255,
+        verbose_name=_('description'),
+    )
+
+    points = models.PositiveIntegerField(
+        verbose_name=_('points'),
+    )
+
+    @property
+    def obtained(self):
+        achievements = Achievement.objects.filter(challenge=self, valid=True)
+        return achievements.count()
+
+    def __str__(self):
+        return self.name
+
+    def get_absolute_url(self):
+        return reverse_lazy('family:challenge_detail', args=(self.pk,))
+
+    @transaction.atomic
+    def save(self, *args, **kwargs):
+        super().save(*args, **kwargs)
+        # Update families who already obtained this challenge
+        achievements = Achievement.objects.filter(challenge=self)
+        for achievement in achievements:
+            achievement.save()
+
+    class Meta:
+        verbose_name = _('challenge')
+        verbose_name_plural = _('challenges')
+
+
+class Achievement(models.Model):
+    challenge = models.ForeignKey(
+        Challenge,
+        on_delete=models.PROTECT,
+
+    )
+    family = models.ForeignKey(
+        Family,
+        on_delete=models.PROTECT,
+        verbose_name=_('family'),
+    )
+
+    obtained_at = models.DateTimeField(
+        verbose_name=_('obtained at'),
+        default=timezone.now,
+    )
+
+    valid = models.BooleanField(
+        verbose_name=_('valid'),
+        default=False,
+    )
+
+    class Meta:
+        unique_together = ('challenge', 'family',)
+        verbose_name = _('achievement')
+        verbose_name_plural = _('achievements')
+
+    def __str__(self):
+        return _('Challenge {challenge} carried out by Family {family}').format(challenge=self.challenge.name, family=self.family.name, )
+
+    @transaction.atomic
+    def save(self, *args, update_score=True, **kwargs):
+        """
+        When saving, also grants points to the family
+        """
+        self.family = Family.objects.select_for_update().get(pk=self.family_id)
+        self.challenge = Challenge.objects.select_for_update().get(pk=self.challenge_id)
+
+        super().save(*args, **kwargs)
+
+        if update_score:
+            self.family.refresh_from_db()
+            self.family.update_score()
+
+    @transaction.atomic
+    def delete(self, *args, **kwargs):
+        """
+        When deleting, also removes points from the family
+        """
+        # Get the family and challenge before deletion
+        self.family = Family.objects.select_for_update().get(pk=self.family_id)
+
+        # Delete the achievement
+        super().delete(*args, **kwargs)
+
+        # Remove points from the family
+        self.family.refresh_from_db()
+        self.family.update_score()

apps/family/static/family/js/achievements.js

@@ -0,0 +1,411 @@
+// Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// When a transaction is performed, lock the interface to prevent spam clicks.
+var LOCK = false
+
+/**
+ * Refresh the history table on the consumptions page.
+ */
+function refreshHistory () {
+  $('#history').load('/family/manage/ #history')
+}
+
+$(document).ready(function () {
+  // If hash of a category in the URL, then select this category
+  // else select the first one
+  if (location.hash) {
+    $("a[href='" + location.hash + "']").tab('show')
+  } else {
+    $("a[data-toggle='tab']").first().tab('show')
+  }
+
+  // When selecting a category, change URL
+  $(document.body).on('click', "a[data-toggle='tab']", function () {
+    location.hash = this.getAttribute('href')
+  })
+
+})
+
+notes = []
+notes_display = []
+buttons = []
+
+// When the user searches an alias, we update the auto-completion
+autoCompleteFamily('note', 'note_list', notes, notes_display,
+  'note', 'user_note', 'profile_pic', function () {
+    return true
+  })
+
+/**
+ * Add a transaction from a button.
+ * @param fam Where the money goes
+ * @param amount The price of the item
+ * @param type The type of the transaction (content type id for RecurrentTransaction)
+ * @param category_id The category identifier
+ * @param category_name The category name
+ * @param template_id The identifier of the button
+ * @param template_name The name of  the button
+ */
+function addChallenge (id, name, amount) {
+  var challenge = null
+  /** Ajout de 1 à chaque clic d'un bouton déjà choisi  */
+  buttons.forEach(function (b) {
+    if (b.id === id) {
+      challenge = b
+    }
+  })
+  if (challenge == null) {
+    challenge = {
+      id: id,
+      name: name,
+    }
+    buttons.push(challenge)
+  }
+
+  const dc_obj = true
+  
+    const list = 'consos_list'
+    let html = ''
+    buttons.forEach(function (challenge) {
+      html += li('conso_button_' + challenge.id, challenge.name)
+    })
+    document.getElementById(list).innerHTML = html
+
+    buttons.forEach((button) => {
+      document.getElementById(`conso_button_${button.id}`).addEventListener('click', () => {
+        if (LOCK) { return }
+        removeNote(button, 'conso_button', buttons, list)()
+      })
+    })
+
+}
+
+/**
+ * Reset the page as its initial state.
+ */
+function reset () {
+  notes_display.length = 0
+  notes.length = 0
+  buttons.length = 0
+  document.getElementById('note_list').innerHTML = ''
+  document.getElementById('consos_list').innerHTML = ''
+  document.getElementById('note').value = ''
+  document.getElementById('note').dataset.originTitle = ''
+  $('#note').tooltip('hide')
+  document.getElementById('profile_pic').src = '/static/member/img/default_picture.png'
+  document.getElementById('profile_pic_link').href = '#'
+  refreshHistory()
+  LOCK = false
+}
+
+/**
+ * Apply all transactions: all notes in `notes` buy each item in `buttons`
+ */
+function consumeAll () {
+  if (LOCK) { return }
+  LOCK = true
+
+  let error = false
+
+  if (notes_display.length === 0) {
+    // ... gestion erreur ...
+    error = true
+  }
+  if (buttons.length === 0) {
+    // ... gestion erreur ...
+    error = true
+  }
+  if (error) {
+    LOCK = false
+    return
+  }
+  // Récupérer les IDs des familles et des challenges
+  const family_ids = notes_display.map(fam => fam.id)
+  const challenge_ids = buttons.map(chal => chal.id)
+
+  $.ajax({
+    url: '/family/api/family/achievements/batch/',
+    type: 'POST',
+    data: JSON.stringify({
+      families: family_ids,
+      challenges: challenge_ids
+    }),
+    contentType: 'application/json',
+    headers: {
+      'X-CSRFToken': CSRF_TOKEN
+    },
+    success: function (data) {
+      reset()
+      data.results.forEach(function (result) {
+        if (result.status === 'created') {
+          addMsg(
+            interpolate(gettext('Invalid achievement for challenge %s ' +
+            'and family %s created.'), [result.challenge, result.family]),
+            'success',
+            5000
+          )
+        } else {
+          addMsg(
+            interpolate(gettext('An achievement for challenge %s ' +
+            'and family %s already exists.'), [result.challenge, result.family]),
+            'danger',
+            8000
+          )
+        }
+      })
+    }
+  })
+}
+
+
+var searchbar = document.getElementById("search-input")
+var search_results = document.getElementById("search-results")
+
+var old_pattern = null;
+var firstMatch = null;
+/**
+ * Updates the button search tab
+ * @param force Forces the update even if the pattern didn't change
+ */
+function updateSearch(force = false) {
+  let pattern = searchbar.value
+  if (pattern === "")
+    firstMatch = null;
+  if ((pattern === old_pattern || pattern === "") && !force)
+    return;
+  firstMatch = null;
+  const re = new RegExp(pattern, "i");
+  Array.from(search_results.children).forEach(function(b) {
+    if (re.test(b.innerText)) {
+      b.hidden = false;
+      if (firstMatch === null) {
+        firstMatch = b;
+      }
+    } else
+      b.hidden = true;
+  });
+}
+
+searchbar.addEventListener("input", function (e) {
+  debounce(updateSearch)()
+});
+searchbar.addEventListener("keyup", function (e) {
+  if (firstMatch && e.key === "Enter")
+    firstMatch.click()
+});
+
+function createshiny() {
+  const list_btn = document.querySelectorAll('.btn-outline-dark')
+  const shiny_class = list_btn[Math.floor(Math.random() * list_btn.length)].classList
+  shiny_class.replace('btn-outline-dark', 'btn-outline-dark-shiny')
+}
+createshiny()
+
+
+
+
+
+/**
+ * Query the 20 first matched notes with a given pattern
+ * @param pattern The pattern that is queried
+ * @param fun For each found note with the matched alias `alias`, fun(note, alias) is called.
+ */
+function getMatchedFamilies (pattern, fun) {
+  $.getJSON('/api/family/family/?format=json&alias=' + pattern + '&search=family', fun)
+}
+
+/**
+ * Generate a <li> entry with a given id and text
+ */
+function li (id, text, extra_css) {
+  return '<li class="list-group-item py-1 px-2 d-flex justify-content-between align-items-center text-truncate ' +
+        (extra_css || '') + '"' + ' id="' + id + '">' + text + '</li>\n'
+}
+
+
+/**
+ * Génère un champ d'auto-complétion pour rechercher une famille par son nom (version simplifiée sans alias)
+ * @param field_id L'identifiant du champ texte où le nom est saisi
+ * @param family_list_id L'identifiant du bloc div où les familles sélectionnées sont affichées
+ * @param families Un tableau contenant les objets famille sélectionnés
+ * @param families_display Un tableau contenant les infos des familles sélectionnées : [nom, id, objet famille, quantité]
+ * @param family_prefix Le préfixe des <li> pour les familles sélectionnées
+ * @param user_family_field L'identifiant du champ qui affiche la famille survolée (optionnel)
+ * @param profile_pic_field L'identifiant du champ qui affiche la photo de la famille survolée (optionnel)
+ * @param family_click Fonction appelée lors du clic sur un nom. Si elle existe et ne retourne pas true, la famille n'est pas affichée.
+ */
+function autoCompleteFamily(field_id, family_list_id, families, families_display, family_prefix = 'family', user_family_field = null, profile_pic_field = null, family_click = null) {
+  const field = $('#' + field_id)
+  // Configuration du tooltip
+  field.tooltip({
+    html: true,
+    placement: 'bottom',
+    title: 'Chargement...',
+    trigger: 'manual',
+    container: field.parent(),
+    fallbackPlacement: 'clockwise'
+  })
+
+  // Masquer le tooltip lors d'un clic ailleurs
+  $(document).click(function (e) {
+    if (!e.target.id.startsWith(family_prefix)) {
+      field.tooltip('hide')
+    }
+  })
+
+  let old_pattern = null
+
+  // Réinitialiser la recherche au clic
+  field.click(function () {
+    field.tooltip('hide')
+    field.removeClass('is-invalid')
+    field.val('')
+    old_pattern = ''
+  })
+
+  // Sur "Entrée", sélectionner la première famille
+  field.keypress(function (event) {
+    if (event.originalEvent.charCode === 13 && families.length > 0) {
+      const li_obj = field.parent().find('ul li').first()
+      displayFamily(families[0], families[0].name, user_family_field, profile_pic_field)
+      li_obj.trigger('click')
+    }
+  })
+
+  // Mise à jour des suggestions lors de la saisie
+  field.keyup(function (e) {
+    field.removeClass('is-invalid')
+
+    if (e.originalEvent.charCode === 13) { return }
+
+    const pattern = field.val()
+
+    if (pattern === old_pattern) { return }
+    old_pattern = pattern
+    families.length = 0
+
+    if (pattern === '') {
+      field.tooltip('hide')
+      families.length = 0
+      return
+    }
+
+    // Appel à l'API pour récupérer les familles correspondantes
+    $.getJSON('/api/family/family/?format=json&search=' + pattern,
+      function (results) {
+        if (pattern !== $('#' + field_id).val()) { return }
+
+        let matched_html = '<ul class="list-group list-group-flush">'
+        results.results.forEach(function (family) {
+          matched_html += li(family_prefix + '_' + family.id,
+            family.name,
+            '')
+          families.push(family)
+        })
+        matched_html += '</ul>'
+
+        field.attr('data-original-title', matched_html).tooltip('show')
+
+        results.results.forEach(function (family) {
+          const family_obj = $('#' + family_prefix + '_' + family.id)
+          family_obj.hover(function () {
+            displayFamily(family, family.name, user_family_field, profile_pic_field)
+          })
+          family_obj.click(function () {
+            var disp = null
+            families_display.forEach(function (d) {
+              if (d.id === family.id) {
+                disp = d
+              }
+            })
+            if (disp == null) {
+              disp = {
+                name: family.name,
+                id: family.id,
+                family: family,
+              }
+              families_display.push(disp)
+            }
+
+            if (family_click && !family_click()) { return }
+
+            const family_list = $('#' + family_list_id)
+            let html = ''
+            families_display.forEach(function (disp) {
+              html += li(family_prefix + '_' + disp.id,
+                disp.name,
+                '')
+            })
+
+            family_list.html(html)
+            field.tooltip('update')
+
+            families_display.forEach(function (disp) {
+              const line_obj = $('#' + family_prefix + '_' + disp.id)
+              line_obj.hover(function () {
+                displayFamily(disp.family, disp.name, user_family_field, profile_pic_field)
+              })
+              line_obj.click(removeFamily(disp, family_prefix, families_display, family_list_id, user_family_field,
+                profile_pic_field))
+            })
+          })
+        })
+      })
+  })
+}
+
+/**
+ * Affiche le nom et la photo d'une famille
+ * @param family L'objet famille à afficher
+ * @param user_family_field L'identifiant du champ où afficher le nom (optionnel)
+ * @param profile_pic_field L'identifiant du champ où afficher la photo (optionnel)
+ */
+function displayFamily(family, user_family_field = null, profile_pic_field = null) {
+  if (!family.display_image) {
+    family.display_image = '/static/member/img/default_picture.png'
+  }
+  if (user_family_field !== null) {
+    $('#' + user_family_field).removeAttr('class')
+    $('#' + user_family_field).text(family.name)
+    if (profile_pic_field != null) {
+      $('#' + profile_pic_field).attr('src', family.display_image)
+      // Si tu veux un lien vers la page famille :
+      $('#' + profile_pic_field + '_link').attr('href', '/family/detail/' + family.id + '/')
+    }
+  }
+}
+
+
+/**
+ * Retire une famille de la liste sélectionnée.
+ * @param d La famille à retirer
+ * @param family_prefix Le préfixe des <li>
+ * @param families_display Le tableau des familles sélectionnées
+ * @param family_list_id L'id du bloc où sont affichées les familles
+ * @param user_family_field Champ d'affichage (optionnel)
+ * @param profile_pic_field Champ photo (optionnel)
+ * @returns une fonction compatible avec les événements jQuery
+ */
+function removeFamily(d, family_prefix, families_display, family_list_id, user_family_field = null, profile_pic_field = null) {
+  return function () {
+    const new_families_display = []
+    let html = ''
+    families_display.forEach(function (disp) {
+    })
+
+    families_display.length = 0
+    new_families_display.forEach(function (disp) {
+      families_display.push(disp)
+    })
+
+    $('#' + family_list_id).html(html)
+    families_display.forEach(function (disp) {
+      const obj = $('#' + family_prefix + '_' + disp.id)
+      obj.click(removeFamily(disp, family_prefix, families_display, family_list_id, user_family_field, profile_pic_field))
+      obj.hover(function () {
+        displayFamily(disp.family, user_family_field, profile_pic_field)
+      })
+    })
+  }
+}

apps/family/tables.py

@@ -0,0 +1,149 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import django_tables2 as tables
+from django.utils.html import format_html
+from django.utils.translation import gettext_lazy as _
+from django_tables2 import A
+from django.urls import reverse, reverse_lazy
+from note_kfet.middlewares import get_current_request
+from permission.backends import PermissionBackend
+
+from .models import Achievement, Challenge, Family, FamilyMembership
+
+
+class FamilyTable(tables.Table):
+    """
+    List all families
+    """
+
+    description = tables.Column(verbose_name=_("Description"))
+
+    class Meta:
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover'
+        }
+        model = Family
+        template_name = 'django_tables2/bootstrap4.html'
+        fields = ('name', 'score', 'rank',)
+        order_by = ('rank',)
+        row_attrs = {
+            'class': 'table-row',
+            'data-href': lambda record: reverse('family:family_detail', args=[record.pk]),
+            'style': 'cursor:pointer',
+        }
+
+
+class ChallengeTable(tables.Table):
+    """
+    List all challenges
+    """
+
+    name = tables.Column(verbose_name=_("Name"))
+    description = tables.Column(verbose_name=_("Description"))
+    points = tables.Column(verbose_name=_("Points"))
+
+    class Meta:
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover'
+        }
+        order_by = ('id',)
+        model = Challenge
+        template_name = 'django_tables2/bootstrap4.html'
+        fields = ('name', 'description', 'points',)
+        row_attrs = {
+            'class': 'table-row',
+            'data-href': lambda record: reverse('family:challenge_detail', args=[record.pk]),
+            'style': 'cursor:pointer',
+        }
+
+
+class FamilyMembershipTable(tables.Table):
+    """
+    List all family memberships.
+    """
+
+    def render_user(self, value):
+        # Display user's name, clickable if permission is granted
+        s = value.username
+        if PermissionBackend.check_perm(get_current_request(), "auth.view_user", value):
+            s = format_html("<a href='{url}'>{name}</a>",
+                            url=reverse_lazy('member:user_detail', kwargs={"pk": value.pk}), name=s)
+        return s
+
+    class Meta:
+        attrs = {
+            'class': 'table table-condensed table-striped',
+            'style': 'table-layout: fixed;'
+        }
+        template_name = 'django_tables2/bootstrap4.html'
+        fields = ('user',)
+        model = FamilyMembership
+
+
+class AchievementTable(tables.Table):
+    """
+    List recent achievements.
+    """
+
+    challenge = tables.Column(verbose_name=_("Challenge"))
+
+    validate = tables.LinkColumn(
+        'family:achievement_validate',
+        args=[A('id')],
+        verbose_name=_("Validate"),
+        text=_("Validate"),
+        orderable=False,
+        attrs={
+            'th': {
+                'id': 'validate-achievement-header'
+            },
+            'a': {
+                'class': 'btn btn-success',
+                'data-type': 'validate-achievement'
+            }
+        },
+    )
+
+    delete = tables.LinkColumn(
+        'family:achievement_delete',
+        args=[A('id')],
+        verbose_name=_("Delete"),
+        text=_("Delete"),
+        orderable=False,
+        attrs={
+            'th': {
+                'id': 'delete-achievement-header'
+            },
+            'a': {
+                'class': 'btn btn-danger',
+                'data-type': 'delete-achievement'
+            }
+        },
+    )
+
+    class Meta:
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover'
+        }
+        model = Achievement
+        fields = ('family', 'challenge', 'challenge__points', 'obtained_at', 'valid')
+        template_name = 'django_tables2/bootstrap4.html'
+        order_by = ('-obtained_at',)
+
+
+class FamilyAchievementTable(tables.Table):
+    """
+    Table des défis réalisés par une famille spécifique.
+    """
+
+    challenge = tables.Column(verbose_name=_("Challenge"))
+
+    class Meta:
+        model = Achievement
+        template_name = 'django_tables2/bootstrap4.html'
+        fields = ('challenge', 'challenge__points', 'obtained_at', 'valid')
+        attrs = {
+            'class': 'table table-condensed table-striped table-hover'
+        }
+        order_by = ('-obtained_at',)

apps/family/templates/family/achievement_confirm_delete.html

@@ -0,0 +1,25 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+    <div class="card bg-light">
+        <div class="card-header text-center">
+            <h4>{% trans "Delete achievement" %}</h4>
+        </div>
+            <div class="card-body">
+                <div class="alert alert-warning">
+                    {% blocktrans %}Are you sure you want to delete this achievement? This action can't be undone.{% endblocktrans %}
+                </div>
+            </div>
+        <div class="card-footer text-center">
+            <form method="post">
+                {% csrf_token %}
+                <a class="btn btn-primary" href="{% url 'family:achievement_list' %}">{% trans "Return to achievements list" %}</a>
+                <button class="btn btn-danger" type="submit">{% trans "Delete" %}</button>
+            </form>
+        </div>
+    </div>
+{% endblock %}

apps/family/templates/family/achievement_confirm_validate.html

@@ -0,0 +1,28 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+    <div class="card bg-light">
+        <div class="card-header text-center">
+            <h4>{% trans "Validate achievement" %}</h4>
+        </div>
+            <div class="card-body">
+                <div class="alert alert-warning">
+                    {% blocktrans %}Are you sure you want to validate this achievement? This action can't be undone.{% endblocktrans %}
+                </div>
+            </div>
+        <div class="card-footer text-center">
+            <form method="post">
+                {% csrf_token %}
+                <a class="btn btn-primary" href="{% url 'family:achievement_list' %}">{% trans "Return to achievements list" %}</a>
+                <form method="post" action="{% url 'family:achievement_validate' pk %}">
+                    {% csrf_token %}
+                    <button type="submit" class="btn btn-success">{% trans "Validate" %}</button>
+                </form>
+            </form>
+        </div>
+    </div>
+{% endblock %}

apps/family/templates/family/achievement_list.html

@@ -0,0 +1,33 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n django_tables2 %}
+
+{% block content %}
+
+<div class="card mb-4" id="history">
+    <div class="card-header">
+        <p class="card-text font-weight-bold">
+            {% trans "Invalid achievements history" %}
+        </p>
+        <a class="btn btn-sm btn-primary mx-2" href="{% url "family:manage" %}">
+            {% trans "Return to management page" %}
+        </a>
+    </div>
+    {% render_table invalid %}
+</div>
+
+<div class="card mb-4" id="history">
+    <div class="card-header">
+        <p class="card-text font-weight-bold">
+            {% trans "Valid achievements history" %}
+        </p>
+        <a class="btn btn-sm btn-primary mx-2" href="{% url "family:manage" %}">
+            {% trans "Return to management page" %}
+        </a>
+    </div>
+    {% render_table valid %}
+</div>
+{% endblock %}

apps/family/templates/family/add_member.html

@@ -0,0 +1,60 @@
+{% extends "family/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load crispy_forms_tags i18n pretty_money %}
+
+{% block profile_content %}
+<div class="card bg-light">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    <div class="card-body">
+        
+        <form method="post" action="">
+            {% csrf_token %}
+            {{ form|crispy }}
+            <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
+        </form>
+    </div>
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script>
+    function autocompleted(user) {
+        $("#id_last_name").val(user.last_name);
+        $("#id_first_name").val(user.first_name);
+        $.getJSON("/api/members/profile/" + user.id + "/", function (profile) {
+            let fee = profile.paid ? "{{ club.membership_fee_paid }}" : "{{ club.membership_fee_unpaid }}";
+            $("#id_credit_amount").val((Number(fee) / 100).toFixed(2));
+        });
+    }
+
+    soge_field = $("#id_soge");
+
+    function fillFields() {
+        let checked = soge_field.is(':checked');
+        if (!checked) {
+            $("input").attr('disabled', false);
+            $("#id_user").attr('disabled', true);
+            $("select").attr('disabled', false);
+            return;
+        }
+
+        let credit_type = $("#id_credit_type");
+        credit_type.attr('disabled', true);
+        credit_type.val(4);
+
+        let credit_amount = $("#id_credit_amount");
+        credit_amount.attr('disabled', true);
+        credit_amount.val('{{ total_fee }}');
+
+        let bank = $("#id_bank");
+        bank.attr('disabled', true);
+        bank.val('Société générale');
+    }
+
+    soge_field.change(fillFields);
+</script>
+{% endblock %}

apps/family/templates/family/base.html

@@ -0,0 +1,52 @@
+{% extends "base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n perms %}
+
+{# Use a fluid-width container #}
+{% block containertype %}container-fluid{% endblock %}
+
+{% block content %}
+<div class="row mt-4">
+    <div class="col-xl-4">
+        {% block profile_info %}
+        <div class="card bg-light" id="card-infos">
+            <h4 class="card-header text-center">
+                {{ family.name }}
+            </h4>
+            <div class="text-center">
+                <a href="{% url 'family:update_pic' family.pk  %}">
+                    <img src="{{ family.display_image.url }}" class="img-thumbnail mt-2">
+                </a>
+            </div>
+            <div class="card-body" id="profile_infos">
+                {% include "family/family_info.html" %}
+            </div>
+            <div class="card-footer">
+                {% if can_add_members %}
+                <a class="btn btn-sm btn-success" href="{% url 'family:family_add_member' family_pk=family.pk %}"
+                   data-turbolinks="false"> {% trans "Add member" %}</a>
+                {% endif %}
+                {% if ".change_"|has_perm:family %}
+                <a class="btn btn-sm btn-secondary" href="{% url 'family:family_update' pk=family.pk %}"
+                   data-turbolinks="false">
+                    <i class="fa fa-edit"></i> {% trans 'Update Profile' %}
+                </a>
+                {% endif %}
+                {% url 'family:family_detail' family.pk as family_detail_url %}
+                {% if request.path_info != family_detail_url %}
+                <a class="btn btn-sm btn-primary" href="{{ family_detail_url }}">{% trans 'View Profile' %}</a>
+                {% endif %}
+                <a class="btn btn-sm btn-primary" href="{% url "family:family_list" %}">
+                    {% trans "Return to the family list" %}
+                  </a>
+            </div>
+        </div>
+        {% endblock %}
+    </div>
+    <div class="col-xl-8">
+        {% block profile_content %}{% endblock %}
+    </div>
+</div>
+{% endblock %}

apps/family/templates/family/challenge_detail.html

@@ -0,0 +1,36 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }} {{ challenge.name }}
+  </h3>
+  <div class="card-body">
+    <ul>
+      {% for field, value in fields %}
+      <li> {{ field }} : {{ value }}</li>
+      {% endfor %}
+      <li> {% trans "Obtained by " %} {{obtained}}
+        {% if obtained > 1 %}
+          {% trans "families" %}
+        {% else %}
+          {% trans "family" %}
+        {% endif %}
+      </li>
+    </ul>
+      <a class="btn btn-sm btn-primary" href="{% url "family:challenge_list" %}">
+        {% trans "Return to the challenge list" %}
+      </a>
+      {% if update %}
+      <a class="btn btn-sm btn-secondary" href="{% url "family:challenge_update" pk=challenge.pk %}">
+        {% trans "Update" %}
+      </a>
+      {% endif %}
+  </div>
+</div>
+{% endblock %}

apps/family/templates/family/challenge_form.html

@@ -1,5 +1,6 @@
 {% extends "base.html" %}
 {% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
 SPDX-License-Identifier: GPL-3.0-or-later
 {% endcomment %}
 {% load i18n crispy_forms_tags %}

apps/family/templates/family/challenge_list.html

@@ -0,0 +1,42 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+{% block content %}
+<div class="row">
+    <div class="col-xl-12">
+        <div class="btn-group btn-group-toggle" style="width: 100%; padding: 0 0 2em 0">
+            <a href="{% url "family:family_list" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Families" %}
+            </a>
+            <a href="#" class="btn btn-sm btn-outline-primary active">
+                {% trans "Challenges" %}
+            </a>
+            {% if can_manage %}
+            <a href="{% url "family:manage" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Manage" %}
+            </a>
+            {% endif %}
+        </div>
+    </div>
+</div>
+
+<div class="card bg-white mb-3">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    {% render_table table %}
+</div>
+{% endblock %}
+
+{% block extrajavascript %}
+<script type="text/javascript">
+    $(".table-row").click(function () {
+            window.document.location = $(this).data("href");
+        });
+</script>
+{% endblock %}

apps/family/templates/family/family_detail.html

@@ -0,0 +1,29 @@
+{% extends "family/base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n perms %}
+
+{% block profile_content %}
+{% if member_list.data %}
+<div class="card">
+    <div class="card-header position-relative" id="clubListHeading">
+        <i class="fa fa-users"></i> {% trans "Family members" %}
+    </div>
+    {% render_table member_list %}
+</div>
+
+<div class="my-4"></div>
+{% endif %}
+
+{% if achievement_list.data %}
+<div class="card">
+    <div class="card-header position-relative">
+        <i class="fa fa-trophy"></i> {% trans "Completed challenges" %}
+    </div>
+    {% render_table achievement_list %}
+</div>
+{% endif %}
+{% endblock %}

apps/family/templates/family/family_form.html

@@ -1,5 +1,6 @@
 {% extends "base.html" %}
 {% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
 SPDX-License-Identifier: GPL-3.0-or-later
 {% endcomment %}
 {% load i18n crispy_forms_tags %}

apps/family/templates/family/family_info.html

@@ -0,0 +1,15 @@
+{% load i18n pretty_money perms %}
+
+<dl class="row">
+    <dt class="col-xl-6">{% trans 'name'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ family.name }}</dd>
+
+    <dt class="col-xl-6">{% trans 'description'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ family.description }}</dd>
+
+    <dt class="col-xl-6">{% trans 'score'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ family.score }}</dd>
+
+    <dt class="col-xl-6">{% trans 'rank'|capfirst %}</dt>
+    <dd class="col-xl-6">{{ family.rank }}</dd>
+</dl>

apps/family/templates/family/family_list.html

@@ -0,0 +1,43 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+{% block content %}
+<div class="row">
+    <div class="col-xl-12">
+        <div class="btn-group btn-group-toggle" style="width: 100%; padding: 0 0 2em 0">
+            <a href="#" class="btn btn-sm btn-outline-primary active">
+                {% trans "Families" %}
+            </a>
+            <a href="{% url "family:challenge_list" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Challenges" %}
+            </a>
+            {% if can_manage %}
+            <a href="{% url "family:manage" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Manage" %}
+            </a>
+            {% endif %}
+        </div>
+    </div>
+</div>
+
+<div class="card bg-white mb-3">
+    <h3 class="card-header text-center">
+        {{ title }}
+    </h3>
+    {% render_table table %}
+</div>
+
+{% endblock %}
+
+{% block extrajavascript %}
+<script type="text/javascript">
+    $(".table-row").click(function () {
+            window.document.location = $(this).data("href");
+        });
+</script>
+{% endblock %}

apps/family/templates/family/manage.html

@@ -0,0 +1,287 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n static django_tables2 %}
+
+{% block containertype %}container-fluid{% endblock %}
+
+{% block content %}
+<div class="row">
+    <div class="col-xl-12">
+        <div class="btn-group btn-group-toggle" style="width: 100%; padding: 0 0 2em 0">
+            <a href="{% url "family:family_list" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Families" %}
+            </a>
+            <a href="{% url "family:challenge_list" %}" class="btn btn-sm btn-outline-primary">
+                {% trans "Challenges" %}
+            </a>
+            <a href="#" class="btn btn-sm btn-outline-primary active">
+                {% trans "Manage" %}
+            </a>
+        </div>
+    </div>
+</div>
+
+<div class="row mb-3">
+    <div class='col-sm-5 col-xl-6' id="infos_div">
+        {% if can_add_achievement %}
+        <div class="row justify-content-center justify-content-md-end">
+            {# Family details column #}
+            <div class="col picture-col">
+                <div class="card bg-light mb-4 text-center">
+                    <a id="profile_pic_link" href="#">
+                        <img src="{% static "member/img/default_picture.png" %}" id="profile_pic" alt="" class="card-img-top d-none d-sm-block">
+                    </a>
+                    <div class="card-body text-center text-break p-2">
+                        <span id="user_note"><i class="small">{% trans "Please select a family" %}</i></span>
+                    </div>
+                </div>
+            </div>
+
+            {# Family selection column #}
+            <div class="col-xl" id="user_select_div">
+                <div class="card bg-light border-success mb-4">
+                    <div class="card-header">
+                        <p class="card-text font-weight-bold">
+                            {% trans "Families" %}
+                        </p>
+                    </div>
+                    <div class="card-body p-0" style="min-height:125px;">
+                        <ul class="list-group list-group-flush" id="note_list"></ul>
+                    </div>
+                    {# User search with autocompletion #}
+                    <div class="card-footer">
+                        <input class="form-control mx-auto d-block mb-2" placeholder="{% trans "Name" %}" type="text" id="note" autofocus />
+                        {% if user_family %}
+                        <button class="btn btn-sm btn-secondary btn-block" id="select_my_family">
+                            {% trans "Select my family" %} ({{ user_family.name }})
+                        </button>
+                        {% endif %}
+                    </div>
+                </div>
+            </div>
+
+            {# Summary of challenges and validate button #}
+            <div class="col-xl-5" id="consos_list_div">
+                <div class="card bg-light border-info mb-4">
+                    <div class="card-header">
+                        <p class="card-text font-weight-bold">
+                            {% trans "Challenges" %}
+                        </p>
+                    </div>
+                    <div class="card-body p-0" style="min-height:125px;">
+                        <ul class="list-group list-group-flush" id="consos_list"></ul>
+                    </div>
+                    <div class="card-footer text-center">
+                        <span id="consume_all" class="btn btn-primary">
+                            {% trans "Validate!" %}
+                        </span>
+                    </div>
+                </div>
+            </div>
+        </div>
+        {% endif %}
+
+        {# Create family/challenge buttons #}
+        {% if can_add_family or can_add_challenge %}
+        <div class="card bg-light border-success mb-4">
+          <h3 class="card-header font-weight-bold text-center">
+              {% trans "Create a family or challenge" %}
+          </h3>
+        <div class="card-body text-center">
+            {% if can_add_family %}
+            <a class="btn btn-sm btn-primary mx-2" href="{% url "family:family_create" %}">
+                {% trans "Add a family" %}
+            </a>
+            {% endif %}
+            {% if can_add_challenge %}
+            <a class="btn btn-sm btn-primary mx-2" href="{% url "family:challenge_create" %}">
+                {% trans "Add a challenge" %}
+            </a>
+            {% endif %}
+        </div>
+        </div>
+        {% endif %}
+    </div>
+
+    {# Buttons column #}
+    <div class="col">
+        {% if can_add_achievement %}
+        <div class="card bg-light border-primary text-center mb-4">
+            {# Tabs for list and search #}
+            <div class="card-header">
+                <ul class="nav nav-tabs nav-fill card-header-tabs">
+                    <li class="nav-item">
+                        <a class="nav-link font-weight-bold" data-toggle="tab" href="#list">
+                            {% trans "List" %}
+                        </a>
+                    </li>
+                    <li class="nav-item">
+                        <a class="nav-link font-weight-bold" data-toggle="tab" href="#search">
+                            {% trans "Search" %}
+                        </a>
+                    </li>
+                </ul>
+            </div>
+
+            {# Tabs content #}
+            <div class="card-body">
+                <div class="tab-content">
+                    <div class="tab-pane" id="list">
+                        <div class="d-inline-flex flex-wrap justify-content-center">
+                            {% for challenge in all_challenges %}
+                                    <button class="btn btn-outline-dark rounded-0 flex-fill"
+                                            id="challenge{{ challenge.id }}" name="button" value="{{ challenge.name }}">
+                                        {{ challenge.name }} ({{ challenge.points }} {% trans "points" %})
+                                    </button>
+                            {% endfor %}
+                        </div>
+                    </div>
+                    <div class="tab-pane" id="search">
+                        <input class="form-control mx-auto d-block mb-3" placeholder="{% trans "Search challenge..." %}" type="search" id="search-input"/>
+                        <div class="d-inline-flex flex-wrap justify-content-center" id="search-results">
+                            {% for challenge in all_challenges %}
+                                    <button class="btn btn-outline-dark rounded-0 flex-fill" hidden
+                                            id="search_challenge{{ challenge.id }}" name="button" value="{{ challenge.name }}">
+                                            {{ challenge.name }} ({{ challenge.points }} {% trans "points" %})
+                                    </button>
+                            {% endfor %}
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+        </div>
+        {% endif %}
+    </div>
+</div>
+
+{# achievement history #}
+{% if table.data %}
+    <div class="card">
+        <div class="card-header position-relative" id="historyListHeading">
+            <a class="stretched-link font-weight-bold" 
+                href="{% url 'family:achievement_list' %}" >
+                {% trans "Recent achievements history" %}
+            </a>
+        </div>
+        <div id="history">
+            {% render_table table %}
+        </div>
+    </div>
+
+        <!-- Popup de validation -->
+    <div class="modal fade" id="validationModal" tabindex="-1" role="dialog" aria-labelledby="validationModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-dialog-centered" role="document">
+        <div class="modal-content border-success">
+        <div class="modal-header bg-success text-white">
+            <h5 class="modal-title" id="validationModalLabel">{% trans "Confirmation" %}</h5>
+            <button type="button" class="close text-white" data-dismiss="modal" aria-label="Close">
+            <span aria-hidden="true">&times;</span>
+            </button>
+        </div>
+        <div class="modal-body">
+                <p><strong>{% trans "Are you sure you want to validate this challenge?" %}</strong></p>
+                <p>{% trans "To have your challenge officially validated, please send a message with:" %}</p>
+                <ul>
+                <li>{% trans "The name of the family" %}</li>
+                <li>{% trans "The name of the challenge" %}</li>
+                <li>{% trans "A photo or video as proof" %}</li>
+                </ul>
+                <p>
+                <strong>{% trans "Send it via WhatsApp to:" %}</strong>
+                {% if phone_numbers %}"
+                {% for num in phone_numbers %}
+                    <a href="https://wa.me/{{ num }}" target="_blank">{{ num }}</a>{% if not forloop.last %}, {% endif %}
+                {% endfor %}
+                {% endif %}
+                </p>
+        </div>
+        <div class="modal-footer">
+            <button type="button" class="btn btn-primary" data-dismiss="modal">{% trans "OK" %}</button>
+        </div>
+        </div>
+    </div>
+    </div>
+{% endif %}
+{% endblock %}
+
+
+
+{% block extrajavascript %}
+    <script type="text/javascript" src="{% static "family/js/achievements.js" %}"></script>
+    <script type="text/javascript">
+        {% for challenge in all_challenges %}
+        document.getElementById("challenge{{ challenge.id }}").addEventListener("click", function() {
+            addChallenge({{ challenge.id}}, "{{ challenge.name|escapejs }}", {{ challenge.points }});
+        });
+        {% endfor %}
+    
+        {% for challenge in all_challenges %}
+            document.getElementById("search_challenge{{ challenge.id }}").addEventListener("click", function() {
+                addChallenge({{ challenge.id}}, "{{ challenge.name|escapejs }}", {{ challenge.points }});
+            });
+        {% endfor %} 
+    </script>
+    <script>
+        document.getElementById("consume_all").addEventListener("click", function () {
+            $('#validationModal').modal('show');
+        });
+
+        $('#validationModal .btn-primary').on('click', function () {
+            consumeAll();
+        });
+        
+        {% if user_family %}
+        document.getElementById("select_my_family").addEventListener("click", function () {
+            // Simulate selecting the user's family
+            var userFamily = {
+                id: {{ user_family.id }},
+                name: "{{ user_family.name|escapejs }}",
+                display_image: "{{ user_family.display_image.url|default:'/static/member/img/default_picture.png'|escapejs }}"
+            };
+            
+            // Check if family is already selected
+            var alreadySelected = false;
+            notes_display.forEach(function (d) {
+                if (d.id === userFamily.id) {
+                    alreadySelected = true;
+                }
+            });
+            
+            if (!alreadySelected) {
+                // Add the family to the selected families
+                var disp = {
+                    name: userFamily.name,
+                    id: userFamily.id,
+                    family: userFamily,
+                };
+                notes_display.push(disp);
+                
+                // Update the display
+                const family_list = $('#note_list');
+                let html = '';
+                notes_display.forEach(function (disp) {
+                    html += li('note_' + disp.id, disp.name, '');
+                });
+                
+                family_list.html(html);
+                
+                // Add click handlers for removal
+                notes_display.forEach(function (disp) {
+                    const line_obj = $('#note_' + disp.id);
+                    line_obj.hover(function () {
+                        displayFamily(disp.family, disp.name, 'user_note', 'profile_pic');
+                    });
+                    line_obj.click(removeFamily(disp, 'note', notes_display, 'note_list', 'user_note', 'profile_pic'));
+                });
+                
+                // Display the family info
+                displayFamily(userFamily, userFamily.name, 'user_note', 'profile_pic');
+            }
+        });
+        {% endif %}
+    </script>
+{% endblock %}

apps/family/templates/family/picture_update.html

@@ -0,0 +1,118 @@
+{% extends "family/base.html" %}
+{% comment %}
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block profile_content %}
+<div class="card bg-light">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body">
+    <div class="text-center">
+      <form method="post" enctype="multipart/form-data" id="formUpload">
+        {% csrf_token %}
+        {{ form |crispy }}
+        {% if user.note.display_image != "pic/default.png" %}
+          <input type="submit" class="btn btn-primary" value="{% trans "Remove" %}">
+        {% endif %}
+      </form>
+    </div>
+    <!-- MODAL TO CROP THE IMAGE -->
+    <div class="modal fade" id="modalCrop" data-backdrop="static">
+      <div class="modal-dialog">
+        <div class="modal-content">
+            <div class="modal-body-wrapper" style="width: 500px; height: 500px; padding: 16px;">
+              <div class="modal-body" style="width: 100%; height: 100%; padding: 0">
+                <img src="" id="modal-image" style="display: block; max-width: 100%;">
+              </div>
+            </div>
+          <div class="modal-footer">
+            <div class="btn-group pull-left" role="group">
+              <button type="button" class="btn btn-default" id="js-zoom-in">
+                <span class="glyphicon glyphicon-zoom-in"></span>
+              </button>
+              <button type="button" class="btn btn-default js-zoom-out">
+                <span class="glyphicon glyphicon-zoom-out"></span>
+              </button>
+            </div>
+            <button type="button" class="btn btn-default" data-dismiss="modal">{% trans "Nevermind" %}</button>
+            <button type="button" class="btn btn-primary js-crop-and-upload">{% trans "Crop and upload" %}</button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+{% endblock %}
+
+{% block extracss %}
+<link href="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.6/cropper.min.css" rel="stylesheet">
+{% endblock %}
+
+{% block extrajavascript%}
+<script src="https://cdnjs.cloudflare.com/ajax/libs/cropperjs/1.5.6/cropper.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/jquery-cropper@1.0.1/dist/jquery-cropper.min.js"></script>
+<script>
+  $(function () {
+
+    /* SCRIPT TO OPEN THE MODAL WITH THE PREVIEW */
+    $("#id_image").change(function (e) {
+      if (this.files && this.files[0]) {
+        // Check the image size
+        if (this.files[0].size > 2*1024*1024) {
+          alert("Ce fichier est trop volumineux.")
+	} else {
+          // Read the selected image file
+          var reader = new FileReader();
+          reader.onload = function (e) {
+            $("#modal-image").attr("src", e.target.result);
+            $("#modalCrop").modal("show");
+          }
+          reader.readAsDataURL(this.files[0]);
+        }
+      }
+    });
+
+    /* SCRIPTS TO HANDLE THE CROPPER BOX */
+    var $image = $("#modal-image");
+    var cropBoxData;
+    var canvasData;
+    $("#modalCrop").on("shown.bs.modal", function () {
+      $image.cropper({
+        viewMode: 1,
+        aspectRatio: 1 / 1,
+        minCropBoxWidth: 200,
+        minCropBoxHeight: 200,
+        ready: function () {
+          $image.cropper("setCanvasData", canvasData);
+          $image.cropper("setCropBoxData", cropBoxData);
+        }
+      });
+    }).on("hidden.bs.modal", function () {
+      cropBoxData = $image.cropper("getCropBoxData");
+      canvasData = $image.cropper("getCanvasData");
+      $image.cropper("destroy");
+    });
+
+    $(".js-zoom-in").click(function () {
+      $image.cropper("zoom", 0.1);
+    });
+
+    $(".js-zoom-out").click(function () {
+      $image.cropper("zoom", -0.1);
+    });
+
+    /* SCRIPT TO COLLECT THE DATA AND POST TO THE SERVER */
+    $(".js-crop-and-upload").click(function () {
+      var cropData = $image.cropper("getData");
+      $("#id_x").val(cropData["x"]);
+      $("#id_y").val(cropData["y"]);
+      $("#id_height").val(cropData["height"]);
+      $("#id_width").val(cropData["width"]);
+      $("#formUpload").submit();
+    });
+  });
+</script>
+{% endblock %}

apps/family/tests/test_family.py

@@ -0,0 +1,328 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import os
+
+from api.tests import TestAPI
+from django.contrib.auth.models import User
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.test import TestCase
+from rest_framework.test import APITestCase
+from django.urls import reverse
+from django.utils import timezone
+
+from ..api.views import FamilyViewSet, FamilyMembershipViewSet, ChallengeViewSet, AchievementViewSet
+from ..models import Family, FamilyMembership, Challenge, Achievement
+
+
+class TestFamily(TestCase):
+    """
+    Test family
+    """
+
+    def setUp(self):
+        self.user = User.objects.create_superuser(
+            username='admintoto',
+            password='toto1234',
+            email='toto@example.com',
+        )
+        self.client.force_login(self.user)
+
+        sess = self.client.session
+        sess['permission_mask'] = 42
+        sess.save()
+
+        self.family = Family.objects.create(
+            name='Test family',
+            description='',
+        )
+
+        self.challenge = Challenge.objects.create(
+            name='Test challenge',
+            description='',
+            points=100,
+        )
+
+        self.achievement = Achievement.objects.create(
+            family=self.family,
+            challenge=self.challenge,
+            valid=False,
+        )
+
+    def test_family_list(self):
+        """
+        Test display family list
+        """
+        response = self.client.get(reverse("family:family_list"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_family_create(self):
+        """
+        Test create a family
+        """
+        response = self.client.get(reverse("family:family_create"))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(reverse("family:family_create"), data={
+            "name": "Family toto",
+            "description": "A test family",
+        })
+        self.assertTrue(Family.objects.filter(name="Family toto").exists())
+        self.assertRedirects(response, reverse("family:manage"), 302, 200)
+
+    def test_family_detail(self):
+        """
+        Test display the detail of a family
+        """
+        response = self.client.get(reverse("family:family_detail", args=(self.family.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+    def test_family_update(self):
+        """
+        Test update a family
+        """
+        response = self.client.get(reverse("family:family_update", args=(self.family.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(reverse("family:family_update", args=(self.family.pk,)), data=dict(
+            name="Toto family updated",
+            description="A larger description for the test family"
+        ))
+        self.assertRedirects(response, self.family.get_absolute_url(), 302, 200)
+        self.assertTrue(Family.objects.filter(name="Toto family updated").exists())
+
+    def test_family_update_picture(self):
+        """
+        Test update the picture of a family
+        """
+        response = self.client.get(reverse("family:update_pic", args=(self.family.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        old_pic = self.family.display_image
+
+        with open("apps/family/static/family/img/default_picture.png", "rb") as f:
+            image = SimpleUploadedFile("image.png", f.read(), "image/png")
+            response = self.client.post(reverse("family:update_pic", args=(self.family.pk,)), dict(
+                image=image,
+                x=0,
+                y=0,
+                width=200,
+                height=200,
+            ))
+            self.assertRedirects(response, self.family.get_absolute_url(), 302, 200)
+
+        self.family.refresh_from_db()
+        self.assertTrue(os.path.exists(self.family.display_image.path))
+        os.remove(self.family.display_image.path)
+
+        self.family.display_image = old_pic
+        self.family.save()
+
+    def test_family_add_member(self):
+        """
+        Test add memberships to a family
+        """
+        response = self.client.get(reverse("family:family_add_member", args=(self.family.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        user = User.objects.create(username="totototo")
+        user.profile.registration_valid = True
+        user.profile.email_confirmed = True
+        user.profile.save()
+        user.save()
+
+        response = self.client.post(reverse("family:family_add_member", args=(self.family.pk,)), data=dict(
+            user=user.pk,
+        ))
+        self.assertRedirects(response, self.family.get_absolute_url(), 302, 200)
+
+        self.assertTrue(FamilyMembership.objects.filter(user=user, family=self.family, year=timezone.now().year).exists())
+
+    def test_challenge_list(self):
+        """
+        Test display challenge list
+        """
+        response = self.client.get(reverse('family:challenge_list'))
+        self.assertEqual(response.status_code, 200)
+
+    def test_challenge_create(self):
+        """
+        Test create a challenge
+        """
+        response = self.client.get(reverse("family:challenge_create"))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(reverse("family:challenge_create"), data={
+            "name": "Challenge for toto",
+            "description": "A test challenge",
+            "points": 50,
+        })
+        self.assertTrue(Challenge.objects.filter(name="Challenge for toto").exists())
+        self.assertRedirects(response, reverse("family:manage"), 302, 200)
+
+    def test_challenge_detail(self):
+        """
+        Test display the detail of a challenge
+        """
+        response = self.client.get(reverse("family:challenge_detail", args=(self.challenge.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+    def test_challenge_update(self):
+        """
+        Test update a challenge
+        """
+        response = self.client.get(reverse("family:challenge_update", args=(self.challenge.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(reverse("family:challenge_update", args=(self.challenge.pk,)), data=dict(
+            name="Challenge updated",
+            description="Another description",
+            points=10,
+        ))
+        self.assertRedirects(response, self.challenge.get_absolute_url(), 302, 200)
+        self.assertTrue(Challenge.objects.filter(name="Challenge updated").exists())
+
+    def test_render_manage_page(self):
+        """
+        Test render manage page
+        """
+        response = self.client.get(reverse("family:manage"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_validate_achievement(self):
+        """
+        Test validate an achievement
+        """
+        old_family_score = self.family.score
+
+        response = self.client.get(reverse("family:achievement_validate", args=(self.achievement.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(reverse("family:achievement_validate", args=(self.achievement.pk,)))
+        self.assertRedirects(response, reverse("family:achievement_list"), 302, 200)
+
+        self.achievement.refresh_from_db()
+        self.assertIs(self.achievement.valid, True)
+
+        self.family.refresh_from_db()
+        self.assertEqual(self.family.score, old_family_score + self.achievement.challenge.points)
+
+    def test_delete_achievement(self):
+        """
+        Test delete an achievement
+        """
+        response = self.client.get(reverse("family:achievement_delete", args=(self.achievement.pk,)))
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.delete(reverse("family:achievement_delete", args=(self.achievement.pk,)))
+        self.assertRedirects(response, reverse("family:achievement_list"), 302, 200)
+        self.assertFalse(Achievement.objects.filter(pk=self.achievement.pk).exists())
+
+
+class TestBatchAchievements(APITestCase):
+    def setUp(self):
+        self.user = User.objects.create_superuser(
+            username='admintoto',
+            password='toto1234',
+            email='toto@example.com',
+        )
+        self.client.force_login(self.user)
+
+        sess = self.client.session
+        sess['permission_mask'] = 42
+        sess.save()
+
+        self.families = [
+            Family.objects.create(name=f'Famille {i}', description='') for i in range(2)
+        ]
+        self.challenges = [
+            Challenge.objects.create(name=f'Challenge {i}', description='', points=50) for i in range(3)
+        ]
+
+        self.achievement = Achievement.objects.create(
+            family=self.families[0],
+            challenge=self.challenges[0],
+            valid=False,
+        )
+
+        self.url = reverse("family:api:batch_achievements")
+
+    def test_batch_achievement_creation(self):
+        family_ids = [f.id for f in self.families]
+        challenge_ids = [c.id for c in self.challenges]
+        response = self.client.post(
+            self.url,
+            data={
+                'families': family_ids,
+                'challenges': challenge_ids
+            },
+            format='json'
+        )
+
+        self.assertEqual(response.status_code, 201)
+        for result in response.data['results']:
+            if result['family'] == self.families[0].name and result['challenge'] == self.challenges[0].name:
+                self.assertEqual(result['status'], 'existed')
+            else:
+                self.assertEqual(result['status'], 'created')
+
+        expected_count = len(family_ids) * len(challenge_ids)
+        self.assertEqual(Achievement.objects.count(), expected_count)
+
+        # Check that correct couples family/challenge exist
+        for f in self.families:
+            for c in self.challenges:
+                self.assertTrue(
+                    Achievement.objects.filter(family=f, challenge=c).exists()
+                )
+
+
+class TestFamilyAPI(TestAPI):
+    def setUp(self):
+        super().setUp()
+
+        self.family = Family.objects.create(
+            name='Test family',
+            description='',
+        )
+
+        self.familymembership = FamilyMembership.objects.create(
+            user=self.user,
+            family=self.family,
+        )
+
+        self.challenge = Challenge.objects.create(
+            name='Test challenge',
+            description='',
+            points=100,
+        )
+
+        self.achievement = Achievement.objects.create(
+            family=self.family,
+            challenge=self.challenge,
+            valid=False,
+        )
+
+    def test_family_api(self):
+        """
+        Load Family API page and test all filters and permissions
+        """
+        self.check_viewset(FamilyViewSet, '/api/family/family/')
+
+    def test_familymembership_api(self):
+        """
+        Load FamilyMembership API page and test all filters and permissions
+        """
+        self.check_viewset(FamilyMembershipViewSet, '/api/family/familymembership/')
+
+    def test_challenge_api(self):
+        """
+        Load Challenge API page and test all filters and permissions
+        """
+        self.check_viewset(ChallengeViewSet, '/api/family/challenge/')
+
+    def test_achievement_api(self):
+        """
+        Load Achievement API page and test all filters and permissions
+        """
+        self.check_viewset(AchievementViewSet, '/api/family/achievement/')

apps/family/urls.py

@@ -0,0 +1,25 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.urls import path, include
+
+from . import views
+
+app_name = 'family'
+urlpatterns = [
+    path('list/', views.FamilyListView.as_view(), name="family_list"),
+    path('create/', views.FamilyCreateView.as_view(), name="family_create"),
+    path('<int:pk>/detail/', views.FamilyDetailView.as_view(), name="family_detail"),
+    path('<int:pk>/update/', views.FamilyUpdateView.as_view(), name="family_update"),
+    path('<int:pk>/update_pic/', views.FamilyPictureUpdateView.as_view(), name="update_pic"),
+    path('<int:family_pk>/add_member/', views.FamilyAddMemberView.as_view(), name="family_add_member"),
+    path('challenge/list/', views.ChallengeListView.as_view(), name="challenge_list"),
+    path('challenge/create/', views.ChallengeCreateView.as_view(), name="challenge_create"),
+    path('challenge/<int:pk>/detail/', views.ChallengeDetailView.as_view(), name="challenge_detail"),
+    path('challenge/<int:pk>/update/', views.ChallengeUpdateView.as_view(), name="challenge_update"),
+    path('manage/', views.FamilyManageView.as_view(), name="manage"),
+    path('achievement/list/', views.AchievementListView.as_view(), name="achievement_list"),
+    path('achievement/<int:pk>/validate/', views.AchievementValidateView.as_view(), name="achievement_validate"),
+    path('achievement/<int:pk>/delete/', views.AchievementDeleteView.as_view(), name="achievement_delete"),
+    path('api/family/', include(('family.api.urls', 'family_api'), namespace='api')),
+]

apps/family/views.py

@@ -0,0 +1,469 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from datetime import date
+
+from django.conf import settings
+from django.shortcuts import redirect
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.core.exceptions import PermissionDenied
+from django.db import transaction
+from django.views.generic import DetailView, UpdateView, ListView
+from django.views.generic.edit import DeleteView, FormMixin
+from django.views.generic.base import TemplateView
+from django.utils.translation import gettext_lazy as _
+from django_tables2 import SingleTableView, MultiTableMixin
+from permission.backends import PermissionBackend
+from permission.views import ProtectQuerysetMixin, ProtectedCreateView
+from django.urls import reverse_lazy
+from member.forms import ImageForm
+import phonenumbers
+
+from .models import Family, Challenge, FamilyMembership, User, Achievement
+from .tables import FamilyTable, ChallengeTable, FamilyMembershipTable, AchievementTable, FamilyAchievementTable
+from .forms import ChallengeForm, FamilyMembershipForm, FamilyForm
+
+
+class FamilyCreateView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    Create family
+    """
+    model = Family
+    extra_context = {"title": _('Create family')}
+    form_class = FamilyForm
+
+    def get_sample_object(self):
+        return Family(
+            name="",
+            description="Sample family",
+            score=0,
+            rank=0,
+        )
+
+    def get_success_url(self):
+        self.object.refresh_from_db()
+        return reverse_lazy("family:manage")
+
+
+class FamilyListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
+    """
+    List existing Families
+    """
+    model = Family
+    table_class = FamilyTable
+    extra_context = {"title": _('Families list')}
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        fake_family = Family(name="", description="")
+        fake_challenge = Challenge(name="", description="", points=0)
+        can_add_family = PermissionBackend.check_perm(self.request, "family.add_family", fake_family)
+        can_add_challenge = PermissionBackend.check_perm(self.request, "family.add_challenge", fake_challenge)
+
+        if Family.objects.exists() and Challenge.objects.exists():
+            fake_achievement = Achievement(family=Family.objects.first(), challenge=Challenge.objects.first(), valid=False)
+            can_add_achievement = PermissionBackend.check_perm(self.request, "family.add_achievement", fake_achievement)
+        else:
+            can_add_achievement = False
+
+        context["can_manage"] = can_add_family or can_add_challenge or can_add_achievement
+
+        return context
+
+
+class FamilyDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
+    """
+    Display details of a family
+    """
+    model = Family
+    context_object_name = "family"
+    extra_context = {"title": _('Family detail')}
+
+    def get_context_data(self, **kwargs):
+        """
+        Add members list
+        """
+        context = super().get_context_data(**kwargs)
+
+        family = self.object
+
+        # member list
+        family_member = FamilyMembership.objects.filter(
+            family=family,
+            year=date.today().year,
+        ).filter(PermissionBackend.filter_queryset(self.request, FamilyMembership, "view"))\
+            .order_by("user__username")
+        family_member = family_member.distinct("user__username")\
+            if settings.DATABASES["default"]["ENGINE"] == 'django.db.backends.postgresql' else family_member
+
+        membership_table = FamilyMembershipTable(data=family_member, prefix="membership-")
+        membership_table.paginate(per_page=5, page=self.request.GET.get('membership-page', 1))
+        context['member_list'] = membership_table
+
+        # Check if the user has the right to create a membership, to display the button.
+        empty_membership = FamilyMembership(
+            family=family,
+            user=User.objects.first(),
+            year=date.today().year,
+        )
+        context["can_add_members"] = PermissionBackend()\
+            .has_perm(self.request.user, "family.add_membership", empty_membership)
+
+        # Défis réalisé par la famille
+        achievements = Achievement.objects.filter(family=family)
+        achievements_table = FamilyAchievementTable(data=achievements, prefix="achievement-")
+        achievements_table.paginate(per_page=5, page=self.request.GET.get('achievement-page', 1))
+        context["achievement_list"] = achievements_table
+
+        return context
+
+
+class FamilyUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+    """
+    Update the information of a family.
+    """
+    model = Family
+    context_object_name = "family"
+    form_class = FamilyForm
+    extra_context = {"title": _('Update family')}
+
+    def get_success_url(self):
+        return reverse_lazy('family:family_detail', kwargs={'pk': self.object.pk})
+
+
+class FamilyPictureUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, FormMixin, DetailView):
+    """
+    Update profile picture of the family
+    """
+    model = Family
+    extra_context = {"title": _("Update family picture")}
+    template_name = 'family/picture_update.html'
+    form_class = ImageForm
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context['form'] = self.form_class(self.request.POST, self.request.FILES)
+        return context
+
+    def get_success_url(self):
+        """Redirect to family page after upload"""
+        return reverse_lazy('family:family_detail', kwargs={'pk': self.object.pk})
+
+    def post(self, request, *args, **kwargs):
+        form = self.get_form()
+        self.object = self.get_object()
+        return self.form_valid(form) if form.is_valid() else self.form_invalid(form)
+
+    @transaction.atomic
+    def form_valid(self, form):
+        """
+        Save the image
+        """
+        image = form.cleaned_data['image']
+
+        if image is None:
+            image = "pic/default.png"
+        else:
+            # Rename as PNG or GIF
+            extension = image.name.split(".")[-1]
+            if extension == "gif":
+                image.name = "{}_pic.gif".format(self.object.pk)
+            else:
+                image.name = "{}_pic.png".format(self.object.pk)
+
+        # Save
+        self.object.display_image = image
+        self.object.save()
+        return super().form_valid(form)
+
+
+class FamilyAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    Add a membership to a family
+    """
+    model = FamilyMembership
+    form_class = FamilyMembershipForm
+    template_name = 'family/add_member.html'
+    extra_context = {"title": _("Add a new member to the family")}
+
+    def get_sample_object(self):
+        if "family_pk" in self.kwargs:
+            family = Family.objects.get(pk=self.kwargs["family_pk"])
+        else:
+            family = FamilyMembership.objects.get(pk=self.kwargs["pk"]).family
+        return FamilyMembership(
+            user=self.request.user,
+            family=family,
+            year=date.today().year,
+        )
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        family = Family.objects.filter(PermissionBackend.filter_queryset(self.request, Family, "view"))\
+            .get(pk=self.kwargs['family_pk'])
+
+        context['family'] = family
+
+        return context
+
+    @transaction.atomic
+    def form_valid(self, form):
+        """
+        Create family membership, check that everythinf is good
+        """
+        family = Family.objects.filter(PermissionBackend.filter_queryset(self.request, Family, "view")) \
+            .get(pk=self.kwargs["family_pk"])
+
+        form.instance.family = family
+
+        return super().form_valid(form)
+
+    def get_success_url(self):
+        return reverse_lazy('family:family_detail', kwargs={'pk': self.object.family.id})
+
+
+class ChallengeCreateView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    Create challenge
+    """
+    model = Challenge
+    extra_context = {"title": _('Create challenge')}
+    form_class = ChallengeForm
+
+    def get_sample_object(self):
+        return Challenge(
+            name="",
+            description="Sample challenge",
+            points=0,
+        )
+
+    def get_success_url(self):
+        return reverse_lazy('family:manage')
+
+
+class ChallengeListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
+    """
+    List all challenges
+    """
+    model = Challenge
+    table_class = ChallengeTable
+    extra_context = {"title": _('Challenges list')}
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        fake_family = Family(name="", description="")
+        fake_challenge = Challenge(name="", description="", points=0)
+        can_add_family = PermissionBackend.check_perm(self.request, "family.add_family", fake_family)
+        can_add_challenge = PermissionBackend.check_perm(self.request, "family.add_challenge", fake_challenge)
+
+        if Family.objects.exists() and Challenge.objects.exists():
+            fake_achievement = Achievement(family=Family.objects.first(), challenge=Challenge.objects.first(), valid=False)
+            can_add_achievement = PermissionBackend.check_perm(self.request, "family.add_achievement", fake_achievement)
+        else:
+            can_add_achievement = False
+
+        context["can_manage"] = can_add_family or can_add_challenge or can_add_achievement
+
+        return context
+
+
+class ChallengeDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
+    """
+    Display details of a challenge
+    """
+    model = Challenge
+    context_object_name = "challenge"
+    extra_context = {"title": _('Details of:')}
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        fields = ["name", "description", "points",]
+
+        fields = dict([(field, getattr(self.object, field)) for field in fields])
+
+        context["fields"] = [(
+            Challenge._meta.get_field(field).verbose_name.capitalize(),
+            value) for field, value in fields.items()]
+        context["obtained"] = self.object.obtained
+        context["update"] = PermissionBackend.check_perm(self.request, "family.change_challenge")
+
+        return context
+
+
+class ChallengeUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+    """
+    Update the information of a challenge
+    """
+    model = Challenge
+    context_object_name = "challenge"
+    extra_context = {"title": _('Update challenge')}
+    form_class = ChallengeForm
+
+    def get_success_url(self, **kwargs):
+        self.object.refresh_from_db()
+        return reverse_lazy('family:challenge_detail', kwargs={'pk': self.object.pk})
+
+
+class FamilyManageView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
+    """
+    Manage families and challenges
+    """
+    model = Achievement
+    template_name = 'family/manage.html'
+    table_class = AchievementTable
+    extra_context = {'title': _('Manage families and challenges')}
+
+    def dispatch(self, request, *args, **kwargs):
+        # Check that the user is authenticated
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        perm = PermissionBackend.has_model_perm(self.request, Achievement(), "add")
+        perm = perm or PermissionBackend.has_model_perm(self.request, Challenge(), "add")
+        perm = perm or PermissionBackend.has_model_perm(self.request, Family(), "add")
+        if not perm:
+            raise PermissionDenied(_("You are not able to manage families and challenges."))
+        return super().dispatch(request, *args, **kwargs)
+
+    def get_queryset(self, **kwargs):
+        # retrieves only Transaction that user has the right to see.
+        return Achievement.objects.filter(
+            PermissionBackend.filter_queryset(self.request, Achievement, "view")
+        ).order_by("-obtained_at").all()
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        context['all_challenges'] = Challenge.objects.filter(
+            PermissionBackend.filter_queryset(self.request, Challenge, "view")
+        ).order_by('name')
+
+        context["can_add_family"] = PermissionBackend.has_model_perm(self.request, Family(), "add")
+        context["can_add_challenge"] = PermissionBackend.has_model_perm(self.request, Challenge(), "add")
+        context["can_add_achievement"] = PermissionBackend.has_model_perm(self.request, Achievement(), "add")
+
+        # Get the user's family if they have one
+        try:
+            user_family_membership = FamilyMembership.objects.get(user=self.request.user)
+            context["user_family"] = user_family_membership.family
+        except FamilyMembership.DoesNotExist:
+            context["user_family"] = None
+
+        phone_numbers = [
+            u.profile.phone_number for u in User.objects.filter(
+                memberships__roles__id=35,
+                memberships__date_end__gte=date.today(),
+                profile__phone_number__isnull=False
+            ).distinct()
+        ]
+        formatted_phone_numbers = [phonenumbers.format_number(num, phonenumbers.PhoneNumberFormat.INTERNATIONAL) for num in phone_numbers if num]
+        context["phone_numbers"] = formatted_phone_numbers
+
+        return context
+
+    def get_table(self, **kwargs):
+        table = super().get_table(**kwargs)
+        table.exclude = ('delete', 'validate',)
+        table.orderable = False
+        return table
+
+    def get_table_data(self, **kwargs):
+        qs = super().get_queryset(**kwargs)
+
+        qs = qs.filter(PermissionBackend.filter_queryset(self.request, Achievement, "view"))
+
+        return qs
+
+
+class AchievementListView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMixin, ListView):
+    """
+    List all achievements
+    """
+    model = Achievement
+    tables = [AchievementTable, AchievementTable, ]
+    extra_context = {'title': _('Achievement list')}
+
+    def dispatch(self, request, *args, **kwargs):
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        if not PermissionBackend.has_model_perm(self.request, Achievement(), "change"):
+            raise PermissionDenied(_("You are not able to see the achievement validation interface."))
+        return super().dispatch(request, *args, **kwargs)
+
+    def get_tables(self, **kwargs):
+        tables = super().get_tables(**kwargs)
+
+        tables[0].prefix = 'invalid-'
+        tables[1].prefix = 'valid-'
+        tables[1].exclude = ('validate', 'delete',)
+
+        return tables
+
+    def get_tables_data(self):
+        table_valid = self.get_queryset().filter(valid=True)
+        table_invalid = self.get_queryset().filter(valid=False)
+        return [table_invalid, table_valid, ]
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+
+        tables = context['tables']
+
+        context['invalid'] = tables[0]
+        context['valid'] = tables[1]
+        return context
+
+
+class AchievementValidateView(ProtectQuerysetMixin, LoginRequiredMixin, TemplateView):
+    """
+    Validate an achievement obtained by a family
+    """
+    template_name = 'family/achievement_confirm_validate.html'
+
+    def dispatch(self, request, *args, **kwargs):
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        fake_achievement = Achievement(
+            family=Family.objects.first(),
+            challenge=Challenge.objects.first(),
+            valid=False,
+        )
+        if not PermissionBackend.check_perm(self.request, "family.change_achievement_valid", fake_achievement):
+            raise PermissionDenied()
+        return super().dispatch(request, *args, **kwargs)
+
+    def post(self, request, pk):
+        achievement = Achievement.objects.get(pk=pk)
+
+        achievement.valid = True
+        achievement.save()
+
+        return redirect(reverse_lazy('family:achievement_list'))
+
+
+class AchievementDeleteView(ProtectQuerysetMixin, LoginRequiredMixin, DeleteView):
+    """
+    Delete an Achievement
+    """
+    model = Achievement
+
+    def dispatch(self, request, *args, **kwargs):
+        if not request.user.is_authenticated:
+            return self.handle_no_permission()
+
+        fake_achievement = Achievement(
+            family=Family.objects.first(),
+            challenge=Challenge.objects.first(),
+            valid=False,
+        )
+        if not PermissionBackend.check_perm(self.request, "family.change_achievement_valid", fake_achievement):
+            raise PermissionDenied()
+        return super().dispatch(request, *args, **kwargs)
+
+    def get_success_url(self):
+        return reverse_lazy('family:achievement_list')

apps/food/admin.py

@@ -2,36 +2,58 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib import admin
-from django.db import transaction
+from polymorphic.admin import PolymorphicChildModelAdmin, PolymorphicParentModelAdmin
 from note_kfet.admin import admin_site
 
-from .models import Allergen, BasicFood, QRCode, TransformedFood
-
-
-@admin.register(QRCode, site=admin_site)
-class QRCodeAdmin(admin.ModelAdmin):
-    pass
-
-
-@admin.register(BasicFood, site=admin_site)
-class BasicFoodAdmin(admin.ModelAdmin):
-    @transaction.atomic
-    def save_related(self, *args, **kwargs):
-        ans = super().save_related(*args, **kwargs)
-        args[1].instance.update()
-        return ans
-
-
-@admin.register(TransformedFood, site=admin_site)
-class TransformedFoodAdmin(admin.ModelAdmin):
-    exclude = ["allergens", "expiry_date"]
-
-    @transaction.atomic
-    def save_related(self, request, form, *args, **kwargs):
-        super().save_related(request, form, *args, **kwargs)
-        form.instance.update()
+from .models import Allergen, Food, BasicFood, TransformedFood, QRCode
 
 
 @admin.register(Allergen, site=admin_site)
 class AllergenAdmin(admin.ModelAdmin):
-    pass
+    """
+    Admin customisation for Allergen
+    """
+    ordering = ['name']
+
+
+@admin.register(Food, site=admin_site)
+class FoodAdmin(PolymorphicParentModelAdmin):
+    """
+    Admin customisation for Food
+    """
+    child_models = (Food, BasicFood, TransformedFood)
+    list_display = ('name', 'expiry_date', 'owner', 'is_ready')
+    list_filter = ('is_ready', 'end_of_life')
+    search_fields = ['name']
+    ordering = ['expiry_date', 'name']
+
+
+@admin.register(BasicFood, site=admin_site)
+class BasicFood(PolymorphicChildModelAdmin):
+    """
+    Admin customisation for BasicFood
+    """
+    list_display = ('name', 'expiry_date', 'date_type', 'owner', 'is_ready')
+    list_filter = ('is_ready', 'date_type', 'end_of_life')
+    search_fields = ['name']
+    ordering = ['expiry_date', 'name']
+
+
+@admin.register(TransformedFood, site=admin_site)
+class TransformedFood(PolymorphicChildModelAdmin):
+    """
+    Admin customisation for TransformedFood
+    """
+    list_display = ('name', 'expiry_date', 'shelf_life', 'owner', 'is_ready')
+    list_filter = ('is_ready', 'end_of_life', 'shelf_life')
+    search_fields = ['name']
+    ordering = ['expiry_date', 'name']
+
+
+@admin.register(QRCode, site=admin_site)
+class QRCodeAdmin(admin.ModelAdmin):
+    """
+    Admin customisation for QRCode
+    """
+    list_diplay = ('qr_code_number', 'food_container')
+    search_fields = ['food_container__name']

apps/food/api/serializers.py

@@ -3,7 +3,7 @@
 
 from rest_framework import serializers
 
-from ..models import Allergen, BasicFood, QRCode, TransformedFood
+from ..models import Allergen, Food, BasicFood, TransformedFood, QRCode
 
 
 class AllergenSerializer(serializers.ModelSerializer):
@@ -11,40 +11,46 @@ class AllergenSerializer(serializers.ModelSerializer):
     REST API Serializer for Allergen.
     The djangorestframework plugin will analyse the model `Allergen` and parse all fields in the API.
     """
-
     class Meta:
         model = Allergen
         fields = '__all__'
 
 
+class FoodSerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for Food.
+    The djangorestframework plugin will analyse the model `Food` and parse all fields in the API.
+    """
+    class Meta:
+        model = Food
+        fields = '__all__'
+
+
 class BasicFoodSerializer(serializers.ModelSerializer):
     """
     REST API Serializer for BasicFood.
     The djangorestframework plugin will analyse the model `BasicFood` and parse all fields in the API.
     """
-
     class Meta:
         model = BasicFood
         fields = '__all__'
 
 
-class QRCodeSerializer(serializers.ModelSerializer):
-    """
-    REST API Serializer for QRCode.
-    The djangorestframework plugin will analyse the model `QRCode` and parse all fields in the API.
-    """
-
-    class Meta:
-        model = QRCode
-        fields = '__all__'
-
-
 class TransformedFoodSerializer(serializers.ModelSerializer):
     """
     REST API Serializer for TransformedFood.
     The djangorestframework plugin will analyse the model `TransformedFood` and parse all fields in the API.
     """
-
     class Meta:
         model = TransformedFood
         fields = '__all__'
+
+
+class QRCodeSerializer(serializers.ModelSerializer):
+    """
+    REST API Serializer for QRCode.
+    The djangorestframework plugin will analyse the model `QRCode` and parse all fields in the API.
+    """
+    class Meta:
+        model = QRCode
+        fields = '__all__'

apps/food/api/urls.py

@@ -1,7 +1,7 @@
 # Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from .views import AllergenViewSet, BasicFoodViewSet, QRCodeViewSet, TransformedFoodViewSet
+from .views import AllergenViewSet, FoodViewSet, BasicFoodViewSet, TransformedFoodViewSet, QRCodeViewSet
 
 
 def register_food_urls(router, path):
@@ -9,6 +9,7 @@ def register_food_urls(router, path):
     Configure router for Food REST API.
     """
     router.register(path + '/allergen', AllergenViewSet)
-    router.register(path + '/basic_food', BasicFoodViewSet)
+    router.register(path + '/food', FoodViewSet)
+    router.register(path + '/basicfood', BasicFoodViewSet)
+    router.register(path + '/transformedfood', TransformedFoodViewSet)
     router.register(path + '/qrcode', QRCodeViewSet)
-    router.register(path + '/transformed_food', TransformedFoodViewSet)

apps/food/api/views.py

@@ -5,8 +5,8 @@ from api.viewsets import ReadProtectedModelViewSet
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework.filters import SearchFilter
 
-from .serializers import AllergenSerializer, BasicFoodSerializer, QRCodeSerializer, TransformedFoodSerializer
-from ..models import Allergen, BasicFood, QRCode, TransformedFood
+from .serializers import AllergenSerializer, FoodSerializer, BasicFoodSerializer, TransformedFoodSerializer, QRCodeSerializer
+from ..models import Allergen, Food, BasicFood, TransformedFood, QRCode
 
 
 class AllergenViewSet(ReadProtectedModelViewSet):
@@ -22,11 +22,24 @@ class AllergenViewSet(ReadProtectedModelViewSet):
     search_fields = ['$name', ]
 
 
+class FoodViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `Food` objects, serialize it to JSON with the given serializer,
+    then render it on /api/food/food/
+    """
+    queryset = Food.objects.order_by('id')
+    serializer_class = FoodSerializer
+    filter_backends = [DjangoFilterBackend, SearchFilter]
+    filterset_fields = ['name', ]
+    search_fields = ['$name', ]
+
+
 class BasicFoodViewSet(ReadProtectedModelViewSet):
     """
     REST API View set.
     The djangorestframework plugin will get all `BasicFood` objects, serialize it to JSON with the given serializer,
-    then render it on /api/food/basic_food/
+    then render it on /api/food/basicfood/
     """
     queryset = BasicFood.objects.order_by('id')
     serializer_class = BasicFoodSerializer
@@ -35,6 +48,19 @@ class BasicFoodViewSet(ReadProtectedModelViewSet):
     search_fields = ['$name', ]
 
 
+class TransformedFoodViewSet(ReadProtectedModelViewSet):
+    """
+    REST API View set.
+    The djangorestframework plugin will get all `TransformedFood` objects, serialize it to JSON with the given serializer,
+    then render it on /api/food/transformedfood/
+    """
+    queryset = TransformedFood.objects.order_by('id')
+    serializer_class = TransformedFoodSerializer
+    filter_backends = [DjangoFilterBackend, SearchFilter]
+    filterset_fields = ['name', ]
+    search_fields = ['$name', ]
+
+
 class QRCodeViewSet(ReadProtectedModelViewSet):
     """
     REST API View set.
@@ -46,16 +72,3 @@ class QRCodeViewSet(ReadProtectedModelViewSet):
     filter_backends = [DjangoFilterBackend, SearchFilter]
     filterset_fields = ['qr_code_number', ]
     search_fields = ['$qr_code_number', ]
-
-
-class TransformedFoodViewSet(ReadProtectedModelViewSet):
-    """
-    REST API View set.
-    The djangorestframework plugin will get all `TransformedFood` objects, serialize it to JSON with the given serializer,
-    then render it on /api/food/transformed_food/
-    """
-    queryset = TransformedFood.objects.order_by('id')
-    serializer_class = TransformedFoodSerializer
-    filter_backends = [DjangoFilterBackend, SearchFilter]
-    filterset_fields = ['name', ]
-    search_fields = ['$name', ]

apps/food/fixtures/initial.json

@@ -0,0 +1,100 @@
+[
+    {
+	"model": "food.allergen",
+	"pk": 1,
+	"fields": {
+	    "name": "Lait"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 2,
+	"fields": {
+	    "name": "Oeufs"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 3,
+	"fields": {
+	    "name": "Gluten"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 4,
+	"fields": {
+	    "name": "Fruits à coques"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 5,
+	"fields": {
+	    "name": "Arachides"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 6,
+	"fields": {
+	    "name": "Sésame"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 7,
+	"fields": {
+	    "name": "Soja"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 8,
+	"fields": {
+	    "name": "Céleri"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 9,
+	"fields": {
+	    "name": "Lupin"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 10,
+	"fields": {
+	    "name": "Moutarde"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 11,
+	"fields": {
+	    "name": "Sulfites"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 12,
+	"fields": {
+	    "name": "Crustacés"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 13,
+	"fields": {
+	    "name": "Mollusques"
+	}
+    },
+    {
+	"model": "food.allergen",
+	"pk": 14,
+	"fields": {
+	    "name": "Poissons"
+	}
+    }
+]

apps/food/forms.py

@@ -3,42 +3,41 @@
 
 from random import shuffle
 
-from django import forms
-from django.utils.translation import gettext_lazy as _
-from django.utils import timezone
-from member.models import Club
 from bootstrap_datepicker_plus.widgets import DateTimePickerInput
+from django import forms
+from django.forms.widgets import NumberInput
+from django.utils.translation import gettext_lazy as _
+from member.models import Club
 from note_kfet.inputs import Autocomplete
 from note_kfet.middlewares import get_current_request
 from permission.backends import PermissionBackend
 
-from .models import BasicFood, QRCode, TransformedFood
+from .models import Food, BasicFood, TransformedFood, QRCode
 
 
-class AddIngredientForms(forms.ModelForm):
+class QRCodeForms(forms.ModelForm):
     """
-    Form for add an ingredient
+    Form for create QRCode for container
     """
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.fields['ingredient'].queryset = self.fields['ingredient'].queryset.filter(
+        self.fields['food_container'].queryset = self.fields['food_container'].queryset.filter(
+            end_of_life__isnull=True,
             polymorphic_ctype__model='transformedfood',
-            is_ready=False,
-            is_active=True,
-            was_eaten=False,
-        )
-        # Caution, the logic is inverted here, we flip the logic on saving in AddIngredientView
-        self.fields['is_active'].initial = True
-        self.fields['is_active'].label = _("Fully used")
+        ).filter(PermissionBackend.filter_queryset(
+            get_current_request(),
+            TransformedFood,
+            "view",
+        ))
 
     class Meta:
-        model = TransformedFood
-        fields = ('ingredient', 'is_active')
+        model = QRCode
+        fields = ('food_container',)
 
 
 class BasicFoodForms(forms.ModelForm):
     """
-    Form for add non-transformed food
+    Form for add basicfood
     """
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -51,64 +50,138 @@ class BasicFoodForms(forms.ModelForm):
         clubs = list(Club.objects.filter(PermissionBackend.filter_queryset(get_current_request(), Club, "change")).all())
         shuffle(clubs)
         self.fields['owner'].widget.attrs["placeholder"] = ", ".join(club.name for club in clubs[:4]) + ", ..."
+        self.fields['order'].widget.attrs["placeholder"] = _("Specific order given to GCKs")
 
     class Meta:
         model = BasicFood
-        fields = ('name', 'owner', 'date_type', 'expiry_date', 'is_active', 'was_eaten', 'allergens',)
+        fields = ('name', 'owner', 'date_type', 'expiry_date', 'allergens', 'order',)
         widgets = {
             "owner": Autocomplete(
                 model=Club,
                 attrs={"api_url": "/api/members/club/"},
             ),
-            'expiry_date': DateTimePickerInput(),
+            "expiry_date": DateTimePickerInput(),
         }
 
 
-class QRCodeForms(forms.ModelForm):
-    """
-    Form for create QRCode
-    """
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields['food_container'].queryset = self.fields['food_container'].queryset.filter(
-            is_active=True,
-            was_eaten=False,
-            polymorphic_ctype__model='transformedfood',
-        )
-
-    class Meta:
-        model = QRCode
-        fields = ('food_container',)
-
-
 class TransformedFoodForms(forms.ModelForm):
     """
     Form for add transformedfood
     """
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.fields['name'].widget.attrs.update({"autofocus": "autofocus"})
         self.fields['name'].required = True
         self.fields['owner'].required = True
-        self.fields['creation_date'].required = True
-        self.fields['creation_date'].initial = timezone.now
-        self.fields['is_active'].initial = True
-        self.fields['is_ready'].initial = False
-        self.fields['was_eaten'].initial = False
 
         # Some example
         self.fields['name'].widget.attrs.update({"placeholder": _("Lasagna")})
         clubs = list(Club.objects.filter(PermissionBackend.filter_queryset(get_current_request(), Club, "change")).all())
         shuffle(clubs)
         self.fields['owner'].widget.attrs["placeholder"] = ", ".join(club.name for club in clubs[:4]) + ", ..."
+        self.fields['order'].widget.attrs["placeholder"] = _("Specific order given to GCKs")
 
     class Meta:
         model = TransformedFood
-        fields = ('name', 'creation_date', 'owner', 'is_active', 'is_ready', 'was_eaten', 'shelf_life')
+        fields = ('name', 'owner', 'order',)
         widgets = {
             "owner": Autocomplete(
                 model=Club,
                 attrs={"api_url": "/api/members/club/"},
             ),
-            'creation_date': DateTimePickerInput(),
         }
+
+
+class BasicFoodUpdateForms(forms.ModelForm):
+    """
+    Form for update basicfood object
+    """
+    class Meta:
+        model = BasicFood
+        fields = ('name', 'owner', 'date_type', 'expiry_date', 'end_of_life', 'is_ready', 'order', 'allergens')
+        widgets = {
+            "owner": Autocomplete(
+                model=Club,
+                attrs={"api_url": "/api/members/club/"},
+            ),
+            "expiry_date": DateTimePickerInput(),
+        }
+
+
+class TransformedFoodUpdateForms(forms.ModelForm):
+    """
+    Form for update transformedfood object
+    """
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['shelf_life'].label = _('Shelf life (in hours)')
+
+    class Meta:
+        model = TransformedFood
+        fields = ('name', 'owner', 'end_of_life', 'is_ready', 'order', 'shelf_life')
+        widgets = {
+            "owner": Autocomplete(
+                model=Club,
+                attrs={"api_url": "/api/members/club/"},
+            ),
+            "expiry_date": DateTimePickerInput(),
+            "shelf_life": NumberInput(),
+        }
+
+
+class AddIngredientForms(forms.ModelForm):
+    """
+    Form for add an ingredient
+    """
+    fully_used = forms.BooleanField()
+    fully_used.initial = True
+    fully_used.required = False
+    fully_used.label = _("Fully used")
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # TODO find a better way to get pk (be not url scheme dependant)
+        pk = get_current_request().path.split('/')[-1]
+        self.fields['ingredients'].queryset = self.fields['ingredients'].queryset.filter(
+            polymorphic_ctype__model="transformedfood",
+            is_ready=False,
+            end_of_life='',
+        ).filter(PermissionBackend.filter_queryset(get_current_request(), Food, "change")).exclude(pk=pk)
+
+    class Meta:
+        model = TransformedFood
+        fields = ('ingredients',)
+
+
+class ManageIngredientsForm(forms.Form):
+    """
+    Form to manage ingredient
+    """
+    fully_used = forms.BooleanField()
+    fully_used.initial = True
+    fully_used.required = True
+    fully_used.label = _('Fully used')
+
+    name = forms.CharField()
+    name.widget = Autocomplete(
+        model=Food,
+        resetable=True,
+        attrs={"api_url": "/api/food/food",
+               "class": "autocomplete"},
+    )
+    name.label = _('Name')
+
+    qrcode = forms.IntegerField()
+    qrcode.widget = Autocomplete(
+        model=QRCode,
+        resetable=True,
+        attrs={"api_url": "/api/food/qrcode/",
+               "name_field": "qr_code_number",
+               "class": "autocomplete"},
+    )
+    qrcode.label = _('QR code number')
+
+
+ManageIngredientsFormSet = forms.formset_factory(
+    ManageIngredientsForm,
+    extra=1,
+)

apps/food/migrations/0001_initial.py

@@ -1,84 +1,199 @@
-# Generated by Django 2.2.28 on 2024-07-05 08:57
+# Generated by Django 4.2.20 on 2025-04-17 21:43
 
+import datetime
 from django.db import migrations, models
 import django.db.models.deletion
 import django.utils.timezone
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [
-        ('contenttypes', '0002_remove_content_type_name'),
-        ('member', '0011_profile_vss_charter_read'),
+        ("contenttypes", "0002_remove_content_type_name"),
+        ("member", "0013_auto_20240801_1436"),
     ]
 
     operations = [
         migrations.CreateModel(
-            name='Allergen',
+            name="Allergen",
             fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('name', models.CharField(max_length=255, verbose_name='name')),
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("name", models.CharField(max_length=255, verbose_name="name")),
             ],
             options={
-                'verbose_name': 'Allergen',
-                'verbose_name_plural': 'Allergens',
+                "verbose_name": "Allergen",
+                "verbose_name_plural": "Allergens",
             },
         ),
         migrations.CreateModel(
-            name='Food',
+            name="Food",
             fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('name', models.CharField(max_length=255, verbose_name='name')),
-                ('expiry_date', models.DateTimeField(verbose_name='expiry date')),
-                ('was_eaten', models.BooleanField(default=False, verbose_name='was eaten')),
-                ('is_ready', models.BooleanField(default=False, verbose_name='is ready')),
-                ('allergens', models.ManyToManyField(blank=True, to='food.Allergen', verbose_name='allergen')),
-                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='+', to='member.Club', verbose_name='owner')),
-                ('polymorphic_ctype', models.ForeignKey(editable=False, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='polymorphic_food.food_set+', to='contenttypes.ContentType')),
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("name", models.CharField(max_length=255, verbose_name="name")),
+                ("expiry_date", models.DateTimeField(verbose_name="expiry date")),
+                (
+                    "end_of_life",
+                    models.CharField(max_length=255, verbose_name="end of life"),
+                ),
+                (
+                    "is_ready",
+                    models.BooleanField(max_length=255, verbose_name="is ready"),
+                ),
+                ("order", models.CharField(max_length=255, verbose_name="order")),
+                (
+                    "allergens",
+                    models.ManyToManyField(
+                        blank=True, to="food.allergen", verbose_name="allergens"
+                    ),
+                ),
+                (
+                    "owner",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="+",
+                        to="member.club",
+                        verbose_name="owner",
+                    ),
+                ),
+                (
+                    "polymorphic_ctype",
+                    models.ForeignKey(
+                        editable=False,
+                        null=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="polymorphic_%(app_label)s.%(class)s_set+",
+                        to="contenttypes.contenttype",
+                    ),
+                ),
             ],
             options={
-                'verbose_name': 'foods',
+                "verbose_name": "Food",
+                "verbose_name_plural": "Foods",
             },
         ),
         migrations.CreateModel(
-            name='BasicFood',
+            name="BasicFood",
             fields=[
-                ('food_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='food.Food')),
-                ('date_type', models.CharField(choices=[('DLC', 'DLC'), ('DDM', 'DDM')], max_length=255)),
-                ('arrival_date', models.DateTimeField(default=django.utils.timezone.now, verbose_name='arrival date')),
+                (
+                    "food_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="food.food",
+                    ),
+                ),
+                (
+                    "arrival_date",
+                    models.DateTimeField(
+                        default=django.utils.timezone.now, verbose_name="arrival date"
+                    ),
+                ),
+                (
+                    "date_type",
+                    models.CharField(
+                        choices=[("DLC", "DLC"), ("DDM", "DDM")], max_length=255
+                    ),
+                ),
             ],
             options={
-                'verbose_name': 'Basic food',
-                'verbose_name_plural': 'Basic foods',
+                "verbose_name": "Basic food",
+                "verbose_name_plural": "Basic foods",
             },
-            bases=('food.food',),
+            bases=("food.food",),
         ),
         migrations.CreateModel(
-            name='QRCode',
+            name="QRCode",
             fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('qr_code_number', models.PositiveIntegerField(unique=True, verbose_name='QR-code number')),
-                ('food_container', models.OneToOneField(on_delete=django.db.models.deletion.PROTECT, related_name='QR_code', to='food.Food', verbose_name='food container')),
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                (
+                    "qr_code_number",
+                    models.PositiveIntegerField(
+                        unique=True, verbose_name="qr code number"
+                    ),
+                ),
+                (
+                    "food_container",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="QR_code",
+                        to="food.food",
+                        verbose_name="food container",
+                    ),
+                ),
             ],
             options={
-                'verbose_name': 'QR-code',
-                'verbose_name_plural': 'QR-codes',
+                "verbose_name": "QR-code",
+                "verbose_name_plural": "QR-codes",
             },
         ),
         migrations.CreateModel(
-            name='TransformedFood',
+            name="TransformedFood",
             fields=[
-                ('food_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='food.Food')),
-                ('creation_date', models.DateTimeField(verbose_name='creation date')),
-                ('is_active', models.BooleanField(default=True, verbose_name='is active')),
-                ('ingredient', models.ManyToManyField(blank=True, related_name='transformed_ingredient_inv', to='food.Food', verbose_name='transformed ingredient')),
+                (
+                    "food_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="food.food",
+                    ),
+                ),
+                (
+                    "creation_date",
+                    models.DateTimeField(
+                        default=django.utils.timezone.now, verbose_name="creation date"
+                    ),
+                ),
+                (
+                    "shelf_life",
+                    models.DurationField(
+                        default=datetime.timedelta(days=3), verbose_name="shelf life"
+                    ),
+                ),
+                (
+                    "ingredients",
+                    models.ManyToManyField(
+                        blank=True,
+                        related_name="transformed_ingredient_inv",
+                        to="food.food",
+                        verbose_name="transformed ingredient",
+                    ),
+                ),
             ],
             options={
-                'verbose_name': 'Transformed food',
-                'verbose_name_plural': 'Transformed foods',
+                "verbose_name": "Transformed food",
+                "verbose_name_plural": "Transformed foods",
             },
-            bases=('food.food',),
+            bases=("food.food",),
         ),
     ]

apps/food/migrations/0002_transformedfood_shelf_life.py

@@ -1,19 +0,0 @@
-# Generated by Django 2.2.28 on 2024-07-06 20:37
-
-import datetime
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('food', '0001_initial'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='transformedfood',
-            name='shelf_life',
-            field=models.DurationField(default=datetime.timedelta(days=3), verbose_name='shelf life'),
-        ),
-    ]

apps/food/migrations/0003_create_14_allergens_mandatory.py

@@ -1,62 +0,0 @@
-from django.db import migrations
-
-def create_14_mandatory_allergens(apps, schema_editor):
-    """
-    There are 14 mandatory allergens, they are pre-injected
-    """
-
-    Allergen = apps.get_model("food", "allergen")
-    
-    Allergen.objects.get_or_create(
-        name="Gluten",
-    ) 
-    Allergen.objects.get_or_create(
-        name="Fruits à coques",
-    )
-    Allergen.objects.get_or_create(
-        name="Crustacés",
-    )
-    Allergen.objects.get_or_create(
-        name="Céléri",
-    )
-    Allergen.objects.get_or_create(
-        name="Oeufs",
-    )
-    Allergen.objects.get_or_create(
-        name="Moutarde",
-    )
-    Allergen.objects.get_or_create(
-        name="Poissons",
-    )
-    Allergen.objects.get_or_create(
-        name="Soja",
-    )
-    Allergen.objects.get_or_create(
-        name="Lait",
-    )
-    Allergen.objects.get_or_create(
-        name="Sulfites",
-    )
-    Allergen.objects.get_or_create(
-        name="Sésame",
-    )
-    Allergen.objects.get_or_create(
-        name="Lupin",
-    )
-    Allergen.objects.get_or_create(
-        name="Arachides",
-    )
-    Allergen.objects.get_or_create(
-        name="Mollusques",
-    )
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('food', '0002_transformedfood_shelf_life'),
-    ]
-
-    operations = [
-        migrations.RunPython(create_14_mandatory_allergens),
-    ]
-    
-    

apps/food/migrations/0004_auto_20240813_2358.py

@@ -1,28 +0,0 @@
-# Generated by Django 2.2.28 on 2024-08-13 21:58
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('food', '0003_create_14_allergens_mandatory'),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name='transformedfood',
-            name='is_active',
-        ),
-        migrations.AddField(
-            model_name='food',
-            name='is_active',
-            field=models.BooleanField(default=True, verbose_name='is active'),
-        ),
-        migrations.AlterField(
-            model_name='qrcode',
-            name='food_container',
-            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='QR_code', to='food.Food', verbose_name='food container'),
-        ),
-    ]

apps/food/migrations/0005_alter_food_polymorphic_ctype.py

@@ -1,20 +0,0 @@
-# Generated by Django 4.2.15 on 2024-08-28 08:00
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('contenttypes', '0002_remove_content_type_name'),
-        ('food', '0004_auto_20240813_2358'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='food',
-            name='polymorphic_ctype',
-            field=models.ForeignKey(editable=False, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='polymorphic_%(app_label)s.%(class)s_set+', to='contenttypes.contenttype'),
-        ),
-    ]

apps/food/models.py

@@ -6,37 +6,13 @@ from datetime import timedelta
 from django.db import models, transaction
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
-from member.models import Club
 from polymorphic.models import PolymorphicModel
-
-
-class QRCode(models.Model):
-    """
-    An QRCode model
-    """
-    qr_code_number = models.PositiveIntegerField(
-        verbose_name=_("QR-code number"),
-        unique=True,
-    )
-
-    food_container = models.ForeignKey(
-        'Food',
-        on_delete=models.CASCADE,
-        related_name='QR_code',
-        verbose_name=_('food container'),
-    )
-
-    class Meta:
-        verbose_name = _("QR-code")
-        verbose_name_plural = _("QR-codes")
-
-    def __str__(self):
-        return _("QR-code number {qr_code_number}").format(qr_code_number=self.qr_code_number)
+from member.models import Club
 
 
 class Allergen(models.Model):
     """
-    A list of allergen and alimentary restrictions
+    Allergen and alimentary restrictions
     """
     name = models.CharField(
         verbose_name=_('name'),
@@ -44,16 +20,19 @@ class Allergen(models.Model):
     )
 
     class Meta:
-        verbose_name = _('Allergen')
-        verbose_name_plural = _('Allergens')
+        verbose_name = _("Allergen")
+        verbose_name_plural = _("Allergens")
 
     def __str__(self):
         return self.name
 
 
 class Food(PolymorphicModel):
+    """
+    Describe any type of food
+    """
     name = models.CharField(
-        verbose_name=_('name'),
+        verbose_name=_("name"),
         max_length=255,
     )
 
@@ -67,7 +46,7 @@ class Food(PolymorphicModel):
     allergens = models.ManyToManyField(
         Allergen,
         blank=True,
-        verbose_name=_('allergen'),
+        verbose_name=_('allergens'),
     )
 
     expiry_date = models.DateTimeField(
@@ -75,41 +54,69 @@ class Food(PolymorphicModel):
         null=False,
     )
 
-    was_eaten = models.BooleanField(
-        default=False,
-        verbose_name=_('was eaten'),
+    end_of_life = models.CharField(
+        blank=True,
+        verbose_name=_('end of life'),
+        max_length=255,
     )
 
-    # is_ready != is_active : is_ready signifie que la nourriture est prête à être manger,
-    #                         is_active signifie que la nourriture n'est pas encore archivé
-    # il sert dans les cas où il est plus intéressant que de l'open soit conservé (confiture par ex)
-
     is_ready = models.BooleanField(
-        default=False,
         verbose_name=_('is ready'),
+        max_length=255,
     )
 
-    is_active = models.BooleanField(
-        default=True,
-        verbose_name=_('is active'),
+    order = models.CharField(
+        blank=True,
+        verbose_name=_('order'),
+        max_length=255,
     )
 
     def __str__(self):
         return self.name
 
     @transaction.atomic
-    def save(self, force_insert=False, force_update=False, using=None, update_fields=None):
-        return super().save(force_insert, force_update, using, update_fields)
+    def update_allergens(self):
+        # update parents
+        for parent in self.transformed_ingredient_inv.iterator():
+            old_allergens = list(parent.allergens.all()).copy()
+            parent.allergens.clear()
+            for child in parent.ingredients.iterator():
+                if child.pk != self.pk:
+                    parent.allergens.set(parent.allergens.union(child.allergens.all()))
+            parent.allergens.set(parent.allergens.union(self.allergens.all()))
+            if old_allergens != list(parent.allergens.all()):
+                parent.save(old_allergens=old_allergens)
+
+    def update_expiry_date(self):
+        # update parents
+        for parent in self.transformed_ingredient_inv.iterator():
+            old_expiry_date = parent.expiry_date
+            parent.expiry_date = parent.shelf_life + parent.creation_date
+            for child in parent.ingredients.iterator():
+                if (child.pk != self.pk
+                    and not (child.polymorphic_ctype.model == 'basicfood'
+                             and child.date_type == 'DDM')):
+                    parent.expiry_date = min(parent.expiry_date, child.expiry_date)
+
+            if self.polymorphic_ctype.model == 'basicfood' and self.date_type == 'DLC':
+                parent.expiry_date = min(parent.expiry_date, self.expiry_date)
+            if old_expiry_date != parent.expiry_date:
+                parent.save()
 
     class Meta:
-        verbose_name = _('food')
-        verbose_name = _('foods')
+        verbose_name = _('Food')
+        verbose_name_plural = _('Foods')
 
 
 class BasicFood(Food):
     """
-    Food which has been directly buy on supermarket
+    A basic food is a food directly buy and stored
     """
+    arrival_date = models.DateTimeField(
+        default=timezone.now,
+        verbose_name=_('arrival date'),
+    )
+
     date_type = models.CharField(
         max_length=255,
         choices=(
@@ -118,50 +125,70 @@ class BasicFood(Food):
         )
     )
 
-    arrival_date = models.DateTimeField(
-        verbose_name=_('arrival date'),
-        default=timezone.now,
-    )
-
-    # label = models.ImageField(
-    #     verbose_name=_('food label'),
-    #     max_length=255,
-    #     blank=False,
-    #     null=False,
-    #     upload_to='label/',
-    # )
-
     @transaction.atomic
-    def update_allergens(self):
-        # update parents
-        for parent in self.transformed_ingredient_inv.iterator():
-            parent.update_allergens()
+    def save(self, force_insert=False, force_update=False, using=None, update_fields=None, **kwargs):
+        created = self.pk is None
+        if not created:
+            # Check if important fields are updated
+            old_food = Food.objects.select_for_update().get(pk=self.pk)
+            if not hasattr(self, "_force_save"):
+                # Allergens
 
-    @transaction.atomic
-    def update_expiry_date(self):
-        # update parents
-        for parent in self.transformed_ingredient_inv.iterator():
-            parent.update_expiry_date()
-
-    @transaction.atomic
-    def update(self):
+                if ('old_allergens' in kwargs
+                        and list(self.allergens.all()) != kwargs['old_allergens']):
                     self.update_allergens()
+
+                # Expiry date
+                if ((self.expiry_date != old_food.expiry_date
+                        and self.date_type == 'DLC')
+                        or old_food.date_type != self.date_type):
                     self.update_expiry_date()
 
+        return super().save(force_insert, force_update, using, update_fields)
+
+    @staticmethod
+    def get_lastests_objects(number, distinct_field, order_by_field):
+        """
+        Get the last object with distinct field and ranked with order_by
+        This methods exist because we can't distinct with one field and
+        order with another
+        """
+        foods = BasicFood.objects.order_by(order_by_field).all()
+        field = []
+        for food in foods:
+            if getattr(food, distinct_field) in field:
+                continue
+            else:
+                field.append(getattr(food, distinct_field))
+                number -= 1
+                yield food
+            if not number:
+                return
+
     class Meta:
         verbose_name = _('Basic food')
         verbose_name_plural = _('Basic foods')
 
+    def __str__(self):
+        return self.name
+
 
 class TransformedFood(Food):
     """
-    Transformed food  are a mix between basic food and meal
+    A transformed food is a food with ingredients
     """
     creation_date = models.DateTimeField(
+        default=timezone.now,
         verbose_name=_('creation date'),
     )
 
-    ingredient = models.ManyToManyField(
+    # Without microbiological analyzes, the storage time is 3 days
+    shelf_life = models.DurationField(
+        default=timedelta(days=3),
+        verbose_name=_('shelf life'),
+    )
+
+    ingredients = models.ManyToManyField(
         Food,
         blank=True,
         symmetrical=False,
@@ -169,58 +196,91 @@ class TransformedFood(Food):
         verbose_name=_('transformed ingredient'),
     )
 
-    # Without microbiological analyzes, the storage time is 3 days
-    shelf_life = models.DurationField(
-        verbose_name=_("shelf life"),
-        default=timedelta(days=3),
-    )
+    def check_cycle(self, ingredients, origin, checked):
+        for ingredient in ingredients:
+            if ingredient == origin:
+                # We break the cycle
+                self.ingredients.remove(ingredient)
+            if ingredient.polymorphic_ctype.model == 'transformedfood' and ingredient not in checked:
+                ingredient.check_cycle(ingredient.ingredients.all(), origin, checked)
+                checked.append(ingredient)
 
     @transaction.atomic
-    def archive(self):
-        # When a meal are archived, if it was eaten, update ingredient fully used for this meal
-        raise NotImplementedError
+    def save(self, force_insert=False, force_update=False, using=None, update_fields=None, **kwargs):
+        created = self.pk is None
+        if not created:
+            # Check if important fields are updated
+            update = {'allergens': False, 'expiry_date': False}
+            old_food = Food.objects.select_for_update().get(pk=self.pk)
+            if not hasattr(self, "_force_save"):
+                # Allergens
+                # Unfortunately with the many-to-many relation we can't access
+                # to old allergens
+                if ('old_allergens' in kwargs
+                        and list(self.allergens.all()) != kwargs['old_allergens']):
+                    update['allergens'] = True
 
-    @transaction.atomic
-    def update_allergens(self):
-        # When allergens are changed, simply update the parents' allergens
-        old_allergens = list(self.allergens.all())
-        self.allergens.clear()
-        for ingredient in self.ingredient.iterator():
-            self.allergens.set(self.allergens.union(ingredient.allergens.all()))
-
-        if old_allergens == list(self.allergens.all()):
-            return
-        super().save()
-
-        # update parents
-        for parent in self.transformed_ingredient_inv.iterator():
-            parent.update_allergens()
-
-    @transaction.atomic
-    def update_expiry_date(self):
-        # When expiry_date is changed, simply update the parents' expiry_date
-        old_expiry_date = self.expiry_date
+                # Expiry date
+                update['expiry_date'] = (self.shelf_life != old_food.shelf_life
+                                         or self.creation_date != old_food.creation_date)
+                if update['expiry_date']:
                     self.expiry_date = self.creation_date + self.shelf_life
-        for ingredient in self.ingredient.iterator():
-            self.expiry_date = min(self.expiry_date, ingredient.expiry_date)
+                # Unfortunately with the set method ingredients are already save,
+                # we check cycle after if possible
+                if ('old_ingredients' in kwargs
+                        and list(self.ingredients.all()) != list(kwargs['old_ingredients'])):
+                    update['allergens'] = True
+                    update['expiry_date'] = True
 
-        if old_expiry_date == self.expiry_date:
-            return
-        super().save()
-
-        # update parents
-        for parent in self.transformed_ingredient_inv.iterator():
-            parent.update_expiry_date()
-
-    @transaction.atomic
-    def update(self):
+                    # it's preferable to keep a queryset but we allow list too
+                    if type(kwargs['old_ingredients']) is list:
+                        kwargs['old_ingredients'] = Food.objects.filter(
+                            pk__in=[food.pk for food in kwargs['old_ingredients']])
+                    self.check_cycle(self.ingredients.all().difference(kwargs['old_ingredients']), self, [])
+                if update['allergens']:
                     self.update_allergens()
+                if update['expiry_date']:
                     self.update_expiry_date()
 
-    @transaction.atomic
-    def save(self, *args, **kwargs):
-        super().save(*args, **kwargs)
+        if created:
+            self.expiry_date = self.shelf_life + self.creation_date
+
+            # We save here because we need pk for many-to-many relation
+            super().save(force_insert, force_update, using, update_fields)
+
+            for child in self.ingredients.iterator():
+                self.allergens.set(self.allergens.union(child.allergens.all()))
+                if not (child.polymorphic_ctype.model == 'basicfood' and child.date_type == 'DDM'):
+                    self.expiry_date = min(self.expiry_date, child.expiry_date)
+        return super().save(force_insert, force_update, using, update_fields)
 
     class Meta:
         verbose_name = _('Transformed food')
         verbose_name_plural = _('Transformed foods')
+
+    def __str__(self):
+        return self.name
+
+
+class QRCode(models.Model):
+    """
+    QR-code for register food
+    """
+    qr_code_number = models.PositiveIntegerField(
+        unique=True,
+        verbose_name=_('qr code number'),
+    )
+
+    food_container = models.ForeignKey(
+        Food,
+        on_delete=models.CASCADE,
+        related_name='QR_code',
+        verbose_name=_('food container'),
+    )
+
+    class Meta:
+        verbose_name = _('QR-code')
+        verbose_name_plural = _('QR-codes')
+
+    def __str__(self):
+        return _('QR-code number') + ' ' + str(self.qr_code_number)

apps/food/tables.py

@@ -2,18 +2,36 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import django_tables2 as tables
-from django_tables2 import A
+from django.utils.translation import gettext_lazy as _
 
-from .models import TransformedFood
+from .models import Food
 
 
-class TransformedFoodTable(tables.Table):
-    name = tables.LinkColumn(
-        'food:food_view',
-        args=[A('pk'), ],
-    )
+class FoodTable(tables.Table):
+    """
+    List all foods.
+    """
+    qr_code_numbers = tables.Column(empty_values=(), verbose_name=_("QR Codes"), orderable=False)
+
+    date = tables.Column(empty_values=(), verbose_name=_("Arrival/creation date"), orderable=False)
+
+    def render_date(self, record):
+        if record.__class__.__name__ == "BasicFood":
+            return record.arrival_date.strftime("%d/%m/%Y %H:%M")
+        elif record.__class__.__name__ == "TransformedFood":
+            return record.creation_date.strftime("%d/%m/%Y %H:%M")
+        else:
+            return "--"
+
+    def render_qr_code_numbers(self, record):
+        return ", ".join(str(q.qr_code_number) for q in record.QR_code.all())
 
     class Meta:
-        model = TransformedFood
+        model = Food
         template_name = 'django_tables2/bootstrap4.html'
-        fields = ('name', "owner", "allergens", "expiry_date")
+        fields = ('name', 'owner', 'qr_code_numbers', 'allergens', 'date', 'expiry_date')
+        row_attrs = {
+            'class': 'table-row',
+            'data-href': lambda record: 'detail/' + str(record.pk),
+            'style': 'cursor:pointer',
+        }

apps/food/templates/food/basicfood_detail.html

@@ -1,37 +0,0 @@
-{% extends "base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load i18n crispy_forms_tags %}
-
-{% block content %}
-<div class="card bg-white mb-3">
-  <h3 class="card-header text-center">
-    {{ title }} {{ food.name }}
-  </h3>
-  <div class="card-body">
-    <ul>
-      <li><p>{% trans 'Owner' %} : {{ food.owner }}</p></li>
-      <li><p>{% trans 'Arrival date' %} : {{ food.arrival_date }}</p></li>
-      <li><p>{% trans 'Expiry date' %} : {{ food.expiry_date }} ({{ food.date_type }})</p></li>
-      <li>{% trans 'Allergens' %} :</li>
-      <ul>
-      {% for allergen in food.allergens.iterator %}
-        <li>{{ allergen.name }}</li>
-      {% endfor %}
-      </ul>
-	<p>
-	<li><p>{% trans 'Active' %} : {{ food.is_active }}<p></li>
-	<li><p>{% trans 'Eaten' %} : {{ food.was_eaten }}<p></li>
-    </ul>
-    {% if can_update %}
-	<a class="btn btn-sm btn-warning" href="{% url "food:basic_update" pk=food.pk %}">{% trans 'Update' %}</a>
-    {% endif %}
-    {% if can_add_ingredient %}
-    	<a class="btn btn-sm btn-success" href="{% url "food:add_ingredient" pk=food.pk %}">
-		{% trans 'Add to a meal' %}
-	</a>
-    {% endif %}
-  </div>
-</div>
-{% endblock %}

apps/food/templates/food/create_qrcode_form.html

@@ -1,55 +0,0 @@
-{% extends "base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load render_table from django_tables2 %}
-{% load i18n crispy_forms_tags %}
-
-{% block content %}
-<div class="card bg-white mb-3">
-  <h3 class="card-header text-center">
-    {{ title }}
-  </h3>
-  <div class="card-body" id="form">
-    <a class="btn btn-sm btn-success" href="{% url "food:qrcode_basic_create" slug=slug %}">
-      {% trans 'New basic food' %}
-    </a>
-    <form method="post">
-      {%  csrf_token %}
-      {{ form|crispy }}
-      <button class="btn btn-primary" type="submit">{% trans "Submit" %}</button>
-    </form>
-    <div class="card-body" id="profile_infos">
-      <h4>{% trans "Copy constructor" %}</h4>
-      <table class="table">
-        <thead>
-          <tr>
-            <th class="orderable">
-              {% trans "Name" %}
-            </th>
-            <th class="orderable">
-              {% trans "Owner" %}
-            </th>
-            <th class="orderable">
-              {% trans "Arrival date" %}
-            </th>
-            <th class="orderable">
-              {% trans "Expiry date" %}
-            </th>
-          </tr>
-        </thead>
-        <tbody>
-          {% for basic in last_basic %}
-            <tr>
-              <td><a href="{% url "food:qrcode_basic_create" slug=slug %}?copy={{ basic.pk }}">{{ basic.name }}</a></td>
-              <td>{{ basic.owner }}</td>
-              <td>{{ basic.arrival_date }}</td>
-              <td>{{ basic.expiry_date }}</td>
-            </tr>
-          {% endfor %}
-        </tbody>
-      </table>
-    </div>
-  </div>
-</div>
-{% endblock %}

apps/food/templates/food/food_detail.html

@@ -0,0 +1,56 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }} {{ food.name }}
+  </h3>
+  <div class="card-body">
+    <ul>
+      {% if QR_code %}
+      <li> {{QR_code}} </li>
+      {% endif %}
+      {% for field, value in fields %}
+      <li> {{ field }} : {{ value }}</li>
+      {% endfor %}
+      {% if meals %}
+      <li> {% trans "Contained in" %} :
+      {% for meal in meals %}
+      <a href="{% url "food:transformedfood_view" pk=meal.pk %}">{{ meal.name }}</a>{% if not forloop.last %},{% endif %}
+      {% endfor %}
+      </li>
+      {% endif %}
+      {% if foods %}
+      <li> {% trans "Contain" %} :
+      {% for food in foods %}
+        <a href="{% url "food:food_view" pk=food.pk %}">{{ food.name }}</a>{% if not forloop.last %},{% endif %}
+      {% endfor %}
+      </li>
+      {% endif %}
+    </ul>
+      {% if update %}
+        <a class="btn btn-sm btn-secondary" href="{% url "food:food_update" pk=food.pk %}">
+          {% trans "Update" %}
+        </a>
+      {% endif %}
+      {% if add_ingredient %}
+        <a class="btn btn-sm btn-primary" href="{% url "food:add_ingredient" pk=food.pk %}">
+          {% trans "Add to a meal" %}
+        </a>
+      {% endif %}
+      {% if manage_ingredients %}
+        <a class="btn btn-sm btn-secondary" href="{% url "food:manage_ingredients" pk=food.pk %}">
+          {% trans "Manage ingredients" %}
+        </a>
+      {% endif %}
+        <a class="btn btn-sm btn-primary" href="{% url "food:food_list" %}">
+          {% trans "Return to the food list" %}
+        </a>
+  </div>
+</div>
+{% endblock %}

apps/food/templates/food/food_list.html

@@ -0,0 +1,157 @@
+{% extends "base_search.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+{% block content %}
+<div class="card bg-light">
+  <h3 class="card-header text-center">
+      {{ title }}
+  </h3>
+  <div class="card-body">
+    <style>
+      input[type=number]::-webkit-inner-spin-button,
+      input[type=number]::-webkit-outer-spin-button {
+          -webkit-appearance: none;
+          margin: 0;
+      }
+      input[type=number] {
+          appearance: textfield;
+          padding: 6px;
+          border: 1px solid #ccc;
+          border-radius: 4px;
+          width: 100px;
+      }
+    </style>
+    <div class="d-flex align-items-center" style="max-width: 300px;">
+      <form method="get" action="{% url 'food:redirect_view' %}" class="d-flex w-100">
+        <input type="number" name="slug" placeholder="QR-code" required class="form-control form-control-sm" style="max-width: 120px;">
+        <button type="submit" class="btn btn-sm btn-primary">{% trans "View food" %}</button>
+      </form>
+    </div>
+  </div>
+  <div class="card-body">
+    <div class="form-check">
+      <label for="stock_only" class="form-check-label">
+          <input id="stock_only" name="stock_only" type="checkbox" class="checkboxinput form-check-input" checked>
+          {% trans "Filter with only food in stock" %}
+      </label>
+    </div>
+      <input id="searchbar" type="text" class="form-control"
+          placeholder="{% trans "Search by attribute such as name..." %}">
+  </div>
+
+  {% block extra_inside_card %}
+  {% endblock %}
+
+  <div id="dynamic-table">
+      {% if table.data %}
+      {% render_table table %}
+      {% else %}
+      <div class="card-body">
+          <div class="alert alert-warning">
+              {% trans "There is no results." %}
+          </div>
+      </div>
+      {% endif %}
+  </div>
+</div>
+<br>
+<div class="card bg-light mb-3">
+  <h3 class="card-header text-center">
+    {% trans "Meal served" %}
+  </h3>
+  {% if can_add_meal %}
+  <div class="card-footer">
+    <a class="btn btn-sm btn-primary" href="{% url 'food:transformedfood_create' %}">
+      {% trans "New meal" %}
+    </a>
+  </div>
+  {% endif %}
+  {% if served.data %}
+  {% render_table served %}
+  {% else %}
+  <div class="card-body">
+    <div class="alert alert-warning">
+      {% trans "There is no meal served." %}
+    </div>
+  </div>
+</div>
+  {% endif %}
+<div class="card bg-light mb-3">
+  <h3 class="card-header text-center">
+    {% trans "Free food" %}
+  </h3>
+  {% if open.data %}
+  {% render_table open %}
+  {% else %}
+  <div class="card-body">
+    <div class="alert alert-warning">
+      {% trans "There is no free food." %}
+    </div>
+  </div>
+  {% endif %}
+</div>
+{% if club_tables %}
+<div class="card bg-light mb-3">
+  <h3 class="card-header text-center">
+    {% trans "Food of your clubs" %}
+  </h3>
+</div>
+  {% for table in club_tables %}
+<div class="card bg-light mb-3">
+  <h3 class="card-header text-center">
+    {% trans "Food of club" %} {{ table.prefix }} 
+  </h3>
+  {% if table.data %}
+    {% render_table table %}
+  {% else %}
+  <div class="card-body">
+    <div class="alert alert-warning">
+      {% trans "Yours club has not food yet." %}
+    </div>
+  </div>
+  {% endif %}
+</div>
+  {% endfor %}
+  {% endif %}
+</div>
+
+<script type="text/javascript">
+
+    let old_pattern = null;
+    let searchbar_obj = $("#searchbar");
+    let stock_only_obj = $("#stock_only");
+
+    function reloadTable() {
+        let pattern = searchbar_obj.val();
+
+        $("#dynamic-table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + (
+            stock_only_obj.is(':checked') ? "" : "&stock=1") + " #dynamic-table");
+    }
+
+    searchbar_obj.keyup(reloadTable);
+    stock_only_obj.change(reloadTable);
+
+    $(document).on("click", ".table-row", function () {
+        window.document.location = $(this).data("href");
+    });
+</script>
+<script>
+  document.addEventListener('DOMContentLoaded', function() {
+      document.getElementById('goButton').addEventListener('click', function(event) {
+          event.preventDefault();
+          const slug = document.getElementById('slugInput').value;
+          if (slug && !isNaN(slug)) {
+              window.location.href = `/food/${slug}/`;
+          } else {
+              alert("Veuillez entrer un nombre valide.");
+          }
+      });
+  });
+  </script>
+
+{% endblock %}

apps/food/templates/food/food_update.html

@@ -1,5 +1,6 @@
 {% extends "base.html" %}
 {% comment %}
+Copyright (C) by BDE ENS Paris-Saclay
 SPDX-License-Identifier: GPL-3.0-or-later
 {% endcomment %}
 {% load i18n crispy_forms_tags %}

apps/food/templates/food/manage_ingredients.html

@@ -0,0 +1,116 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body" id="form"></div>
+  <form method="post" action="">
+    {% csrf_token %}
+    <table class="table table-condensed table-striped">
+      {# Fill initial data #}
+      {% for display, form in formset %}
+      {% if forloop.first %}
+      <thead>
+	<tr>
+	  <th>{{ form.name.label }}</th>
+	  <th>{{ form.qrcode.label }}</th>
+	  <th>{{ form.fully_used.label }}</th>
+	</tr>
+      </thead>
+      <tbody id="form_body">
+	{% endif %}
+	{% if display %}
+	<tr class="row-formset ingredients">
+	{% else %}
+	<tr class="row-formset ingredients" style="display: none">
+	{% endif %}
+	  <td>{{ form.name }}</td>
+	  <td>{{ form.qrcode }}</td>
+	  <td>{{ form.fully_used }}</td>
+	</tr>
+      {% endfor %}
+      </tbody>
+    </table>
+
+    {# Display buttons to add and remove ingredients #}
+    <div class="card-body">
+      <div class="btn-group btn-block" role="group">
+	<button type="button" id="add_more" class="btn btn-success">{% trans "Add ingredient" %}</button>
+	<button type="button" id="remove_one" class="btn btn-danger">{% trans "Remove ingredient" %}</button>
+      </div>
+    <button class="btn btn-primary" type="submit">{% trans "Submit"%}</button>
+    </div>
+  </form>
+</div>
+
+{% endblock %}
+{% block extrajavascript %} 
+<script>
+/* script that handles add and remove lines */
+
+const foods = {{ ingredients | safe }};
+
+function set_ingredient_id () {
+	let ingredients = document.getElementsByClassName('ingredients');
+	for (var i = 0; i < ingredients.length; i++) {
+		ingredients[i].id = 'ingredients-' + parseInt(i);
+	};
+}
+set_ingredient_id();
+
+function prepopulate () {
+	for (var i = 0; i < {{ ingredients_count }}; i++) {
+		let prefix = 'id_form-' + parseInt(i) + '-';
+		document.getElementById(prefix + 'name_pk').value = parseInt(foods[i]['food_pk']);
+		document.getElementById(prefix + 'name').value = foods[i]['food_name'];
+		document.getElementById(prefix + 'qrcode_pk').value = parseInt(foods[i]['qr_pk']);
+		if (foods[i]['qr_number'] === '') {
+			document.getElementById(prefix + 'qrcode').value = '';
+		}
+		else {
+		document.getElementById(prefix + 'qrcode').value = parseInt(foods[i]['qr_number']);
+		};
+		document.getElementById(prefix + 'fully_used').checked = Boolean(foods[i]['fully_used']);
+	};
+}
+prepopulate();
+
+function delete_form_data (form_id) {
+	let prefix = "id_form-" + parseInt(form_id) + "-";
+	document.getElementById(prefix + "name_pk").value = "";
+	document.getElementById(prefix + "name").value = "";
+	document.getElementById(prefix + "qrcode_pk").value = "";
+	document.getElementById(prefix + "qrcode").value = "";
+	document.getElementById(prefix + "fully_used").checked = true;
+}
+var form_count = {{ ingredients_count }} + 1;
+
+$('#add_more').click(function () {
+	let ingredient_form = document.getElementById('ingredients-' + parseInt(form_count));
+	if (ingredient_form === null) {
+		addMsg(gettext("You can't add more ingredient"), "danger",  5000);
+		return;};
+	ingredient_form.style = "display: true";
+	form_count += 1;
+});
+  
+$('#remove_one').click(function () {
+	let ingredient_form = document.getElementById('ingredients-' + parseInt(form_count - 1));
+	if (ingredient_form === null) {
+		return;};
+	ingredient_form.style = "display: none";
+	delete_form_data(form_count - 1);
+	form_count -= 1;
+});
+
+addMsg(gettext("Add ingredient with their name or their qrcode, if two different priority is given to qrcode"), "warning"); 
+
+</script>
+{% endblock %}

apps/food/templates/food/qrcode.html

@@ -0,0 +1,52 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+{% load render_table from django_tables2 %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body" id="form">
+    <form method="post">
+      {% csrf_token %}
+      {{ form | crispy }}
+      <button class="btn btn-primary" type="submit">{% trans "Submit"%}</button>
+    </form>
+    <div class="card-body">
+    <h4>
+      {% trans "Copy constructor" %}
+      <a class="btn btn-secondary" href="{% url "food:basicfood_create" slug=slug %}">{% trans "New food" %}</a>
+    </h4>
+      <table class="table">
+	<thead>
+	  <tr>
+	    <th class="orderable">
+	      {% trans "Name" %}
+	    </th>
+	    <th class="orderable">
+	      {% trans "Owner" %}
+	    </th>
+	    <th class="orderable">
+	      {% trans "Expiry date" %}
+	    </th>
+	  </tr>
+	</thead>
+	<tbody>
+	  {% for food in last_items %}
+	    <tr>
+		    <td><a href="{% url "food:basicfood_create" slug=slug %}?copy={{ food.pk }}">{{ food.name }}</a></td>
+	      <td>{{ food.owner }}</td>
+	      <td>{{ food.expiry_date }}</td>
+	    </tr>
+	  {% endfor %}
+	</tbody>
+      </table>
+    </div>
+  </div>
+</div>
+{% endblock %}

apps/food/templates/food/qrcode_detail.html

@@ -1,39 +0,0 @@
-{% extends "base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load i18n crispy_forms_tags %}
-
-{% block content %}
-<div class="card bg-white mb-3">
-    <h3 class="card-header text-center">
-	{{ title }} {% trans 'number' %} {{ qrcode.qr_code_number }}
-    </h3>
-	<div class="card-body">
-	    <ul>
-		<li><p>{% trans 'Name' %} : {{ qrcode.food_container.name }}</p></li>
-		<li><p>{% trans 'Owner' %} : {{ qrcode.food_container.owner }}</p></li>
-		<li><p>{% trans 'Expiry date' %} : {{ qrcode.food_container.expiry_date  }}</p></li>
-	    </ul>
-	{% if qrcode.food_container.polymorphic_ctype.model == 'basicfood' and can_update_basic %}
-	    <a class="btn btn-sm btn-warning" href="{% url "food:basic_update" pk=qrcode.food_container.pk %}" data-turbolinks="false">
-		{% trans 'Update' %}
-	    </a>
-	{% elif can_update_transformed %}
-	    <a class="btn btn-sm btn-warning" href="{% url "food:transformed_update" pk=qrcode.food_container.pk %}">
-		{% trans 'Update' %}
-	    </a>
-	{% endif %}
-	{% if can_view_detail %}
-	    <a class="btn btn-sm btn-primary" href="{% url "food:food_view" pk=qrcode.food_container.pk %}">
-		{% trans 'View details' %}
-	    </a>
-	{% endif %}
-	{% if can_add_ingredient %}
-	    <a class="btn btn-sm btn-success" href="{% url "food:add_ingredient" pk=qrcode.food_container.pk %}">
-		{% trans 'Add to a meal' %}
-	    </a>
-	{% endif %}
-	</div>
-</div>
-{% endblock %}

apps/food/templates/food/transformedfood_detail.html

@@ -1,51 +0,0 @@
-{% extends "base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load i18n crispy_forms_tags %}
-
-{% block content %}
-<div class="card bg-white mb-3">
-    <h3 class="card-header text-center">
-	{{ title }} {{ food.name }}
-    </h3>
-	<div class="card-body">
-	    <ul>
-		<li><p>{% trans 'Owner' %} : {{ food.owner }}</p></li>
-		{% if can_see_ready %}
-		<li><p>{% trans 'Ready' %} : {{ food.is_ready }}</p></li>
-		{% endif %}
-		<li><p>{% trans 'Creation date' %} : {{ food.creation_date }}</p></li>
-		<li><p>{% trans 'Expiry date' %} : {{ food.expiry_date }}</p></li>
-		<li>{% trans 'Allergens' %} :</li>
-		<ul>
-		    {% for allergen in food.allergens.iterator %}
-		    <li>{{ allergen.name }}</li>
-		    {% endfor %}
-	        </ul>
-		<p>
-		<li>{% trans 'Ingredients' %} :</li>
-		<ul>
-		    {% for ingredient in food.ingredient.iterator %}
-		    <li><a href="{% url "food:food_view" pk=ingredient.pk %}">{{ ingredient.name }}</a></li>
-		    {% endfor %}
-		</ul>
-		<p>
-		<li><p>{% trans 'Shelf life' %} : {{ food.shelf_life }}</p></li>
-		<li><p>{% trans 'Ready' %} : {{ food.is_ready }}</p></li>
-		<li><p>{% trans 'Active' %} : {{ food.is_active }}</p></li>
-		<li><p>{% trans 'Eaten' %} : {{ food.was_eaten }}</p></li>
-	    </ul>
-	    {% if can_update %}
-	        <a class="btn btn-sm btn-warning" href="{% url "food:transformed_update" pk=food.pk %}">
-		    {% trans 'Update' %}
-		</a>
-	    {% endif %}
-	    {% if can_add_ingredient %}
-	        <a class="btn btn-sm btn-success" href="{% url "food:add_ingredient" pk=food.pk %}">
-		    {% trans 'Add to a meal' %}
-		</a>
-	    {% endif %}
-    </div>
-</div>
-{% endblock %}

apps/food/templates/food/transformedfood_list.html

@@ -1,60 +0,0 @@
-{% extends "base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load render_table from django_tables2 %}
-{% load i18n %}
-
-{% block content %}
-<div class="card bg-light mb-3">
-    <h3 class="card-header text-center">
-	{% trans "Meal served" %}
-    </h3>
-    {% if can_create_meal %}
-    <div class="card-footer">
-	<a class="btn btn-sm btn-success" href="{% url 'food:transformed_create' %}" data-turbolinks="false">
-	    {% trans 'New meal' %}
-	</a>
-    </div>
-    {% endif %}
-    {% if served.data %}
-    {% render_table served %}
-    {% else %}
-    <div class="card-body">
-	<div class="alert alert-warning">
-	    {% trans "There is no meal served." %}
-	</div>
-    </div>
-    {% endif %}
-</div>
-
-<div class="card bg-light mb-3">
-    <h3 class="card-header text-center">
-	{% trans "Open" %}
-    </h3>
-    {% if open.data %}
-    {% render_table open %}
-    {% else %}
-    <div class="card-body">
-	<div class="alert alert-warning">
-	    {% trans "There is no free meal." %}
-	</div>
-    </div>
-    {% endif %}
-</div>
-
-<div class="card bg-light mb-3">
-    <h3 class="card-header text-center">
-        {% trans "All meals" %}
-    </h3>
-    {% if table.data %}
-    {% render_table table %}
-    {% else %}
-    <div class="card-body">
-        <div class="alert alert-warning">
-            {% trans "There is no meal." %}
-        </div>
-    </div>
-    {% endif %}
-</div>
-{% endblock %}

apps/food/templates/food/transformedfood_update.html

@@ -0,0 +1,87 @@
+{% extends "base.html" %}
+{% comment %}
+Copyright (C) by BDE ENS Paris-Saclay
+SPDX-License-Identifier: GPL-3.0-or-later
+{% endcomment %}
+{% load i18n crispy_forms_tags %}
+
+{% block content %}
+<div class="card bg-white mb-3">
+  <h3 class="card-header text-center">
+    {{ title }}
+  </h3>
+  <div class="card-body" id="form">
+    <form method="post">
+      {% csrf_token %}
+      {{ form | crispy }}
+      <table class="table table-condensed table-striped">
+        {# Fill initial data #}
+        {% for ingredient_form in formset %}
+        {% if forloop.first %}
+        <thead>
+          <tr>
+	    <th>{% trans "Name" %}</th>
+	    <th>{% trans "QR-code number" %}</th>
+	    <th>{% trans "Fully used" %}<th>
+          </tr>
+        </thead>
+        <tbody id="form_body">
+        {% endif %}
+        <tr class="row-formset">
+		{{ ingredient_form | crispy }}
+          <td>{{ ingredient_form.name }}</td>
+	  <td>{{ ingredient_form.qrcode }}</td>
+	  <td>{{ ingredient_form.fully_used }}</td>
+        </tr>
+        {% endfor %}
+        </tbody>
+      </table>
+      {# Display buttons to add and remove products #}
+      <div class="card-body">
+        <div class="btn-group btn-block" role="group">
+          <button type="button" id="add_more" class="btn btn-success">{% trans "Add ingredient" %}</button>
+	  <button type="button" id="remove_one" class="btn btn-danger">{% trans "Remove ingredient" %}</button>
+        </div>
+        <button type="submit" class="btn btn-block btn-primary">{% trans "Submit" %}</button>
+      </div>
+    </form>
+  </div>
+</div>
+
+{# Hidden div that store an empty product form, to be copied into new forms #}
+<div id="empty_form" style="display: none;">
+    <table class='no_error'>
+        <tbody id="for_real">
+            <tr class="row-formset">
+                <td>{{ formset.empty_form.name }}</td>
+		<td>{{ formset.empty_form.qrcode }}</td>
+		<td>{{ formset.empty_form.fully_used }}</td>
+            </tr>
+        </tbody>
+    </table>
+</div>
+{% endblock %}
+{% block extrajavascript %}
+<script>
+    /* script that handles add and remove lines */
+    IDS = {};
+
+    $("#id_form-TOTAL_FORMS").val($(".row-formset").length - 1);
+
+    $('#add_more').click(function () {
+        let form_idx = $('#id_form-TOTAL_FORMS').val();
+        $('#form_body').append($('#for_real').html().replace(/__prefix__/g, form_idx));
+        $('#id_form-TOTAL_FORMS').val(parseInt(form_idx) + 1);
+        $('#id_form-' + parseInt(form_idx) + '-id').val(IDS[parseInt(form_idx)]);
+    });
+
+    $('#remove_one').click(function () {
+        let form_idx = $('#id_form-TOTAL_FORMS').val();
+        if (form_idx > 0) {
+            IDS[parseInt(form_idx) - 1] = $('#id_form-' + (parseInt(form_idx) - 1) + '-id').val();
+            $('#form_body tr:last-child').remove();
+            $('#id_form-TOTAL_FORMS').val(parseInt(form_idx) - 1);
+        }
+    });
+</script>
+{% endblock %}

apps/food/tests.py

@@ -1,3 +0,0 @@
-# from django.test import TestCase
-
-# Create your tests here.

apps/food/tests/test_food.py

@@ -0,0 +1,170 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from api.tests import TestAPI
+from django.contrib.auth.models import User
+from django.test import TestCase
+from django.urls import reverse
+from django.utils import timezone
+
+from ..api.views import AllergenViewSet, BasicFoodViewSet, TransformedFoodViewSet, QRCodeViewSet
+from ..models import Allergen, BasicFood, TransformedFood, QRCode
+
+
+class TestFood(TestCase):
+    """
+    Test food
+    """
+    fixtures = ('initial',)
+
+    def setUp(self):
+        self.user = User.objects.create_superuser(
+            username='admintoto',
+            password='toto1234',
+            email='toto@example.com'
+        )
+        self.client.force_login(self.user)
+
+        sess = self.client.session
+        sess['permission_mask'] = 42
+        sess.save()
+
+        self.allergen = Allergen.objects.create(
+            name='allergen',
+        )
+
+        self.basicfood = BasicFood.objects.create(
+            name='basicfood',
+            owner_id=1,
+            expiry_date=timezone.now(),
+            is_ready=False,
+            date_type='DLC',
+        )
+
+        self.transformedfood = TransformedFood.objects.create(
+            name='transformedfood',
+            owner_id=1,
+            expiry_date=timezone.now(),
+            is_ready=False,
+        )
+
+        self.qrcode = QRCode.objects.create(
+            qr_code_number=1,
+            food_container=self.basicfood,
+        )
+
+        def test_food_list(self):
+            """
+            Display food list
+            """
+            response = self.client.get(reverse('food:food_list'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_qrcode_create(self):
+            """
+            Display QRCode creation
+            """
+            response = self.client.get(reverse('food:qrcode_create'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_basicfood_create(self):
+            """
+            Display BasicFood creation
+            """
+            response = self.client.get(reverse('food:basicfood_create'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_transformedfood_create(self):
+            """
+            Display TransformedFood creation
+            """
+            response = self.client.get(reverse('food:transformedfood_create'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_food_create(self):
+            """
+            Display Food update
+            """
+            response = self.client.get(reverse('food:food_update'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_food_view(self):
+            """
+            Display Food detail
+            """
+            response = self.client.get(reverse('food:food_view'))
+            self.assertEqual(response.status_code, 302)
+
+        def test_basicfood_view(self):
+            """
+            Display BasicFood detail
+            """
+            response = self.client.get(reverse('food:basicfood_view'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_transformedfood_view(self):
+            """
+            Display TransformedFood detail
+            """
+            response = self.client.get(reverse('food:transformedfood_view'))
+            self.assertEqual(response.status_code, 200)
+
+        def test_add_ingredient(self):
+            """
+            Display add ingredient view
+            """
+            response = self.client.get(reverse('food:add_ingredient'))
+            self.assertEqual(response.status_code, 200)
+
+
+class TestFoodAPI(TestAPI):
+    def setUp(self) -> None:
+        super().setUP()
+
+        self.allergen = Allergen.objects.create(
+            name='name',
+        )
+
+        self.basicfood = BasicFood.objects.create(
+            name='basicfood',
+            owner_id=1,
+            expiry_date=timezone.now(),
+            is_ready=False,
+            date_type='DLC',
+        )
+
+        self.transformedfood = TransformedFood.objects.create(
+            name='transformedfood',
+            owner_id=1,
+            expiry_date=timezone.now(),
+            is_ready=False,
+        )
+
+        self.qrcode = QRCode.objects.create(
+            qr_code_number=1,
+            food_container=self.basicfood,
+        )
+
+        def test_allergen_api(self):
+            """
+            Load Allergen API page and test all filters and permissions
+            """
+            self.check_viewset(AllergenViewSet, '/api/food/allergen/')
+
+        def test_basicfood_api(self):
+            """
+            Load BasicFood API page and test all filters and permissions
+            """
+            self.check_viewset(BasicFoodViewSet, '/api/food/basicfood/')
+
+        def test_transformedfood_api(self):
+            """
+            Load TransformedFood API page and test all filters and permissions
+            """
+            self.check_viewset(TransformedFoodViewSet, '/api/food/transformedfood/')
+
+        def test_qrcode_api(self):
+            """
+            Load QRCode API page and test all filters and permissions
+            """
+            self.check_viewset(QRCodeViewSet, '/api/food/qrcode/')

apps/food/urls.py

@@ -8,14 +8,15 @@ from . import views
 app_name = 'food'
 
 urlpatterns = [
-    path('', views.TransformedListView.as_view(), name='food_list'),
-    path('<int:slug>', views.QRCodeView.as_view(), name='qrcode_view'),
-    path('detail/<int:pk>', views.FoodView.as_view(), name='food_view'),
-
-    path('<int:slug>/create_qrcode', views.QRCodeCreateView.as_view(), name='qrcode_create'),
-    path('<int:slug>/create_qrcode/basic', views.QRCodeBasicFoodCreateView.as_view(), name='qrcode_basic_create'),
-    path('create/transformed', views.TransformedFoodCreateView.as_view(), name='transformed_create'),
-    path('update/basic/<int:pk>', views.BasicFoodUpdateView.as_view(), name='basic_update'),
-    path('update/transformed/<int:pk>', views.TransformedFoodUpdateView.as_view(), name='transformed_update'),
-    path('add/<int:pk>', views.AddIngredientView.as_view(), name='add_ingredient'),
+    path('', views.FoodListView.as_view(), name='food_list'),
+    path('<int:slug>', views.QRCodeCreateView.as_view(), name='qrcode_create'),
+    path('<int:slug>/add/basic', views.BasicFoodCreateView.as_view(), name='basicfood_create'),
+    path('add/transformed', views.TransformedFoodCreateView.as_view(), name='transformedfood_create'),
+    path('update/<int:pk>', views.FoodUpdateView.as_view(), name='food_update'),
+    path('update/ingredients/<int:pk>', views.ManageIngredientsView.as_view(), name='manage_ingredients'),
+    path('detail/<int:pk>', views.FoodDetailView.as_view(), name='food_view'),
+    path('detail/basic/<int:pk>', views.BasicFoodDetailView.as_view(), name='basicfood_view'),
+    path('detail/transformed/<int:pk>', views.TransformedFoodDetailView.as_view(), name='transformedfood_view'),
+    path('add/ingredient/<int:pk>', views.AddIngredientView.as_view(), name='add_ingredient'),
+    path('redirect/', views.QRCodeRedirectView.as_view(), name='redirect_view'),
 ]

apps/food/utils.py

@@ -0,0 +1,53 @@
+# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from django.utils.translation import gettext_lazy as _
+
+seconds = (_('second'), _('seconds'))
+minutes = (_('minute'), _('minutes'))
+hours = (_('hour'), _('hours'))
+days = (_('day'), _('days'))
+weeks = (_('week'), _('weeks'))
+
+
+def plural(x):
+    if x == 1:
+        return 0
+    return 1
+
+
+def pretty_duration(duration):
+    """
+    I receive datetime.timedelta object
+    You receive string object
+    """
+    text = []
+    sec = duration.seconds
+    d = duration.days
+
+    if d >= 7:
+        w = d // 7
+        text.append(str(w) + ' ' + weeks[plural(w)])
+        d -= w * 7
+    if d > 0:
+        text.append(str(d) + ' ' + days[plural(d)])
+
+    if sec >= 3600:
+        h = sec // 3600
+        text.append(str(h) + ' ' + hours[plural(h)])
+        sec -= h * 3600
+
+    if sec >= 60:
+        m = sec // 60
+        text.append(str(m) + ' ' + minutes[plural(m)])
+        sec -= m * 60
+
+    if sec > 0:
+        text.append(str(sec) + ' ' + seconds[plural(sec)])
+
+    if len(text) == 0:
+        return ''
+    if len(text) == 1:
+        return text[0]
+    if len(text) >= 2:
+        return ', '.join(t for t in text[:-1]) + ' ' + _('and') + ' ' + text[-1]

apps/food/views.py

@@ -1,421 +1,532 @@
 # Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from django.db import transaction
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.http import HttpResponseRedirect
+from datetime import timedelta
+
+from api.viewsets import is_regex
 from django_tables2.views import MultiTableMixin
-from django.urls import reverse
-from django.utils.translation import gettext_lazy as _
-from django.utils import timezone
-from django.views.generic import DetailView, UpdateView
+from django.db import transaction
+from django.db.models import Q
+from django.http import HttpResponseRedirect, Http404
+from django.views.generic import DetailView, UpdateView, CreateView
 from django.views.generic.list import ListView
-from django.forms import HiddenInput
+from django.views.generic.base import RedirectView
+from django.urls import reverse_lazy
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+from member.models import Club, Membership
 from permission.backends import PermissionBackend
-from permission.views import ProtectQuerysetMixin, ProtectedCreateView
+from permission.views import ProtectQuerysetMixin, ProtectedCreateView, LoginRequiredMixin
 
-from .forms import AddIngredientForms, BasicFoodForms, QRCodeForms, TransformedFoodForms
-from .models import BasicFood, Food, QRCode, TransformedFood
-from .tables import TransformedFoodTable
+from .models import Food, BasicFood, TransformedFood, QRCode
+from .forms import QRCodeForms, BasicFoodForms, TransformedFoodForms, \
+    ManageIngredientsForm, ManageIngredientsFormSet, AddIngredientForms, \
+    BasicFoodUpdateForms, TransformedFoodUpdateForms
+from .tables import FoodTable
+from .utils import pretty_duration
 
 
-class AddIngredientView(ProtectQuerysetMixin, UpdateView):
+class FoodListView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMixin, ListView):
     """
-    A view to add an ingredient
+    Display Food
     """
     model = Food
-    template_name = 'food/add_ingredient_form.html'
-    extra_context = {"title": _("Add the ingredient")}
-    form_class = AddIngredientForms
+    tables = [FoodTable, FoodTable, FoodTable, ]
+    extra_context = {"title": _('Food')}
+    template_name = 'food/food_list.html'
 
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-        context["pk"] = self.kwargs["pk"]
-        return context
+    def get_queryset(self, **kwargs):
+        return super().get_queryset(**kwargs).distinct()
 
-    @transaction.atomic
-    def form_valid(self, form):
-        form.instance.creater = self.request.user
-        food = Food.objects.get(pk=self.kwargs['pk'])
-        add_ingredient_form = AddIngredientForms(data=self.request.POST)
-        if food.is_ready:
-            form.add_error(None, _("The product is already prepared"))
-            return self.form_invalid(form)
-        if not add_ingredient_form.is_valid():
-            return self.form_invalid(form)
+    def get_tables(self):
+        bureau_role_pk = 4
+        clubs = Club.objects.filter(membership__in=Membership.objects.filter(
+            user=self.request.user, roles=bureau_role_pk).filter(
+                date_end__gte=timezone.now()))
 
-        # We flip logic ""fully used = not is_active""
-        food.is_active = not food.is_active
-        # Save the aliment and the allergens associed
-        for transformed_pk in self.request.POST.getlist('ingredient'):
-            transformed = TransformedFood.objects.get(pk=transformed_pk)
-            if not transformed.is_ready:
-                transformed.ingredient.add(food)
-                transformed.update()
-        food.save()
+        tables = [FoodTable] * (clubs.count() + 3)
+        self.tables = tables
+        tables = super().get_tables()
+        tables[0].prefix = 'search-'
+        tables[1].prefix = 'open-'
+        tables[2].prefix = 'served-'
+        for i in range(clubs.count()):
+            tables[i + 3].prefix = clubs[i].name
+        return tables
 
-        return HttpResponseRedirect(self.get_success_url())
+    def get_tables_data(self):
+        # table search
+        qs = self.get_queryset().order_by('name')
+        if "search" in self.request.GET and self.request.GET['search']:
+            pattern = self.request.GET['search']
 
-    def get_success_url(self, **kwargs):
-        return reverse('food:food_list')
+            # check regex
+            valid_regex = is_regex(pattern)
+            suffix = '__iregex' if valid_regex else '__istartswith'
+            prefix = '^' if valid_regex else ''
+            qs = qs.filter(Q(**{f'name{suffix}': prefix + pattern})
+                           | Q(**{f'owner__name{suffix}': prefix + pattern})
+                           | Q(**{f'owner__note__alias__name{suffix}': prefix + pattern}))
+        else:
+            qs = qs.none()
+        if "stock" not in self.request.GET or not self.request.GET["stock"] == '1':
+            qs = qs.filter(end_of_life='')
 
+        search_table = qs.filter(PermissionBackend.filter_queryset(self.request, Food, 'view'))
+        # table open
+        open_table = self.get_queryset().filter(
+            Q(polymorphic_ctype__model='transformedfood')
+            | Q(polymorphic_ctype__model='basicfood', basicfood__date_type='DLC')).filter(
+                expiry_date__lt=timezone.now(), end_of_life='').filter(
+                    PermissionBackend.filter_queryset(self.request, Food, 'view'))
+        open_table = open_table.union(self.get_queryset().filter(
+            Q(end_of_life='', order__iexact='open')
+        ).filter(
+            PermissionBackend.filter_queryset(self.request, Food, 'view'))).order_by('expiry_date')
+        # table served
+        served_table = self.get_queryset().order_by('-pk').filter(
+            end_of_life='', is_ready=True).exclude(
+                Q(polymorphic_ctype__model='basicfood',
+                  basicfood__date_type='DLC',
+                  expiry_date__lte=timezone.now(),)
+                | Q(polymorphic_ctype__model='transformedfood',
+                    expiry_date__lte=timezone.now(),
+                    ))
+        # tables club
+        bureau_role_pk = 4
+        clubs = Club.objects.filter(membership__in=Membership.objects.filter(
+            user=self.request.user, roles=bureau_role_pk).filter(
+                date_end__gte=timezone.now()))
+        club_table = []
+        for club in clubs:
+            club_table.append(self.get_queryset().order_by('expiry_date').filter(
+                owner=club, end_of_life='').filter(
+                    PermissionBackend.filter_queryset(self.request, Food, 'view')
+            ))
 
-class BasicFoodUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
-    """
-    A view to update a basic food
-    """
-    model = BasicFood
-    form_class = BasicFoodForms
-    template_name = 'food/basicfood_form.html'
-    extra_context = {"title": _("Update an aliment")}
-
-    @transaction.atomic
-    def form_valid(self, form):
-        form.instance.creater = self.request.user
-        basic_food_form = BasicFoodForms(data=self.request.POST)
-        if not basic_food_form.is_valid():
-            return self.form_invalid(form)
-
-        ans = super().form_valid(form)
-        form.instance.update()
-        return ans
-
-    def get_success_url(self, **kwargs):
-        self.object.refresh_from_db()
-        return reverse('food:food_view', kwargs={"pk": self.object.pk})
-
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-        return context
-
-
-class FoodView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
-    """
-    A view to see a food
-    """
-    model = Food
-    extra_context = {"title": _("Details of:")}
-    context_object_name = "food"
+        return [search_table, open_table, served_table] + club_table
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
 
-        context["can_update"] = PermissionBackend.check_perm(self.request, "food.change_food")
-        context["can_add_ingredient"] = PermissionBackend.check_perm(self.request, "food.change_transformedfood")
+        tables = context['tables']
+        # for extends base_search.html we need to name 'search_table' in 'table'
+        for name, table in zip(['table', 'open', 'served'], tables):
+            context[name] = table
+        context['club_tables'] = tables[3:]
+
+        context['can_add_meal'] = PermissionBackend.check_perm(self.request, 'food.transformedfood_add')
         return context
 
 
-class QRCodeBasicFoodCreateView(ProtectQuerysetMixin, ProtectedCreateView):
-    #####################################################################
-    # TO DO
-    # - this feature is very pratical for meat or fish, nevertheless we can implement this later
-    # - fix picture save
-    # - implement solution crop and convert image (reuse or recode ImageForm from members apps)
-    #####################################################################
+class QRCodeCreateView(ProtectQuerysetMixin, LoginRequiredMixin, CreateView):
     """
-    A view to add a basic food with a qrcode
-    """
-    model = BasicFood
-    form_class = BasicFoodForms
-    template_name = 'food/basicfood_form.html'
-    extra_context = {"title": _("Add a new basic food with QRCode")}
-
-    @transaction.atomic
-    def form_valid(self, form):
-        form.instance.creater = self.request.user
-        basic_food_form = BasicFoodForms(data=self.request.POST)
-        if not basic_food_form.is_valid():
-            return self.form_invalid(form)
-
-        # Save the aliment and the allergens associed
-        basic_food = form.save(commit=False)
-        # We assume the date of labeling and the same as the date of arrival
-        basic_food.arrival_date = timezone.now()
-        basic_food.is_ready = False
-        basic_food.is_active = True
-        basic_food.was_eaten = False
-        basic_food._force_save = True
-        basic_food.save()
-        basic_food.refresh_from_db()
-
-        qrcode = QRCode()
-        qrcode.qr_code_number = self.kwargs['slug']
-        qrcode.food_container = basic_food
-        qrcode.save()
-
-        return super().form_valid(form)
-
-    def get_success_url(self, **kwargs):
-        self.object.refresh_from_db()
-        return reverse('food:qrcode_view', kwargs={"slug": self.kwargs['slug']})
-
-    def get_sample_object(self):
-
-        # We choose a club which may work or BDE else
-        owner_id = 1
-        for membership in self.request.user.memberships.all():
-            club_id = membership.club.id
-            food = BasicFood(name="", expiry_date=timezone.now(), owner_id=club_id)
-            if PermissionBackend.check_perm(self.request, "food.add_basicfood", food):
-                owner_id = club_id
-
-        return BasicFood(
-            name="",
-            expiry_date=timezone.now(),
-            owner_id=owner_id,
-        )
-
-    def get_context_data(self, **kwargs):
-        # Some field are hidden on create
-        context = super().get_context_data(**kwargs)
-
-        form = context['form']
-        form.fields['is_active'].widget = HiddenInput()
-        form.fields['was_eaten'].widget = HiddenInput()
-
-        copy = self.request.GET.get('copy', None)
-        if copy is not None:
-            basic = BasicFood.objects.get(pk=copy)
-            for field in ['date_type', 'expiry_date', 'name', 'owner']:
-                form.fields[field].initial = getattr(basic, field)
-            for field in ['allergens']:
-                form.fields[field].initial = getattr(basic, field).all()
-
-        return context
-
-
-class QRCodeCreateView(ProtectQuerysetMixin, ProtectedCreateView):
-    """
-    A view to add a new qrcode
+    A view to add qrcode
     """
     model = QRCode
-    template_name = 'food/create_qrcode_form.html'
+    template_name = 'food/qrcode.html'
     form_class = QRCodeForms
     extra_context = {"title": _("Add a new QRCode")}
 
     def get(self, *args, **kwargs):
         qrcode = kwargs["slug"]
         if self.model.objects.filter(qr_code_number=qrcode).count() > 0:
-            return HttpResponseRedirect(reverse("food:qrcode_view", kwargs=kwargs))
+            pk = self.model.objects.get(qr_code_number=qrcode).food_container.pk
+            return HttpResponseRedirect(reverse_lazy("food:food_view", kwargs={"pk": pk}))
         else:
             return super().get(*args, **kwargs)
 
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-        context["slug"] = self.kwargs["slug"]
-
-        context["last_basic"] = BasicFood.objects.order_by('-pk').all()[:10]
-
-        return context
-
     @transaction.atomic
     def form_valid(self, form):
-        form.instance.creater = self.request.user
         qrcode_food_form = QRCodeForms(data=self.request.POST)
         if not qrcode_food_form.is_valid():
             return self.form_invalid(form)
 
-        # Save the qrcode
         qrcode = form.save(commit=False)
-        qrcode.qr_code_number = self.kwargs["slug"]
+        qrcode.qr_code_number = self.kwargs['slug']
         qrcode._force_save = True
         qrcode.save()
         qrcode.refresh_from_db()
+        return super().form_valid(form)
 
-        qrcode.food_container.save()
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context['slug'] = self.kwargs['slug']
+
+        # get last 10 BasicFood objects with distincts 'name' ordered by '-pk'
+        # we can't use .distinct and .order_by with differents columns hence the generator
+        context['last_items'] = [food for food in BasicFood.get_lastests_objects(10, 'name', '-pk')]
+        return context
+
+    def get_success_url(self, **kwargs):
+        self.object.refresh_from_db()
+        return reverse_lazy('food:food_view', kwargs={'pk': self.object.food_container.pk})
+
+    def get_sample_object(self):
+        return QRCode(
+            qr_code_number=self.kwargs['slug'],
+            food_container_id=1,
+        )
+
+
+class BasicFoodCreateView(ProtectQuerysetMixin, ProtectedCreateView):
+    """
+    A view to add basicfood
+    """
+    model = BasicFood
+    form_class = BasicFoodForms
+    extra_context = {"title": _("Add an aliment")}
+    template_name = "food/food_update.html"
+
+    def get_sample_object(self):
+        # We choose a club which may work or BDE else
+        food = BasicFood(
+            name="",
+            owner_id=1,
+            expiry_date=timezone.now(),
+            is_ready=True,
+            arrival_date=timezone.now(),
+            date_type='DLC',
+        )
+
+        for membership in self.request.user.memberships.all():
+            club_id = membership.club.id
+            food.owner_id = club_id
+            if PermissionBackend.check_perm(self.request, "food.add_basicfood", food):
+                return food
+
+        return food
+
+    @transaction.atomic
+    def form_valid(self, form):
+        if QRCode.objects.filter(qr_code_number=self.kwargs['slug']).count() > 0:
+            return HttpResponseRedirect(reverse_lazy('food:qrcode_create', kwargs={'slug': self.kwargs['slug']}))
+        food_form = BasicFoodForms(data=self.request.POST)
+        if not food_form.is_valid():
+            return self.form_invalid(form)
+
+        food = form.save(commit=False)
+        food.is_ready = False
+        food.save()
+        food.refresh_from_db()
+
+        qrcode = QRCode()
+        qrcode.qr_code_number = self.kwargs['slug']
+        qrcode.food_container = food
+        qrcode.save()
 
         return super().form_valid(form)
 
     def get_success_url(self, **kwargs):
         self.object.refresh_from_db()
-        return reverse('food:qrcode_view', kwargs={"slug": self.kwargs['slug']})
+        return reverse_lazy('food:basicfood_view', kwargs={"pk": self.object.pk})
 
-    def get_sample_object(self):
-        return QRCode(
-            qr_code_number=self.kwargs["slug"],
-            food_container_id=1
-        )
+    def get_context_data(self, *args, **kwargs):
+        context = super().get_context_data(*args, **kwargs)
 
+        copy = self.request.GET.get('copy', None)
+        if copy is not None:
+            food = BasicFood.objects.get(pk=copy)
 
-class QRCodeView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
-    """
-    A view to see a qrcode
-    """
-    model = QRCode
-    extra_context = {"title": _("QRCode")}
-    context_object_name = "qrcode"
-    slug_field = "qr_code_number"
-
-    def get(self, *args, **kwargs):
-        qrcode = kwargs["slug"]
-        if self.model.objects.filter(qr_code_number=qrcode).count() > 0:
-            return super().get(*args, **kwargs)
+            for field in context['form'].fields:
+                if field == 'allergens':
+                    context['form'].fields[field].initial = getattr(food, field).all()
                 else:
-            return HttpResponseRedirect(reverse("food:qrcode_create", kwargs=kwargs))
+                    context['form'].fields[field].initial = getattr(food, field)
 
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-
-        qr_code_number = self.kwargs['slug']
-        qrcode = self.model.objects.get(qr_code_number=qr_code_number)
-
-        model = qrcode.food_container.polymorphic_ctype.model
-
-        if model == "basicfood":
-            context["can_update_basic"] = PermissionBackend.check_perm(self.request, "food.change_basicfood")
-            context["can_view_detail"] = PermissionBackend.check_perm(self.request, "food.view_basicfood")
-        if model == "transformedfood":
-            context["can_update_transformed"] = PermissionBackend.check_perm(self.request, "food.change_transformedfood")
-            context["can_view_detail"] = PermissionBackend.check_perm(self.request, "food.view_transformedfood")
-        context["can_add_ingredient"] = PermissionBackend.check_perm(self.request, "food.change_transformedfood")
         return context
 
 
 class TransformedFoodCreateView(ProtectQuerysetMixin, ProtectedCreateView):
     """
-    A view to add a tranformed food
+    A view to add transformedfood
     """
     model = TransformedFood
-    template_name = 'food/transformedfood_form.html'
     form_class = TransformedFoodForms
-    extra_context = {"title": _("Add a new meal")}
-
-    @transaction.atomic
-    def form_valid(self, form):
-        form.instance.creater = self.request.user
-        transformed_food_form = TransformedFoodForms(data=self.request.POST)
-        if not transformed_food_form.is_valid():
-            return self.form_invalid(form)
-
-        # Save the aliment and allergens associated
-        transformed_food = form.save(commit=False)
-        transformed_food.expiry_date = transformed_food.creation_date
-        transformed_food.is_active = True
-        transformed_food.is_ready = False
-        transformed_food.was_eaten = False
-        transformed_food._force_save = True
-        transformed_food.save()
-        transformed_food.refresh_from_db()
-        ans = super().form_valid(form)
-        transformed_food.update()
-        return ans
-
-    def get_success_url(self, **kwargs):
-        self.object.refresh_from_db()
-        return reverse('food:food_view', kwargs={"pk": self.object.pk})
+    extra_context = {"title": _("Add a meal")}
+    template_name = "food/food_update.html"
 
     def get_sample_object(self):
         # We choose a club which may work or BDE else
-        owner_id = 1
-        for membership in self.request.user.memberships.all():
-            club_id = membership.club.id
-            food = TransformedFood(name="",
-                                   creation_date=timezone.now(),
-                                   expiry_date=timezone.now(),
-                                   owner_id=club_id)
-            if PermissionBackend.check_perm(self.request, "food.add_transformedfood", food):
-                owner_id = club_id
-                break
-
-        return TransformedFood(
+        food = TransformedFood(
             name="",
-            owner_id=owner_id,
-            creation_date=timezone.now(),
+            owner_id=1,
             expiry_date=timezone.now(),
+            is_ready=True,
         )
 
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
+        for membership in self.request.user.memberships.all():
+            club_id = membership.club.id
+            food.owner_id = club_id
+            if PermissionBackend.check_perm(self.request, "food.add_transformedfood", food):
+                return food
 
-        # Some field are hidden on create
-        form = context['form']
-        form.fields['is_active'].widget = HiddenInput()
-        form.fields['is_ready'].widget = HiddenInput()
-        form.fields['was_eaten'].widget = HiddenInput()
-        form.fields['shelf_life'].widget = HiddenInput()
+        return food
 
-        return context
+    @transaction.atomic
+    def form_valid(self, form):
+        form.instance.expiry_date = timezone.now() + timedelta(days=3)
+        form.instance.is_ready = False
+        return super().form_valid(form)
+
+    def get_success_url(self, **kwargs):
+        self.object.refresh_from_db()
+        return reverse_lazy('food:transformedfood_view', kwargs={"pk": self.object.pk})
 
 
-class TransformedFoodUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+MAX_FORMS = 100
+
+
+class ManageIngredientsView(LoginRequiredMixin, UpdateView):
     """
-    A view to update transformed product
+    A view to manage ingredient for a transformed food
     """
     model = TransformedFood
-    template_name = 'food/transformedfood_form.html'
-    form_class = TransformedFoodForms
-    extra_context = {'title': _('Update a meal')}
+    fields = ['ingredients']
+    extra_context = {"title": _("Manage ingredients of:")}
+    template_name = 'food/manage_ingredients.html'
+
+    @transaction.atomic
+    def form_valid(self, form):
+        old_ingredients = list(self.object.ingredients.all()).copy()
+        old_allergens = list(self.object.allergens.all()).copy()
+        self.object.ingredients.clear()
+        for i in range(self.object.ingredients.all().count() + 1 + MAX_FORMS):
+            prefix = 'form-' + str(i) + '-'
+            if form.data[prefix + 'qrcode'] not in ['0', '']:
+                ingredient = QRCode.objects.get(pk=form.data[prefix + 'qrcode']).food_container
+                self.object.ingredients.add(ingredient)
+                if (prefix + 'fully_used') in form.data and form.data[prefix + 'fully_used'] == 'on':
+                    ingredient.end_of_life = _('Fully used in {meal}'.format(
+                        meal=self.object.name))
+                    ingredient.save()
+
+            elif form.data[prefix + 'name'] != '':
+                ingredient = Food.objects.get(pk=form.data[prefix + 'name'])
+                self.object.ingredients.add(ingredient)
+                if (prefix + 'fully_used') in form.data and form.data[prefix + 'fully_used'] == 'on':
+                    ingredient.end_of_life = _('Fully used in {meal}'.format(
+                        meal=self.object.name))
+                    ingredient.save()
+        # We recalculate new expiry date and allergens
+        self.object.expiry_date = self.object.creation_date + self.object.shelf_life
+        self.object.allergens.clear()
+
+        for ingredient in self.object.ingredients.iterator():
+            if not (ingredient.polymorphic_ctype.model == 'basicfood' and ingredient.date_type == 'DDM'):
+                self.object.expiry_date = min(self.object.expiry_date, ingredient.expiry_date)
+            self.object.allergens.set(self.object.allergens.union(ingredient.allergens.all()))
+
+        self.object.save(old_ingredients=old_ingredients, old_allergens=old_allergens)
+        return HttpResponseRedirect(self.get_success_url())
+
+    def get_context_data(self, *args, **kwargs):
+        context = super().get_context_data(*args, **kwargs)
+        context['title'] += ' ' + self.object.name
+        formset = ManageIngredientsFormSet()
+        ingredients = self.object.ingredients.all()
+        formset.extra += ingredients.count() + MAX_FORMS
+        context['form'] = ManageIngredientsForm()
+        context['ingredients_count'] = ingredients.count()
+        display = [True] * (1 + ingredients.count()) + [False] * (formset.extra - ingredients.count() - 1)
+        context['formset'] = zip(display, formset)
+        context['ingredients'] = []
+        for ingredient in ingredients:
+            qr = QRCode.objects.filter(food_container=ingredient)
+
+            context['ingredients'].append({
+                'food_pk': ingredient.pk,
+                'food_name': ingredient.name,
+                'qr_pk': '' if qr.count() == 0 else qr[0].pk,
+                'qr_number': '' if qr.count() == 0 else qr[0].qr_code_number,
+                'fully_used': 'true' if ingredient.end_of_life else '',
+            })
+        return context
+
+    def get_success_url(self, **kwargs):
+        return reverse_lazy('food:transformedfood_view', kwargs={"pk": self.object.pk})
+
+
+class AddIngredientView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+    """
+    A view to add ingredient to a meal
+    """
+    model = Food
+    extra_context = {"title": _("Add the ingredient:")}
+    form_class = AddIngredientForms
+    template_name = 'food/food_update.html'
+
+    def get_context_data(self, *args, **kwargs):
+        context = super().get_context_data(*args, **kwargs)
+        context['title'] += ' ' + self.object.name
+        return context
+
+    @transaction.atomic
+    def form_valid(self, form):
+        meals = TransformedFood.objects.filter(pk__in=form.data.getlist('ingredients')).all()
+        if not meals:
+            return HttpResponseRedirect(reverse_lazy('food:food_view', kwargs={"pk": self.object.pk}))
+        for meal in meals:
+            old_ingredients = list(meal.ingredients.all()).copy()
+            old_allergens = list(meal.allergens.all()).copy()
+            meal.ingredients.add(self.object.pk)
+            # update allergen and expiry date if necessary
+            if not (self.object.polymorphic_ctype.model == 'basicfood'
+                    and self.object.date_type == 'DDM'):
+                meal.expiry_date = min(meal.expiry_date, self.object.expiry_date)
+            meal.allergens.set(meal.allergens.union(self.object.allergens.all()))
+            meal.save(old_ingredients=old_ingredients, old_allergens=old_allergens)
+            if 'fully_used' in form.data:
+                if not self.object.end_of_life:
+                    self.object.end_of_life = _(f'Food fully used in : {meal.name}')
+                else:
+                    self.object.end_of_life += ', ' + meal.name
+        if 'fully_used' in form.data:
+            self.object.is_ready = False
+        self.object.save()
+        # We redirect only the first parent
+        parent_pk = meals[0].pk
+        return HttpResponseRedirect(self.get_success_url(parent_pk=parent_pk))
+
+    def get_success_url(self, **kwargs):
+        return reverse_lazy('food:transformedfood_view', kwargs={"pk": kwargs['parent_pk']})
+
+
+class FoodUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
+    """
+    A view to update Food
+    """
+    model = Food
+    extra_context = {"title": _("Update an aliment")}
+    template_name = 'food/food_update.html'
 
     @transaction.atomic
     def form_valid(self, form):
         form.instance.creater = self.request.user
-        transformedfood_form = TransformedFoodForms(data=self.request.POST)
-        if not transformedfood_form.is_valid():
-            return self.form_invalid(form)
+        food = Food.objects.get(pk=self.kwargs['pk'])
+        old_allergens = list(food.allergens.all()).copy()
 
+        if food.polymorphic_ctype.model == 'transformedfood':
+            old_ingredients = food.ingredients.all()
+            form.instance.shelf_life = timedelta(
+                seconds=int(form.data['shelf_life']) * 60 * 60)
+
+        food_form = self.get_form_class()(data=self.request.POST)
+        if not food_form.is_valid():
+            return self.form_invalid(form)
         ans = super().form_valid(form)
-        form.instance.update()
+        if food.polymorphic_ctype.model == 'transformedfood':
+            form.instance.save(old_ingredients=old_ingredients)
+        else:
+            form.instance.save(old_allergens=old_allergens)
         return ans
 
+    def get_form_class(self, **kwargs):
+        food = Food.objects.get(pk=self.kwargs['pk'])
+        if food.polymorphic_ctype.model == 'basicfood':
+            return BasicFoodUpdateForms
+        else:
+            return TransformedFoodUpdateForms
+
+    def get_form(self, **kwargs):
+        form = super().get_form(**kwargs)
+        if 'shelf_life' in form.initial:
+            hours = form.initial['shelf_life'].days * 24 + form.initial['shelf_life'].seconds // 3600
+            form.initial['shelf_life'] = hours
+        return form
+
     def get_success_url(self, **kwargs):
         self.object.refresh_from_db()
-        return reverse('food:food_view', kwargs={"pk": self.object.pk})
+        return reverse_lazy('food:food_view', kwargs={"pk": self.object.pk})
+
+
+class FoodDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
+    """
+    A view to see a food
+    """
+    model = Food
+    extra_context = {"title": _('Details of:')}
+    context_object_name = "food"
+    template_name = "food/food_detail.html"
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
+        fields = ["name", "owner", "expiry_date", "allergens", "is_ready", "end_of_life", "order"]
+
+        fields = dict([(field, getattr(self.object, field)) for field in fields])
+        if fields["is_ready"]:
+            fields["is_ready"] = _("Yes")
+        else:
+            fields["is_ready"] = _("No")
+        fields["allergens"] = ", ".join(
+            allergen.name for allergen in fields["allergens"].all())
+
+        context["fields"] = [(
+            Food._meta.get_field(field).verbose_name.capitalize(),
+            value) for field, value in fields.items()]
+        if self.object.QR_code.exists():
+            context["QR_code"] = self.object.QR_code.first()
+        context["meals"] = self.object.transformed_ingredient_inv.all()
+        context["update"] = PermissionBackend.check_perm(self.request, "food.change_food")
+        context["add_ingredient"] = (self.object.end_of_life == '' and PermissionBackend.check_perm(self.request, "food.change_transformedfood"))
         return context
 
+    def get(self, *args, **kwargs):
+        if Food.objects.filter(pk=kwargs['pk']).count() != 1:
+            return Http404
+        model = Food.objects.get(pk=kwargs['pk']).polymorphic_ctype.model
+        if 'stop_redirect' in kwargs and kwargs['stop_redirect']:
+            return super().get(*args, **kwargs)
+        kwargs = {'pk': kwargs['pk']}
+        if model == 'basicfood':
+            return HttpResponseRedirect(reverse_lazy("food:basicfood_view", kwargs=kwargs))
+        return HttpResponseRedirect(reverse_lazy("food:transformedfood_view", kwargs=kwargs))
 
-class TransformedListView(ProtectQuerysetMixin, LoginRequiredMixin, MultiTableMixin, ListView):
-    """
-    Displays ready TransformedFood
-    """
-    model = TransformedFood
-    tables = [TransformedFoodTable, TransformedFoodTable, TransformedFoodTable]
-    extra_context = {"title": _("Transformed food")}
-
-    def get_queryset(self, **kwargs):
-        return super().get_queryset(**kwargs).distinct()
-
-    def get_tables(self):
-        tables = super().get_tables()
-
-        tables[0].prefix = "all-"
-        tables[1].prefix = "open-"
-        tables[2].prefix = "served-"
-        return tables
-
-    def get_tables_data(self):
-        # first table = all transformed food, second table = free, third = served
-        return [
-            self.get_queryset().order_by("-creation_date"),
-            TransformedFood.objects.filter(is_ready=True, is_active=True, was_eaten=False, expiry_date__lt=timezone.now())
-                                   .filter(PermissionBackend.filter_queryset(self.request, TransformedFood, "view"))
-                                   .distinct()
-                                   .order_by("-creation_date"),
-            TransformedFood.objects.filter(is_ready=True, is_active=True, was_eaten=False, expiry_date__gte=timezone.now())
-                                   .filter(PermissionBackend.filter_queryset(self.request, TransformedFood, "view"))
-                                   .distinct()
-                                   .order_by("-creation_date")
-        ]
 
+class BasicFoodDetailView(FoodDetailView):
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
-
-        # We choose a club which should work
-        for membership in self.request.user.memberships.all():
-            club_id = membership.club.id
-            food = TransformedFood(
-                name="",
-                owner_id=club_id,
-                creation_date=timezone.now(),
-                expiry_date=timezone.now(),
-            )
-            if PermissionBackend.check_perm(self.request, "food.add_transformedfood", food):
-                context['can_create_meal'] = True
-                break
-
-        tables = context["tables"]
-        for name, table in zip(["table", "open", "served"], tables):
-            context[name] = table
+        fields = ['arrival_date', 'date_type']
+        for field in fields:
+            context["fields"].append((
+                BasicFood._meta.get_field(field).verbose_name.capitalize(),
+                getattr(self.object, field)
+            ))
         return context
+
+    def get(self, *args, **kwargs):
+        if Food.objects.filter(pk=kwargs['pk']).count() == 1:
+            kwargs['stop_redirect'] = (Food.objects.get(pk=kwargs['pk']).polymorphic_ctype.model == 'basicfood')
+        return super().get(*args, **kwargs)
+
+
+class TransformedFoodDetailView(FoodDetailView):
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context["fields"].append((
+            TransformedFood._meta.get_field("creation_date").verbose_name.capitalize(),
+            self.object.creation_date
+        ))
+        context["fields"].append((
+            TransformedFood._meta.get_field("shelf_life").verbose_name.capitalize(),
+            pretty_duration(self.object.shelf_life)
+        ))
+        context["foods"] = self.object.ingredients.all()
+        context["manage_ingredients"] = True
+        return context
+
+    def get(self, *args, **kwargs):
+        if Food.objects.filter(pk=kwargs['pk']).count() == 1:
+            kwargs['stop_redirect'] = (Food.objects.get(pk=kwargs['pk']).polymorphic_ctype.model == 'transformedfood')
+        return super().get(*args, **kwargs)
+
+
+class QRCodeRedirectView(RedirectView):
+    """
+    Redirects to the QR code creation page from Food List
+    """
+    def get_redirect_url(self, *args, **kwargs):
+        slug = self.request.GET.get('slug')
+        if slug:
+            return reverse_lazy('food:qrcode_create', kwargs={'slug': slug})
+        return reverse_lazy('food:list')

apps/member/apps.py

@@ -6,7 +6,7 @@ from django.conf import settings
 from django.db.models.signals import post_save
 from django.utils.translation import gettext_lazy as _
 
-from .signals import save_user_profile
+from .signals import save_user_profile, update_wei_registration_fee_on_membership_creation, update_wei_registration_fee_on_club_change
 
 
 class MemberConfig(AppConfig):
@@ -17,7 +17,16 @@ class MemberConfig(AppConfig):
         """
         Define app internal signals to interact with other apps
         """
+        from .models import Membership, Club
         post_save.connect(
             save_user_profile,
             sender=settings.AUTH_USER_MODEL,
         )
+        post_save.connect(
+            update_wei_registration_fee_on_membership_creation,
+            sender=Membership
+        )
+        post_save.connect(
+            update_wei_registration_fee_on_club_change,
+            sender=Club
+        )

apps/member/forms.py

@@ -10,6 +10,7 @@ from django.contrib.auth.forms import AuthenticationForm
 from django.contrib.auth.models import User
 from django.db import transaction
 from django.forms import CheckboxSelectMultiple
+from phonenumber_field.formfields import PhoneNumberField
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from note.models import NoteSpecial, Alias
@@ -23,7 +24,7 @@ from .models import Profile, Club, Membership
 class CustomAuthenticationForm(AuthenticationForm):
     permission_mask = forms.ModelChoiceField(
         label=_("Permission mask"),
-        queryset=PermissionMask.objects.order_by("rank"),
+        queryset=PermissionMask.objects.order_by("-rank"),
         empty_label=None,
     )
 
@@ -45,6 +46,11 @@ class ProfileForm(forms.ModelForm):
     A form for the extras field provided by the :model:`member.Profile` model.
     """
     # Remove widget=forms.HiddenInput() if you want to use report frequency.
+    phone_number = PhoneNumberField(
+        widget=forms.TextInput(attrs={"type": "tel", "class": "form-control"}),
+        required=False
+    )
+
     report_frequency = forms.IntegerField(required=False, initial=0, label=_("Report frequency"))
 
     last_report = forms.DateTimeField(required=False, disabled=True, label=_("Last report date"))
@@ -72,7 +78,12 @@ class ProfileForm(forms.ModelForm):
         if not self.instance.section or (("department" in self.changed_data
                                          or "promotion" in self.changed_data) and "section" not in self.changed_data):
             self.instance.section = self.instance.section_generated
-        return super().save(commit)
+        instance = super().save(commit=False)
+        if instance.phone_number:
+            instance.phone_number = instance.phone_number.as_e164
+        if commit:
+            instance.save()
+        return instance
 
     class Meta:
         model = Profile

apps/member/migrations/0014_create_bda.py

@@ -0,0 +1,46 @@
+from django.db import migrations
+
+def create_bda(apps, schema_editor):
+    """
+    The club BDA is now pre-injected.
+    """
+    Club = apps.get_model("member", "club")
+    NoteClub = apps.get_model("note", "noteclub")
+    Alias = apps.get_model("note", "alias")
+    ContentType = apps.get_model('contenttypes', 'ContentType')
+    polymorphic_ctype_id = ContentType.objects.get_for_model(NoteClub).id
+    
+    Club.objects.get_or_create(
+        id=10,
+        name="BDA",
+        email="bda.ensparissaclay@gmail.com",
+        require_memberships=True,
+        membership_fee_paid=750,
+        membership_fee_unpaid=750,
+        membership_duration=396,
+        membership_start="2024-08-01",
+        membership_end="2025-09-30",
+    )
+    NoteClub.objects.get_or_create(
+        id=1937,
+        club_id=10,
+        polymorphic_ctype_id=polymorphic_ctype_id,
+    )
+    Alias.objects.get_or_create(
+        id=1937,
+        note_id=1937,
+        name="BDA",
+        normalized_name="bda",
+    )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('member', '0013_auto_20240801_1436'),
+    ]
+    
+    operations = [
+        migrations.RunPython(create_bda),
+    ]
+

apps/member/migrations/0015_alter_profile_promotion.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.4 on 2025-08-02 13:43
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('member', '0014_create_bda'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='profile',
+            name='promotion',
+            field=models.PositiveSmallIntegerField(default=2025, help_text='Year of entry to the school (None if not ENS student)', null=True, verbose_name='promotion'),
+        ),
+    ]

apps/member/models.py

@@ -417,7 +417,7 @@ class Membership(models.Model):
         A membership is valid if today is between the start and the end date.
         """
         if self.date_end is not None:
-            return self.date_start.toordinal() <= datetime.datetime.now().toordinal() < self.date_end.toordinal()
+            return self.date_start.toordinal() <= datetime.datetime.now().toordinal() <= self.date_end.toordinal()
         else:
             return self.date_start.toordinal() <= datetime.datetime.now().toordinal()
 
@@ -438,8 +438,6 @@ class Membership(models.Model):
             )
             if hasattr(self, '_force_renew_parent') and self._force_renew_parent:
                 new_membership._force_renew_parent = True
-            if hasattr(self, '_soge') and self._soge:
-                new_membership._soge = True
             if hasattr(self, '_force_save') and self._force_save:
                 new_membership._force_save = True
             new_membership.save()
@@ -458,8 +456,6 @@ class Membership(models.Model):
             # Renew the previous membership of the parent club
             parent_membership = parent_membership.first()
             parent_membership._force_renew_parent = True
-            if hasattr(self, '_soge'):
-                parent_membership._soge = True
             if hasattr(self, '_force_save'):
                 parent_membership._force_save = True
             parent_membership.renew()
@@ -471,8 +467,6 @@ class Membership(models.Model):
                 date_start=self.date_start,
             )
             parent_membership._force_renew_parent = True
-            if hasattr(self, '_soge'):
-                parent_membership._soge = True
             if hasattr(self, '_force_save'):
                 parent_membership._force_save = True
             parent_membership.save()

apps/member/signals.py

@@ -1,6 +1,8 @@
 # Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+from django.conf import settings
+
 
 def save_user_profile(instance, created, raw, **_kwargs):
     """
@@ -13,3 +15,27 @@ def save_user_profile(instance, created, raw, **_kwargs):
             instance.profile.email_confirmed = True
             instance.profile.registration_valid = True
         instance.profile.save()
+
+
+def update_wei_registration_fee_on_membership_creation(sender, instance, created, **kwargs):
+    if not hasattr(instance, "_no_signal") and 'wei' in settings.INSTALLED_APPS and created:
+        from wei.models import WEIRegistration
+        if instance.club.id == 1 or instance.club.id == 2:
+            registrations = WEIRegistration.objects.filter(
+                user=instance.user,
+                wei__year=instance.date_start.year,
+            )
+            for r in registrations:
+                r._force_save = True
+                r.save()
+
+
+def update_wei_registration_fee_on_club_change(sender, instance, **kwargs):
+    if not hasattr(instance, "_no_signal") and 'wei' in settings.INSTALLED_APPS and (instance.id == 1 or instance.id == 2):
+        from wei.models import WEIRegistration
+        registrations = WEIRegistration.objects.filter(
+            wei__year=instance.membership_start.year,
+        )
+        for r in registrations:
+            r._force_save = True
+            r.save()

apps/member/tables.py

@@ -92,6 +92,20 @@ class MembershipTable(tables.Table):
         }
     )
 
+    user_email = tables.Column(
+        verbose_name="Email",
+        accessor="user.email",
+        orderable=False,
+        visible=False,
+    )
+
+    user_full_name = tables.Column(
+        verbose_name=_("Full name"),
+        accessor="user.get_full_name",
+        orderable=False,
+        visible=False,
+    )
+
     def render_user(self, value):
         # If the user has the right, link the displayed user with the page of its detail.
         s = value.username
@@ -149,6 +163,16 @@ class MembershipTable(tables.Table):
                             + "'>" + s + "</a>")
         return s
 
+    def value_user(self, record):
+        return record.user.username if record.user else ""
+
+    def value_club(self, record):
+        return record.club.name if record.club else ""
+
+    def value_roles(self, record):
+        roles = record.roles.all()
+        return ", ".join(str(role) for role in roles)
+
     class Meta:
         attrs = {
             'class': 'table table-condensed table-striped',

apps/member/templates/member/club_members.html

@@ -36,8 +36,14 @@ SPDX-License-Identifier: GPL-3.0-or-later
             {% trans "There is no membership found with this pattern." %}
         </div>
         {% endif %}
+        <div class="card-footer text-center">
+            <button class="btn btn-block btn-primary mb-3" onclick="window.location.href='?_export=csv'">
+                {% trans "Export to CSV" %}
+            </button>
         </div>
     </div>
+    
+</div>
 {% endblock %}
 
 {% block extrajavascript %}

apps/member/templates/member/includes/profile_info.html

@@ -7,6 +7,19 @@
     <dt class="col-xl-6">{% trans 'username'|capfirst %}</dt>
     <dd class="col-xl-6">{{ user_object.username }}</dd>
 
+    {% if family_app_installed %}
+    <dt class="col-xl-6">{% trans 'family'|capfirst %}</dt>
+    <dd class="col-xl-6">
+        {% if families %}
+            {% for fam in families %}
+            <a href="{% url 'family:family_detail' fam.pk %}">{{ fam.name }}</a>{% if not forloop.last %}, {% endif %}
+            {% endfor %}
+        {% else %}
+            <span class="text-muted">Aucune</span>
+        {% endif %}
+    </dd>
+    {% endif %}
+
     {% if user_object.pk == user.pk %}
     <dt class="col-xl-6">{% trans 'password'|capfirst %}</dt>
     <dd class="col-xl-6">

apps/member/templates/member/picture_update.html

@@ -20,11 +20,13 @@ SPDX-License-Identifier: GPL-3.0-or-later
       </form>
     </div>
     <!-- MODAL TO CROP THE IMAGE -->
-    <div class="modal fade" id="modalCrop">
+    <div class="modal fade" id="modalCrop" data-backdrop="static">
       <div class="modal-dialog">
         <div class="modal-content">
-          <div class="modal-body">
-            <img src="" id="modal-image" style="max-width: 100%;">
+            <div class="modal-body-wrapper" style="width: 500px; height: 500px; padding: 16px;">
+              <div class="modal-body" style="width: 100%; height: 100%; padding: 0">
+                <img src="" id="modal-image" style="display: block; max-width: 100%;">
+              </div>
             </div>
           <div class="modal-footer">
             <div class="btn-group pull-left" role="group">

apps/member/templates/member/profile_update.html

@@ -10,7 +10,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
         {{ title }}
     </h3>
     <div class="card-body">
-        <form method="post">
+        <form method="post" id="profile-form">
             {% csrf_token %}
             {{ form | crispy }}
             {{ profile_form | crispy }}
@@ -21,3 +21,45 @@ SPDX-License-Identifier: GPL-3.0-or-later
     </div>
 </div>
 {% endblock %}
+
+{% block extrajavascript %}
+<!-- intl-tel-input CSS/JS -->
+<script>
+(() => {
+    const input = document.querySelector("input[name='phone_number']");
+    const form = document.querySelector("#profile-form");
+
+    if (!input || !form || input.type === "hidden" || input.disabled || input.readOnly) {
+        return;
+    }
+
+    const iti = window.intlTelInput(input, {
+        initialCountry: "auto",
+        nationalMode: false,
+        autoPlaceholder: "off",
+        geoIpLookup: callback => {
+            fetch("https://ipapi.co/json")
+                .then(res => res.json())
+                .then(data => callback(data.country_code))
+                .catch(() => callback("fr"));
+        },
+        loadUtils: () => import("https://cdn.jsdelivr.net/npm/intl-tel-input@25.5.2/build/js/utils.js"),
+    });
+
+    form.addEventListener("submit", function(e){
+        if (!input.value.trim()) {
+            return;
+        }
+
+        const number = iti.getNumber(intlTelInput.utils.numberFormat.E164);
+        if (number) {
+            input.value = number;
+            form.submit();
+        } else {
+            e.preventDefault();
+            input.focus();
+        }
+    });
+})();
+</script>
+{% endblock %}

apps/member/tests/test_login.py

@@ -44,7 +44,7 @@ class TemplateLoggedInTests(TestCase):
         self.assertRedirects(response, settings.LOGIN_REDIRECT_URL, 302, 302)
 
     def test_logout(self):
-        response = self.client.get(reverse("logout"))
+        response = self.client.post(reverse("logout"))
         self.assertEqual(response.status_code, 200)
 
     def test_admin_index(self):

apps/member/views.py

@@ -17,6 +17,7 @@ from django.utils.translation import gettext_lazy as _
 from django.views.generic import DetailView, UpdateView, TemplateView
 from django.views.generic.edit import FormMixin
 from django_tables2.views import MultiTableMixin, SingleTableMixin, SingleTableView
+from django_tables2.export.views import ExportMixin
 from rest_framework.authtoken.models import Token
 from api.viewsets import is_regex
 from note.models import Alias, NoteClub, NoteUser, Trust
@@ -26,6 +27,7 @@ from note_kfet.middlewares import _set_current_request
 from permission.backends import PermissionBackend
 from permission.models import Role
 from permission.views import ProtectQuerysetMixin, ProtectedCreateView
+from family.models import Family
 from django import forms
 
 from .forms import UserForm, ProfileForm, ImageForm, ClubForm, MembershipForm, \
@@ -206,6 +208,10 @@ class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
             modified_note.is_active = True
             context["can_unlock_note"] = not user.note.is_active and PermissionBackend\
                 .check_perm(self.request, "note.change_noteuser_is_active", modified_note)
+        if 'family' in settings.INSTALLED_APPS:
+            context["family_app_installed"] = True
+            families = Family.objects.filter(memberships__user=user).distinct()
+            context["families"] = families
 
         return context
 
@@ -945,11 +951,12 @@ class ClubManageRolesView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
         return reverse_lazy('member:user_detail', kwargs={'pk': self.object.user.id})
 
 
-class ClubMembersListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
+class ClubMembersListView(ExportMixin, ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
     model = Membership
     table_class = MembershipTable
     template_name = "member/club_members.html"
     extra_context = {"title": _("Members of the club")}
+    export_formats = ["csv"]
 
     def get_queryset(self, **kwargs):
         qs = super().get_queryset().filter(club_id=self.kwargs["pk"])
@@ -981,6 +988,14 @@ class ClubMembersListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableV
 
         return qs.distinct()
 
+    def get_export_filename(self, export_format):
+        return "members.csv"
+
+    def get_export_content_type(self, export_format):
+        if export_format == "csv":
+            return "text/csv"
+        return super().get_export_content_type(export_format)
+
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         club = Club.objects.filter(

apps/note/api/urls.py

@@ -13,7 +13,7 @@ def register_note_urls(router, path):
     router.register(path + '/note', NotePolymorphicViewSet)
     router.register(path + '/alias', AliasViewSet)
     router.register(path + '/trust', TrustViewSet)
-    router.register(path + '/consumer', ConsumerViewSet)
+    router.register(path + '/consumer', ConsumerViewSet, basename='alias2')
 
     router.register(path + '/transaction/category', TemplateCategoryViewSet)
     router.register(path + '/transaction/transaction', TransactionViewSet)

apps/note/static/note/js/consos.js

@@ -228,7 +228,7 @@ function consume (source, source_alias, dest, quantity, amount, reason, type, ca
           addMsg(interpolate(gettext('Warning, the transaction from the note %s succeed, ' +
               'but the emitter note %s is negative.'), [source_alias, source_alias]), 'warning', 30000)
         }
-        if (source.membership && source.membership.date_end < new Date().toISOString()) {
+        if (source.membership && source.membership.date_end <= new Date().toISOString()) {
           addMsg(interpolate(gettext('Warning, the emitter note %s is no more a BDE member.'), [source_alias]),
               'danger', 30000)
         }

apps/note/static/note/js/transfer.js

@@ -67,6 +67,8 @@ $(document).ready(function () {
 
       last.quantity = 1
       
+      
+
       if (last.note.club) {
         $('#last_name').val(last.note.name)
         $('#first_name').val(last.note.name)
@@ -111,6 +113,7 @@ $(document).ready(function () {
     dest.removeClass('d-none')
     $('#dest_note_list').removeClass('d-none')
     $('#debit_type').addClass('d-none')
+    $('#reason').val('')
   
     $('#source_note_label').text(select_emitters_label)
     $('#dest_note_label').text(select_receveirs_label)
@@ -134,6 +137,7 @@ $(document).ready(function () {
     dest.val('')
     dest.tooltip('hide')
     $('#debit_type').addClass('d-none')
+    $('#reason').val('Rechargement note')
 
     $('#source_note_label').text(transfer_type_label)
     $('#dest_note_label').text(select_receveir_label)
@@ -162,6 +166,7 @@ $(document).ready(function () {
     dest.addClass('d-none')
     dest.tooltip('hide')
     $('#debit_type').removeClass('d-none')
+    $('#reason').val('')
 
     $('#source_note_label').text(select_emitter_label)
     $('#dest_note_label').text(transfer_type_label)
@@ -305,10 +310,10 @@ $('#btn_transfer').click(function () {
             destination: dest.note.id,
             destination_alias: dest.name
           }).done(function () {
-          if (source.note.membership && source.note.membership.date_end < new Date().toISOString()) {
+          if (source.note.membership && source.note.membership.date_end <= new Date().toISOString()) {
             addMsg(interpolate(gettext('Warning, the emitter note %s is no more a BDE member.'), [source.name]), 'danger', 30000)
           }
-          if (dest.note.membership && dest.note.membership.date_end < new Date().toISOString()) {
+          if (dest.note.membership && dest.note.membership.date_end <= new Date().toISOString()) {
             addMsg(interpolate(gettext('Warning, the destination note %s is no more a BDE member.'), [dest.name]), 'danger', 30000)
           }
 
@@ -409,7 +414,7 @@ $('#btn_transfer').click(function () {
         bank: $('#bank').val()
       }).done(function () {
       addMsg(gettext('Credit/debit succeed!'), 'success', 10000)
-      if (user_note.membership && user_note.membership.date_end < new Date().toISOString()) { addMsg(gettext('Warning, the emitter note %s is no more a BDE member.'), 'danger', 10000) }
+      if (user_note.membership && user_note.membership.date_end <= new Date().toISOString()) { addMsg(gettext('Warning, the emitter note %s is no more a BDE member.'), 'danger', 10000) }
       reset()
     }).fail(function (err) {
       const errObj = JSON.parse(err.responseText)