Remove unused file

.ansible-lint

@@ -0,0 +1,3 @@
+skip_list:
+  - command-instead-of-shell  # Use shell only when shell functionality is required
+  - experimental  # all rules tagged as experimental

.env_example

@@ -10,6 +10,7 @@ DJANGO_SECRET_KEY=CHANGE_ME
 DJANGO_SETTINGS_MODULE=note_kfet.settings
 CONTACT_EMAIL=tresorerie.bde@localhost
 NOTE_URL=localhost
+DOMAIN=localhost
 
 # Config for mails. Only used in production
 NOTE_MAIL=notekfet@localhost

.gitignore

@@ -47,7 +47,6 @@ backups/
 env/
 venv/
 db.sqlite3
-shell.nix
 
 # ansibles customs host
 ansible/host_vars/*.yaml

.gitlab-ci.yml

@@ -10,50 +10,22 @@ variables:
 # Debian Buster
 py37-django22:
   stage: test
-  image: debian:buster-backports
-  before_script:
-    - >
-        apt-get update &&
-        apt-get install --no-install-recommends -t buster-backports -y
-        python3-django python3-django-crispy-forms
-        python3-django-extensions python3-django-filters python3-django-polymorphic
-        python3-djangorestframework python3-django-oauth-toolkit python3-psycopg2 python3-pil
-        python3-babel python3-lockfile python3-pip python3-phonenumbers python3-memcache
-        python3-bs4 python3-setuptools tox texlive-xetex
+  image: otthorn/nk20_ci_37
   script: tox -e py37-django22
 
 # Ubuntu 20.04
 py38-django22:
   stage: test
-  image: ubuntu:20.04
-  before_script:
-    # Fix tzdata prompt
-    - ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime && echo Europe/Paris > /etc/timezone
-    - >
-        apt-get update &&
-        apt-get install --no-install-recommends -y
-        python3-django python3-django-crispy-forms
-        python3-django-extensions python3-django-filters python3-django-polymorphic
-        python3-djangorestframework python3-django-oauth-toolkit python3-psycopg2 python3-pil
-        python3-babel python3-lockfile python3-pip python3-phonenumbers python3-memcache
-        python3-bs4 python3-setuptools tox texlive-xetex
+  image: otthorn/nk20_ci_38
   script: tox -e py38-django22
 
 # Debian Bullseye
 py39-django22:
   stage: test
-  image: debian:bullseye
-  before_script:
-    - >
-        apt-get update &&
-        apt-get install --no-install-recommends -y
-        python3-django python3-django-crispy-forms
-        python3-django-extensions python3-django-filters python3-django-polymorphic
-        python3-djangorestframework python3-django-oauth-toolkit python3-psycopg2 python3-pil
-        python3-babel python3-lockfile python3-pip python3-phonenumbers python3-memcache
-        python3-bs4 python3-setuptools tox texlive-xetex
+  image: otthorn/nk20_ci_39
   script: tox -e py39-django22
 
+# Tox linter
 linters:
   stage: quality-assurance
   image: debian:buster-backports
@@ -64,6 +36,20 @@ linters:
   # Be nice to new contributors, but please use `tox`
   allow_failure: true
 
+# Ansible linter
+ansible-linter:
+  stage: quality-assurance
+  image: otthorn/nk20_ci_ansiblelint
+  script: ansible-lint ansible/
+
+# Docker linter
+docker-linter:
+  stage: quality-assurance
+  image: hadolint/hadolint
+  script:
+    - hadolint -c .hadolint Dockerfile
+    - hadolint -c .hadolint docker_ci/Dockerfile.*
+
 # Compile documentation
 documentation:
   stage: docs

.hadolint

@@ -0,0 +1,4 @@
+ignored:
+  - DL3008  # Do not force to pin version in apt (Debian)
+  - DL3013  # Do not force to pin version in pip (PyPI)
+  - DL3018  # Do not force to pin version in apk (Alpine)

README.md

@@ -1,8 +1,8 @@
 # NoteKfet 2020
 
 [![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0.txt)
-[![pipeline status](https://gitlab.crans.org/bde/nk20/badges/main/pipeline.svg)](https://gitlab.crans.org/bde/nk20/commits/main)
-[![coverage report](https://gitlab.crans.org/bde/nk20/badges/main/coverage.svg)](https://gitlab.crans.org/bde/nk20/commits/main)
+[![pipeline status](https://gitlab.crans.org/bde/nk20/badges/master/pipeline.svg)](https://gitlab.crans.org/bde/nk20/commits/master)
+[![coverage report](https://gitlab.crans.org/bde/nk20/badges/master/coverage.svg)](https://gitlab.crans.org/bde/nk20/commits/master)
 
 ## Table des matières
 
@@ -55,7 +55,7 @@ Bien que cela permette de créer une instance sur toutes les distributions,
     (env)$ ./manage.py makemigrations
     (env)$ ./manage.py migrate
     (env)$ ./manage.py loaddata initial
-    (env)$ ./manage.py createsuperuser  # Création d'un⋅e utilisateur⋅rice initial
+    (env)$ ./manage.py createsuperuser  # Création d'un utilisateur initial
     ```
 
 6.  Enjoy :
@@ -279,8 +279,7 @@ Le cahier des charges initial est disponible [sur le Wiki Crans](https://wiki.cr
 La documentation des classes et fonctions est directement dans le code et est explorable à partir de la partie documentation de l'interface d'administration de Django.
 **Commentez votre code !**
 
-La documentation plus haut niveau sur le développement et sur l'utilisation
-est disponible sur <https://note.crans.org/doc> et également dans le dossier `docs`.
+La documentation plus haut niveau sur le développement est disponible sur [le Wiki associé au dépôt Git](https://gitlab.crans.org/bde/nk20/-/wikis/home).
 
 ## FAQ
 

ansible/base.yml

@@ -7,7 +7,7 @@
       prompt: "Password of the database (leave it blank to skip database init)"
       private: yes
   vars:
-    mirror: eclats.crans.org
+    mirror: mirror.crans.org
   roles:
     - 1-apt-basic
     - 2-nk20

ansible/host_vars/bde-nk20-beta.adh.crans.org.yml

@@ -0,0 +1,6 @@
+---
+note:
+  server_name: note-beta.crans.org
+  git_branch: beta
+  cron_enabled: false
+  email: notekfet2020@lists.crans.org

ansible/host_vars/bde-note-dev.adh.crans.org.yml

@@ -2,6 +2,5 @@
 note:
   server_name: note-dev.crans.org
   git_branch: beta
-  serve_static: false
   cron_enabled: false
   email: notekfet2020@lists.crans.org

ansible/host_vars/bde-note.adh.crans.org.yml

@@ -1,7 +1,6 @@
 ---
 note:
   server_name: note.crans.org
-  git_branch: main
-  serve_static: true
+  git_branch: master
   cron_enabled: true
   email: notekfet2020@lists.crans.org

ansible/hosts_example

@@ -1,5 +1,6 @@
 [dev]
 bde-note-dev.adh.crans.org
+bde-nk20-beta.adh.crans.org
 
 [prod]
 bde-note.adh.crans.org

ansible/roles/1-apt-basic/tasks/main.yml

@@ -1,15 +1,14 @@
 ---
-- name: Add buster-backports to apt sources if needed
+- name: Add buster-backports to apt sources
   apt_repository:
     repo: deb http://{{ mirror }}/debian buster-backports main
     state: present
-  when:
-    - ansible_distribution == "Debian"
-    - ansible_distribution_major_version | int == 10
+  when: ansible_facts['distribution'] == "Debian"
 
 - name: Install note_kfet APT dependencies
   apt:
     update_cache: true
+    default_release: "{{ 'buster-backports' if ansible_facts['distribution'] == 'Debian' }}"
     install_recommends: false
     name:
       # Common tools

ansible/roles/5-nginx/templates/nginx_note.conf

@@ -41,7 +41,6 @@ server {
     # max upload size
     client_max_body_size 75M;   # adjust to taste
 
-{% if note.serve_static %}
     # Django media
     location /media  {
         alias /var/www/note_kfet/media;  # your Django project's media files - amend as required
@@ -51,7 +50,6 @@ server {
         alias /var/www/note_kfet/static; # your Django project's static files - amend as required
     }
 
-{% endif %}
     location /doc {
         alias /var/www/documentation;    # The documentation of the project
     }

apps/activity/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'activity.apps.ActivityConfig'

apps/activity/admin.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib import admin

apps/activity/api/serializers.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from rest_framework import serializers

apps/activity/api/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from .views import ActivityTypeViewSet, ActivityViewSet, EntryViewSet, GuestViewSet

apps/activity/api/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from api.viewsets import ReadProtectedModelViewSet

apps/activity/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/activity/forms.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import timedelta
@@ -11,7 +11,7 @@ from django.utils.translation import gettext_lazy as _
 from member.models import Club
 from note.models import Note, NoteUser
 from note_kfet.inputs import Autocomplete, DateTimePickerInput
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user
 from permission.backends import PermissionBackend
 
 from .models import Activity, Guest
@@ -24,15 +24,9 @@ class ActivityForm(forms.ModelForm):
         self.fields["attendees_club"].initial = Club.objects.get(name="Kfet")
         self.fields["attendees_club"].widget.attrs["placeholder"] = "Kfet"
         clubs = list(Club.objects.filter(PermissionBackend
-                                         .filter_queryset(get_current_request(), Club, "view")).all())
+                                         .filter_queryset(get_current_authenticated_user(), Club, "view")).all())
         shuffle(clubs)
-        self.fields["organizer"].widget.attrs["placeholder"] = ", ".join(club.name for club in clubs[:4]) + ",…"
-
-    def clean_organizer(self):
-        organizer = self.cleaned_data['organizer']
-        if not organizer.note.is_active:
-            self.add_error('organiser', _('The note of this club is inactive.'))
-        return organizer
+        self.fields["organizer"].widget.attrs["placeholder"] = ", ".join(club.name for club in clubs[:4]) + ", ..."
 
     def clean_date_end(self):
         date_end = self.cleaned_data["date_end"]
@@ -53,7 +47,7 @@ class ActivityForm(forms.ModelForm):
                 model=Note,
                 attrs={
                     "api_url": "/api/note/note/",
-                    'placeholder': 'Note de l\'événement sur laquelle envoyer les crédits d\'invitation…'
+                    'placeholder': 'Note de l\'événement sur laquelle envoyer les crédits d\'invitation ...'
                 },
             ),
             "attendees_club": Autocomplete(
@@ -115,7 +109,7 @@ class GuestForm(forms.ModelForm):
                     # We don't evaluate the content type at launch because the DB might be not initialized
                     'api_url_suffix':
                         lambda: '&polymorphic_ctype=' + str(ContentType.objects.get_for_model(NoteUser).pk),
-                    'placeholder': 'Note…',
+                    'placeholder': 'Note ...',
                 },
             ),
         }

apps/activity/models.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import os
@@ -126,7 +126,7 @@ class Activity(models.Model):
     @transaction.atomic
     def save(self, *args, **kwargs):
         """
-        Update the activity wiki page each time the activity is updated (validation, change description,…)
+        Update the activity wiki page each time the activity is updated (validation, change description, ...)
         """
         if self.date_end < self.date_start:
             raise ValidationError(_("The end date must be after the start date."))

apps/activity/tables.py

@@ -1,9 +1,7 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-
 from django.utils import timezone
-from django.utils.html import escape
-from django.utils.safestring import mark_safe
+from django.utils.html import format_html
 from django.utils.translation import gettext_lazy as _
 import django_tables2 as tables
 from django_tables2 import A
@@ -54,8 +52,8 @@ class GuestTable(tables.Table):
     def render_entry(self, record):
         if record.has_entry:
             return str(_("Entered on ") + str(_("{:%Y-%m-%d %H:%M:%S}").format(record.entry.time, )))
-        return mark_safe('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
-                         '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))
+        return format_html('<button id="{id}" class="btn btn-danger btn-sm" onclick="remove_guest(this.id)"> '
+                           '{delete_trans}</button>'.format(id=record.id, delete_trans=_("remove").capitalize()))
 
 
 def get_row_class(record):
@@ -93,7 +91,7 @@ class EntryTable(tables.Table):
         if hasattr(record, 'username'):
             username = record.username
             if username != value:
-                return mark_safe(escape(value) + " <em>aka.</em> " + escape(username))
+                return format_html(value + " <em>aka.</em> " + username)
         return value
 
     def render_balance(self, value):

apps/activity/templates/activity/activity_entry.html

@@ -37,7 +37,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
     <button class="btn btn-light">{% trans "Return to activity page" %}</button>
 </a>
 
-<input id="alias" type="text" class="form-control" placeholder="Nom/note…">
+<input id="alias" type="text" class="form-control" placeholder="Nom/note ...">
 
 <hr>
 
@@ -63,12 +63,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
         refreshBalance();
     }
 
-    alias_obj.keyup(function(event) {
-        let code = event.originalEvent.keyCode
-        if (65 <= code <= 122 || code === 13) {
-            debounce(reloadTable)()
-        }
-    });
+    alias_obj.keyup(reloadTable);
 
     $(document).ready(init);
 

apps/activity/tests/test_activities.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import timedelta

apps/activity/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.urls import path

apps/activity/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from hashlib import md5
@@ -66,19 +66,21 @@ class ActivityListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView
     ordering = ('-date_start',)
     extra_context = {"title": _("Activities")}
 
-    def get_queryset(self, **kwargs):
-        return super().get_queryset(**kwargs).distinct()
+    def get_queryset(self):
+        return super().get_queryset().distinct()
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
 
         upcoming_activities = Activity.objects.filter(date_end__gt=timezone.now())
         context['upcoming'] = ActivityTable(
-            data=upcoming_activities.filter(PermissionBackend.filter_queryset(self.request, Activity, "view")),
+            data=upcoming_activities.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view")),
             prefix='upcoming-',
         )
 
-        started_activities = self.get_queryset().filter(open=True, valid=True).distinct().all()
+        started_activities = Activity.objects\
+            .filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
+            .filter(open=True, valid=True).all()
         context["started_activities"] = started_activities
 
         return context
@@ -96,7 +98,7 @@ class ActivityDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         context = super().get_context_data()
 
         table = GuestTable(data=Guest.objects.filter(activity=self.object)
-                           .filter(PermissionBackend.filter_queryset(self.request, Guest, "view")))
+                           .filter(PermissionBackend.filter_queryset(self.request.user, Guest, "view")))
         context["guests"] = table
 
         context["activity_started"] = timezone.now() > timezone.localtime(self.object.date_start)
@@ -142,15 +144,15 @@ class ActivityInviteView(ProtectQuerysetMixin, ProtectedCreateView):
 
     def get_form(self, form_class=None):
         form = super().get_form(form_class)
-        form.activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request, Activity, "view"))\
-            .filter(pk=self.kwargs["pk"]).first()
+        form.activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
+            .get(pk=self.kwargs["pk"])
         form.fields["inviter"].initial = self.request.user.note
         return form
 
     @transaction.atomic
     def form_valid(self, form):
         form.instance.activity = Activity.objects\
-            .filter(PermissionBackend.filter_queryset(self.request, Activity, "view")).get(pk=self.kwargs["pk"])
+            .filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view")).get(pk=self.kwargs["pk"])
         return super().form_valid(form)
 
     def get_success_url(self, **kwargs):
@@ -168,13 +170,10 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
         Don't display the entry interface if the user has no right to see it (no right to add an entry for itself),
         it is closed or doesn't manage entries.
         """
-        if not self.request.user.is_authenticated:
-            return self.handle_no_permission()
-
         activity = Activity.objects.get(pk=self.kwargs["pk"])
 
         sample_entry = Entry(activity=activity, note=self.request.user.note)
-        if not PermissionBackend.check_perm(self.request, "activity.add_entry", sample_entry):
+        if not PermissionBackend.check_perm(self.request.user, "activity.add_entry", sample_entry):
             raise PermissionDenied(_("You are not allowed to display the entry interface for this activity."))
 
         if not activity.activity_type.manage_entries:
@@ -192,8 +191,8 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
         guest_qs = Guest.objects\
             .annotate(balance=F("inviter__balance"), note_name=F("inviter__user__username"))\
             .filter(activity=activity)\
-            .filter(PermissionBackend.filter_queryset(self.request, Guest, "view"))\
-            .order_by('last_name', 'first_name')
+            .filter(PermissionBackend.filter_queryset(self.request.user, Guest, "view"))\
+            .order_by('last_name', 'first_name').distinct()
 
         if "search" in self.request.GET and self.request.GET["search"]:
             pattern = self.request.GET["search"]
@@ -207,7 +206,7 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
             )
         else:
             guest_qs = guest_qs.none()
-        return guest_qs.distinct()
+        return guest_qs
 
     def get_invited_note(self, activity):
         """
@@ -231,7 +230,7 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
         )
 
         # Filter with permission backend
-        note_qs = note_qs.filter(PermissionBackend.filter_queryset(self.request, Alias, "view"))
+        note_qs = note_qs.filter(PermissionBackend.filter_queryset(self.request.user, Alias, "view"))
 
         if "search" in self.request.GET and self.request.GET["search"]:
             pattern = self.request.GET["search"]
@@ -257,7 +256,7 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
         """
         context = super().get_context_data(**kwargs)
 
-        activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request, Activity, "view"))\
+        activity = Activity.objects.filter(PermissionBackend.filter_queryset(self.request.user, Activity, "view"))\
             .distinct().get(pk=self.kwargs["pk"])
         context["activity"] = activity
 
@@ -282,9 +281,9 @@ class ActivityEntryView(LoginRequiredMixin, TemplateView):
         context["notespecial_ctype"] = ContentType.objects.get_for_model(NoteSpecial).pk
 
         activities_open = Activity.objects.filter(open=True).filter(
-            PermissionBackend.filter_queryset(self.request, Activity, "view")).distinct().all()
+            PermissionBackend.filter_queryset(self.request.user, Activity, "view")).distinct().all()
         context["activities_open"] = [a for a in activities_open
-                                      if PermissionBackend.check_perm(self.request,
+                                      if PermissionBackend.check_perm(self.request.user,
                                                                       "activity.add_entry",
                                                                       Entry(activity=a, note=self.request.user.note,))]
 

apps/api/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'api.apps.APIConfig'

apps/api/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/api/serializers.py

@@ -1,20 +1,13 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 
 from django.contrib.contenttypes.models import ContentType
 from django.contrib.auth.models import User
-from django.utils import timezone
-from rest_framework import serializers
-from member.api.serializers import ProfileSerializer, MembershipSerializer
-from member.models import Membership
-from note.api.serializers import NoteSerializer
-from note.models import Alias
-from note_kfet.middlewares import get_current_request
-from permission.backends import PermissionBackend
+from rest_framework.serializers import ModelSerializer
 
 
-class UserSerializer(serializers.ModelSerializer):
+class UserSerializer(ModelSerializer):
     """
     REST API Serializer for Users.
     The djangorestframework plugin will analyse the model `User` and parse all fields in the API.
@@ -29,7 +22,7 @@ class UserSerializer(serializers.ModelSerializer):
         )
 
 
-class ContentTypeSerializer(serializers.ModelSerializer):
+class ContentTypeSerializer(ModelSerializer):
     """
     REST API Serializer for Users.
     The djangorestframework plugin will analyse the model `User` and parse all fields in the API.
@@ -38,54 +31,3 @@ class ContentTypeSerializer(serializers.ModelSerializer):
     class Meta:
         model = ContentType
         fields = '__all__'
-
-
-class OAuthSerializer(serializers.ModelSerializer):
-    """
-    Informations that are transmitted by OAuth.
-    For now, this includes user, profile and valid memberships.
-    This should be better managed later.
-    """
-    normalized_name = serializers.SerializerMethodField()
-
-    profile = serializers.SerializerMethodField()
-
-    note = serializers.SerializerMethodField()
-
-    memberships = serializers.SerializerMethodField()
-
-    def get_normalized_name(self, obj):
-        return Alias.normalize(obj.username)
-
-    def get_profile(self, obj):
-        # Display the profile of the user only if we have rights to see it.
-        return ProfileSerializer().to_representation(obj.profile) \
-            if PermissionBackend.check_perm(get_current_request(), 'member.view_profile', obj.profile) else None
-
-    def get_note(self, obj):
-        # Display the note of the user only if we have rights to see it.
-        return NoteSerializer().to_representation(obj.note) \
-            if PermissionBackend.check_perm(get_current_request(), 'note.view_note', obj.note) else None
-
-    def get_memberships(self, obj):
-        # Display only memberships that we are allowed to see.
-        return serializers.ListSerializer(child=MembershipSerializer()).to_representation(
-            obj.memberships.filter(date_start__lte=timezone.now(), date_end__gte=timezone.now())
-                           .filter(PermissionBackend.filter_queryset(get_current_request(), Membership, 'view')))
-
-    class Meta:
-        model = User
-        fields = (
-            'id',
-            'username',
-            'normalized_name',
-            'first_name',
-            'last_name',
-            'email',
-            'is_superuser',
-            'is_active',
-            'is_staff',
-            'profile',
-            'note',
-            'memberships',
-        )

apps/api/tests.py

@@ -1,9 +1,8 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import json
 from datetime import datetime, date
-from decimal import Decimal
 from urllib.parse import quote_plus
 from warnings import warn
 
@@ -153,8 +152,6 @@ class TestAPI(TestCase):
                 value = value.isoformat()
             elif isinstance(value, ImageFieldFile):
                 value = value.name
-            elif isinstance(value, Decimal):
-                value = str(value)
             query = json.dumps({field.name: value})
 
             # Create sample permission

apps/api/urls.py

@@ -1,11 +1,10 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.conf import settings
 from django.conf.urls import url, include
 from rest_framework import routers
 
-from .views import UserInformationView
 from .viewsets import ContentTypeViewSet, UserViewSet
 
 # Routers provide an easy way of automatically determining the URL conf.
@@ -48,6 +47,5 @@ app_name = 'api'
 # Additionally, we include login URLs for the browsable API.
 urlpatterns = [
     url('^', include(router.urls)),
-    url('^me/', UserInformationView.as_view()),
     url('^api-auth/', include('rest_framework.urls', namespace='rest_framework')),
 ]

apps/api/views.py

@@ -1,20 +0,0 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-from django.contrib.auth.models import User
-from rest_framework.generics import RetrieveAPIView
-
-from .serializers import OAuthSerializer
-
-
-class UserInformationView(RetrieveAPIView):
-    """
-    These fields are give to OAuth authenticators.
-    """
-    serializer_class = OAuthSerializer
-
-    def get_queryset(self):
-        return User.objects.filter(pk=self.request.user.pk)
-
-    def get_object(self):
-        return self.request.user

apps/api/viewsets.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib.contenttypes.models import ContentType
@@ -9,6 +9,7 @@ from django.contrib.auth.models import User
 from rest_framework.filters import SearchFilter
 from rest_framework.viewsets import ReadOnlyModelViewSet, ModelViewSet
 from permission.backends import PermissionBackend
+from note_kfet.middlewares import get_current_session
 from note.models import Alias
 
 from .serializers import UserSerializer, ContentTypeSerializer
@@ -24,7 +25,9 @@ class ReadProtectedModelViewSet(ModelViewSet):
         self.model = ContentType.objects.get_for_model(self.serializer_class.Meta.model).model_class()
 
     def get_queryset(self):
-        return self.queryset.filter(PermissionBackend.filter_queryset(self.request, self.model, "view")).distinct()
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.queryset.filter(PermissionBackend.filter_queryset(user, self.model, "view")).distinct()
 
 
 class ReadOnlyProtectedModelViewSet(ReadOnlyModelViewSet):
@@ -37,7 +40,9 @@ class ReadOnlyProtectedModelViewSet(ReadOnlyModelViewSet):
         self.model = ContentType.objects.get_for_model(self.serializer_class.Meta.model).model_class()
 
     def get_queryset(self):
-        return self.queryset.filter(PermissionBackend.filter_queryset(self.request, self.model, "view")).distinct()
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.queryset.filter(PermissionBackend.filter_queryset(user, self.model, "view")).distinct()
 
 
 class UserViewSet(ReadProtectedModelViewSet):

apps/logs/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'logs.apps.LogsConfig'

apps/logs/api/serializers.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from rest_framework import serializers

apps/logs/api/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from .views import ChangelogViewSet

apps/logs/api/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django_filters.rest_framework import DjangoFilterBackend

apps/logs/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/logs/models.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.conf import settings

apps/logs/signals.py

@@ -1,11 +1,11 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib.contenttypes.models import ContentType
 from rest_framework.renderers import JSONRenderer
 from rest_framework.serializers import ModelSerializer
 from note.models import NoteUser, Alias
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user, get_current_ip
 
 from .models import Changelog
 
@@ -56,13 +56,13 @@ def save_object(sender, instance, **kwargs):
     # noinspection PyProtectedMember
     previous = instance._previous
 
-    # Si un⋅e utilisateur⋅rice est connecté⋅e, on récupère l'utilisateur⋅rice courant⋅e ainsi que son adresse IP
-    request = get_current_request()
+    # Si un utilisateur est connecté, on récupère l'utilisateur courant ainsi que son adresse IP
+    user, ip = get_current_authenticated_user(), get_current_ip()
 
-    if request is None:
+    if user is None:
         # Si la modification n'a pas été faite via le client Web, on suppose que c'est du à `manage.py`
         # On récupère alors l'utilisateur·trice connecté·e à la VM, et on récupère la note associée
-        # IMPORTANT : l'utilisateur⋅rice dans la VM doit être un des alias note du respo info
+        # IMPORTANT : l'utilisateur dans la VM doit être un des alias note du respo info
         ip = "127.0.0.1"
         username = Alias.normalize(getpass.getuser())
         note = NoteUser.objects.filter(alias__normalized_name=username)
@@ -71,23 +71,9 @@ def save_object(sender, instance, **kwargs):
         # else:
         if note.exists():
             user = note.get().user
-        else:
-            user = None
-    else:
-        user = request.user
-        if 'HTTP_X_REAL_IP' in request.META:
-            ip = request.META.get('HTTP_X_REAL_IP')
-        elif 'HTTP_X_FORWARDED_FOR' in request.META:
-            ip = request.META.get('HTTP_X_FORWARDED_FOR').split(', ')[0]
-        else:
-            ip = request.META.get('REMOTE_ADDR')
-
-        if not user.is_authenticated:
-            # For registration and OAuth2 purposes
-            user = None
 
     # noinspection PyProtectedMember
-    if request is not None and instance._meta.label_lower == "auth.user" and previous:
+    if user is not None and instance._meta.label_lower == "auth.user" and previous:
         # On n'enregistre pas les connexions
         if instance.last_login != previous.last_login:
             return
@@ -134,13 +120,13 @@ def delete_object(sender, instance, **kwargs):
     if instance._meta.label_lower in EXCLUDED or hasattr(instance, "_no_signal"):
         return
 
-    # Si un⋅e utilisateur⋅rice est connecté⋅e, on récupère l'utilisateur⋅rice courant⋅e ainsi que son adresse IP
-    request = get_current_request()
+    # Si un utilisateur est connecté, on récupère l'utilisateur courant ainsi que son adresse IP
+    user, ip = get_current_authenticated_user(), get_current_ip()
 
-    if request is None:
+    if user is None:
         # Si la modification n'a pas été faite via le client Web, on suppose que c'est du à `manage.py`
         # On récupère alors l'utilisateur·trice connecté·e à la VM, et on récupère la note associée
-        # IMPORTANT : l'utilisateur⋅rice dans la VM doit être un des alias note du respo info
+        # IMPORTANT : l'utilisateur dans la VM doit être un des alias note du respo info
         ip = "127.0.0.1"
         username = Alias.normalize(getpass.getuser())
         note = NoteUser.objects.filter(alias__normalized_name=username)
@@ -149,20 +135,6 @@ def delete_object(sender, instance, **kwargs):
         # else:
         if note.exists():
             user = note.get().user
-        else:
-            user = None
-    else:
-        user = request.user
-        if 'HTTP_X_REAL_IP' in request.META:
-            ip = request.META.get('HTTP_X_REAL_IP')
-        elif 'HTTP_X_FORWARDED_FOR' in request.META:
-            ip = request.META.get('HTTP_X_FORWARDED_FOR').split(', ')[0]
-        else:
-            ip = request.META.get('REMOTE_ADDR')
-
-        if not user.is_authenticated:
-            # For registration and OAuth2 purposes
-            user = None
 
     # On crée notre propre sérialiseur JSON pour pouvoir sauvegarder les modèles
     class CustomSerializer(ModelSerializer):

apps/member/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'member.apps.MemberConfig'

apps/member/admin.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib import admin

apps/member/api/serializers.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from rest_framework import serializers

apps/member/api/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from .views import ProfileViewSet, ClubViewSet, MembershipViewSet

apps/member/api/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django_filters.rest_framework import DjangoFilterBackend

apps/member/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/member/auth.py

@@ -1,17 +0,0 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-from cas_server.auth import DjangoAuthUser  # pragma: no cover
-from note.models import Alias
-
-
-class CustomAuthUser(DjangoAuthUser):  # pragma: no cover
-    """
-    Override Django Auth User model to define a custom Matrix username.
-    """
-
-    def attributs(self):
-        d = super().attributs()
-        if self.user:
-            d["normalized_name"] = Alias.normalize(self.user.username)
-        return d

apps/member/forms.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import io
@@ -200,9 +200,9 @@ class MembershipForm(forms.ModelForm):
     class Meta:
         model = Membership
         fields = ('user', 'date_start')
-        # Le champ d'utilisateur⋅rice est remplacé par un champ d'auto-complétion.
+        # Le champ d'utilisateur est remplacé par un champ d'auto-complétion.
         # Quand des lettres sont tapées, une requête est envoyée sur l'API d'auto-complétion
-        # et récupère les noms d'utilisateur⋅rices valides
+        # et récupère les noms d'utilisateur valides
         widgets = {
             'user':
                 Autocomplete(
@@ -210,7 +210,7 @@ class MembershipForm(forms.ModelForm):
                     attrs={
                         'api_url': '/api/user/',
                         'name_field': 'username',
-                        'placeholder': 'Nom…',
+                        'placeholder': 'Nom ...',
                     },
                 ),
             'date_start': DatePickerInput(),
@@ -227,7 +227,7 @@ class MembershipRolesForm(forms.ModelForm):
             attrs={
                 'api_url': '/api/user/',
                 'name_field': 'username',
-                'placeholder': 'Nom…',
+                'placeholder': 'Nom ...',
             },
         ),
     )

apps/member/hashers.py

@@ -1,14 +1,12 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import hashlib
-from collections import OrderedDict
 
 from django.conf import settings
-from django.contrib.auth.hashers import PBKDF2PasswordHasher, mask_hash
+from django.contrib.auth.hashers import PBKDF2PasswordHasher
 from django.utils.crypto import constant_time_compare
-from django.utils.translation import gettext_lazy as _
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user, get_current_session
 
 
 class CustomNK15Hasher(PBKDF2PasswordHasher):
@@ -26,22 +24,16 @@ class CustomNK15Hasher(PBKDF2PasswordHasher):
 
     def must_update(self, encoded):
         if settings.DEBUG:
-            # Small hack to let superusers to impersonate people.
-            # Don't change their password.
-            request = get_current_request()
-            current_user = request.user
+            current_user = get_current_authenticated_user()
             if current_user is not None and current_user.is_superuser:
                 return False
         return True
 
     def verify(self, password, encoded):
         if settings.DEBUG:
-            # Small hack to let superusers to impersonate people.
-            # If a superuser is already connected, let him/her log in as another person.
-            request = get_current_request()
-            current_user = request.user
+            current_user = get_current_authenticated_user()
             if current_user is not None and current_user.is_superuser\
-                    and request.session.get("permission_mask", -1) >= 42:
+                    and get_current_session().get("permission_mask", -1) >= 42:
                 return True
 
         if '|' in encoded:
@@ -49,18 +41,6 @@ class CustomNK15Hasher(PBKDF2PasswordHasher):
             return constant_time_compare(hashlib.sha256((salt + password).encode("utf-8")).hexdigest(), db_hashed_pass)
         return super().verify(password, encoded)
 
-    def safe_summary(self, encoded):
-        # Displayed information in Django Admin.
-        if '|' in encoded:
-            salt, db_hashed_pass = encoded.split('$')[2].split('|')
-            return OrderedDict([
-                (_('algorithm'), 'custom_nk15'),
-                (_('iterations'), '1'),
-                (_('salt'), mask_hash(salt)),
-                (_('hash'), mask_hash(db_hashed_pass)),
-            ])
-        return super().safe_summary(encoded)
-
 
 class DebugSuperuserBackdoor(PBKDF2PasswordHasher):
     """
@@ -71,11 +51,8 @@ class DebugSuperuserBackdoor(PBKDF2PasswordHasher):
 
     def verify(self, password, encoded):
         if settings.DEBUG:
-            # Small hack to let superusers to impersonate people.
-            # If a superuser is already connected, let him/her log in as another person.
-            request = get_current_request()
-            current_user = request.user
+            current_user = get_current_authenticated_user()
             if current_user is not None and current_user.is_superuser\
-                    and request.session.get("permission_mask", -1) >= 42:
+                    and get_current_session().get("permission_mask", -1) >= 42:
                 return True
         return super().verify(password, encoded)

apps/member/migrations/0003_create_bde_and_kfet.py

@@ -19,8 +19,8 @@ def create_bde_and_kfet(apps, schema_editor):
         membership_fee_paid=500,
         membership_fee_unpaid=500,
         membership_duration=396,
-        membership_start="2021-08-01",
-        membership_end="2022-09-30",
+        membership_start="2020-08-01",
+        membership_end="2021-09-30",
     )
     Club.objects.get_or_create(
         id=2,
@@ -31,8 +31,8 @@ def create_bde_and_kfet(apps, schema_editor):
         membership_fee_paid=3500,
         membership_fee_unpaid=3500,
         membership_duration=396,
-        membership_start="2021-08-01",
-        membership_end="2022-09-30",
+        membership_start="2020-08-01",
+        membership_end="2021-09-30",
     )
 
     NoteClub.objects.get_or_create(

apps/member/migrations/0007_auto_20210313_1235.py

@@ -1,23 +0,0 @@
-# Generated by Django 2.2.19 on 2021-03-13 11:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('member', '0006_create_note_account_bde_membership'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='membership',
-            name='roles',
-            field=models.ManyToManyField(related_name='memberships', to='permission.Role', verbose_name='roles'),
-        ),
-        migrations.AlterField(
-            model_name='profile',
-            name='promotion',
-            field=models.PositiveSmallIntegerField(default=2021, help_text='Year of entry to the school (None if not ENS student)', null=True, verbose_name='promotion'),
-        ),
-    ]

apps/member/migrations/0008_auto_20211005_1544.py

@@ -1,18 +0,0 @@
-# Generated by Django 2.2.24 on 2021-10-05 13:44
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('member', '0007_auto_20210313_1235'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='profile',
-            name='department',
-            field=models.CharField(choices=[('A0', 'Informatics (A0)'), ('A1', 'Mathematics (A1)'), ('A2', 'Physics (A2)'), ("A'2", "Applied physics (A'2)"), ("A''2", "Chemistry (A''2)"), ('A3', 'Biology (A3)'), ('B1234', 'SAPHIRE (B1234)'), ('B1', 'Mechanics (B1)'), ('B2', 'Civil engineering (B2)'), ('B3', 'Mechanical engineering (B3)'), ('B4', 'EEA (B4)'), ('C', 'Design (C)'), ('D2', 'Economy-management (D2)'), ('D3', 'Social sciences (D3)'), ('E', 'English (E)'), ('EXT', 'External (EXT)')], max_length=8, verbose_name='department'),
-        ),
-    ]

apps/member/models.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import datetime
@@ -57,7 +57,7 @@ class Profile(models.Model):
             ('A1', _("Mathematics (A1)")),
             ('A2', _("Physics (A2)")),
             ("A'2", _("Applied physics (A'2)")),
-            ("A''2", _("Chemistry (A''2)")),
+            ('A''2', _("Chemistry (A''2)")),
             ('A3', _("Biology (A3)")),
             ('B1234', _("SAPHIRE (B1234)")),
             ('B1', _("Mechanics (B1)")),
@@ -74,7 +74,7 @@ class Profile(models.Model):
 
     promotion = models.PositiveSmallIntegerField(
         null=True,
-        default=datetime.date.today().year if datetime.date.today().month >= 8 else datetime.date.today().year - 1,
+        default=datetime.date.today().year,
         verbose_name=_("promotion"),
         help_text=_("Year of entry to the school (None if not ENS student)"),
     )
@@ -258,18 +258,16 @@ class Club(models.Model):
         This function is called each time the club detail view is displayed.
         Update the year of the membership dates.
         """
-        if not self.membership_start or not self.membership_end:
+        if not self.membership_start:
             return
 
         today = datetime.date.today()
 
         if (today - self.membership_start).days >= 365:
-            if self.membership_start:
-                self.membership_start = datetime.date(self.membership_start.year + 1,
-                                                      self.membership_start.month, self.membership_start.day)
-            if self.membership_end:
-                self.membership_end = datetime.date(self.membership_end.year + 1,
-                                                    self.membership_end.month, self.membership_end.day)
+            self.membership_start = datetime.date(self.membership_start.year + 1,
+                                                  self.membership_start.month, self.membership_start.day)
+            self.membership_end = datetime.date(self.membership_end.year + 1,
+                                                self.membership_end.month, self.membership_end.day)
             self._force_save = True
             self.save(force_update=True)
 
@@ -402,10 +400,10 @@ class Membership(models.Model):
 
             if self.club.parent_club.name == "BDE":
                 parent_membership.roles.set(
-                    Role.objects.filter(Q(name="Adhérent⋅e BDE") | Q(name="Membre de club")).all())
+                    Role.objects.filter(Q(name="Adhérent BDE") | Q(name="Membre de club")).all())
             elif self.club.parent_club.name == "Kfet":
                 parent_membership.roles.set(
-                    Role.objects.filter(Q(name="Adhérent⋅e Kfet") | Q(name="Membre de club")).all())
+                    Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all())
             else:
                 parent_membership.roles.set(Role.objects.filter(name="Membre de club").all())
             parent_membership.save()
@@ -415,12 +413,6 @@ class Membership(models.Model):
         """
         Calculate fee and end date before saving the membership and creating the transaction if needed.
         """
-        # Ensure that club membership dates are valid
-        old_membership_start = self.club.membership_start
-        self.club.update_membership_dates()
-        if self.club.membership_start != old_membership_start:
-            self.club.save()
-
         created = not self.pk
         if not created:
             for role in self.roles.all():

apps/member/signals.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 

apps/member/static/member/js/trust.js

@@ -1,53 +0,0 @@
-/**
- * On form submit, create a new friendship
- */
-function create_trust (e) {
-  // Do not submit HTML form
-  e.preventDefault()
-
-  // Get data and send to API
-  const formData = new FormData(e.target)
-  $.getJSON('/api/note/alias/'+formData.get('trusted') + '/',
-    function (trusted_alias) {
-      if ((trusted_alias.note == formData.get('trusting')))
-      {
-         addMsg(gettext("You can't add yourself as a friend"), "danger")
-         return
-      }
-      $.post('/api/note/trust/', {
-        csrfmiddlewaretoken: formData.get('csrfmiddlewaretoken'),
-        trusting: formData.get('trusting'),
-        trusted: trusted_alias.note
-      }).done(function () {
-        // Reload table
-        $('#trust_table').load(location.pathname + ' #trust_table')
-        addMsg(gettext('Friendship successfully added'), 'success')
-      }).fail(function (xhr, _textStatus, _error) {
-        errMsg(xhr.responseJSON)
-      })
-    }).fail(function (xhr, _textStatus, _error) {
-        errMsg(xhr.responseJSON)
-    })
-}
-
-/**
- * On click of "delete", delete the alias
- * @param button_id:Integer Alias id to remove
- */
-function delete_button (button_id) {
-  $.ajax({
-    url: '/api/note/trust/' + button_id + '/',
-    method: 'DELETE',
-    headers: { 'X-CSRFTOKEN': CSRF_TOKEN }
-  }).done(function () {
-    addMsg(gettext('Friendship successfully deleted'), 'success')
-    $('#trust_table').load(location.pathname + ' #trust_table')
-  }).fail(function (xhr, _textStatus, _error) {
-    errMsg(xhr.responseJSON)
-  })
-}
-
-$(document).ready(function () {
-  // Attach event
-  document.getElementById('form_trust').addEventListener('submit', create_trust)
-})

apps/member/tables.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import date
@@ -9,7 +9,7 @@ from django.utils.translation import gettext_lazy as _
 from django.urls import reverse_lazy
 from django.utils.html import format_html
 from note.templatetags.pretty_money import pretty_money
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user
 from permission.backends import PermissionBackend
 
 from .models import Club, Membership
@@ -31,8 +31,7 @@ class ClubTable(tables.Table):
         row_attrs = {
             'class': 'table-row',
             'id': lambda record: "row-" + str(record.pk),
-            'data-href': lambda record: record.pk,
-            'style': 'cursor:pointer',
+            'data-href': lambda record: record.pk
         }
 
 
@@ -52,19 +51,19 @@ class UserTable(tables.Table):
     def render_email(self, record, value):
         # Replace the email by a dash if the user can't see the profile detail
         # Replace also the URL
-        if not PermissionBackend.check_perm(get_current_request(), "member.view_profile", record.profile):
+        if not PermissionBackend.check_perm(get_current_authenticated_user(), "member.view_profile", record.profile):
             value = "—"
             record.email = value
         return value
 
     def render_section(self, record, value):
         return value \
-            if PermissionBackend.check_perm(get_current_request(), "member.view_profile", record.profile) \
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "member.view_profile", record.profile) \
             else "—"
 
     def render_balance(self, record, value):
         return pretty_money(value)\
-            if PermissionBackend.check_perm(get_current_request(), "note.view_note", record.note) else "—"
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", record.note) else "—"
 
     class Meta:
         attrs = {
@@ -75,8 +74,7 @@ class UserTable(tables.Table):
         model = User
         row_attrs = {
             'class': 'table-row',
-            'data-href': lambda record: record.pk,
-            'style': 'cursor:pointer',
+            'data-href': lambda record: record.pk
         }
 
 
@@ -95,7 +93,7 @@ class MembershipTable(tables.Table):
     def render_user(self, value):
         # If the user has the right, link the displayed user with the page of its detail.
         s = value.username
-        if PermissionBackend.check_perm(get_current_request(), "auth.view_user", value):
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "auth.view_user", value):
             s = format_html("<a href={url}>{name}</a>",
                             url=reverse_lazy('member:user_detail', kwargs={"pk": value.pk}), name=s)
 
@@ -104,7 +102,7 @@ class MembershipTable(tables.Table):
     def render_club(self, value):
         # If the user has the right, link the displayed club with the page of its detail.
         s = value.name
-        if PermissionBackend.check_perm(get_current_request(), "member.view_club", value):
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "member.view_club", value):
             s = format_html("<a href={url}>{name}</a>",
                             url=reverse_lazy('member:club_detail', kwargs={"pk": value.pk}), name=s)
 
@@ -120,7 +118,7 @@ class MembershipTable(tables.Table):
                     club=record.club,
                     user=record.user,
                     date_start__gte=record.club.membership_start,
-                    date_end__lte=record.club.membership_end or date(9999, 12, 31),
+                    date_end__lte=record.club.membership_end,
             ).exists():  # If the renew is not yet performed
                 empty_membership = Membership(
                     club=record.club,
@@ -129,7 +127,7 @@ class MembershipTable(tables.Table):
                     date_end=date.today(),
                     fee=0,
                 )
-                if PermissionBackend.check_perm(get_current_request(),
+                if PermissionBackend.check_perm(get_current_authenticated_user(),
                                                 "member.add_membership", empty_membership):  # If the user has right
                     renew_url = reverse_lazy('member:club_renew_membership',
                                              kwargs={"pk": record.pk})
@@ -144,7 +142,7 @@ class MembershipTable(tables.Table):
         # If the user has the right to manage the roles, display the link to manage them
         roles = record.roles.all()
         s = ", ".join(str(role) for role in roles)
-        if PermissionBackend.check_perm(get_current_request(), "member.change_membership_roles", record):
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "member.change_membership_roles", record):
             s = format_html("<a href='" + str(reverse_lazy("member:club_manage_roles", kwargs={"pk": record.pk}))
                             + "'>" + s + "</a>")
         return s
@@ -167,7 +165,7 @@ class ClubManagerTable(tables.Table):
     def render_user(self, value):
         # If the user has the right, link the displayed user with the page of its detail.
         s = value.username
-        if PermissionBackend.check_perm(get_current_request(), "auth.view_user", value):
+        if PermissionBackend.check_perm(get_current_authenticated_user(), "auth.view_user", value):
             s = format_html("<a href={url}>{name}</a>",
                             url=reverse_lazy('member:user_detail', kwargs={"pk": value.pk}), name=s)
 

apps/member/templates/member/includes/profile_info.html

@@ -25,14 +25,6 @@
         </a>
     </dd>
 
-    <dt class="col-xl-6">{% trans 'friendships'|capfirst %}</dt>
-    <dd class="col-xl-6">
-        <a class="badge badge-secondary" href="{% url 'member:user_trust' user_object.pk %}">
-            <i class="fa fa-edit"></i>
-            {% trans 'Manage friendships' %} ({{ user_object.note.trusting.all|length }})
-        </a>
-    </dd>
-
     {% if "member.view_profile"|has_perm:user_object.profile %}
         <dt class="col-xl-6">{% trans 'section'|capfirst %}</dt>
         <dd class="col-xl-6">{{ user_object.profile.section }}</dd>
@@ -47,13 +39,13 @@
         <dt class="col-xl-6">{% trans 'address'|capfirst %}</dt>
         <dd class="col-xl-6">{{ user_object.profile.address }}</dd>
 
-        <dt class="col-xl-6">{% trans 'paid'|capfirst %}</dt>
-        <dd class="col-xl-6">{{ user_object.profile.paid|yesno }}</dd>
-    {% endif %}
-
-    {% if user_object.note and "note.view_note"|has_perm:user_object.note %}
+        {% if user_object.note and "note.view_note"|has_perm:user_object.note %}
         <dt class="col-xl-6">{% trans 'balance'|capfirst %}</dt>
         <dd class="col-xl-6">{{ user_object.note.balance | pretty_money }}</dd>
+
+        <dt class="col-xl-6">{% trans 'paid'|capfirst %}</dt>
+        <dd class="col-xl-6">{{ user_object.profile.paid|yesno }}</dd>
+        {% endif %}
     {% endif %}
 </dl>
 

apps/member/templates/member/manage_auth_tokens.html

@@ -5,98 +5,32 @@ SPDX-License-Identifier: GPL-3.0-or-later
 {% load i18n %}
 
 {% block content %}
-<div class="row mt-4">
-    <div class="col-xl-6">
-        <div class="card">
-            <div class="card-header text-center">
-                <h3>{% trans "Token authentication" %}</h3>
-            </div>
-            <div class="card-body">
-                <div class="alert alert-info">
-                    <h4>À quoi sert un jeton d'authentification ?</h4>
+<div class="alert alert-info">
+    <h4>À quoi sert un jeton d'authentification ?</h4>
 
-                    Un jeton vous permet de vous connecter à <a href="/api/">l'API de la Note Kfet</a> via votre propre compte
-                    depuis un client externe.<br />
-                    Il suffit pour cela d'ajouter en en-tête de vos requêtes <code>Authorization: Token &lt;TOKEN&gt;</code>
-                    pour pouvoir vous identifier.<br /><br />
+    Un jeton vous permet de vous connecter à <a href="/api/">l'API de la Note Kfet</a>.<br />
+    Il suffit pour cela d'ajouter en en-tête de vos requêtes <code>Authorization: Token &lt;TOKEN&gt;</code>
+    pour pouvoir vous identifier.<br /><br />
 
-                    La documentation de l'API est disponible ici :
-                    <a href="/doc/api/">{{ request.scheme }}://{{ request.get_host }}/doc/api/</a>.
-                </div>
-
-                <div class="alert alert-info">
-                    <strong>{%trans  'Token' %} :</strong>
-                    {% if 'show' in request.GET %}
-                    {{ token.key }} (<a href="?">cacher</a>)
-                    {% else %}
-                    <em>caché</em> (<a href="?show">montrer</a>)
-                    {% endif %}
-                    <br />
-                    <strong>{%trans  'Created' %} :</strong> {{ token.created }}
-                </div>
-
-                <div class="alert alert-warning">
-                    <strong>{% trans "Warning" %} :</strong> regénérer le jeton va révoquer tout accès autorisé à l'API via ce jeton !
-                </div>
-            </div>
-            <div class="card-footer text-center">
-                <a href="?regenerate">
-                    <button class="btn btn-primary">{% trans 'Regenerate token' %}</button>
-                </a>
-            </div>
-        </div>
-    </div>
-
-    <div class="col-xl-6">
-        <div class="card">
-            <div class="card-header text-center">
-                <h3>{% trans "OAuth2 authentication" %}</h3>
-            </div>
-            <div class="card-header">
-                <div class="alert alert-info">
-                    <p>
-                        La Note Kfet implémente également le protocole <a href="https://oauth.net/2/">OAuth2</a>, afin de
-                        permettre à des applications tierces d'interagir avec la Note en récoltant des informations
-                        (de connexion par exemple) voir en permettant des modifications à distance, par exemple lorsqu'il
-                        s'agit d'avoir un site marchand sur lequel faire des transactions via la Note Kfet.
-                    </p>
-
-                    <p>
-                        L'usage de ce protocole est recommandé pour tout usage non personnel, car permet de mieux cibler
-                        les droits dont on a besoin, en restreignant leur usage par jeton généré.
-                    </p>
-
-                    <p>
-                        La documentation vis-à-vis de l'usage de ce protocole est disponible ici :
-                        <a href="/doc/external_services/oauth2/">{{ request.scheme }}://{{ request.get_host }}/doc/external_services/oauth2/</a>.
-                    </p>
-                </div>
-
-                Liste des URL à communiquer à votre application :
-
-                <ul>
-                    <li>
-                        {% trans "Authorization:" %}
-                        <a href="{% url 'oauth2_provider:authorize' %}">{{ request.scheme }}://{{ request.get_host }}{% url 'oauth2_provider:authorize' %}</a>
-                    </li>
-                    <li>
-                        {% trans "Token:" %}
-                        <a href="{% url 'oauth2_provider:authorize' %}">{{ request.scheme }}://{{ request.get_host }}{% url 'oauth2_provider:token' %}</a>
-                    </li>
-                    <li>
-                        {% trans "Revoke Token:" %}
-                        <a href="{% url 'oauth2_provider:authorize' %}">{{ request.scheme }}://{{ request.get_host }}{% url 'oauth2_provider:revoke-token' %}</a>
-                    </li>
-                    <li>
-                        {% trans "Introspect Token:" %}
-                        <a href="{% url 'oauth2_provider:authorize' %}">{{ request.scheme }}://{{ request.get_host }}{% url 'oauth2_provider:introspect' %}</a>
-                    </li>
-                </ul>
-            </div>
-            <div class="card-footer text-center">
-                <a class="btn btn-primary" href="{% url 'oauth2_provider:list' %}">{% trans "Show my applications" %}</a>
-            </div>
-        </div>
-    </div>
+    Une documentation de l'API arrivera ultérieurement.
 </div>
+
+<div class="alert alert-info">
+    <strong>{%trans  'Token' %} :</strong>
+    {% if 'show' in request.GET %}
+    {{ token.key }} (<a href="?">cacher</a>)
+    {% else %}
+    <em>caché</em> (<a href="?show">montrer</a>)
+    {% endif %}
+    <br />
+    <strong>{%trans  'Created' %} :</strong> {{ token.created }}
+</div>
+
+<div class="alert alert-warning">
+    <strong>Attention :</strong> regénérer le jeton va révoquer tout accès autorisé à l'API via ce jeton !
+</div>
+
+<a href="?regenerate">
+    <button class="btn btn-primary">{% trans 'Regenerate token' %}</button>
+</a>
 {% endblock %}

apps/member/templates/member/profile_trust.html

@@ -1,41 +0,0 @@
-{% extends "member/base.html" %}
-{% comment %}
-SPDX-License-Identifier: GPL-3.0-or-later
-{% endcomment %}
-{% load static django_tables2 i18n %}
-
-{% block profile_content %}
-<div class="card bg-light mb-3">
-    <h3 class="card-header text-center">
-        {% trans "Note friendships" %}
-    </h3>
-    <div class="card-body">
-        {% if can_create %}
-            <form class="input-group" method="POST" id="form_trust">
-                {% csrf_token %}
-                <input type="hidden" name="trusting" value="{{ object.note.pk }}">
-                {%include "autocomplete_model.html" %}
-                <div class="input-group-append">
-                    <input type="submit" class="btn btn-success" value="{% trans "Add" %}">
-                </div>
-            </form>
-        {% endif %}
-    </div>
-    {% render_table trusting %}
-</div>
-
-<div class="alert alert-warning card">
-    {% blocktrans trimmed %}
-        Adding someone as a friend enables them to initiate transactions coming
-        from your account (while keeping your balance positive). This is
-        designed to simplify using note kfet transfers to transfer money between
-        users. The intent is that one person can make all transfers for a group of
-        friends without needing additional rights among them.
-    {% endblocktrans %}
-</div>
-{% endblock %}
-
-{% block extrajavascript %}
-<script src="{% static "member/js/trust.js" %}"></script>
-<script src="{% static "js/autocomplete_model.js" %}"></script>
-{% endblock%}

apps/member/templatetags/memberinfo.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import date

apps/member/tests/test_login.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 from django.conf import settings
 from django.contrib.auth.models import User

apps/member/tests/test_memberships.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import hashlib
@@ -291,7 +291,7 @@ class TestMemberships(TestCase):
 
         response = self.client.post(reverse("member:club_manage_roles", args=(self.membership.pk,)), data=dict(
             roles=[role.id for role in Role.objects.filter(
-                Q(name="Membre de club") | Q(name="Trésorièr⋅e de club") | Q(name="Bureau de club")).all()],
+                Q(name="Membre de club") | Q(name="Trésorier·ère de club") | Q(name="Bureau de club")).all()],
         ))
         self.assertRedirects(response, self.user.profile.get_absolute_url(), 302, 200)
         self.membership.refresh_from_db()

apps/member/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.urls import path
@@ -23,6 +23,5 @@ urlpatterns = [
     path('user/<int:pk>/update/', views.UserUpdateView.as_view(), name="user_update_profile"),
     path('user/<int:pk>/update_pic/', views.ProfilePictureUpdateView.as_view(), name="user_update_pic"),
     path('user/<int:pk>/aliases/', views.ProfileAliasView.as_view(), name="user_alias"),
-    path('user/<int:pk>/trust', views.ProfileTrustView.as_view(), name="user_trust"),
     path('manage-auth-token/', views.ManageAuthTokens.as_view(), name='auth_token'),
 ]

apps/member/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import timedelta, date
@@ -8,7 +8,6 @@ from django.contrib.auth import logout
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.models import User
 from django.contrib.auth.views import LoginView
-from django.contrib.contenttypes.models import ContentType
 from django.db import transaction
 from django.db.models import Q, F
 from django.shortcuts import redirect
@@ -19,10 +18,10 @@ from django.views.generic import DetailView, UpdateView, TemplateView
 from django.views.generic.edit import FormMixin
 from django_tables2.views import SingleTableView
 from rest_framework.authtoken.models import Token
-from note.models import Alias, NoteClub, NoteUser, Trust
+from note.models import Alias, NoteUser
 from note.models.transactions import Transaction, SpecialTransaction
-from note.tables import HistoryTable, AliasTable, TrustTable
-from note_kfet.middlewares import _set_current_request
+from note.tables import HistoryTable, AliasTable
+from note_kfet.middlewares import _set_current_user_and_ip
 from permission.backends import PermissionBackend
 from permission.models import Role
 from permission.views import ProtectQuerysetMixin, ProtectedCreateView
@@ -42,8 +41,7 @@ class CustomLoginView(LoginView):
     @transaction.atomic
     def form_valid(self, form):
         logout(self.request)
-        self.request.user = form.get_user()
-        _set_current_request(self.request)
+        _set_current_user_and_ip(form.get_user(), self.request.session, None)
         self.request.session['permission_mask'] = form.cleaned_data['permission_mask'].rank
         return super().form_valid(form)
 
@@ -72,7 +70,7 @@ class UserUpdateView(ProtectQuerysetMixin, LoginRequiredMixin, UpdateView):
         form.fields['email'].required = True
         form.fields['email'].help_text = _("This address must be valid.")
 
-        if PermissionBackend.check_perm(self.request, "member.change_profile", context['user_object'].profile):
+        if PermissionBackend.check_perm(self.request.user, "member.change_profile", context['user_object'].profile):
             context['profile_form'] = self.profile_form(instance=context['user_object'].profile,
                                                         data=self.request.POST if self.request.POST else None)
             if not self.object.profile.report_frequency:
@@ -155,13 +153,13 @@ class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         history_list = \
             Transaction.objects.all().filter(Q(source=user.note) | Q(destination=user.note))\
             .order_by("-created_at")\
-            .filter(PermissionBackend.filter_queryset(self.request, Transaction, "view"))
+            .filter(PermissionBackend.filter_queryset(self.request.user, Transaction, "view"))
         history_table = HistoryTable(history_list, prefix='transaction-')
         history_table.paginate(per_page=20, page=self.request.GET.get("transaction-page", 1))
         context['history_list'] = history_table
 
         club_list = Membership.objects.filter(user=user, date_end__gte=date.today() - timedelta(days=15))\
-            .filter(PermissionBackend.filter_queryset(self.request, Membership, "view"))\
+            .filter(PermissionBackend.filter_queryset(self.request.user, Membership, "view"))\
             .order_by("club__name", "-date_start")
         # Display only the most recent membership
         club_list = club_list.distinct("club__name")\
@@ -175,23 +173,24 @@ class UserDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
             modified_note = NoteUser.objects.get(pk=user.note.pk)
             # Don't log these tests
             modified_note._no_signal = True
-            modified_note.is_active = False
+            modified_note.is_active = True
             modified_note.inactivity_reason = 'manual'
             context["can_lock_note"] = user.note.is_active and PermissionBackend\
-                                           .check_perm(self.request, "note.change_noteuser_is_active", modified_note)
+                                           .check_perm(self.request.user, "note.change_noteuser_is_active",
+                                                       modified_note)
             old_note = NoteUser.objects.select_for_update().get(pk=user.note.pk)
             modified_note.inactivity_reason = 'forced'
             modified_note._force_save = True
             modified_note.save()
             context["can_force_lock"] = user.note.is_active and PermissionBackend\
-                .check_perm(self.request, "note.change_noteuser_is_active", modified_note)
+                .check_perm(self.request.user, "note.change_note_is_active", modified_note)
             old_note._force_save = True
             old_note._no_signal = True
             old_note.save()
             modified_note.refresh_from_db()
             modified_note.is_active = True
             context["can_unlock_note"] = not user.note.is_active and PermissionBackend\
-                .check_perm(self.request, "note.change_noteuser_is_active", modified_note)
+                .check_perm(self.request.user, "note.change_note_is_active", modified_note)
 
         return context
 
@@ -238,45 +237,12 @@ class UserListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
-        pre_registered_users = User.objects.filter(PermissionBackend.filter_queryset(self.request, User, "view"))\
+        pre_registered_users = User.objects.filter(PermissionBackend.filter_queryset(self.request.user, User, "view"))\
             .filter(profile__registration_valid=False)
         context["can_manage_registrations"] = pre_registered_users.exists()
         return context
 
 
-class ProfileTrustView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
-    """
-    View and manage user trust relationships
-    """
-    model = User
-    template_name = 'member/profile_trust.html'
-    context_object_name = 'user_object'
-    extra_context = {"title": _("Note friendships")}
-
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-        note = context['object'].note
-        context["trusting"] = TrustTable(
-            note.trusting.filter(PermissionBackend.filter_queryset(self.request, Trust, "view")).distinct().all())
-        context["can_create"] = PermissionBackend.check_perm(self.request, "note.add_trust", Trust(
-            trusting=context["object"].note,
-            trusted=context["object"].note
-        ))
-        context["widget"] = {
-            "name": "trusted",
-            "attrs": {
-                "model_pk": ContentType.objects.get_for_model(Alias).pk,
-                "class": "autocomplete form-control",
-                "id": "trusted",
-                "resetable": True,
-                "api_url": "/api/note/alias/?note__polymorphic_ctype__model=noteuser",
-                "name_field": "name",
-                "placeholder": ""
-            }
-        }
-        return context
-
-
 class ProfileAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
     """
     View and manage user aliases.
@@ -290,9 +256,8 @@ class ProfileAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         context = super().get_context_data(**kwargs)
         note = context['object'].note
         context["aliases"] = AliasTable(
-            note.alias.filter(PermissionBackend.filter_queryset(self.request, Alias, "view")).distinct()
-            .order_by('normalized_name').all())
-        context["can_create"] = PermissionBackend.check_perm(self.request, "note.add_alias", Alias(
+            note.alias.filter(PermissionBackend.filter_queryset(self.request.user, Alias, "view")).distinct().all())
+        context["can_create"] = PermissionBackend.check_perm(self.request.user, "note.add_alias", Alias(
             note=context["object"].note,
             name="",
             normalized_name="",
@@ -417,7 +382,7 @@ class ClubListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
-        context["can_add_club"] = PermissionBackend.check_perm(self.request, "member.add_club", Club(
+        context["can_add_club"] = PermissionBackend.check_perm(self.request.user, "member.add_club", Club(
             name="",
             email="club@example.com",
         ))
@@ -438,12 +403,9 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         """
         context = super().get_context_data(**kwargs)
 
-        club = self.object
-        context["note"] = club.note
-
-        if PermissionBackend.check_perm(self.request, "member.change_club_membership_start", club):
+        club = context["club"]
+        if PermissionBackend.check_perm(self.request.user, "member.change_club_membership_start", club):
             club.update_membership_dates()
-
         # managers list
         managers = Membership.objects.filter(club=self.object, roles__name="Bureau de club",
                                              date_start__lte=date.today(), date_end__gte=date.today())\
@@ -451,7 +413,7 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         context["managers"] = ClubManagerTable(data=managers, prefix="managers-")
         # transaction history
         club_transactions = Transaction.objects.all().filter(Q(source=club.note) | Q(destination=club.note))\
-            .filter(PermissionBackend.filter_queryset(self.request, Transaction, "view"))\
+            .filter(PermissionBackend.filter_queryset(self.request.user, Transaction, "view"))\
             .order_by('-created_at')
         history_table = HistoryTable(club_transactions, prefix="history-")
         history_table.paginate(per_page=20, page=self.request.GET.get('history-page', 1))
@@ -460,7 +422,7 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         club_member = Membership.objects.filter(
             club=club,
             date_end__gte=date.today() - timedelta(days=15),
-        ).filter(PermissionBackend.filter_queryset(self.request, Membership, "view"))\
+        ).filter(PermissionBackend.filter_queryset(self.request.user, Membership, "view"))\
             .order_by("user__username", "-date_start")
         # Display only the most recent membership
         club_member = club_member.distinct("user__username")\
@@ -481,29 +443,6 @@ class ClubDetailView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         context["can_add_members"] = PermissionBackend()\
             .has_perm(self.request.user, "member.add_membership", empty_membership)
 
-        # Check permissions to see if the authenticated user can lock/unlock the note
-        with transaction.atomic():
-            modified_note = NoteClub.objects.get(pk=club.note.pk)
-            # Don't log these tests
-            modified_note._no_signal = True
-            modified_note.is_active = False
-            modified_note.inactivity_reason = 'manual'
-            context["can_lock_note"] = club.note.is_active and PermissionBackend \
-                .check_perm(self.request, "note.change_noteclub_is_active", modified_note)
-            old_note = NoteClub.objects.select_for_update().get(pk=club.note.pk)
-            modified_note.inactivity_reason = 'forced'
-            modified_note._force_save = True
-            modified_note.save()
-            context["can_force_lock"] = club.note.is_active and PermissionBackend \
-                .check_perm(self.request, "note.change_noteclub_is_active", modified_note)
-            old_note._force_save = True
-            old_note._no_signal = True
-            old_note.save()
-            modified_note.refresh_from_db()
-            modified_note.is_active = True
-            context["can_unlock_note"] = not club.note.is_active and PermissionBackend \
-                .check_perm(self.request, "note.change_noteclub_is_active", modified_note)
-
         return context
 
 
@@ -520,8 +459,8 @@ class ClubAliasView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView):
         context = super().get_context_data(**kwargs)
         note = context['object'].note
         context["aliases"] = AliasTable(note.alias.filter(
-            PermissionBackend.filter_queryset(self.request, Alias, "view")).distinct().all())
-        context["can_create"] = PermissionBackend.check_perm(self.request, "note.add_alias", Alias(
+            PermissionBackend.filter_queryset(self.request.user, Alias, "view")).distinct().all())
+        context["can_create"] = PermissionBackend.check_perm(self.request.user, "note.add_alias", Alias(
             note=context["object"].note,
             name="",
             normalized_name="",
@@ -596,7 +535,7 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
         form = context['form']
 
         if "club_pk" in self.kwargs:  # We create a new membership.
-            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request, Club, "view"))\
+            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request.user, Club, "view"))\
                 .get(pk=self.kwargs["club_pk"], weiclub=None)
             form.fields['credit_amount'].initial = club.membership_fee_paid
             # Ensure that the user is member of the parent club and all its the family tree.
@@ -686,6 +625,9 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
         # Retrieve form data
         credit_type = form.cleaned_data["credit_type"]
         credit_amount = form.cleaned_data["credit_amount"]
+        last_name = form.cleaned_data["last_name"]
+        first_name = form.cleaned_data["first_name"]
+        bank = form.cleaned_data["bank"]
         soge = form.cleaned_data["soge"] and not user.profile.soge and (club.name == "BDE" or club.name == "Kfet")
 
         if not credit_type:
@@ -716,7 +658,8 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
         if club.name != "Kfet" and club.parent_club and not Membership.objects.filter(
                 user=form.instance.user,
                 club=club.parent_club,
-                date_start__gte=club.parent_club.membership_start,
+                date_start__lte=timezone.now(),
+                date_end__gte=club.parent_club.membership_end,
         ).exists():
             form.add_error('user', _('User is not a member of the parent club') + ' ' + club.parent_club.name)
             error = True
@@ -731,9 +674,17 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
                            .format(form.instance.club.membership_end))
             error = True
 
-        if credit_amount and not SpecialTransaction.validate_payment_form(form):
-            # Check that special information for payment are filled
-            error = True
+        if credit_amount:
+            if not last_name or not first_name or (not bank and credit_type.special_type == "Chèque"):
+                if not last_name:
+                    form.add_error('last_name', _("This field is required."))
+                    error = True
+                if not first_name:
+                    form.add_error('first_name', _("This field is required."))
+                    error = True
+                if not bank and credit_type.special_type == "Chèque":
+                    form.add_error('bank', _("This field is required."))
+                    error = True
 
         return not error
 
@@ -744,7 +695,7 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
         """
         # Get the club that is concerned by the membership
         if "club_pk" in self.kwargs:  # get from url of new membership
-            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request, Club, "view")) \
+            club = Club.objects.filter(PermissionBackend.filter_queryset(self.request.user, Club, "view")) \
                 .get(pk=self.kwargs["club_pk"])
             user = form.instance.user
             old_membership = None
@@ -795,7 +746,6 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
             # When we renew the BDE membership, we update the profile section
             # that should happens at least once a year.
             user.profile.section = user.profile.section_generated
-            user.profile._force_save = True
             user.profile.save()
 
         # Credit note before the membership is created.
@@ -820,8 +770,8 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
 
         ret = super().form_valid(form)
 
-        member_role = Role.objects.filter(Q(name="Adhérent⋅e BDE") | Q(name="Membre de club")).all() \
-            if club.name == "BDE" else Role.objects.filter(Q(name="Adhérent⋅e Kfet") | Q(name="Membre de club")).all() \
+        member_role = Role.objects.filter(Q(name="Adhérent BDE") | Q(name="Membre de club")).all() \
+            if club.name == "BDE" else Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all() \
             if club.name == "Kfet"else Role.objects.filter(name="Membre de club").all()
         # Set the same roles as before
         if old_membership:
@@ -857,7 +807,7 @@ class ClubAddMemberView(ProtectQuerysetMixin, ProtectedCreateView):
                 membership.refresh_from_db()
                 if old_membership.exists():
                     membership.roles.set(old_membership.get().roles.all())
-                membership.roles.set(Role.objects.filter(Q(name="Adhérent⋅e Kfet") | Q(name="Membre de club")).all())
+                membership.roles.set(Role.objects.filter(Q(name="Adhérent Kfet") | Q(name="Membre de club")).all())
                 membership.save()
 
         return ret
@@ -928,7 +878,7 @@ class ClubMembersListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableV
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         club = Club.objects.filter(
-            PermissionBackend.filter_queryset(self.request, Club, "view")
+            PermissionBackend.filter_queryset(self.request.user, Club, "view")
         ).get(pk=self.kwargs["pk"])
         context["club"] = club
 

apps/note/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'note.apps.NoteConfig'

apps/note/admin.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.contrib import admin

apps/note/api/serializers.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.conf import settings
@@ -8,11 +8,11 @@ from rest_framework.exceptions import ValidationError
 from rest_polymorphic.serializers import PolymorphicSerializer
 from member.api.serializers import MembershipSerializer
 from member.models import Membership
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user
 from permission.backends import PermissionBackend
 from rest_framework.utils import model_meta
 
-from ..models.notes import Note, NoteClub, NoteSpecial, NoteUser, Alias, Trust
+from ..models.notes import Note, NoteClub, NoteSpecial, NoteUser, Alias
 from ..models.transactions import TransactionTemplate, Transaction, MembershipTransaction, TemplateCategory, \
     RecurrentTransaction, SpecialTransaction
 
@@ -77,22 +77,6 @@ class NoteUserSerializer(serializers.ModelSerializer):
         return str(obj)
 
 
-class TrustSerializer(serializers.ModelSerializer):
-    """
-    REST API Serializer for Trusts.
-    The djangorestframework plugin will analyse the model `Trust` and parse all fields in the API.
-    """
-
-    class Meta:
-        model = Trust
-        fields = '__all__'
-
-    def validate(self, attrs):
-        instance = Trust(**attrs)
-        instance.clean()
-        return attrs
-
-
 class AliasSerializer(serializers.ModelSerializer):
     """
     REST API Serializer for Aliases.
@@ -142,7 +126,7 @@ class ConsumerSerializer(serializers.ModelSerializer):
         """
         # If the user has no right to see the note, then we only display the note identifier
         return NotePolymorphicSerializer().to_representation(obj.note)\
-            if PermissionBackend.check_perm(get_current_request(), "note.view_note", obj.note)\
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", obj.note)\
             else dict(
             id=obj.note.id,
             name=str(obj.note),
@@ -158,7 +142,7 @@ class ConsumerSerializer(serializers.ModelSerializer):
     def get_membership(self, obj):
         if isinstance(obj.note, NoteUser):
             memberships = Membership.objects.filter(
-                PermissionBackend.filter_queryset(get_current_request(), Membership, "view")).filter(
+                PermissionBackend.filter_queryset(get_current_authenticated_user(), Membership, "view")).filter(
                 user=obj.note.user,
                 club=2,  # Kfet
             ).order_by("-date_start")

apps/note/api/urls.py

@@ -1,9 +1,8 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from .views import NotePolymorphicViewSet, AliasViewSet, ConsumerViewSet, \
-    TemplateCategoryViewSet, TransactionViewSet, TransactionTemplateViewSet, \
-    TrustViewSet
+    TemplateCategoryViewSet, TransactionViewSet, TransactionTemplateViewSet
 
 
 def register_note_urls(router, path):
@@ -12,7 +11,6 @@ def register_note_urls(router, path):
     """
     router.register(path + '/note', NotePolymorphicViewSet)
     router.register(path + '/alias', AliasViewSet)
-    router.register(path + '/trust', TrustViewSet)
     router.register(path + '/consumer', ConsumerViewSet)
 
     router.register(path + '/transaction/category', TemplateCategoryViewSet)

apps/note/api/views.py

@@ -1,6 +1,5 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-import re
 
 from django.conf import settings
 from django.db.models import Q
@@ -11,12 +10,12 @@ from rest_framework import viewsets
 from rest_framework.response import Response
 from rest_framework import status
 from api.viewsets import ReadProtectedModelViewSet, ReadOnlyProtectedModelViewSet
+from note_kfet.middlewares import get_current_session
 from permission.backends import PermissionBackend
 
 from .serializers import NotePolymorphicSerializer, AliasSerializer, ConsumerSerializer,\
-    TemplateCategorySerializer, TransactionTemplateSerializer, TransactionPolymorphicSerializer, \
-    TrustSerializer
-from ..models.notes import Note, Alias, NoteUser, NoteClub, NoteSpecial, Trust
+    TemplateCategorySerializer, TransactionTemplateSerializer, TransactionPolymorphicSerializer
+from ..models.notes import Note, Alias, NoteUser, NoteClub, NoteSpecial
 from ..models.transactions import TransactionTemplate, Transaction, TemplateCategory
 
 
@@ -41,11 +40,12 @@ class NotePolymorphicViewSet(ReadProtectedModelViewSet):
         Parse query and apply filters.
         :return: The filtered set of requested notes
         """
-        queryset = self.queryset.filter(PermissionBackend.filter_queryset(self.request, Note, "view")
-                                        | PermissionBackend.filter_queryset(self.request, NoteUser, "view")
-                                        | PermissionBackend.filter_queryset(self.request, NoteClub, "view")
-                                        | PermissionBackend.filter_queryset(self.request, NoteSpecial, "view"))\
-            .distinct()
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        queryset = self.queryset.filter(PermissionBackend.filter_queryset(user, Note, "view")
+                                        | PermissionBackend.filter_queryset(user, NoteUser, "view")
+                                        | PermissionBackend.filter_queryset(user, NoteClub, "view")
+                                        | PermissionBackend.filter_queryset(user, NoteSpecial, "view")).distinct()
 
         alias = self.request.query_params.get("alias", ".*")
         queryset = queryset.filter(
@@ -57,55 +57,24 @@ class NotePolymorphicViewSet(ReadProtectedModelViewSet):
         return queryset.order_by("id")
 
 
-class TrustViewSet(ReadProtectedModelViewSet):
-    """
-    REST Trust View set.
-    The djangorestframework plugin will get all `Trust` objects, serialize it to JSON with the given serializer,
-    then render it on /api/note/trust/
-    """
-    queryset = Trust.objects
-    serializer_class = TrustSerializer
-    filter_backends = [SearchFilter, DjangoFilterBackend, OrderingFilter]
-    search_fields = ['$trusting__alias__name', '$trusting__alias__normalized_name',
-                     '$trusted__alias__name', '$trusted__alias__normalized_name']
-    filterset_fields = ['trusting', 'trusting__noteuser__user', 'trusted', 'trusted__noteuser__user']
-    ordering_fields = ['trusting', 'trusted', ]
-
-    def get_serializer_class(self):
-        serializer_class = self.serializer_class
-        if self.request.method in ['PUT', 'PATCH']:
-            # trust relationship can't change people involved
-            serializer_class.Meta.read_only_fields = ('trusting', 'trusting',)
-        return serializer_class
-
-    def destroy(self, request, *args, **kwargs):
-        instance = self.get_object()
-        try:
-            self.perform_destroy(instance)
-        except ValidationError as e:
-            return Response({e.code: str(e)}, status.HTTP_400_BAD_REQUEST)
-        return Response(status=status.HTTP_204_NO_CONTENT)
-
-
 class AliasViewSet(ReadProtectedModelViewSet):
     """
     REST API View set.
     The djangorestframework plugin will get all `Alias` objects, serialize it to JSON with the given serializer,
-    then render it on /api/note/aliases/
+    then render it on /api/aliases/
     """
     queryset = Alias.objects
     serializer_class = AliasSerializer
     filter_backends = [SearchFilter, DjangoFilterBackend, OrderingFilter]
     search_fields = ['$normalized_name', '$name', '$note__polymorphic_ctype__model', ]
-    filterset_fields = ['name', 'normalized_name', 'note', 'note__noteuser__user',
-                        'note__noteclub__club', 'note__polymorphic_ctype__model', ]
+    filterset_fields = ['note', 'note__noteuser__user', 'note__noteclub__club', 'note__polymorphic_ctype__model', ]
     ordering_fields = ['name', 'normalized_name', ]
 
     def get_serializer_class(self):
         serializer_class = self.serializer_class
         if self.request.method in ['PUT', 'PATCH']:
             # alias owner cannot be change once establish
-            serializer_class.Meta.read_only_fields = ('note',)
+            setattr(serializer_class.Meta, 'read_only_fields', ('note',))
         return serializer_class
 
     def destroy(self, request, *args, **kwargs):
@@ -113,7 +82,7 @@ class AliasViewSet(ReadProtectedModelViewSet):
         try:
             self.perform_destroy(instance)
         except ValidationError as e:
-            return Response({e.code: str(e)}, status.HTTP_400_BAD_REQUEST)
+            return Response({e.code: e.message}, status.HTTP_400_BAD_REQUEST)
         return Response(status=status.HTTP_204_NO_CONTENT)
 
     def get_queryset(self):
@@ -149,8 +118,7 @@ class ConsumerViewSet(ReadOnlyProtectedModelViewSet):
     serializer_class = ConsumerSerializer
     filter_backends = [SearchFilter, OrderingFilter, DjangoFilterBackend]
     search_fields = ['$normalized_name', '$name', '$note__polymorphic_ctype__model', ]
-    filterset_fields = ['name', 'normalized_name', 'note', 'note__noteuser__user',
-                        'note__noteclub__club', 'note__polymorphic_ctype__model', ]
+    filterset_fields = ['note', 'note__noteuser__user', 'note__noteclub__club', 'note__polymorphic_ctype__model', ]
     ordering_fields = ['name', 'normalized_name', ]
 
     def get_queryset(self):
@@ -165,31 +133,23 @@ class ConsumerViewSet(ReadOnlyProtectedModelViewSet):
             if settings.DATABASES[queryset.db]["ENGINE"] == 'django.db.backends.postgresql' else queryset
 
         alias = self.request.query_params.get("alias", None)
-        # Check if this is a valid regex. If not, we won't check regex
-        try:
-            re.compile(alias)
-            valid_regex = True
-        except (re.error, TypeError):
-            valid_regex = False
-        suffix = '__iregex' if valid_regex else '__istartswith'
-        alias_prefix = '^' if valid_regex else ''
         queryset = queryset.prefetch_related('note')
 
         if alias:
             # We match first an alias if it is matched without normalization,
             # then if the normalized pattern matches a normalized alias.
             queryset = queryset.filter(
-                **{f'name{suffix}': alias_prefix + alias}
+                name__iregex="^" + alias
             ).union(
                 queryset.filter(
-                    Q(**{f'normalized_name{suffix}': alias_prefix + Alias.normalize(alias)})
-                    & ~Q(**{f'name{suffix}': alias_prefix + alias})
+                    Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                    & ~Q(name__iregex="^" + alias)
                 ),
                 all=True).union(
                 queryset.filter(
-                    Q(**{f'normalized_name{suffix}': alias_prefix + alias.lower()})
-                    & ~Q(**{f'normalized_name{suffix}': alias_prefix + Alias.normalize(alias)})
-                    & ~Q(**{f'name{suffix}': alias_prefix + alias})
+                    Q(normalized_name__iregex="^" + alias.lower())
+                    & ~Q(normalized_name__iregex="^" + Alias.normalize(alias))
+                    & ~Q(name__iregex="^" + alias)
                 ),
                 all=True)
 
@@ -245,5 +205,7 @@ class TransactionViewSet(ReadProtectedModelViewSet):
     ordering_fields = ['created_at', 'amount', ]
 
     def get_queryset(self):
-        return self.model.objects.filter(PermissionBackend.filter_queryset(self.request, self.model, "view"))\
+        user = self.request.user
+        get_current_session().setdefault("permission_mask", 42)
+        return self.model.objects.filter(PermissionBackend.filter_queryset(user, self.model, "view"))\
             .order_by("created_at", "id")

apps/note/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/note/forms.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 from datetime import datetime
 
@@ -26,7 +26,7 @@ class TransactionTemplateForm(forms.ModelForm):
                         # We don't evaluate the content type at launch because the DB might be not initialized
                         'api_url_suffix':
                             lambda: '&polymorphic_ctype=' + str(ContentType.objects.get_for_model(NoteClub).pk),
-                        'placeholder': 'Note…',
+                        'placeholder': 'Note ...',
                     },
                 ),
             'amount': AmountInput(),
@@ -43,7 +43,7 @@ class SearchTransactionForm(forms.Form):
             resetable=True,
             attrs={
                 'api_url': '/api/note/alias/',
-                'placeholder': 'Note…',
+                'placeholder': 'Note ...',
             },
         ),
     )
@@ -57,7 +57,7 @@ class SearchTransactionForm(forms.Form):
             resetable=True,
             attrs={
                 'api_url': '/api/note/alias/',
-                'placeholder': 'Note…',
+                'placeholder': 'Note ...',
             },
         ),
     )

apps/note/migrations/0005_auto_20210313_1235.py

@@ -1,19 +0,0 @@
-# Generated by Django 2.2.19 on 2021-03-13 11:35
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('note', '0004_remove_null_tag_on_charfields'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='alias',
-            name='note',
-            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='alias', to='note.Note'),
-        ),
-    ]

apps/note/migrations/0006_trust.py

@@ -1,27 +0,0 @@
-# Generated by Django 2.2.24 on 2021-09-05 19:16
-
-from django.db import migrations, models
-import django.db.models.deletion
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('note', '0005_auto_20210313_1235'),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='Trust',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('trusted', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='trusted', to='note.Note', verbose_name='trusted')),
-                ('trusting', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='trusting', to='note.Note', verbose_name='trusting')),
-            ],
-            options={
-                'verbose_name': 'friendship',
-                'verbose_name_plural': 'friendships',
-                'unique_together': {('trusting', 'trusted')},
-            },
-        ),
-    ]

apps/note/models/__init__.py

@@ -1,13 +1,13 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-from .notes import Alias, Note, NoteClub, NoteSpecial, NoteUser, Trust
+from .notes import Alias, Note, NoteClub, NoteSpecial, NoteUser
 from .transactions import MembershipTransaction, Transaction, \
     TemplateCategory, TransactionTemplate, RecurrentTransaction, SpecialTransaction
 
 __all__ = [
     # Notes
-    'Alias', 'Trust', 'Note', 'NoteClub', 'NoteSpecial', 'NoteUser',
+    'Alias', 'Note', 'NoteClub', 'NoteSpecial', 'NoteUser',
     # Transactions
     'MembershipTransaction', 'Transaction', 'TemplateCategory', 'TransactionTemplate',
     'RecurrentTransaction', 'SpecialTransaction',

apps/note/models/notes.py

@@ -1,9 +1,10 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import unicodedata
 
 from django.conf import settings
+from django.conf.global_settings import DEFAULT_FROM_EMAIL
 from django.core.exceptions import ValidationError
 from django.core.mail import send_mail
 from django.core.validators import RegexValidator
@@ -189,8 +190,8 @@ class NoteClub(Note):
     def send_mail_negative_balance(self):
         plain_text = render_to_string("note/mails/negative_balance.txt", dict(note=self))
         html = render_to_string("note/mails/negative_balance.html", dict(note=self))
-        send_mail("[Note Kfet] Passage en négatif (club {})".format(self.club.name), plain_text,
-                  settings.DEFAULT_FROM_EMAIL, [self.club.email], html_message=html)
+        send_mail("[Note Kfet] Passage en négatif (club {})".format(self.club.name), plain_text, DEFAULT_FROM_EMAIL,
+                  [self.club.email], html_message=html)
 
 
 class NoteSpecial(Note):
@@ -217,38 +218,6 @@ class NoteSpecial(Note):
         return self.special_type
 
 
-class Trust(models.Model):
-    """
-    A one-sided trust relationship bertween two users
-
-    If another user considers you as your friend, you can transfer money from
-    them
-    """
-
-    trusting = models.ForeignKey(
-        Note,
-        on_delete=models.CASCADE,
-        related_name='trusting',
-        verbose_name=_('trusting')
-    )
-
-    trusted = models.ForeignKey(
-        Note,
-        on_delete=models.CASCADE,
-        related_name='trusted',
-        verbose_name=_('trusted')
-    )
-
-    class Meta:
-        verbose_name = _("friendship")
-        verbose_name_plural = _("friendships")
-        unique_together = ("trusting", "trusted")
-
-    def __str__(self):
-        return _("Friendship between {trusting} and {trusted}").format(
-            trusting=str(self.trusting), trusted=str(self.trusted))
-
-
 class Alias(models.Model):
     """
     points toward  a :model:`note.NoteUser` or :model;`note.NoteClub` instance.

apps/note/models/transactions.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.core.exceptions import ValidationError
@@ -20,7 +20,7 @@ class TemplateCategory(models.Model):
     """
     Defined a recurrent transaction category
 
-    Example: food, softs,…
+    Example: food, softs, ...
     """
     name = models.CharField(
         verbose_name=_("name"),
@@ -40,7 +40,7 @@ class TransactionTemplate(models.Model):
     """
     Defined a recurrent transaction
 
-    associated to selling something (a burger, a beer,…)
+    associated to selling something (a burger, a beer, ...)
     """
     name = models.CharField(
         verbose_name=_('name'),
@@ -333,36 +333,6 @@ class SpecialTransaction(Transaction):
         self.clean()
         super().save(*args, **kwargs)
 
-    @staticmethod
-    def validate_payment_form(form):
-        """
-        Ensure that last name and first name are filled for a form that creates a SpecialTransaction,
-        and check that if the user pays with a check, then the bank field is filled.
-
-        Return True iff there is no error.
-        Whenever there is an error, they are inserted in the form errors.
-        """
-
-        credit_type = form.cleaned_data["credit_type"]
-        last_name = form.cleaned_data["last_name"]
-        first_name = form.cleaned_data["first_name"]
-        bank = form.cleaned_data["bank"]
-
-        error = False
-
-        if not last_name or not first_name or (not bank and credit_type.special_type == "Chèque"):
-            if not last_name:
-                form.add_error('last_name', _("This field is required."))
-                error = True
-            if not first_name:
-                form.add_error('first_name', _("This field is required."))
-                error = True
-            if not bank and credit_type.special_type == "Chèque":
-                form.add_error('bank', _("This field is required."))
-                error = True
-
-        return not error
-
     class Meta:
         verbose_name = _("Special transaction")
         verbose_name_plural = _("Special transactions")

apps/note/signals.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.utils import timezone

apps/note/static/note/js/consos.js

@@ -1,4 +1,4 @@
-// Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+// Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 // When a transaction is performed, lock the interface to prevent spam clicks.
@@ -28,7 +28,7 @@ $(document).ready(function () {
 
   // Switching in double consumptions mode should update the layout
   $('#double_conso').change(function () {
-    document.getElementById('consos_list_div').classList.remove('d-none')
+    $('#consos_list_div').removeClass('d-none')
     $('#infos_div').attr('class', 'col-sm-5 col-xl-6')
 
     const note_list_obj = $('#note_list')
@@ -37,7 +37,7 @@ $(document).ready(function () {
       note_list_obj.html('')
 
       buttons.forEach(function (button) {
-        document.getElementById(`conso_button_${button.id}`).addEventListener('click', () => {
+        $('#conso_button_' + button.id).click(function () {
           if (LOCK) { return }
           removeNote(button, 'conso_button', buttons, 'consos_list')()
         })
@@ -46,7 +46,7 @@ $(document).ready(function () {
   })
 
   $('#single_conso').change(function () {
-    document.getElementById('consos_list_div').classList.add('d-none')
+    $('#consos_list_div').addClass('d-none')
     $('#infos_div').attr('class', 'col-sm-5 col-md-4')
 
     const consos_list_obj = $('#consos_list')
@@ -68,9 +68,9 @@ $(document).ready(function () {
   })
 
   // Ensure we begin in single consumption. Fix issue with TurboLinks and BootstrapJS
-  document.querySelector("label[for='double_conso']").classList.remove('active')
+  $("label[for='double_conso']").removeClass('active')
 
-  document.getElementById("consume_all").addEventListener('click', consumeAll)
+  $('#consume_all').click(consumeAll)
 })
 
 notes = []
@@ -127,10 +127,11 @@ function addConso (dest, amount, type, category_id, category_name, template_id,
       html += li('conso_button_' + button.id, button.name +
                 '<span class="badge badge-dark badge-pill">' + button.quantity + '</span>')
     })
-    document.getElementById(list).innerHTML = html
 
-    buttons.forEach((button) => {
-      document.getElementById(`conso_button_${button.id}`).addEventListener('click', () => {
+    $('#' + list).html(html)
+
+    buttons.forEach(function (button) {
+      $('#conso_button_' + button.id).click(function () {
         if (LOCK) { return }
         removeNote(button, 'conso_button', buttons, list)()
       })
@@ -145,13 +146,12 @@ function reset () {
   notes_display.length = 0
   notes.length = 0
   buttons.length = 0
-  document.getElementById('note_list').innerHTML = ''
-  document.getElementById('consos_list').innerHTML = ''
-  document.getElementById('note').value = ''
-  document.getElementById('note').dataset.originTitle = ''
-  $('#note').tooltip('hide')
-  document.getElementById('profile_pic').src = '/static/member/img/default_picture.png'
-  document.getElementById('profile_pic_link').href = '#'
+  $('#note_list').html('')
+  $('#consos_list').html('')
+  $('#note').val('')
+  $('#note').attr('data-original-title', '').tooltip('hide')
+  $('#profile_pic').attr('src', '/static/member/img/default_picture.png')
+  $('#profile_pic_link').attr('href', '#')
   refreshHistory()
   refreshBalance()
   LOCK = false
@@ -168,7 +168,7 @@ function consumeAll () {
   let error = false
 
   if (notes_display.length === 0) {
-    document.getElementById('note').classList.add('is-invalid')
+    $('#note').addClass('is-invalid')
     $('#note_list').html(li('', '<strong>Ajoutez des émetteurs.</strong>', 'text-danger'))
     error = true
   }

apps/note/static/note/js/transfer.js

@@ -222,13 +222,6 @@ $(document).ready(function () {
   })
 })
 
-// Make transfer when pressing Enter on the amount section
-$('#amount, #reason, #last_name, #first_name, #bank').keypress((event) => {
-  if (event.originalEvent.charCode === 13) {
-    $('#btn_transfer').click()
-  }
-})
-
 $('#btn_transfer').click(function () {
   if (LOCK) { return }
 
@@ -250,7 +243,7 @@ $('#btn_transfer').click(function () {
     error = true
   }
 
-  const amount = Math.round(100 * amount_field.val())
+  const amount = Math.floor(100 * amount_field.val())
   if (amount > 2147483647) {
     amount_field.addClass('is-invalid')
     $('#amount-required').html('<strong>' + gettext('The amount must stay under 21,474,836.47 €.') + '</strong>')
@@ -355,14 +348,14 @@ $('#btn_transfer').click(function () {
               destination_alias: dest.name
             }).done(function () {
             addMsg(interpolate(gettext('Transfer of %s from %s to %s failed: %s'),
-                [pretty_money(source.quantity * dest.quantity * amount), source.name, dest.name, gettext('insufficient funds')]), 'danger', 10000)
+                [pretty_money(source.quantity * dest.quantity * amount), source.name, + dest.name, gettext('insufficient funds')]), 'danger', 10000)
             reset()
           }).fail(function (err) {
             const errObj = JSON.parse(err.responseText)
             let error = errObj.detail ? errObj.detail : errObj.non_field_errors
             if (!error) { error = err.responseText }
             addMsg(interpolate(gettext('Transfer of %s from %s to %s failed: %s'),
-                [pretty_money(source.quantity * dest.quantity * amount), source.name, dest.name, error]), 'danger')
+                [pretty_money(source.quantity * dest.quantity * amount), source.name, + dest.name, error]), 'danger')
             LOCK = false
           })
         })

apps/note/tables.py

@@ -1,16 +1,16 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import html
 
 import django_tables2 as tables
-from django.utils.html import format_html, mark_safe
+from django.utils.html import format_html
 from django_tables2.utils import A
 from django.utils.translation import gettext_lazy as _
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_authenticated_user
 from permission.backends import PermissionBackend
 
-from .models.notes import Alias, Trust
+from .models.notes import Alias
 from .models.transactions import Transaction, TransactionTemplate
 from .templatetags.pretty_money import pretty_money
 
@@ -88,16 +88,16 @@ class HistoryTable(tables.Table):
                 "class": lambda record:
                 str(record.valid).lower()
                 + (' validate' if record.source.is_active and record.destination.is_active and PermissionBackend
-                   .check_perm(get_current_request(), "note.change_transaction_invalidity_reason", record)
+                   .check_perm(get_current_authenticated_user(), "note.change_transaction_invalidity_reason", record)
                    else ''),
                 "data-toggle": "tooltip",
                 "title": lambda record: (_("Click to invalidate") if record.valid else _("Click to validate"))
-                if PermissionBackend.check_perm(get_current_request(),
+                if PermissionBackend.check_perm(get_current_authenticated_user(),
                                                 "note.change_transaction_invalidity_reason", record)
                 and record.source.is_active and record.destination.is_active else None,
                 "onclick": lambda record: 'de_validate(' + str(record.id) + ', ' + str(record.valid).lower()
                                           + ', "' + str(record.__class__.__name__) + '")'
-                if PermissionBackend.check_perm(get_current_request(),
+                if PermissionBackend.check_perm(get_current_authenticated_user(),
                                                 "note.change_transaction_invalidity_reason", record)
                 and record.source.is_active and record.destination.is_active else None,
                 "onmouseover": lambda record: '$("#invalidity_reason_'
@@ -126,7 +126,7 @@ class HistoryTable(tables.Table):
         When the validation status is hovered, an input field is displayed to let the user specify an invalidity reason
         """
         has_perm = PermissionBackend \
-            .check_perm(get_current_request(), "note.change_transaction_invalidity_reason", record)
+            .check_perm(get_current_authenticated_user(), "note.change_transaction_invalidity_reason", record)
 
         val = "✔" if value else "✖"
 
@@ -148,31 +148,6 @@ DELETE_TEMPLATE = """
 """
 
 
-class TrustTable(tables.Table):
-    class Meta:
-        attrs = {
-            'class': 'table table condensed table-striped',
-            'id': "trust_table"
-        }
-        model = Trust
-        fields = ("trusted",)
-        template_name = 'django_tables2/bootstrap4.html'
-
-    show_header = False
-    trusted = tables.Column(attrs={'td': {'class': 'text_center'}})
-
-    delete_col = tables.TemplateColumn(
-        template_code=DELETE_TEMPLATE,
-        extra_context={"delete_trans": _('delete')},
-        attrs={
-            'td': {
-                'class': lambda record: 'col-sm-1'
-                + (' d-none' if not PermissionBackend.check_perm(
-                    get_current_request(), "note.delete_trust", record)
-                   else '')}},
-        verbose_name=_("Delete"),)
-
-
 class AliasTable(tables.Table):
     class Meta:
         attrs = {
@@ -190,7 +165,7 @@ class AliasTable(tables.Table):
                                        extra_context={"delete_trans": _('delete')},
                                        attrs={'td': {'class': lambda record: 'col-sm-1' + (
                                            ' d-none' if not PermissionBackend.check_perm(
-                                               get_current_request(), "note.delete_alias",
+                                               get_current_authenticated_user(), "note.delete_alias",
                                                record) else '')}}, verbose_name=_("Delete"), )
 
 
@@ -222,17 +197,6 @@ class ButtonTable(tables.Table):
         verbose_name=_("Edit"),
     )
 
-    hideshow = tables.Column(
-        verbose_name=_("Hide/Show"),
-        accessor="pk",
-        attrs={
-            'td': {
-                'class': 'col-sm-1',
-                'id': lambda record: "hideshow_" + str(record.pk),
-            }
-        },
-    )
-
     delete_col = tables.TemplateColumn(template_code=DELETE_TEMPLATE,
                                        extra_context={"delete_trans": _('delete')},
                                        attrs={'td': {'class': 'col-sm-1'}},
@@ -240,16 +204,3 @@ class ButtonTable(tables.Table):
 
     def render_amount(self, value):
         return pretty_money(value)
-
-    def order_category(self, queryset, is_descending):
-        return queryset.order_by(f"{'-' if is_descending else ''}category__name"), True
-
-    def render_hideshow(self, record):
-        val = '<button id="'
-        val += str(record.pk)
-        val += '" class="btn btn-secondary btn-sm" \
-            onclick="hideshow(' + str(record.id) + ',' + \
-            str(record.display).lower() + ')">'
-        val += str(_("Hide/Show"))
-        val += '</button>'
-        return mark_safe(val)

apps/note/templates/note/conso_form.html

@@ -40,7 +40,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
                         {# User search with autocompletion #}
                         <div class="card-footer">
                             <input class="form-control mx-auto d-block"
-                                placeholder="{% trans "Name or alias…" %}" type="text" id="note" autofocus />
+                                placeholder="{% trans "Name or alias..." %}" type="text" id="note" autofocus />
                         </div>
                     </div>
                 </div>

apps/note/templates/note/mails/negative_balance.html

@@ -22,7 +22,7 @@
 </p>
 
 <p>
-    Par ailleurs, le BDE ne sert pas d'alcool aux adhérent⋅es dont le solde
+    Par ailleurs, le BDE ne sert pas d'alcool aux adhérents dont le solde
     est inférieur à 0 € depuis plus de 24h.
 </p>
 

apps/note/templates/note/mails/negative_balance.txt

@@ -9,7 +9,7 @@ Ce mail t'a été envoyé parce que le solde de ta Note Kfet
 
 Ton solde actuel est de {{ note.balance|pretty_money }}.
 
-Par ailleurs, le BDE ne sert pas d'alcool aux adhérent⋅es dont le solde
+Par ailleurs, le BDE ne sert pas d'alcool aux adhérents dont le solde
 est inférieur à 0 € depuis plus de 24h.
 
 Si tu ne comprends pas ton solde, tu peux consulter ton historique

apps/note/templates/note/transaction_form.html

@@ -10,25 +10,21 @@ SPDX-License-Identifier: GPL-2.0-or-later
 {# bandeau transfert/crédit/débit/activité #}
     <div class="row">
         <div class="col-xl-12">
-            <div class="btn-group btn-block">
-                <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons">
-                    <label for="type_transfer" class="btn btn-sm btn-outline-primary active">
-                        <input type="radio" name="transaction_type" id="type_transfer">
-                        {% trans "Transfer" %}
+            <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons">
+                <label for="type_transfer" class="btn btn-sm btn-outline-primary active">
+                    <input type="radio" name="transaction_type" id="type_transfer">
+                    {% trans "Transfer" %}
+                </label>
+                {% if "note.notespecial"|not_empty_model_list %}
+                    <label for="type_credit" class="btn btn-sm btn-outline-primary">
+                        <input type="radio" name="transaction_type" id="type_credit">
+                        {% trans "Credit" %}
                     </label>
-                    {% if "note.notespecial"|not_empty_model_list %}
-                        <label for="type_credit" class="btn btn-sm btn-outline-primary">
-                            <input type="radio" name="transaction_type" id="type_credit">
-                            {% trans "Credit" %}
-                        </label>
-                        <label for="type_debit" class="btn btn-sm btn-outline-primary">
-                            <input type="radio" name="transaction_type" id="type_debit">
-                            {% trans "Debit" %}
-                        </label>
-                    {% endif %}
-                </div>
-
-                {# Add shortcuts for opened activites if necessary #}
+                    <label for="type_debit" class="btn btn-sm btn-outline-primary">
+                        <input type="radio" name="transaction_type" id="type_debit">
+                        {% trans "Debit" %}
+                    </label>
+                {% endif %}
                 {% for activity in activities_open %}
                     <a href="{% url "activity:activity_entry" pk=activity.pk %}" class="btn btn-sm btn-outline-primary">
                         {% trans "Entries" %} {{ activity.name }}
@@ -61,12 +57,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
                 <ul class="list-group list-group-flush" id="source_note_list">
                 </ul>
                 <div class="card-body">
-                    <select id="credit_type" class="form-control custom-select d-none">
+                    <select id="credit_type" class="custom-select d-none">
                         {% for special_type in special_types %}
                             <option value="{{ special_type.id }}">{{ special_type.special_type }}</option>
                         {% endfor %}
                     </select>
-                    <input class="form-control mx-auto" type="text" id="source_note" placeholder="{% trans "Name or alias…" %}" />
+                    <input class="form-control mx-auto" type="text" id="source_note" placeholder="{% trans "Name or alias..." %}" />
                     <div id="source_me_div">
                         <hr>
                         <a class="btn-block btn btn-secondary" href="#" id="source_me" data-turbolinks="false">
@@ -88,19 +84,19 @@ SPDX-License-Identifier: GPL-2.0-or-later
                 <ul class="list-group list-group-flush" id="dest_note_list">
                 </ul>
                 <div class="card-body">
-                    <select id="debit_type" class="form-control custom-select d-none">
+                    <select id="debit_type" class="custom-select d-none">
                         {% for special_type in special_types %}
                             <option value="{{ special_type.id }}">{{ special_type.special_type }}</option>
                         {% endfor %}
                     </select>
-                    <input class="form-control mx-auto" type="text" id="dest_note" placeholder="{% trans "Name or alias…" %}" />
+                    <input class="form-control mx-auto" type="text" id="dest_note" placeholder="{% trans "Name or alias..." %}" />
                     <ul class="list-group list-group-flush" id="dest_alias_matched">
                     </ul>
                 </div>
             </div>
         </div>
 
-        {# Information on transaction (amount, reason, name,…) #}
+        {# Information on transaction (amount, reason, name,...) #}
         <div class="col-md" id="external_div">
             <div class="card bg-light mb-4">
                 <div class="card-header">

apps/note/templates/note/transactiontemplate_list.html

@@ -10,7 +10,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
 <div class="row justify-content-center mb-4">
     <div class="col-md-10 text-center">
         {# Search field , see js #}
-        <input class="form-control mx-auto w-25" type="text" id="search_field" placeholder="{% trans "Name of the button…" %}" value="{{ request.GET.search }}">
+        <input class="form-control mx-auto w-25" type="text" id="search_field" placeholder="{% trans "Name of the button..." %}" value="{{ request.GET.search }}">
         <hr>
         <a class="btn btn-primary text-center my-1" href="{% url 'note:template_create' %}" data-turbolinks="false">{% trans "New button" %}</a>
     </div>
@@ -19,7 +19,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
     <div class="col-md-12">
         <div class="card card-border shadow">
             <div class="card-header text-center">
-                <h5>{% trans "buttons listing"%}</h5>
+                <h5> {% trans "buttons listing "%}</h5>
             </div>
             <div class="card-body px-0 py-0" id="buttons_table">
                 {% render_table table %}
@@ -31,29 +31,29 @@ SPDX-License-Identifier: GPL-3.0-or-later
 
 {% block extrajavascript %}
 <script type="text/javascript">
-    function refreshMatchedWords() {
-        $("tr").each(function() {
-            let pattern = $('#search_field').val();
-            if (pattern) {
-                $(this).find("td:eq(0), td:eq(1), td:eq(3), td:eq(6)").each(function () {
-                    $(this).html($(this).text().replace(new RegExp(pattern, 'i'), "<mark>$&</mark>"));
-                });
-            }
-        });
-    }
-
-    function reloadTable() {
-        let pattern = $('#search_field').val();
-        $("#buttons_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + " #buttons_table", refreshMatchedWords);
-    }
-
     $(document).ready(function() {
         let searchbar_obj = $("#search_field");
         let timer_on = false;
         let timer;
 
+        function refreshMatchedWords() {
+            $("tr").each(function() {
+                let pattern = searchbar_obj.val();
+                if (pattern) {
+                    $(this).find("td:eq(0), td:eq(1), td:eq(3), td:eq(6)").each(function () {
+                        $(this).html($(this).text().replace(new RegExp(pattern, 'i'), "<mark>$&</mark>"));
+                    });
+                }
+            });
+        }
+
         refreshMatchedWords();
 
+        function reloadTable() {
+            let pattern = searchbar_obj.val();
+            $("#buttons_table").load(location.pathname + "?search=" + pattern.replace(" ", "%20") + " #buttons_table", refreshMatchedWords);
+        }
+
         searchbar_obj.keyup(function() {
             if (timer_on)
                 clearTimeout(timer);
@@ -70,35 +70,12 @@ SPDX-License-Identifier: GPL-3.0-or-later
              headers: {"X-CSRFTOKEN": CSRF_TOKEN}
          })
           .done(function() {
-              addMsg('{% trans "button successfully deleted"%}','success');
+              addMsg('{% trans "button successfully deleted "%}','success');
             $("#buttons_table").load(location.pathname + "?search=" + $("#search_field").val().replace(" ", "%20") + " #buttons_table");
           })
           .fail(function() {
-              addMsg('{% trans "Unable to delete button"%} #' + button_id, 'danger')
+              addMsg('{% trans "Unable to delete button "%} #' + button_id, 'danger')
           });
      }
-
-    // on click of button "hide/show", call the API
-    function hideshow(id, displayed) {
-            $.ajax({
-                url: '/api/note/transaction/template/' + id + '/',
-                type: 'PATCH',
-                dataType: 'json',
-                headers: {
-                    'X-CSRFTOKEN': CSRF_TOKEN
-                },
-                data: {
-                    display: !displayed
-                },
-                success: function() {
-                    if(displayed)
-                        addMsg("{% trans "Button hidden"%}", 'success', 1000)
-                    else addMsg("{% trans "Button displayed"%}", 'success', 1000)
-                    reloadTable()
-                },
-                error: function (err) {
-                    addMsg("{% trans "An error occured"%}", 'danger')
-                }})
-        }
 </script>
 {% endblock %}

apps/note/templatetags/getenv.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django import template

apps/note/templatetags/pretty_money.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django import template

apps/note/tests/test_transactions.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from api.tests import TestAPI

apps/note/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.urls import path

apps/note/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import json
@@ -38,7 +38,7 @@ class TransactionCreateView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTabl
     def get_queryset(self, **kwargs):
         # retrieves only Transaction that user has the right to see.
         return Transaction.objects.filter(
-            PermissionBackend.filter_queryset(self.request, Transaction, "view")
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view")
         ).order_by("-created_at").all()[:20]
 
     def get_context_data(self, **kwargs):
@@ -47,16 +47,16 @@ class TransactionCreateView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTabl
         context['polymorphic_ctype'] = ContentType.objects.get_for_model(Transaction).pk
         context['special_polymorphic_ctype'] = ContentType.objects.get_for_model(SpecialTransaction).pk
         context['special_types'] = NoteSpecial.objects\
-            .filter(PermissionBackend.filter_queryset(self.request, NoteSpecial, "view"))\
+            .filter(PermissionBackend.filter_queryset(self.request.user, NoteSpecial, "view"))\
             .order_by("special_type").all()
 
         # Add a shortcut for entry page for open activities
         if "activity" in settings.INSTALLED_APPS:
             from activity.models import Activity
-            activities_open = Activity.objects.filter(open=True, activity_type__manage_entries=True).filter(
-                PermissionBackend.filter_queryset(self.request, Activity, "view")).distinct().all()
+            activities_open = Activity.objects.filter(open=True).filter(
+                PermissionBackend.filter_queryset(self.request.user, Activity, "view")).distinct().all()
             context["activities_open"] = [a for a in activities_open
-                                          if PermissionBackend.check_perm(self.request,
+                                          if PermissionBackend.check_perm(self.request.user,
                                                                           "activity.add_entry",
                                                                           Entry(activity=a,
                                                                                 note=self.request.user.note, ))]
@@ -90,9 +90,9 @@ class TransactionTemplateListView(ProtectQuerysetMixin, LoginRequiredMixin, Sing
         if "search" in self.request.GET:
             pattern = self.request.GET["search"]
             qs = qs.filter(
-                Q(name__iregex=pattern)
-                | Q(destination__club__name__iregex=pattern)
-                | Q(category__name__iregex=pattern)
+                Q(name__iregex="^" + pattern)
+                | Q(destination__club__name__iregex="^" + pattern)
+                | Q(category__name__iregex="^" + pattern)
                 | Q(description__iregex=pattern)
             )
 
@@ -159,7 +159,7 @@ class ConsoView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
             return self.handle_no_permission()
 
         templates = TransactionTemplate.objects.filter(
-            PermissionBackend().filter_queryset(self.request, TransactionTemplate, "view")
+            PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
         )
         if not templates.exists():
             raise PermissionDenied(_("You can't see any button."))
@@ -170,7 +170,7 @@ class ConsoView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
         restrict to the transaction history the user can see.
         """
         return Transaction.objects.filter(
-            PermissionBackend.filter_queryset(self.request, Transaction, "view")
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view")
         ).order_by("-created_at").all()[:20]
 
     def get_context_data(self, **kwargs):
@@ -180,13 +180,13 @@ class ConsoView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
         # for each category, find which transaction templates the user can see.
         for category in categories:
             category.templates_filtered = category.templates.filter(
-                PermissionBackend().filter_queryset(self.request, TransactionTemplate, "view")
+                PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
             ).filter(display=True).order_by('name').all()
 
         context['categories'] = [cat for cat in categories if cat.templates_filtered]
         # some transactiontemplate are put forward to find them easily
         context['highlighted'] = TransactionTemplate.objects.filter(highlighted=True).filter(
-            PermissionBackend().filter_queryset(self.request, TransactionTemplate, "view")
+            PermissionBackend().filter_queryset(self.request.user, TransactionTemplate, "view")
         ).order_by('name').all()
         context['polymorphic_ctype'] = ContentType.objects.get_for_model(RecurrentTransaction).pk
 
@@ -209,7 +209,7 @@ class TransactionSearchView(ProtectQuerysetMixin, LoginRequiredMixin, DetailView
         data = form.cleaned_data if form.is_valid() else {}
 
         transactions = Transaction.objects.annotate(total_amount=F("quantity") * F("amount")).filter(
-            PermissionBackend.filter_queryset(self.request, Transaction, "view"))\
+            PermissionBackend.filter_queryset(self.request.user, Transaction, "view"))\
             .filter(Q(source=self.object) | Q(destination=self.object)).order_by('-created_at')
 
         if "source" in data and data["source"]:

apps/permission/__init__.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 default_app_config = 'permission.apps.PermissionConfig'

apps/permission/admin.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-lateré
 
 from django.contrib import admin

apps/permission/api/serializers.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from rest_framework import serializers

apps/permission/api/urls.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from .views import PermissionViewSet, RoleViewSet

apps/permission/api/views.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from api.viewsets import ReadOnlyProtectedModelViewSet

apps/permission/apps.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from django.apps import AppConfig

apps/permission/backends.py

@@ -1,15 +1,15 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 from datetime import date
 
 from django.contrib.auth.backends import ModelBackend
-from django.contrib.auth.models import User
+from django.contrib.auth.models import User, AnonymousUser
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Q, F
 from django.utils import timezone
 from note.models import Note, NoteUser, NoteClub, NoteSpecial
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_session
 from member.models import Membership, Club
 
 from .decorators import memoize
@@ -26,31 +26,14 @@ class PermissionBackend(ModelBackend):
 
     @staticmethod
     @memoize
-    def get_raw_permissions(request, t):
+    def get_raw_permissions(user, t):
         """
         Query permissions of a certain type for a user, then memoize it.
-        :param request: The current request
+        :param user: The owner of the permissions
         :param t: The type of the permissions: view, change, add or delete
         :return: The queryset of the permissions of the user (memoized) grouped by clubs
         """
-        if hasattr(request, 'auth') and request.auth is not None and hasattr(request.auth, 'scope'):
-            # OAuth2 Authentication
-            user = request.auth.user
-
-            def permission_filter(membership_obj):
-                query = Q(pk=-1)
-                for scope in request.auth.scope.split(' '):
-                    permission_id, club_id = scope.split('_')
-                    if int(club_id) == membership_obj.club_id:
-                        query |= Q(pk=permission_id)
-                return query
-        else:
-            user = request.user
-
-            def permission_filter(membership_obj):
-                return Q(mask__rank__lte=request.session.get("permission_mask", 42))
-
-        if user.is_anonymous:
+        if isinstance(user, AnonymousUser):
             # Unauthenticated users have no permissions
             return Permission.objects.none()
 
@@ -60,7 +43,7 @@ class PermissionBackend(ModelBackend):
 
         for membership in memberships:
             for role in membership.roles.all():
-                for perm in role.permissions.filter(permission_filter(membership), type=t).all():
+                for perm in role.permissions.filter(type=t, mask__rank__lte=get_current_session().get("permission_mask", -1)).all():
                     if not perm.permanent:
                         if membership.date_start > date.today() or membership.date_end < date.today():
                             continue
@@ -69,22 +52,16 @@ class PermissionBackend(ModelBackend):
         return perms
 
     @staticmethod
-    def permissions(request, model, type):
+    def permissions(user, model, type):
         """
         List all permissions of the given user that applies to a given model and a give type
-        :param request: The current request
+        :param user: The owner of the permissions
         :param model: The model that the permissions shoud apply
         :param type: The type of the permissions: view, change, add or delete
         :return: A generator of the requested permissions
         """
 
-        if hasattr(request, 'auth') and request.auth is not None and hasattr(request.auth, 'scope'):
-            # OAuth2 Authentication
-            user = request.auth.user
-        else:
-            user = request.user
-
-        for permission in PermissionBackend.get_raw_permissions(request, type):
+        for permission in PermissionBackend.get_raw_permissions(user, type):
             if not isinstance(model.model_class()(), permission.model.model_class()) or not permission.membership:
                 continue
 
@@ -111,26 +88,20 @@ class PermissionBackend(ModelBackend):
 
     @staticmethod
     @memoize
-    def filter_queryset(request, model, t, field=None):
+    def filter_queryset(user, model, t, field=None):
         """
         Filter a queryset by considering the permissions of a given user.
-        :param request: The current request
+        :param user: The owner of the permissions that are fetched
         :param model: The concerned model of the queryset
         :param t: The type of modification (view, add, change, delete)
         :param field: The field of the model to test, if concerned
         :return: A query that corresponds to the filter to give to a queryset
         """
-        if hasattr(request, 'auth') and request.auth is not None and hasattr(request.auth, 'scope'):
-            # OAuth2 Authentication
-            user = request.auth.user
-        else:
-            user = request.user
-
-        if user is None or user.is_anonymous:
+        if user is None or isinstance(user, AnonymousUser):
             # Anonymous users can't do anything
             return Q(pk=-1)
 
-        if user.is_superuser and request.session.get("permission_mask", -1) >= 42:
+        if user.is_superuser and get_current_session().get("permission_mask", -1) >= 42:
             # Superusers have all rights
             return Q()
 
@@ -139,7 +110,7 @@ class PermissionBackend(ModelBackend):
 
         # Never satisfied
         query = Q(pk=-1)
-        perms = PermissionBackend.permissions(request, model, t)
+        perms = PermissionBackend.permissions(user, model, t)
         for perm in perms:
             if perm.field and field != perm.field:
                 continue
@@ -151,7 +122,7 @@ class PermissionBackend(ModelBackend):
 
     @staticmethod
     @memoize
-    def check_perm(request, perm, obj=None):
+    def check_perm(user_obj, perm, obj=None):
         """
         Check is the given user has the permission over a given object.
         The result is then memoized.
@@ -159,18 +130,11 @@ class PermissionBackend(ModelBackend):
         primary key, the result is not memoized. Moreover, the right could change
         (e.g. for a transaction, the balance of the user could change)
         """
-        # Requested by a shell
-        if request is None:
+        if user_obj is None or isinstance(user_obj, AnonymousUser):
             return False
 
-        user_obj = request.user
-        sess = request.session
-
-        if hasattr(request, 'auth') and request.auth is not None and hasattr(request.auth, 'scope'):
-            # OAuth2 Authentication
-            user_obj = request.auth.user
-
-        if user_obj is None or user_obj.is_anonymous:
+        sess = get_current_session()
+        if sess is not None and sess.session_key is None:
             return False
 
         if user_obj.is_superuser and sess.get("permission_mask", -1) >= 42:
@@ -185,19 +149,16 @@ class PermissionBackend(ModelBackend):
 
         ct = ContentType.objects.get_for_model(obj)
         if any(permission.applies(obj, perm_type, perm_field)
-               for permission in PermissionBackend.permissions(request, ct, perm_type)):
+               for permission in PermissionBackend.permissions(user_obj, ct, perm_type)):
             return True
         return False
 
     def has_perm(self, user_obj, perm, obj=None):
-        # Warning: this does not check that user_obj has the permission,
-        # but if the current request has the permission.
-        # This function is implemented for backward compatibility, and should not be used.
-        return PermissionBackend.check_perm(get_current_request(), perm, obj)
+        return PermissionBackend.check_perm(user_obj, perm, obj)
 
     def has_module_perms(self, user_obj, app_label):
         return False
 
     def get_all_permissions(self, user_obj, obj=None):
         ct = ContentType.objects.get_for_model(obj)
-        return list(self.permissions(get_current_request(), ct, "view"))
+        return list(self.permissions(user_obj, ct, "view"))

apps/permission/decorators.py

@@ -1,11 +1,11 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 import sys
 from functools import lru_cache
 from time import time
 
 from django.contrib.sessions.models import Session
-from note_kfet.middlewares import get_current_request
+from note_kfet.middlewares import get_current_session
 
 
 def memoize(f):
@@ -48,11 +48,11 @@ def memoize(f):
             last_collect = time()
 
         # If there is no session, then we don't memoize anything.
-        request = get_current_request()
-        if request is None or request.session is None or request.session.session_key is None:
+        sess = get_current_session()
+        if sess is None or sess.session_key is None:
             return f(*args, **kwargs)
 
-        sess_key = request.session.session_key
+        sess_key = sess.session_key
         if sess_key not in sess_funs:
             # lru_cache makes the job of memoization
             # We store only the 512 latest data per session. It has to be enough.

apps/permission/fixtures/initial.json

@@ -36,7 +36,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": true,
-			"description": "Voir son compte utilisateur⋅rice"
+			"description": "Voir son compte utilisateur"
 		}
 	},
 	{
@@ -68,7 +68,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": true,
-			"description": "Voir sa propre note d'utilisateur⋅rice"
+			"description": "Voir sa propre note d'utilisateur"
 		}
 	},
 	{
@@ -111,12 +111,12 @@
 				"note",
 				"alias"
 			],
-			"query": "[\"AND\", [\"OR\", {\"note__noteuser__user__memberships__club__name\": \"BDE\", \"note__noteuser__user__memberships__date_start__lte\": [\"today\"], \"note__noteuser__user__memberships__date_end__gte\": [\"today\"]}, {\"note__noteclub__isnull\": false}], {\"note__is_active\": true}]",
+			"query": "[\"AND\", [\"OR\", {\"note__noteuser__user__memberships__club__name\": \"Kfet\", \"note__noteuser__user__memberships__date_start__lte\": [\"today\"], \"note__noteuser__user__memberships__date_end__gte\": [\"today\"]}, {\"note__noteclub__isnull\": false}], {\"note__is_active\": true}]",
 			"type": "view",
 			"mask": 1,
 			"field": "",
 			"permanent": false,
-			"description": "Voir les alias des notes des clubs et des adhérent⋅es du club BDE"
+			"description": "Voir les aliases des notes des clubs et des adhérents du club Kfet"
 		}
 	},
 	{
@@ -627,7 +627,7 @@
 			"type": "view",
 			"mask": 1,
 			"field": "",
-			"permanent": true,
+			"permanent": false,
 			"description": "Voir les personnes qu'on a invitées"
 		}
 	},
@@ -772,7 +772,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Voir les adhérent⋅es du club"
+			"description": "Voir les adhérents du club"
 		}
 	},
 	{
@@ -788,7 +788,7 @@
 			"mask": 2,
 			"field": "",
 			"permanent": false,
-			"description": "Ajouter un⋅e membre à un club"
+			"description": "Ajouter un membre à un club"
 		}
 	},
 	{
@@ -852,7 +852,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Modifier n'importe quel⋅le utilisateur⋅rice"
+			"description": "Modifier n'importe quel utilisateur"
 		}
 	},
 	{
@@ -868,7 +868,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": false,
-			"description": "Ajouter un⋅e utilisateur⋅rice"
+			"description": "Ajouter un utilisateur"
 		}
 	},
 	{
@@ -977,7 +977,7 @@
 			],
 			"query": "[\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}]",
 			"type": "view",
-			"mask": 2,
+			"mask": 1,
 			"field": "",
 			"permanent": false,
 			"description": "Voir les transactions d'un club"
@@ -1235,7 +1235,7 @@
 			"type": "view",
 			"mask": 1,
 			"field": "",
-			"permanent": true,
+			"permanent": false,
 			"description": "Voir le dernier WEI"
 		}
 	},
@@ -1267,7 +1267,7 @@
 			"type": "add",
 			"mask": 1,
 			"field": "",
-			"permanent": true,
+			"permanent": false,
 			"description": "M'inscrire au dernier WEI"
 		}
 	},
@@ -1284,7 +1284,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": false,
-			"description": "Inscrire un⋅e 1A au WEI"
+			"description": "Inscrire un 1A au WEI"
 		}
 	},
 	{
@@ -1331,7 +1331,7 @@
 			"type": "view",
 			"mask": 1,
 			"field": "",
-			"permanent": true,
+			"permanent": false,
 			"description": "Voir ma propre inscription WEI"
 		}
 	},
@@ -1379,7 +1379,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "soge_credit",
-			"permanent": true,
+			"permanent": false,
 			"description": "Indiquer si mon inscription WEI est payée par la Société générale tant qu'elle n'est pas validée"
 		}
 	},
@@ -1427,7 +1427,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "birth_date",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier la date de naissance de ma propre inscription WEI"
 		}
 	},
@@ -1459,7 +1459,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "gender",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier le genre de ma propre inscription WEI"
 		}
 	},
@@ -1491,7 +1491,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "health_issues",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier mes problèmes de santé de mon inscription WEI"
 		}
 	},
@@ -1523,7 +1523,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "emergency_contact_name",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier le nom du contact en cas d'urgence de mon inscription WEI"
 		}
 	},
@@ -1555,7 +1555,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "emergency_contact_phone",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier le téléphone du contact en cas d'urgence de mon inscription WEI"
 		}
 	},
@@ -1572,7 +1572,7 @@
 			"mask": 1,
 			"field": "information_json",
 			"permanent": false,
-			"description": "Modifier les informations (sondage 1A,…) d'une inscription WEI"
+			"description": "Modifier les informations (sondage 1A, ...) d'une inscription WEI"
 		}
 	},
 	{
@@ -1699,7 +1699,7 @@
 			"type": "add",
 			"mask": 3,
 			"field": "",
-			"permanent": true,
+			"permanent": false,
 			"description": "Créer une adhésion WEI pour le dernier WEI"
 		}
 	},
@@ -1956,7 +1956,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": true,
-			"description": "Voir mes activités passées, même après la fin de l'adhésion BDE"
+			"description": "Voir mes activitées passées, même après la fin de l'adhésion BDE"
 		}
 	},
 	{
@@ -2003,7 +2003,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "clothing_cut",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier ma coupe de vêtements de mon inscription WEI"
 		}
 	},
@@ -2035,7 +2035,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "clothing_size",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier la taille de vêtements de mon inscription WEI"
 		}
 	},
@@ -2100,7 +2100,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Voir n'importe quel⋅le utilisateur⋅rice"
+			"description": "Voir n'importe quel utilisateur"
 		}
 	},
 	{
@@ -2228,7 +2228,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": false,
-			"description": "Créer une note d'utilisateur⋅rice"
+			"description": "Créer une note d'utilisateur"
 		}
 	},
 	{
@@ -2243,7 +2243,7 @@
 			"type": "change",
 			"mask": 1,
 			"field": "information_json",
-			"permanent": true,
+			"permanent": false,
 			"description": "Modifier mes préférences en terme de bus et d'équipe si mon inscription n'est pas validée et que je suis en 2A+"
 		}
 	},
@@ -2276,7 +2276,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Voir toustes les adhérent⋅es du club"
+			"description": "Voir tous les adhérents du club"
 		}
 	},
 	{
@@ -2292,7 +2292,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Ajouter un⋅e membre à n'importe quel club"
+			"description": "Ajouter un membre à n'importe quel club"
 		}
 	},
 	{
@@ -2372,7 +2372,7 @@
 			"mask": 1,
 			"field": "name",
 			"permanent": false,
-			"description": "Modifier le nom d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier le nom d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2388,7 +2388,7 @@
 			"mask": 1,
 			"field": "description",
 			"permanent": false,
-			"description": "Modifier la description d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier la description d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2404,7 +2404,7 @@
 			"mask": 1,
 			"field": "location",
 			"permanent": false,
-			"description": "Modifier le lieu d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier le lieu d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2420,7 +2420,7 @@
 			"mask": 1,
 			"field": "activity_type",
 			"permanent": false,
-			"description": "Modifier le type d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier le type d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2436,7 +2436,7 @@
 			"mask": 1,
 			"field": "organizer",
 			"permanent": false,
-			"description": "Modifier l'organisateur d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier l'organisateur d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2452,7 +2452,7 @@
 			"mask": 1,
 			"field": "attendees_club",
 			"permanent": false,
-			"description": "Modifier le club attendu d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier le club attendu d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2468,7 +2468,7 @@
 			"mask": 1,
 			"field": "date_start",
 			"permanent": false,
-			"description": "Modifier la date de début d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier la date de début d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2484,7 +2484,7 @@
 			"mask": 1,
 			"field": "date_end",
 			"permanent": false,
-			"description": "Modifier la date de fin d'une activité non validée dont on est l'auteur⋅rice"
+			"description": "Modifier la date de fin d'une activité non validée dont on est l'auteur"
 		}
 	},
 	{
@@ -2511,7 +2511,7 @@
 				"note",
 				"noteuser"
 			],
-			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"is_active\": true}]]",
+			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"inactivity_reason\": null}]]",
 			"type": "change",
 			"mask": 1,
 			"field": "is_active",
@@ -2527,7 +2527,7 @@
 				"note",
 				"noteuser"
 			],
-			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"is_active\": true}]]",
+			"query": "[\"AND\", {\"user\": [\"user\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"inactivity_reason\": null}]]",
 			"type": "change",
 			"mask": 1,
 			"field": "inactivity_reason",
@@ -2756,7 +2756,7 @@
 			"mask": 1,
 			"field": "",
 			"permanent": false,
-			"description": "Modifier n'importe quel⋅le utilisateur⋅rice non encore inscrit⋅e"
+			"description": "Modifier n'importe quel utilisateur non encore inscrit"
 		}
 	},
 	{
@@ -2788,7 +2788,7 @@
 			"mask": 3,
 			"field": "",
 			"permanent": false,
-			"description": "Voir tous les alias, y compris ceux des non adhérent⋅es"
+			"description": "Voir tous les alias, y compris ceux des non adhérents"
 		}
 	},
 	{
@@ -2820,7 +2820,7 @@
 			"mask": 2,
 			"field": "",
 			"permanent": false,
-			"description": "Voir n'importe quel⋅le utilisateur⋅rice non encore inscrit⋅e"
+			"description": "Voir n'importe quel utilisateur non encore inscrit"
 		}
 	},
 	{
@@ -2847,12 +2847,12 @@
 				"auth",
 				"user"
 			],
-			"query": "{\"memberships__club__name\": \"BDE\", \"memberships__roles__name\": \"Adhérent⋅e BDE\", \"memberships__date_start__lte\": [\"today\"], \"memberships__date_end__gte\": [\"today\"]}",
+			"query": "{\"memberships__club__name\": \"BDE\", \"memberships__roles__name\": \"Adhérent BDE\", \"memberships__date_start__lte\": [\"today\"], \"memberships__date_end__gte\": [\"today\"]}",
 			"type": "view",
 			"mask": 2,
 			"field": "",
 			"permanent": false,
-			"description": "Voir n'importe quel⋅le utilisateur⋅rice qui est adhérent⋅e BDE"
+			"description": "Voir n'importe quel utilisateur qui est adhérent BDE"
 		}
 	},
 	{
@@ -2871,227 +2871,18 @@
 			"description": "Changer l'image de n'importe quelle note"
 		}
 	},
-	{
-		"model": "permission.permission",
-		"pk": 184,
-		"fields": {
-			"model": [
-				"note",
-				"noteclub"
-			],
-			"query": "[\"AND\", {\"club\": [\"club\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"is_active\": true}]]",
-			"type": "change",
-			"mask": 3,
-			"field": "is_active",
-			"permanent": true,
-			"description": "(Dé)bloquer la note de son club manuellement"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 185,
-		"fields": {
-			"model": [
-				"note",
-				"noteclub"
-			],
-			"query": "[\"AND\", {\"club\": [\"club\"]}, [\"OR\", {\"inactivity_reason\": \"manual\"}, {\"is_active\": true}]]",
-			"type": "change",
-			"mask": 3,
-			"field": "inactivity_reason",
-			"permanent": true,
-			"description": "(Dé)bloquer la note de son club et indiquer que cela a été fait manuellement"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 186,
-		"fields": {
-			"model": [
-				"oauth2_provider",
-				"application"
-			],
-			"query": "{\"user\": [\"user\"]}",
-			"type": "view",
-			"mask": 1,
-			"field": "",
-			"permanent": true,
-			"description": "Voir ses applications OAuth2"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 187,
-		"fields": {
-			"model": [
-				"oauth2_provider",
-				"application"
-			],
-			"query": "{\"user\": [\"user\"]}",
-			"type": "add",
-			"mask": 1,
-			"field": "",
-			"permanent": true,
-			"description": "Créer une application OAuth2"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 188,
-		"fields": {
-			"model": [
-				"oauth2_provider",
-				"application"
-			],
-			"query": "{\"user\": [\"user\"]}",
-			"type": "change",
-			"mask": 1,
-			"field": "",
-			"permanent": true,
-			"description": "Modifier une application OAuth2"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 189,
-		"fields": {
-			"model": [
-				"oauth2_provider",
-				"application"
-			],
-			"query": "{\"user\": [\"user\"]}",
-			"type": "delete",
-			"mask": 1,
-			"field": "",
-			"permanent": true,
-			"description": "Supprimer une application OAuth2"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 190,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{\"trusting\": [\"user\", \"note\"]}",
-			"type": "delete",
-			"mask": 1,
-			"field": "",
-			"permanent": false,
-			"description": "Supprimer une amitié à sa note"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 191,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{\"trusting\": [\"user\", \"note\"]}",
-			"type": "add",
-			"mask": 1,
-			"field": "",
-			"permanent": false,
-			"description": "Ajouter une amitié à sa note"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 192,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{\"trusting__is_active\": true}",
-			"type": "add",
-			"mask": 1,
-			"field": "",
-			"permanent": false,
-			"description": "Ajouter une amitié à une note non bloquée"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 193,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{\"trusting__is_active\": true}",
-			"type": "delete",
-			"mask": 3,
-			"field": "",
-			"permanent": false,
-			"description": "Supprimer une amitié à une note non bloquée"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 194,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{}",
-			"type": "view",
-			"mask": 3,
-			"field": "",
-			"permanent": false,
-			"description": "Voir toutes les amitiés, y compris celles des non adhérent⋅es"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 195,
-		"fields": {
-			"model": [
-				"note",
-				"trust"
-			],
-			"query": "{\"trusting__noteuser__user\": [\"user\"]}",
-			"type": "view",
-			"mask": 1,
-			"field": "",
-			"permanent": true,
-			"description": "Voir ses propres amitiés, pour toujours"
-		}
-	},
-	{
-		"model": "permission.permission",
-		"pk": 196,
-		"fields": {
-			"model": [
-				"note",
-				"transaction"
-			],
-			"query": "[\"AND\", {\"source__trusting__trusted\": [\"user\", \"note\"]}, [\"OR\", {\"source__balance__gte\": {\"F\": [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]]}}, {\"valid\": false}]]",
-			"type": "add",
-			"mask": 1,
-			"field": "",
-			"permanent": false,
-			"description": "Transférer de l'argent depuis une note amie en restant positif"
-		}
-	},
 	{
 		"model": "permission.role",
 		"pk": 1,
 		"fields": {
 			"for_club": 1,
-			"name": "Adh\u00e9rent\u22c5e BDE",
+			"name": "Adh\u00e9rent BDE",
 			"permissions": [
 				1,
 				2,
 				3,
 				4,
 				5,
-				6,
 				7,
 				8,
 				9,
@@ -3099,25 +2890,13 @@
 				11,
 				12,
 				13,
-				14,
-				15,
-				16,
-				17,
 				22,
 				48,
 				52,
 				126,
 				161,
 				162,
-				165,
-				186,
-				187,
-				188,
-				189,
-				190,
-				191,
-				195,
-				196
+				165
 			]
 		}
 	},
@@ -3126,8 +2905,13 @@
 		"pk": 2,
 		"fields": {
 			"for_club": 2,
-			"name": "Adh\u00e9rent\u22c5e Kfet",
+			"name": "Adh\u00e9rent Kfet",
 			"permissions": [
+				6,
+				14,
+				15,
+				16,
+				17,
 				22,
 				34,
 				36,
@@ -3158,9 +2942,7 @@
 				158,
 				159,
 				160,
-				179,
-				189,
-				190
+				179
 			]
 		}
 	},
@@ -3195,7 +2977,7 @@
 		"pk": 5,
 		"fields": {
 			"for_club": null,
-			"name": "Pr\u00e9sident\u22c5e de club",
+			"name": "Pr\u00e9sident\u00b7e de club",
 			"permissions": [
 				50,
 				62,
@@ -3209,7 +2991,7 @@
 		"pk": 6,
 		"fields": {
 			"for_club": null,
-			"name": "Tr\u00e9sorièr\u22c5e de club",
+			"name": "Tr\u00e9sorier\u00b7\u00e8re de club",
 			"permissions": [
 				59,
 				19,
@@ -3228,9 +3010,7 @@
 				166,
 				167,
 				168,
-				182,
-				184,
-				185
+				182
 			]
 		}
 	},
@@ -3239,7 +3019,7 @@
 		"pk": 7,
 		"fields": {
 			"for_club": 1,
-			"name": "Pr\u00e9sident\u22c5e BDE",
+			"name": "Pr\u00e9sident\u00b7e BDE",
 			"permissions": [
 				24,
 				25,
@@ -3255,7 +3035,7 @@
 		"pk": 8,
 		"fields": {
 			"for_club": 1,
-			"name": "Tr\u00e9sorièr\u22c5e BDE",
+			"name": "Tr\u00e9sorier\u00b7\u00e8re BDE",
 			"permissions": [
 				23,
 				24,
@@ -3268,7 +3048,6 @@
 				31,
 				32,
 				33,
-				43,
 				51,
 				53,
 				54,
@@ -3310,10 +3089,7 @@
 				176,
 				177,
 				178,
-				188,
-				183,
-				186,
-				187
+				183
 			]
 		}
 	},
@@ -3501,20 +3277,7 @@
 				180,
 				181,
 				182,
-				183,
-				184,
-				185,
-				186,
-				187,
-				188,
-				189,
-				190,
-				191,
-				192,
-				193,
-				194,
-				195,
-				196
+				183
 			]
 		}
 	},
@@ -3541,7 +3304,6 @@
 				30,
 				31,
 				70,
-				72,
 				143,
 				166,
 				167,
@@ -3574,8 +3336,7 @@
 				45,
 				46,
 				148,
-				149,
-				182
+				149
 			]
 		}
 	},
@@ -3618,7 +3379,7 @@
 		"pk": 13,
 		"fields": {
 			"for_club": null,
-			"name": "Chef\u22c5fe de bus",
+			"name": "Chef de bus",
 			"permissions": [
 				22,
 				84,
@@ -3636,7 +3397,7 @@
 		"pk": 14,
 		"fields": {
 			"for_club": null,
-			"name": "Chef\u22c5fe d'\u00e9quipe",
+			"name": "Chef d'\u00e9quipe",
 			"permissions": [
 				22,
 				84,
@@ -3685,7 +3446,7 @@
 		"pk": 18,
 		"fields": {
 			"for_club": null,
-			"name": "Adhérent\u22c5e WEI",
+			"name": "Adhérent WEI",
 			"permissions": [
 				77,
 				87,
@@ -3734,7 +3495,7 @@
 		"model": "permission.role",
 		"pk": 20,
 		"fields": {
-			"for_club": 1,
+			"for_club": 2,
 			"name": "PC Kfet",
 			"permissions": [
 				6,
@@ -3750,9 +3511,6 @@
 				56,
 				57,
 				58,
-				70,
-				72,
-				135,
 				137,
 				143,
 				147,
@@ -3763,7 +3521,8 @@
 				176,
 				177,
 				180,
-				181
+				181,
+				182
 			]
 		}
 	},

apps/permission/models.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2018-2021 by BDE ENS Paris-Saclay
+# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 import functools
@@ -59,7 +59,7 @@ class InstancedPermission:
 
                     # Force insertion, no data verification, no trigger
                     obj._force_save = True
-                    # We don't want to trigger any signal (log,…)
+                    # We don't want to trigger any signal (log, ...)
                     obj._no_signal = True
                     Model.save(obj, force_insert=True)
                     ret = self.model.model_class().objects.filter(self.query & Q(pk=0)).exists()
@@ -227,7 +227,7 @@ class Permission(models.Model):
     def compute_param(value, **kwargs):
         """
         A parameter is given by a list. The first argument is the name of the parameter.
-        The parameters are the user, the club, and some classes (Note,…)
+        The parameters are the user, the club, and some classes (Note, ...)
         If there are more arguments in the list, then attributes are queried.
         For example, ["user", "note", "balance"] will return the balance of the note of the user.
         If an argument is a list, then this is interpreted with a function call: