🔖(patch) patch release to 1.0.1

- upgrade semver for all package.json, env.d files, and pyproject.toml - update CHANGELOG.md
♿️(frontend) updates links
2024-08-20 10:03:11 +02:00 · 2024-08-19 16:04:57 +02:00 · 2024-08-19 16:04:57 +02:00 · 2024-08-19 16:04:57 +02:00 · 2024-08-09 15:21:42 +02:00 · 2024-08-09 13:37:20 +02:00
384 changed files with 24675 additions and 8735 deletions
@@ -31,3 +31,6 @@ db.sqlite3
 .mypy_cache
 .pylint.d
 .pytest_cache
+
+# Frontend dependencies
+node_modules
@@ -0,0 +1,52 @@
+name: Deploy
+
+on:
+  push:
+    tags:
+      - 'preprod'
+      - 'production'
+
+
+jobs:
+  notify-argocd:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
+
+  start-test-on-preprod:
+    needs:
+      - notify-argocd
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.ref, 'refs/tags/preprod')
+    steps:
+      -
+        name: Debug
+        run: |
+          echo "Start test when preprod is ready"
@@ -11,24 +11,38 @@ on:
    branches:
      - 'main'

+env:
+  DOCKER_USER: 1001:127
+
 jobs:
-  build-and-push:
+  build-and-push-backend:
    runs-on: ubuntu-latest
    steps:
      -
-        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
-          images: lasuite/people
+          images: lasuite/people-backend
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: .github/workflows/secrets.enc.env
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Login to DockerHub
@@ -39,6 +53,86 @@ jobs:
        uses: docker/build-push-action@v5
        with:
          context: .
+          target: backend-production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/people-frontend
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
+      -
+        name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          target: frontend-production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  notify-argocd:
+    needs:
+      - build-and-push-frontend
+      - build-and-push-backend
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
@@ -4,8 +4,6 @@ on:
  push:
    branches:
      - main
-    tags:
-      - 'v*'
  pull_request:
    branches:
      - '*'
@@ -16,7 +14,7 @@ jobs:
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
            fetch-depth: 0
      - name: show
@@ -39,7 +37,7 @@ jobs:
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
        with:
            fetch-depth: 0
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -49,7 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -58,11 +56,9 @@ jobs:
            exit 1
          fi

-  test-front:
+  install-front:
    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/frontend/
+
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
@@ -71,42 +67,85 @@ jobs:
        uses: actions/setup-node@v4
        with:
          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}

      - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        if: steps.front-node_modules.outputs.cache-hit != 'true'
+        run: cd src/frontend/ && yarn install --frozen-lockfile
+
+      - name: Cache install frontend
+        if: steps.front-node_modules.outputs.cache-hit != 'true'
+        uses: actions/cache@v4
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+  build-front:
+    runs-on: ubuntu-latest
+    needs: install-front
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+      - name: Build CI App
+        run: cd src/frontend/ && yarn ci:build
+
+      - name: Cache build frontend
+        uses: actions/cache@v4
+        with:
+          path: src/frontend/apps/desk/out/
+          key: build-front-${{ github.run_id }}
+
+  test-front:
+    runs-on: ubuntu-latest
+    needs: install-front
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}

      - name: Test App
-        run: yarn app:test
-
-      - name: Test Translations
-        run: yarn i18n:test
+        run: cd src/frontend/ && yarn app:test

  lint-front:
    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/frontend/
+    needs: install-front
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
        with:
-          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
-
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
        
      - name: Check linting
-        run: yarn lint
+        run: cd src/frontend/ && yarn lint

  test-e2e:
    runs-on: ubuntu-latest
+    needs: [build-mails, build-front]
    timeout-minutes: 10
    steps:
      - name: Checkout repository
@@ -115,39 +154,51 @@ jobs:
      - name: Set services env variables
        run: |
          make create-env-files
+          cat env.d/development/common.e2e.dist >> env.d/development/common

+      - name: Download mails' templates
+        uses: actions/download-artifact@v4
+        with:
+          name: mails-templates
+          path: src/backend/core/templates/mail
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+      - name: Restore the build cache
+        uses: actions/cache@v4
+        id: cache-build
+        with:
+          path: src/frontend/apps/desk/out/
+          key: build-front-${{ github.run_id }}
+    
      - name: Build and Start Docker Servers
        env:
          DOCKER_BUILDKIT: 1
          COMPOSE_DOCKER_CLI_BUILD: 1
        run: |
-          docker-compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
+          docker compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
          make run
        
-      - name: Apply DRH migrations 
+      - name: Apply DRF migrations
        run: |
          make migrate

-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
-
-      - name: Install dependencies
-        run: cd src/frontend/ && yarn install --frozen-lockfile
+      - name: Add dummy data
+        run: |
+          make demo FLUSH_ARGS='--no-input'

      - name: Install Playwright Browsers
        run: cd src/frontend/apps/e2e && yarn install

-      - name: Build CI App
-        run: cd src/frontend/ && yarn ci:build
-
      - name: Run e2e tests
        run: cd src/frontend/ && yarn e2e:test

-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
@@ -161,7 +212,7 @@ jobs:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
@@ -172,6 +223,11 @@ jobs:
        run: yarn install --frozen-lockfile
      - name: Build mails
        run: yarn build
+      - name: Persist mails' templates
+        uses: actions/upload-artifact@v4
+        with:
+            name: mails-templates
+            path: src/backend/core/templates/mail

  lint-back:
    runs-on: ubuntu-latest
@@ -180,9 +236,9 @@ jobs:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install development dependencies
@@ -196,6 +252,7 @@ jobs:

  test-back:
    runs-on: ubuntu-latest
+    needs: build-mails
    defaults:
      run:
        working-directory: src/backend
@@ -216,7 +273,7 @@ jobs:
      DJANGO_CONFIGURATION: Test
      DJANGO_SETTINGS_MODULE: people.settings
      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
-      DJANGO_JWT_PRIVATE_SIGNING_KEY: ThisIsAnExampleKeyForDevPurposeOnly
+      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
      DB_HOST: localhost
      DB_NAME: people
      DB_USER: dinum
@@ -225,13 +282,18 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
          sudo mkdir -p /data/static
+      - name: Download mails' templates
+        uses: actions/download-artifact@v4
+        with:
+          name: mails-templates
+          path: src/backend/core/templates/mail
      - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install development dependencies
@@ -248,16 +310,27 @@ jobs:
  i18n-crowdin:
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout repository
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
        uses: actions/checkout@v2
-        
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
      - name: Install gettext (required to make messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      
      - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

@@ -268,10 +341,11 @@ jobs:
      - name: Generate the translation base file
        run: ~/.local/bin/django-admin makemessages --keep-pot --all
        
-      - name: Load sops secrets
+      -
+        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: .github/workflows/secrets.enc.env
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      
      - name: Setup Node.js
@@ -1,20 +0,0 @@
-SOPS_PRIVATE=ENC[AES256_GCM,data:uMsnbpi1FFxO430iptp2axlH/souCPCJ/afCqh/kIDWs8xWHu0xJ2o6PlNOgb4l1gHF8sy4eSHFOW5HPKVbZ9gafRIL0JYHJr3A=,iv:IgaHDad7IuW2wFoxGALLDCs+UiSd3rEYwGNSX38wUfI=,tag:zs4wn4hDm5fghfI/7iH6CQ==,type:str]
-CROWDIN_API_TOKEN=ENC[AES256_GCM,data:tZRGFs792GjKYGit+oNubCwPbjWarhlgcyQ7oStO8K3nao0lEzLrm3+ARaOEXkzEkKSal2N1c+vlYIjRyzV1X7WZ7nZQWBiihEJgAfF3NGM=,iv:hohak/1niu5kV/W4XA0KEE3UB0BuNCDxbRxb0O+Aocs=,tag:Ssi0HyEhCKb9+WFyp3/yBQ==,type:str]
-CROWDIN_BASE_PATH=ENC[AES256_GCM,data:m44KrW5xJDE=,iv:bSyKrKQ0Z1yzrNaejAUyD+n1Z9z+ci92GoyS5KiiFKI=,tag:dDtpbn+6LkPwsg+qgMNWvA==,type:str]
-CROWDIN_PROJECT_ID=ENC[AES256_GCM,data:Gonh6ps7,iv:yUqPty+R060m6CYrDf7na2f6h0aRpIhRCXZoJW4ThJg=,tag:ewupoenajsc9o0Aj0r/niw==,type:str]
-DOCKER_HUB_PASSWORD=ENC[AES256_GCM,data:CBjUvS/UQcqdEv8=,iv:zJKGyyRnq+zxhKkYS5h3zw/J1320zrAqpiObcwiHWsA=,tag:OoQNe+4K63KXTWNsvjRZNQ==,type:str]
-DOCKER_HUB_USER=ENC[AES256_GCM,data:ivs7oeBBdA==,iv:cKAQJ071XhcRuFyeHhZkscvvz7sHrKIPJg5pt76hCXg=,tag:2VRmp1ULWvVH8NHcBifBGA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbkIyRi9jTGEzL2RZcGFS\nVkhuN2xMN1FBcm04eGJQUnpvQVRpdmFmaFF3CjdoNVhSM0lrb0lTSXAyUytSKzhG\nNERYaC80OThmUUxCSmt2U2Q0Mno3b0kKLS0tIFRjQzYyOEcwTnRScGhzaGxwaGFL\namxEUXNaeVhWUjYwbzR2Z1Uzb3JsTlEK6tyhbRmcUP4Aql49DPkrYb5tbwvK2EdA\ntvyPQo4pPit+pzgqsVgW+O8Wo4/rYLlITfuVRrOfHEaH3wmf6hziSw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_0__map_recipient=age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIL2NwVjVtVmd1ZE15WmFC\nVGl5cnU1OHVUcXAxWmZCQXBJbXBlcXFUN0RzClpOVXBTek9wbVB6M2s5TWlFbUo3\nelZrT3dsK3p6cEJGTGJoSTRvaEh4NW8KLS0tIGlsL29oSEthU28xV0RERFIxTnZR\nSSs3YjdUT0NyTEtlbjlmZXVOaTd3SzgK5jFJGREfJ/HVytWsCKWFsqM5JoaFSnhv\n538KzzldzcbtWfnY+bQ6A2EBjETwOzCTuQB8axAMj0URXPI+qelKIQ==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_1__map_recipient=age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOWtwSytMNGRmSHNQN0Zz\nV1RTWktXT1c5VjYvNTg2V0x1U3JSTFA1dmtvCnc4RHRodjVxSzcrZXJycCtJMGNy\nZ3ZwbTFDTUc4TTMxbm8rNXQ1ME90Q1UKLS0tIERPUmg1dSt5OWQwaXV0Y2FiYWdt\nVzlhcFNvUS9Nd3A5ZTYwT2lLUU5WVU0KGHSm1BQ3voKs98WiXNLO6hlqoiQmi1/F\n2RCBkE4/gOVyAmJAjOFizaF0Dhd7Ba4KS5l5QylFHloL8XtyixEhog==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_2__map_recipient=age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYlB6cEZKK3NLbm5Ob0hi\nS3M0OFoyTHhVYVA1WmcvSHc2MUErQ2JyaUh3Cnp1NlYvU1BPUnVON29UZWUvWmEz\nOW85N013VUJ3Q1ZZUmMvTWdYclBZTUkKLS0tIG1KODdkazhTUHRPMXZXQnJFNXJY\nOFlSNjZCbkpxcm9tN1dFTkZ4K1lETFUKhiPwKEG71OlTcK/Ul1GKGayLy025vAmo\nNgQUhbqXf7KmqDAmrQNzXTsLsOpRi33l66jFSGkTsFtiXNlmjFljKg==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_3__map_recipient=age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
-sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUzI2eDB0MU41YWoxcjAv\nOU8yMlowb3IybCtzcFBBTEVlUzdBczZkQlFNCk5tbnhLR2kweGNFZmx1OFgwaWZU\nTzRKZTBZamJjRFNYOUJlYmxTUVg4S2MKLS0tIDNGdlVVc0hLK1BPTUJVc0tPb1lK\ndVVWVi9GRkxwYXR1cXMrdnlsejJBeGsKKmVWvIMrBYH+UrDMkZPxN8KWnCgA6WK2\nbexMYr2AIF2QMbhck7XW2NuvAwvwjbJMfcd+cp9boe+EcC4YjdJZlw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_4__map_recipient=age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
-sops_lastmodified=2024-02-05T17:45:08Z
-sops_mac=ENC[AES256_GCM,data:WMsYYvGId0UlRhiw5C4TTpP/7oIIgWteGRtX7Nlo3qQwBc1LSUyN+7kblkXWD+nNG51B0xfl9E5QdXO3Ao2WskQZZEJqqkmt6wSw/ScSPcH56FoIqBhoGsPKyJOZkK0zojnCJQLniTDlISG0UiiJ4KHh8FJDWYbzAy2zFEm3Et8=,iv:zB2hyxnKiA3flsMQ7XFOT/fR9hamd6YWo3BNwce4oWM=,tag:uZ2Ia8sR5R8fmURtJ+PojA==,type:str]
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.8.1
@@ -66,6 +66,7 @@ src/frontend/tsclient

 # Test & lint
 .coverage
+coverage.json
 .pylint.d
 .pytest_cache
 db.sqlite3
@@ -79,3 +80,4 @@ db.sqlite3
 .vscode/
 *.iml
 .devcontainer/
+.tool-versions
@@ -0,0 +1,3 @@
+[submodule "secrets"]
+	path = secrets
+	url = ../secrets
@@ -1,13 +0,0 @@
-creation_rules:
-  # Here we have
-  # - Jacques key-id: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
-  # - github-repo key-id: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
-  # - Anthony Le-Courric key-id: age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
-  # - Antoine Lebaud key-id: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
-  # - Marie Pupo Jeammet key-id: age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
-  - age:
-      age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x,
-      age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7,
-      age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv,
-      age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3,
-      age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
@@ -7,3 +7,20 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 ## [Unreleased]
+
+## [1.0.1] - 2024-08-19
+
+### Fixed
+
+- ✨(frontend) user can add mail domains
+
+## [1.0.0] - 2024-08-09
+
+### Added
+
+- ✨(domains) create and manage domains on admin + API
+- ✨(domains) mailbox creation + link to email provisioning API
+
+[unreleased]: https://github.com/numerique-gouv/people/compare/v1.0.1...main
+[1.0.1]: https://github.com/numerique-gouv/people/releases/v1.0.1
+[1.0.0]: https://github.com/numerique-gouv/people/releases/v1.0.0
@@ -11,6 +11,55 @@ RUN apt-get update && \
  apt-get -y upgrade && \
  rm -rf /var/lib/apt/lists/*

+### ---- Front-end dependencies image ----
+FROM node:20 as frontend-deps
+
+WORKDIR /deps
+
+COPY ./src/frontend/package.json ./package.json
+COPY ./src/frontend/yarn.lock ./yarn.lock
+COPY ./src/frontend/apps/desk/package.json ./apps/desk/package.json
+COPY ./src/frontend/packages/i18n/package.json ./packages/i18n/package.json
+COPY ./src/frontend/packages/eslint-config-people/package.json ./packages/eslint-config-people/package.json
+
+RUN yarn --frozen-lockfile
+
+### ---- Front-end builder dev image ----
+FROM node:20 as frontend-builder-dev
+
+WORKDIR /builder
+
+COPY --from=frontend-deps /deps/node_modules ./node_modules
+COPY ./src/frontend .
+
+WORKDIR ./apps/desk
+
+### ---- Front-end builder image ----
+FROM frontend-builder-dev as frontend-builder
+
+RUN yarn build
+
+# ---- Front-end image ----
+FROM nginxinc/nginx-unprivileged:1.25 as frontend-production
+
+# Un-privileged user running the application
+ARG DOCKER_USER
+USER ${DOCKER_USER}
+
+COPY --from=frontend-builder \
+    /builder/apps/desk/out \
+    /usr/share/nginx/html
+
+COPY ./src/frontend/apps/desk/conf/default.conf /etc/nginx/conf.d
+
+# Copy entrypoint
+COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
+
+ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
+
+CMD ["nginx", "-g", "daemon off;"]
+
+
 # ---- Back-end builder image ----
 FROM base as back-builder

@@ -24,7 +73,7 @@ RUN mkdir /install && \


 # ---- mails ----
-FROM node:18 as mail-builder
+FROM node:20 as mail-builder

 COPY ./src/mail /mail/app

@@ -100,7 +149,7 @@ WORKDIR /app
 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]

 # ---- Development image ----
-FROM core as development
+FROM core as backend-development

 # Switch back to the root user to install development dependencies
 USER root:root
@@ -125,10 +174,10 @@ ENV DB_HOST=postgresql \
    DB_PORT=5432

 # Run django development server
-CMD python manage.py runserver 0.0.0.0:8000
+CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]

 # ---- Production image ----
-FROM core as production
+FROM core as backend-production

 ARG PEOPLE_STATIC_ROOT=/data/static

@@ -147,4 +196,4 @@ COPY --from=link-collector ${PEOPLE_STATIC_ROOT} ${PEOPLE_STATIC_ROOT}
 COPY --from=mail-builder /mail/backend/core/templates/mail /app/core/templates/mail

 # The default command runs gunicorn WSGI server in people's main module
-CMD gunicorn -c /usr/local/etc/gunicorn/people.py people.wsgi:application
+CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/people.py", "people.wsgi:application"]
@@ -166,24 +166,35 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel

+test-coverage: ## compute, display and save test coverage
+	bin/pytest --cov=. --cov-report json .
+.PHONY: test-coverage

 makemigrations:  ## run django makemigrations for the people project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) makemigrations
+	@$(MANAGE) makemigrations $(ARGS)
 .PHONY: makemigrations

 migrate:  ## run django migrations for the people project.
 	@echo "$(BOLD)Running migrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) migrate
+	@$(MANAGE) migrate $(ARGS)
 .PHONY: migrate

+showmigrations:  ## run django showmigrations for the people project.
+	@echo "$(BOLD)Running showmigrations$(RESET)"
+	@$(COMPOSE) up -d postgresql
+	@$(WAIT_DB)
+	@$(MANAGE) showmigrations $(ARGS)
+.PHONY: showmigrations
+
 superuser: ## Create an admin superuser with password "admin"
 	@echo "$(BOLD)Creating a Django superuser$(RESET)"
-	@$(MANAGE) createsuperuser --email admin@example.com --password admin
+	$(MANAGE) createsuperuser --username admin --password admin
+
 .PHONY: superuser

 back-i18n-compile: ## compile the gettext files
@@ -204,9 +215,10 @@ dbshell: ## connect to database shell
 	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell

+resetdb: FLUSH_ARGS ?=
 resetdb: ## flush database and create a superuser "admin"
 	@echo "$(BOLD)Flush database$(RESET)"
-	@$(MANAGE) flush
+	@$(MANAGE) flush $(FLUSH_ARGS)
 	@${MAKE} superuser
 .PHONY: resetdb

@@ -322,3 +334,12 @@ frontend-i18n-generate: \
 frontend-i18n-compile: ## Format the crowin json files used deploy to the apps
 	cd $(PATH_FRONT) && yarn i18n:deploy
 .PHONY: frontend-i18n-compile
+
+# -- K8S
+start-kind: ## Create the kubernetes cluster
+	./bin/start-kind.sh
+.PHONY: start-kind
+
+tilt-up: ## start tilt - k8s local development
+	tilt up -f ./bin/Tiltfile
+.PHONY: tilt-up
@@ -2,7 +2,7 @@

 People is an application to handle users and teams. 

-This project is as of yet **not ready for production**. Expect breaking changes.
+As of today, this project is **not yet ready for production**. Expect breaking changes.

 People is built on top of [Django Rest
 Framework](https://www.django-rest-framework.org/).
@@ -69,6 +69,24 @@ You first need to create a superuser account:
 $ make superuser
 ```

+You can then login with sub `admin` and password `admin`.
+
+### Run frontend
+
+Run the front with:
+
+```bash
+$ make run-front-desk
+```
+
+Then access at
+[http://localhost:3000](http://localhost:3000)
+
+user: people
+
+password: people
+
+
 ## Contributing

 This project is intended to be community-driven, so please, do not hesitate to
@@ -0,0 +1,58 @@
+load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
+load('ext://namespace', 'namespace_create', 'namespace_inject')
+namespace_create('desk')
+
+docker_build(
+    'localhost:5001/people-backend:latest',
+    context='..',
+    dockerfile='../Dockerfile',
+    only=['./src/backend', './src/mail', './docker'],
+    target = 'backend-production',
+    live_update=[
+        sync('../src/backend', '/app'),
+        run(
+            'pip install -r /app/requirements.txt',
+            trigger=['./api/requirements.txt']
+        )
+    ]
+)
+
+docker_build(
+    'localhost:5001/people-frontend:latest',
+    context='..',
+    dockerfile='../Dockerfile',
+    build_args={'ENV': 'dev'},
+    only=['./src/frontend', './src/mail', './docker'],
+    target = 'frontend-builder-dev',
+    live_update=[
+        sync('../src/frontend', '/builder'),
+    ]
+)
+
+k8s_yaml(local('cd ../src/helm && helmfile -n desk -e dev template .'))
+
+migration = '''
+set -eu
+# get k8s pod name from tilt resource name
+POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
+kubectl -n desk exec "$POD_NAME" -- python manage.py makemigrations
+'''
+cmd_button('Make migration',
+           argv=['sh', '-c', migration],
+           resource='desk-backend',
+           icon_name='developer_board',
+           text='Run makemigration',
+)
+
+pod_migrate = '''
+set -eu
+# get k8s pod name from tilt resource name
+POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
+kubectl -n desk exec "$POD_NAME" -- python manage.py migrate --no-input
+'''
+cmd_button('Migrate db',
+           argv=['sh', '-c', pod_migrate],
+           resource='desk-backend',
+           icon_name='developer_board',
+           text='Run database migration',
+)
@@ -0,0 +1,102 @@
+#!/bin/sh
+set -o errexit
+
+CURRENT_DIR=$(pwd)
+
+# 0. Create ca
+echo "0. Create ca"
+mkcert -install
+cd /tmp
+mkcert "127.0.0.1.nip.io" "*.127.0.0.1.nip.io"
+cd $CURRENT_DIR
+
+# 1. Create registry container unless it already exists
+echo "1. Create registry container unless it already exists"
+reg_name='kind-registry'
+reg_port='5001'
+if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
+	docker run \
+		-d --restart=always -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
+		registry:2
+fi
+
+# 2. Create kind cluster with containerd registry config dir enabled
+echo "2. Create kind cluster with containerd registry config dir enabled"
+# TODO: kind will eventually enable this by default and this patch will
+# be unnecessary.
+#
+# See:
+# https://github.com/kubernetes-sigs/kind/issues/2875
+# https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
+# See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
+cat <<EOF | kind create cluster --config=-
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+containerdConfigPatches:
+- |-
+  [plugins."io.containerd.grpc.v1.cri".registry]
+    config_path = "/etc/containerd/certs.d"
+nodes:
+- role: control-plane
+  image: kindest/node:v1.27.3
+  kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        node-labels: "ingress-ready=true"
+  extraPortMappings:
+  - containerPort: 80
+    hostPort: 80
+    protocol: TCP
+  - containerPort: 443
+    hostPort: 443
+    protocol: TCP
+- role: worker
+  image: kindest/node:v1.27.3
+- role: worker
+  image: kindest/node:v1.27.3
+EOF
+
+# 3. Add the registry config to the nodes
+echo "3. Add the registry config to the nodes"
+#
+# This is necessary because localhost resolves to loopback addresses that are
+# network-namespace local.
+# In other words: localhost in the container is not localhost on the host.
+#
+# We want a consistent name that works from both ends, so we tell containerd to
+# alias localhost:${reg_port} to the registry container when pulling images
+REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
+for node in $(kind get nodes); do
+	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
+	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
+[host."http://${reg_name}:5000"]
+EOF
+done
+
+# 4. Connect the registry to the cluster network if not already connected
+echo "4. Connect the registry to the cluster network if not already connected"
+# This allows kind to bootstrap the network but ensures they're on the same network
+if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
+	docker network connect "kind" "${reg_name}"
+fi
+
+# 5. Document the local registry
+echo "5. Document the local registry"
+# https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: local-registry-hosting
+  namespace: kube-public
+data:
+  localRegistryHosting.v1: |
+    host: "localhost:${reg_port}"
+    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
+EOF
+
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
+kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
+kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
@@ -19,11 +19,11 @@ services:
  app-dev:
    build:
      context: .
-      target: development
+      target: backend-development
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
-    image: people:development
+    image: people:backend-development
    environment:
      - PYLINTHOME=/app/.pylint.d
      - DJANGO_CONFIGURATION=Development
@@ -43,7 +43,7 @@ services:
  
  celery-dev:
    user: ${DOCKER_USER:-1000}
-    image: people:development
+    image: people:backend-development
    command: ["celery", "-A", "people.celery_app", "worker", "-l", "DEBUG"]
    environment:
      - DJANGO_CONFIGURATION=Development
@@ -60,13 +60,13 @@ services:
  app:
    build:
      context: .
-      target: production
+      target: backend-production
      args:
        DOCKER_USER: ${DOCKER_USER:-1000}
    user: ${DOCKER_USER:-1000}
-    image: people:production
+    image: people:backend-production
    environment:
-      - DJANGO_CONFIGURATION=ContinuousIntegration
+      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
@@ -78,10 +78,10 @@ services:

  celery:
    user: ${DOCKER_USER:-1000}
-    image: people:production
+    image: people:backend-production
    command: ["celery", "-A", "people.celery_app", "worker", "-l", "INFO"]
    environment:
-      - DJANGO_CONFIGURATION=ContinuousIntegration
+      - DJANGO_CONFIGURATION=Demo
    env_file:
      - env.d/development/common
      - env.d/development/postgresql
@@ -91,14 +91,12 @@ services:
  nginx:
    image: nginx:1.25
    ports:
-      - "8082:8082"
-      - "8088:8088"
+      - "8083:8083"
    volumes:
      - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
-      - ./src/frontend/apps/desk/out:/home/desk
-      - ./data/media:/data/media:ro
    depends_on:
      - app
+      - keycloak

  dockerize:
    image: jwilder/dockerize
@@ -138,7 +136,6 @@ services:

  kc_postgresql:
      image: postgres:14.3
-      platform: linux/amd64
      ports:
        - "5433:5432"
      env_file:
@@ -152,6 +149,11 @@ services:
      - start-dev
      - --features=preview
      - --import-realm
+      - --proxy=edge
+      - --hostname-url=http://localhost:8083
+      - --hostname-admin-url=http://localhost:8083/
+      - --hostname-strict=false
+      - --hostname-strict-https=false
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
@@ -161,6 +163,7 @@ services:
      KC_DB_PASSWORD: pass
      KC_DB_USERNAME: people
      KC_DB_SCHEMA: public
+      PROXY_ADDRESS_FORWARDING: 'true'
    ports:
      - "8080:8080"
    depends_on:
@@ -46,6 +46,9 @@
  "users": [
    {
      "username": "people",
+      "email": "people@people.world",
+      "firstName": "John",
+      "lastName": "Doe",
      "enabled": true,
      "credentials": [
        {
@@ -56,12 +59,43 @@
      "realmRoles": ["user"]
    },
    {
-      "username": "user-e2e",
+      "username": "user-e2e-chromium",
+      "email": "user@chromium.e2e",
+      "firstName": "E2E",
+      "lastName": "Chromium",
      "enabled": true,
      "credentials": [
        {
          "type": "password",
-          "value": "password-e2e"
+          "value": "password-e2e-chromium"
+        }
+      ],
+      "realmRoles": ["user"]
+    },
+    {
+      "username": "user-e2e-webkit",
+      "email": "user@webkit.e2e",
+      "firstName": "E2E",
+      "lastName": "Webkit",
+      "enabled": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "password-e2e-webkit"
+        }
+      ],
+      "realmRoles": ["user"]
+    },
+    {
+      "username": "user-e2e-firefox",
+      "email": "user@firefox.e2e",
+      "firstName": "E2E",
+      "lastName": "Firefox",
+      "enabled": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "password-e2e-firefox"
        }
      ],
      "realmRoles": ["user"]
@@ -313,7 +347,6 @@
      ],
      "security-admin-console": [],
      "admin-cli": [],
-      "people-front": [],
      "account-console": [],
      "broker": [
        {
@@ -326,6 +359,7 @@
          "attributes": {}
        }
      ],
+      "people": [],
      "account": [
        {
          "id": "63b1a4e1-a594-4571-99c3-7c5c3efd61ce",
@@ -580,7 +614,9 @@
      "publicClient": true,
      "frontchannelLogout": false,
      "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
      "authenticationFlowBindingOverrides": {},
      "fullScopeAllowed": false,
      "nodeReRegistrationTimeout": 0,
@@ -618,7 +654,9 @@
      "publicClient": false,
      "frontchannelLogout": false,
      "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
      "authenticationFlowBindingOverrides": {},
      "fullScopeAllowed": false,
      "nodeReRegistrationTimeout": 0,
@@ -638,7 +676,7 @@
    },
    {
      "id": "869481d0-5774-4e64-bc30-fedc7c58958f",
-      "clientId": "people-front",
+      "clientId": "people",
      "name": "",
      "description": "",
      "rootUrl": "",
@@ -648,9 +686,10 @@
      "enabled": true,
      "alwaysDisplayInConsole": false,
      "clientAuthenticatorType": "client-secret",
+      "secret": "ThisIsAnExampleKeyForDevPurposeOnly",
      "redirectUris": [
-        "",
        "http://localhost:8070/*",
+        "http://localhost:8071/*",
        "http://localhost:3200/*",
        "http://localhost:8088/*",
        "http://localhost:3000/*"
@@ -666,18 +705,29 @@
      "consentRequired": false,
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
+      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
-      "publicClient": true,
+      "publicClient": false,
      "frontchannelLogout": true,
      "protocol": "openid-connect",
      "attributes": {
+        "access.token.lifespan": "-1",
+        "client.secret.creation.time": "1707820779",
+        "user.info.response.signature.alg": "RS256",
+        "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
+        "oauth2.device.authorization.grant.enabled": "false",
+        "use.jwks.url": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "use.refresh.tokens": "true",
+        "tls-client-certificate-bound-access-tokens": "false",
        "oidc.ciba.grant.enabled": "false",
        "backchannel.logout.session.required": "true",
-        "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
+        "client_credentials.use_refresh_token": "false",
+        "acr.loa.map": "{}",
+        "require.pushed.authorization.requests": "false",
        "display.on.consent.screen": "false",
-        "oauth2.device.authorization.grant.enabled": "false",
-        "backchannel.logout.revoke.offline.tokens": "false"
+        "client.session.idle.timeout": "-1",
+        "token.response.type.bearer.lower-case": "false"
      },
      "authenticationFlowBindingOverrides": {},
      "fullScopeAllowed": true,
@@ -716,7 +766,9 @@
      "publicClient": false,
      "frontchannelLogout": false,
      "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
      "authenticationFlowBindingOverrides": {},
      "fullScopeAllowed": false,
      "nodeReRegistrationTimeout": 0,
@@ -887,7 +939,8 @@
          "consentRequired": false,
          "config": {
            "id.token.claim": "true",
-            "access.token.claim": "true"
+            "access.token.claim": "true",
+            "userinfo.token.claim": "true"
          }
        }
      ]
@@ -1057,7 +1110,7 @@
        },
        {
          "id": "79712bcf-b7f7-4ca3-b97c-418f48fded9b",
-          "name": "given name",
+          "name": "first name",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-property-mapper",
          "consentRequired": false,
@@ -1066,7 +1119,7 @@
            "user.attribute": "firstName",
            "id.token.claim": "true",
            "access.token.claim": "true",
-            "claim.name": "given_name",
+            "claim.name": "first_name",
            "jsonType.label": "String"
          }
        },
@@ -1087,7 +1140,7 @@
        },
        {
          "id": "7f741e96-41fe-4021-bbfd-506e7eb94e69",
-          "name": "family name",
+          "name": "last name",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-property-mapper",
          "consentRequired": false,
@@ -1096,7 +1149,7 @@
            "user.attribute": "lastName",
            "id.token.claim": "true",
            "access.token.claim": "true",
-            "claim.name": "family_name",
+            "claim.name": "last_name",
            "jsonType.label": "String"
          }
        },
@@ -1207,6 +1260,7 @@
          "consentRequired": false,
          "config": {
            "multivalued": "true",
+            "userinfo.token.claim": "true",
            "user.attribute": "foo",
            "id.token.claim": "true",
            "access.token.claim": "true",
@@ -1,34 +1,13 @@
-server {

-    listen 8082;
+server {
+    listen 8083;
    server_name localhost;
    charset utf-8;

-    location /media {
-        alias /data/media;
+    location / {
+        proxy_pass http://keycloak:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
-
-    # location / {
-    #     proxy_pass http://app:8000;
-    #     proxy_set_header Host $host;
-    #     proxy_set_header X-Real-IP $remote_addr;
-    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    # }
 }
-
-server {
-  listen 8088;
-  server_name localhost;
- 
-  root /home/desk;
- 
-  location / {
-      try_files $uri index.html $uri/ =404;
-  }
- 
-  error_page 404 /404.html;
-  location = /404.html {
-      internal;
-  }
-}
-
@@ -7,9 +7,6 @@ DJANGO_SUPERUSER_PASSWORD=admin
 # Python
 PYTHONPATH=/app

-#JWT
-DJANGO_JWT_PRIVATE_SIGNING_KEY=ThisIsAnExampleKeyForDevPurposeOnly
-
 # People settings

 # Mail
@@ -19,5 +16,20 @@ DJANGO_EMAIL_PORT=1025
 # Backend url
 PEOPLE_BASE_URL="http://localhost:8072"

-# Keycloak
-SIMPLE_JWT_JWK_URL="http://keycloak:8080/realms/people/protocol/openid-connect/certs"
+# OIDC
+OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/certs
+OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/people/protocol/openid-connect/auth
+OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/token
+OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/userinfo
+
+OIDC_RP_CLIENT_ID=people
+OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
+OIDC_RP_SIGN_ALGO=RS256
+OIDC_RP_SCOPES="openid email"
+
+LOGIN_REDIRECT_URL=http://localhost:3000
+LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
+LOGOUT_REDIRECT_URL=http://localhost:3000
+
+OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
+OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
@@ -0,0 +1,3 @@
+# For the CI job test-e2e
+SUSTAINED_THROTTLE_RATES="200/hour"
+BURST_THROTTLE_RATES="200/minute"
@@ -8,4 +8,4 @@ DB_HOST=kc_postgresql
 DB_NAME=keycloak
 DB_USER=people
 DB_PASSWORD=pass
-DB_PORT=5433
+DB_PORT=5433
@@ -8,4 +8,4 @@ DB_HOST=postgresql
 DB_NAME=people
 DB_USER=dinum
 DB_PASSWORD=pass
-DB_PORT=5432
+DB_PORT=5432
@@ -1,6 +1,7 @@
 {
  "extends": ["github>numerique-gouv/renovate-configuration"],
  "dependencyDashboard": true,
+  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
    {
      "enabled": false,
@@ -12,7 +13,13 @@
      "enabled": false,
      "groupName": "ignored js dependencies",
      "matchManagers": ["npm"],
-      "matchPackageNames": ["node", "node-fetch", "i18next-parser"]
+      "matchPackageNames": [
+        "fetch-mock",
+        "node",
+        "node-fetch",
+        "i18next-parser",
+        "eslint"
+      ]
    }
  ]
 }
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+git submodule update --init --recursive
+git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -1,5 +1,5 @@
 """Admin classes and registrations for People's core app."""
-from django import forms
+
 from django.contrib import admin
 from django.contrib.auth import admin as auth_admin
 from django.utils.translation import gettext_lazy as _
@@ -7,42 +7,6 @@ from django.utils.translation import gettext_lazy as _
 from . import models


-class IdentityFormSet(forms.BaseInlineFormSet):
-    """
-    Make the "is_main" field readonly when it is True so that declaring another identity
-    works in the admin.
-    """
-
-    def add_fields(self, form, index):
-        """Disable the "is_main" field when it is set to True"""
-        super().add_fields(form, index)
-        is_main_value = form.instance.is_main if form.instance else False
-        form.fields["is_main"].disabled = is_main_value
-
-
-class IdentityInline(admin.TabularInline):
-    """Inline admin class for user identities."""
-
-    fields = (
-        "sub",
-        "email",
-        "is_main",
-        "created_at",
-        "updated_at",
-    )
-    formset = IdentityFormSet
-    model = models.Identity
-    extra = 0
-    readonly_fields = ("email", "created_at", "sub", "updated_at")
-
-    def has_add_permission(self, request, obj):
-        """
-        Identities are automatically created on successful OIDC logins.
-        Disable creating identities via the admin.
-        """
-        return False
-
-
 class TeamAccessInline(admin.TabularInline):
    """Inline admin class for team accesses."""

@@ -52,6 +16,15 @@ class TeamAccessInline(admin.TabularInline):
    readonly_fields = ("created_at", "updated_at")


+class TeamWebhookInline(admin.TabularInline):
+    """Inline admin class for team webhooks."""
+
+    extra = 0
+    autocomplete_fields = ["team"]
+    model = models.TeamWebhook
+    readonly_fields = ("created_at", "updated_at")
+
+
@admin.register(models.User)
 class UserAdmin(auth_admin.UserAdmin):
    """Admin class for the User model"""
@@ -62,6 +35,7 @@ class UserAdmin(auth_admin.UserAdmin):
            {
                "fields": (
                    "id",
+                    "sub",
                    "password",
                )
            },
@@ -82,8 +56,18 @@ class UserAdmin(auth_admin.UserAdmin):
        ),
        (_("Important dates"), {"fields": ("created_at", "updated_at")}),
    )
-    inlines = (IdentityInline, TeamAccessInline)
+    add_fieldsets = (
+        (
+            None,
+            {
+                "classes": ("wide",),
+                "fields": ("sub", "email", "password1", "password2"),
+            },
+        ),
+    )
+    inlines = (TeamAccessInline,)
    list_display = (
+        "sub",
        "email",
        "created_at",
        "updated_at",
@@ -94,15 +78,21 @@ class UserAdmin(auth_admin.UserAdmin):
    )
    list_filter = ("is_staff", "is_superuser", "is_device", "is_active")
    ordering = ("is_active", "-is_superuser", "-is_staff", "-is_device", "-updated_at")
-    readonly_fields = ("id", "created_at", "updated_at")
-    search_fields = ("id", "email", "identities__sub", "identities__email")
+    readonly_fields = ["id", "created_at", "updated_at"]
+    search_fields = ("id", "email", "sub")
+
+    def get_readonly_fields(self, request, obj=None):
+        """The sub should only be editable for a create, not for updates."""
+        if obj:
+            return self.readonly_fields + ["sub"]
+        return self.readonly_fields


@admin.register(models.Team)
 class TeamAdmin(admin.ModelAdmin):
    """Team admin interface declaration."""

-    inlines = (TeamAccessInline,)
+    inlines = (TeamAccessInline, TeamWebhookInline)
    list_display = (
        "name",
        "slug",
@@ -110,3 +100,58 @@ class TeamAdmin(admin.ModelAdmin):
        "updated_at",
    )
    search_fields = ("name",)
+
+
+@admin.register(models.TeamAccess)
+class TeamAccessAdmin(admin.ModelAdmin):
+    """Team access admin interface declaration."""
+
+    list_display = (
+        "user",
+        "team",
+        "role",
+        "created_at",
+        "updated_at",
+    )
+
+
+@admin.register(models.Invitation)
+class InvitationAdmin(admin.ModelAdmin):
+    """Admin interface to handle invitations."""
+
+    fields = (
+        "email",
+        "team",
+        "role",
+        "created_at",
+        "issuer",
+    )
+    readonly_fields = (
+        "created_at",
+        "is_expired",
+        "issuer",
+    )
+    list_display = (
+        "email",
+        "team",
+        "created_at",
+        "is_expired",
+    )
+
+    def get_readonly_fields(self, request, obj=None):
+        if obj:
+            # all fields read only = disable update
+            return self.fields
+        return self.readonly_fields
+
+    def change_view(self, request, object_id, form_url="", extra_context=None):
+        """Custom edit form. Remove 'save' buttons."""
+        extra_context = extra_context or {}
+        extra_context["show_save_and_continue"] = False
+        extra_context["show_save"] = False
+        extra_context["show_save_and_add_another"] = False
+        return super().change_view(request, object_id, extra_context=extra_context)
+
+    def save_model(self, request, obj, form, change):
+        obj.issuer = request.user
+        obj.save()
@@ -1,4 +1,5 @@
 """People core API endpoints"""
+
 from django.conf import settings
 from django.core.exceptions import ValidationError

@@ -22,6 +23,8 @@ def exception_handler(exc, context):
            detail = exc.message
        elif hasattr(exc, "messages"):
            detail = exc.messages
+        else:
+            detail = ""

        exc = drf_exceptions.ValidationError(detail=detail)

@@ -1,4 +1,5 @@
 """Permission handlers for the People core app."""
+
 from django.core import exceptions

 from rest_framework import permissions
@@ -1,4 +1,5 @@
 """Client serializers for the People core app."""
+
 from rest_framework import exceptions, serializers
 from timezone_field.rest_framework import TimeZoneSerializerField

@@ -26,28 +27,46 @@ class ContactSerializer(serializers.ModelSerializer):
        return super().update(instance, validated_data)


-class UserSerializer(serializers.ModelSerializer):
+class DynamicFieldsModelSerializer(serializers.ModelSerializer):
+    """
+    A ModelSerializer that takes an additional `fields` argument that
+    controls which fields should be displayed.
+    """
+
+    def __init__(self, *args, **kwargs):
+        # Don't pass the 'fields' arg up to the superclass
+        fields = kwargs.pop("fields", None)
+
+        # Instantiate the superclass normally
+        super().__init__(*args, **kwargs)
+
+        if fields is not None:
+            # Drop any fields that are not specified in the `fields` argument.
+            allowed = set(fields)
+            existing = set(self.fields)
+            for field_name in existing - allowed:
+                self.fields.pop(field_name)
+
+
+class UserSerializer(DynamicFieldsModelSerializer):
    """Serialize users."""

-    data = serializers.SerializerMethodField(read_only=True)
    timezone = TimeZoneSerializerField(use_pytz=False, required=True)
+    email = serializers.ReadOnlyField()
+    name = serializers.ReadOnlyField()

    class Meta:
        model = models.User
        fields = [
            "id",
            "email",
-            "data",
            "language",
+            "name",
            "timezone",
            "is_device",
            "is_staff",
        ]
-        read_only_fields = ["id", "email", "data", "is_device", "is_staff"]
-
-    def get_data(self, user) -> dict:
-        """Return contact data for the user."""
-        return user.profile_contact.data if user.profile_contact else {}
+        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]


 class TeamAccessSerializer(serializers.ModelSerializer):
@@ -126,17 +145,52 @@ class TeamAccessSerializer(serializers.ModelSerializer):
        return attrs


+class TeamAccessReadOnlySerializer(TeamAccessSerializer):
+    """Serialize team accesses for list and retrieve actions."""
+
+    user = UserSerializer(read_only=True, fields=["id", "name", "email"])
+
+    class Meta:
+        model = models.TeamAccess
+        fields = [
+            "id",
+            "user",
+            "role",
+            "abilities",
+        ]
+        read_only_fields = [
+            "id",
+            "user",
+            "role",
+            "abilities",
+        ]
+
+
 class TeamSerializer(serializers.ModelSerializer):
    """Serialize teams."""

    abilities = serializers.SerializerMethodField(read_only=True)
-    accesses = TeamAccessSerializer(many=True, read_only=True)
    slug = serializers.SerializerMethodField()

    class Meta:
        model = models.Team
-        fields = ["id", "name", "accesses", "abilities", "slug"]
-        read_only_fields = ["id", "accesses", "abilities", "slug"]
+        fields = [
+            "id",
+            "name",
+            "accesses",
+            "abilities",
+            "slug",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = [
+            "id",
+            "accesses",
+            "abilities",
+            "slug",
+            "created_at",
+            "updated_at",
+        ]

    def get_abilities(self, team) -> dict:
        """Return abilities of the logged-in user on the instance."""
@@ -148,3 +202,38 @@ class TeamSerializer(serializers.ModelSerializer):
    def get_slug(self, instance):
        """Return slug from the team's name."""
        return instance.get_slug()
+
+
+class InvitationSerializer(serializers.ModelSerializer):
+    """Serialize invitations."""
+
+    class Meta:
+        model = models.Invitation
+        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
+        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
+
+    def validate(self, attrs):
+        """Validate and restrict invitation to new user based on email."""
+
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+
+        try:
+            team_id = self.context["team_id"]
+        except KeyError as exc:
+            raise exceptions.ValidationError(
+                "You must set a team ID in kwargs to create a new team invitation."
+            ) from exc
+
+        if not models.TeamAccess.objects.filter(
+            team=team_id,
+            user=user,
+            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
+        ).exists():
+            raise exceptions.PermissionDenied(
+                "You are not allowed to manage invitation for this team."
+            )
+
+        attrs["team_id"] = team_id
+        attrs["issuer"] = user
+        return attrs
@@ -1,14 +0,0 @@
-"""
-Utils that can be useful throughout the People core app
-"""
-from rest_framework_simplejwt.tokens import RefreshToken
-
-
-def get_tokens_for_user(user):
-    """Get JWT tokens for user authentication."""
-    refresh = RefreshToken.for_user(user)
-
-    return {
-        "refresh": str(refresh),
-        "access": str(refresh.access_token),
-    }
@@ -1,24 +1,25 @@
 """API endpoints"""
+
 from django.contrib.postgres.search import TrigramSimilarity
 from django.db.models import Func, Max, OuterRef, Q, Subquery, Value
+from django.db.models.functions import Coalesce

 from rest_framework import (
    decorators,
    exceptions,
+    filters,
    mixins,
    pagination,
    response,
+    throttling,
    viewsets,
 )
-from rest_framework.throttling import UserRateThrottle

 from core import models

 from . import permissions, serializers

-EMAIL_SIMILARITY_THRESHOLD = 0.01
-# TrigramSimilarity threshold is lower for searching email than for names,
-# to improve matching results
+SIMILARITY_THRESHOLD = 0.04


 class NestedGenericViewSet(viewsets.GenericViewSet):
@@ -96,12 +97,11 @@ class SerializerPerActionMixin:
 class Pagination(pagination.PageNumberPagination):
    """Pagination to display no more than 100 objects per page sorted by creation date."""

-    ordering = "-created_on"
    max_page_size = 100
    page_size_query_param = "page_size"


-class BurstRateThrottle(UserRateThrottle):
+class BurstRateThrottle(throttling.UserRateThrottle):
    """
    Throttle rate for minutes. See DRF section in settings for default value.
    """
@@ -109,7 +109,7 @@ class BurstRateThrottle(UserRateThrottle):
    scope = "burst"


-class SustainedRateThrottle(UserRateThrottle):
+class SustainedRateThrottle(throttling.UserRateThrottle):
    """
    Throttle rate for hours. See DRF section in settings for default value.
    """
@@ -185,7 +185,7 @@ class UserViewSet(
    """

    permission_classes = [permissions.IsSelf]
-    queryset = models.User.objects.all().select_related("profile_contact")
+    queryset = models.User.objects.all().order_by("-created_at")
    serializer_class = serializers.UserSerializer
    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
    pagination_class = Pagination
@@ -200,17 +200,25 @@ class UserViewSet(
                is_active=True,
            )

+            # Exclude all users already in the given team
+            if team_id := self.request.GET.get("team_id", ""):
+                queryset = queryset.exclude(teams__id=team_id)
+
            # Search by case-insensitive and accent-insensitive trigram similarity
            if query := self.request.GET.get("q", ""):
                similarity = Max(
                    TrigramSimilarity(
-                        Func("identities__email", function="unaccent"),
+                        Coalesce(Func("email", function="unaccent"), Value("")),
+                        Func(Value(query), function="unaccent"),
+                    )
+                    + TrigramSimilarity(
+                        Coalesce(Func("name", function="unaccent"), Value("")),
                        Func(Value(query), function="unaccent"),
                    )
                )
                queryset = (
                    queryset.annotate(similarity=similarity)
-                    .filter(similarity__gte=EMAIL_SIMILARITY_THRESHOLD)
+                    .filter(similarity__gte=SIMILARITY_THRESHOLD)
                    .order_by("-similarity")
                )

@@ -226,9 +234,9 @@ class UserViewSet(
        """
        Return information on currently logged user
        """
-        context = {"request": request}
+        user = request.user
        return response.Response(
-            self.serializer_class(request.user, context=context).data
+            self.serializer_class(user, context={"request": request}).data
        )


@@ -244,6 +252,9 @@ class TeamViewSet(

    permission_classes = [permissions.AccessPermission]
    serializer_class = serializers.TeamSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["created_at"]
+    ordering = ["-created_at"]
    queryset = models.Team.objects.all()

    def get_queryset(self):
@@ -300,8 +311,15 @@ class TeamAccessViewSet(
    lookup_field = "pk"
    pagination_class = Pagination
    permission_classes = [permissions.AccessPermission]
-    queryset = models.TeamAccess.objects.all().select_related("user")
-    serializer_class = serializers.TeamAccessSerializer
+    queryset = (
+        models.TeamAccess.objects.all().select_related("user").order_by("-created_at")
+    )
+    list_serializer_class = serializers.TeamAccessReadOnlySerializer
+    detail_serializer_class = serializers.TeamAccessSerializer
+
+    filter_backends = [filters.OrderingFilter]
+    ordering = ["role"]
+    ordering_fields = ["role", "user__email", "user__name"]

    def get_permissions(self):
        """User only needs to be authenticated to list team accesses"""
@@ -318,23 +336,50 @@ class TeamAccessViewSet(
        context["team_id"] = self.kwargs["team_id"]
        return context

+    def get_serializer_class(self):
+        if self.action in {"list", "retrieve"}:
+            return self.list_serializer_class
+        return self.detail_serializer_class
+
    def get_queryset(self):
        """Return the queryset according to the action."""
        queryset = super().get_queryset()
        queryset = queryset.filter(team=self.kwargs["team_id"])

-        if self.action == "list":
-            # Limit to team access instances related to a team THAT also has a team access
-            # instance for the logged-in user (we don't want to list only the team access
-            # instances pointing to the logged-in user)
+        if self.action in {"list", "retrieve"}:
+            if query := self.request.GET.get("q", ""):
+                similarity = Max(
+                    TrigramSimilarity(
+                        Coalesce(Func("user__email", function="unaccent"), Value("")),
+                        Func(Value(query), function="unaccent"),
+                    )
+                    + TrigramSimilarity(
+                        Coalesce(Func("user__name", function="unaccent"), Value("")),
+                        Func(Value(query), function="unaccent"),
+                    )
+                )
+                queryset = (
+                    queryset.annotate(similarity=similarity)
+                    .filter(similarity__gte=SIMILARITY_THRESHOLD)
+                    .order_by("-similarity")
+                )
+
+            # Determine which role the logged-in user has in the team
            user_role_query = models.TeamAccess.objects.filter(
-                team__accesses__user=self.request.user
+                user=self.request.user, team=self.kwargs["team_id"]
            ).values("role")[:1]
+
            queryset = (
+                # The logged-in user should be part of a team to see its accesses
                queryset.filter(
                    team__accesses__user=self.request.user,
                )
-                .annotate(user_role=Subquery(user_role_query))
+                # Abilities are computed based on logged-in user's role and
+                # the user role on each team access
+                .annotate(
+                    user_role=Subquery(user_role_query),
+                )
+                .select_related("user")
                .distinct()
            )
        return queryset
@@ -372,3 +417,77 @@ class TeamAccessViewSet(
                raise exceptions.ValidationError({"role": message})

        serializer.save()
+
+
+class InvitationViewset(
+    mixins.CreateModelMixin,
+    mixins.ListModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.DestroyModelMixin,
+    viewsets.GenericViewSet,
+):
+    """API ViewSet for user invitations to team.
+
+    GET /api/v1.0/teams/<team_id>/invitations/:<invitation_id>/
+        Return list of invitations related to that team or or one
+        team access if an id is provided.
+
+    POST /api/v1.0/teams/<team_id>/invitations/ with expected data:
+        - email: str
+        - role: str [owner|admin|member]
+        - issuer : User, automatically added from user making query, if allowed
+        - team : Team, automatically added from requested URI
+        Return newly created invitation
+
+    PUT / PATCH : Not permitted. Instead of updating your invitation,
+        delete and create a new one.
+
+    DELETE  /api/v1.0/teams/<team_id>/invitations/<invitation_id>/
+        Delete targeted invitation
+    """
+
+    lookup_field = "id"
+    pagination_class = Pagination
+    permission_classes = [permissions.AccessPermission]
+    queryset = (
+        models.Invitation.objects.all().select_related("team").order_by("-created_at")
+    )
+    serializer_class = serializers.InvitationSerializer
+
+    def get_permissions(self):
+        """User only needs to be authenticated to list invitations"""
+        if self.action == "list":
+            permission_classes = [permissions.IsAuthenticated]
+        else:
+            return super().get_permissions()
+
+        return [permission() for permission in permission_classes]
+
+    def get_serializer_context(self):
+        """Extra context provided to the serializer class."""
+        context = super().get_serializer_context()
+        context["team_id"] = self.kwargs["team_id"]
+        return context
+
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
+        queryset = queryset.filter(team=self.kwargs["team_id"])
+
+        if self.action == "list":
+            # Determine which role the logged-in user has in the team
+            user_role_query = models.TeamAccess.objects.filter(
+                user=self.request.user, team=self.kwargs["team_id"]
+            ).values("role")[:1]
+
+            queryset = (
+                # The logged-in user should be part of a team to see its accesses
+                queryset.filter(
+                    team__accesses__user=self.request.user,
+                )
+                # Abilities are computed based on logged-in user's role and
+                # the user role on each team access
+                .annotate(user_role=Subquery(user_role_query))
+                .distinct()
+            )
+        return queryset
@@ -1,59 +0,0 @@
-"""Authentication for the People core app."""
-from django.conf import settings
-from django.utils.functional import SimpleLazyObject
-from django.utils.module_loading import import_string
-from django.utils.translation import gettext_lazy as _
-
-from drf_spectacular.authentication import SessionScheme, TokenScheme
-from drf_spectacular.plumbing import build_bearer_security_scheme_object
-from rest_framework import authentication
-from rest_framework_simplejwt.authentication import JWTAuthentication
-
-
-class DelegatedJWTAuthentication(JWTAuthentication):
-    """Override JWTAuthentication to create missing users on the fly."""
-
-    def get_user(self, validated_token):
-        """
-        Return the user related to the given validated token, creating or updating it if necessary.
-        """
-        get_user = import_string(settings.JWT_USER_GETTER)
-        return SimpleLazyObject(lambda: get_user(validated_token))
-
-
-class OpenApiJWTAuthenticationExtension(TokenScheme):
-    """Extension for specifying JWT authentication schemes."""
-
-    target_class = "core.authentication.DelegatedJWTAuthentication"
-    name = "DelegatedJWTAuthentication"
-
-    def get_security_definition(self, auto_schema):
-        """Return the security definition for JWT authentication."""
-        return build_bearer_security_scheme_object(
-            header_name="Authorization",
-            token_prefix="Bearer",  # noqa S106
-        )
-
-
-class SessionAuthenticationWithAuthenticateHeader(authentication.SessionAuthentication):
-    """
-    This class is needed, because REST Framework's default SessionAuthentication does
-    never return 401's, because they cannot fill the WWW-Authenticate header with a
-    valid value in the 401 response. As a result, we cannot distinguish calls that are
-    not unauthorized (401 unauthorized) and calls for which the user does not have
-    permission (403 forbidden).
-    See https://github.com/encode/django-rest-framework/issues/5968
-
-    We do set authenticate_header function in SessionAuthentication, so that a value
-    for the WWW-Authenticate header can be retrieved and the response code is
-    automatically set to 401 in case of unauthenticated requests.
-    """
-
-    def authenticate_header(self, request):
-        return "Session"
-
-
-class OpenApiSessionAuthenticationExtension(SessionScheme):
-    """Extension for specifying session authentication schemes."""
-
-    target_class = "core.api.authentication.SessionAuthenticationWithAuthenticateHeader"
@@ -0,0 +1,107 @@
+"""Authentication Backends for the People core app."""
+
+from django.conf import settings
+from django.core.exceptions import SuspiciousOperation
+from django.utils.translation import gettext_lazy as _
+
+import requests
+from mozilla_django_oidc.auth import (
+    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
+)
+
+
+class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
+    """Custom OpenID Connect (OIDC) Authentication Backend.
+
+    This class overrides the default OIDC Authentication Backend to accommodate differences
+    in the User model, and handles signed and/or encrypted UserInfo response.
+    """
+
+    def get_userinfo(self, access_token, id_token, payload):
+        """Return user details dictionary.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The id token (unused).
+        - payload (dict): The token payload (unused).
+
+        Note: The id_token and payload parameters are unused in this implementation,
+        but were kept to preserve base method signature.
+
+        Note: It handles signed and/or encrypted UserInfo Response. It is required by
+        Agent Connect, which follows the OIDC standard. It forces us to override the
+        base method, which deal with 'application/json' response.
+
+        Returns:
+        - dict: User details dictionary obtained from the OpenID Connect user endpoint.
+        """
+
+        user_response = requests.get(
+            self.OIDC_OP_USER_ENDPOINT,
+            headers={"Authorization": f"Bearer {access_token}"},
+            verify=self.get_settings("OIDC_VERIFY_SSL", True),
+            timeout=self.get_settings("OIDC_TIMEOUT", None),
+            proxies=self.get_settings("OIDC_PROXY", None),
+        )
+        user_response.raise_for_status()
+        userinfo = self.verify_token(user_response.text)
+        return userinfo
+
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Return a User based on userinfo. Get or create a new user if no user matches the Sub.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The ID token.
+        - payload (dict): The user payload.
+
+        Returns:
+        - User: An existing or newly created User instance.
+
+        Raises:
+        - Exception: Raised when user creation is not allowed and no existing user is found.
+        """
+
+        user_info = self.get_userinfo(access_token, id_token, payload)
+
+        # Compute user name from OIDC name fields as defined in settings
+        names_list = [
+            user_info[field]
+            for field in settings.USER_OIDC_FIELDS_TO_NAME
+            if user_info.get(field)
+        ]
+        user_info["name"] = " ".join(names_list) or None
+
+        sub = user_info.get("sub")
+        if sub is None:
+            raise SuspiciousOperation(
+                _("User info contained no recognizable user identification")
+            )
+
+        try:
+            user = self.UserModel.objects.get(sub=sub)
+        except self.UserModel.DoesNotExist:
+            if self.get_settings("OIDC_CREATE_USER", True):
+                user = self.create_user(user_info)
+        else:
+            email = user_info.get("email")
+            name = user_info.get("name")
+            if email and email != user.email or name and name != user.name:
+                self.UserModel.objects.filter(sub=sub).update(email=email, name=name)
+
+        return user
+
+    def create_user(self, claims):
+        """Return a newly created User instance."""
+        sub = claims.get("sub")
+        if sub is None:
+            raise SuspiciousOperation(
+                _("Claims contained no recognizable user identification")
+            )
+
+        return self.UserModel.objects.create(
+            password="!",  # noqa: S106
+            sub=sub,
+            email=claims.get("email"),
+            name=claims.get("name"),
+        )
@@ -0,0 +1,18 @@
+"""Authentication URLs for the People core app."""
+
+from django.urls import path
+
+from mozilla_django_oidc.urls import urlpatterns as mozzila_oidc_urls
+
+from .views import OIDCLogoutCallbackView, OIDCLogoutView
+
+urlpatterns = [
+    # Override the default 'logout/' path from Mozilla Django OIDC with our custom view.
+    path("logout/", OIDCLogoutView.as_view(), name="oidc_logout_custom"),
+    path(
+        "logout-callback/",
+        OIDCLogoutCallbackView.as_view(),
+        name="oidc_logout_callback",
+    ),
+    *mozzila_oidc_urls,
+]
@@ -0,0 +1,137 @@
+"""Authentication Views for the People core app."""
+
+from urllib.parse import urlencode
+
+from django.contrib import auth
+from django.core.exceptions import SuspiciousOperation
+from django.http import HttpResponseRedirect
+from django.urls import reverse
+from django.utils import crypto
+
+from mozilla_django_oidc.utils import (
+    absolutify,
+)
+from mozilla_django_oidc.views import (
+    OIDCLogoutView as MozillaOIDCOIDCLogoutView,
+)
+
+
+class OIDCLogoutView(MozillaOIDCOIDCLogoutView):
+    """Custom logout view for handling OpenID Connect (OIDC) logout flow.
+
+    Adds support for handling logout callbacks from the identity provider (OP)
+    by initiating the logout flow if the user has an active session.
+
+    The Django session is retained during the logout process to persist the 'state' OIDC parameter.
+    This parameter is crucial for maintaining the integrity of the logout flow between this call
+    and the subsequent callback.
+    """
+
+    @staticmethod
+    def persist_state(request, state):
+        """Persist the given 'state' parameter in the session's 'oidc_states' dictionary
+
+        This method is used to store the OIDC state parameter in the session, according to the
+        structure expected by Mozilla Django OIDC's 'add_state_and_verifier_and_nonce_to_session'
+        utility function.
+        """
+
+        if "oidc_states" not in request.session or not isinstance(
+            request.session["oidc_states"], dict
+        ):
+            request.session["oidc_states"] = {}
+
+        request.session["oidc_states"][state] = {}
+        request.session.save()
+
+    def construct_oidc_logout_url(self, request):
+        """Create the redirect URL for interfacing with the OIDC provider.
+
+        Retrieves the necessary parameters from the session and constructs the URL
+        required to initiate logout with the OpenID Connect provider.
+
+        If no ID token is found in the session, the logout flow will not be initiated,
+        and the method will return the default redirect URL.
+
+        The 'state' parameter is generated randomly and persisted in the session to ensure
+        its integrity during the subsequent callback.
+        """
+
+        oidc_logout_endpoint = self.get_settings("OIDC_OP_LOGOUT_ENDPOINT")
+
+        if not oidc_logout_endpoint:
+            return self.redirect_url
+
+        reverse_url = reverse("oidc_logout_callback")
+        id_token = request.session.get("oidc_id_token", None)
+
+        if not id_token:
+            return self.redirect_url
+
+        query = {
+            "id_token_hint": id_token,
+            "state": crypto.get_random_string(self.get_settings("OIDC_STATE_SIZE", 32)),
+            "post_logout_redirect_uri": absolutify(request, reverse_url),
+        }
+
+        self.persist_state(request, query["state"])
+
+        return f"{oidc_logout_endpoint}?{urlencode(query)}"
+
+    def post(self, request):
+        """Handle user logout.
+
+        If the user is not authenticated, redirects to the default logout URL.
+        Otherwise, constructs the OIDC logout URL and redirects the user to start
+        the logout process.
+
+        If the user is redirected to the default logout URL, ensure her Django session
+        is terminated.
+        """
+
+        logout_url = self.redirect_url
+
+        if request.user.is_authenticated:
+            logout_url = self.construct_oidc_logout_url(request)
+
+        # If the user is not redirected to the OIDC provider, ensure logout
+        if logout_url == self.redirect_url:
+            auth.logout(request)
+
+        return HttpResponseRedirect(logout_url)
+
+
+class OIDCLogoutCallbackView(MozillaOIDCOIDCLogoutView):
+    """Custom view for handling the logout callback from the OpenID Connect (OIDC) provider.
+
+    Handles the callback after logout from the identity provider (OP).
+    Verifies the state parameter and performs necessary logout actions.
+
+    The Django session is maintained during the logout process to ensure the integrity
+    of the logout flow initiated in the previous step.
+    """
+
+    http_method_names = ["get"]
+
+    def get(self, request):
+        """Handle the logout callback.
+
+        If the user is not authenticated, redirects to the default logout URL.
+        Otherwise, verifies the state parameter and performs necessary logout actions.
+        """
+
+        if not request.user.is_authenticated:
+            return HttpResponseRedirect(self.redirect_url)
+
+        state = request.GET.get("state")
+
+        if state not in request.session.get("oidc_states", {}):
+            msg = "OIDC callback state not found in session `oidc_states`!"
+            raise SuspiciousOperation(msg)
+
+        del request.session["oidc_states"][state]
+        request.session.save()
+
+        auth.logout(request)
+
+        return HttpResponseRedirect(self.redirect_url)
@@ -1,7 +1,9 @@
 """
 Core application enums declaration
 """
+
 from django.conf import global_settings, settings
+from django.db import models
 from django.utils.translation import gettext_lazy as _

 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
@@ -13,3 +15,11 @@ ALL_LANGUAGES = getattr(
    "ALL_LANGUAGES",
    [(language, _(name)) for language, name in global_settings.LANGUAGES],
 )
+
+
+class WebhookStatusChoices(models.TextChoices):
+    """Defines the possible statuses in which a webhook can be."""
+
+    FAILURE = "failure", _("Failure")
+    PENDING = "pending", _("Pending")
+    SUCCESS = "success", _("Success")
@@ -2,6 +2,7 @@
 """
 Core application factories
 """
+
 from django.conf import settings
 from django.contrib.auth.hashers import make_password

@@ -119,26 +120,17 @@ class ContactFactory(BaseContactFactory):


 class UserFactory(factory.django.DjangoModelFactory):
-    """A factory to random users for testing purposes."""
+    """A factory to create random users for testing purposes."""

    class Meta:
        model = models.User
-
-    email = factory.Faker("email")
-    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
-    password = make_password("password")
-
-
-class IdentityFactory(factory.django.DjangoModelFactory):
-    """A factory to create identities for a user"""
-
-    class Meta:
-        model = models.Identity
        django_get_or_create = ("sub",)

-    user = factory.SubFactory(UserFactory)
    sub = factory.Sequence(lambda n: f"user{n!s}")
    email = factory.Faker("email")
+    name = factory.Faker("name")
+    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
+    password = make_password("password")


 class TeamFactory(factory.django.DjangoModelFactory):
@@ -147,18 +139,20 @@ class TeamFactory(factory.django.DjangoModelFactory):
    class Meta:
        model = models.Team
        django_get_or_create = ("name",)
+        skip_postgeneration_save = True

    name = factory.Sequence(lambda n: f"team{n}")

    @factory.post_generation
    def users(self, create, extracted, **kwargs):
        """Add users to team from a given list of users with or without roles."""
-        if create and extracted:
-            for item in extracted:
-                if isinstance(item, models.User):
-                    TeamAccessFactory(team=self, user=item)
-                else:
-                    TeamAccessFactory(team=self, user=item[0], role=item[1])
+        if not create or not extracted:
+            return
+        for user_entry in extracted:
+            if isinstance(user_entry, models.User):
+                TeamAccessFactory(team=self, user=user_entry)
+            else:
+                TeamAccessFactory(team=self, user=user_entry[0], role=user_entry[1])


 class TeamAccessFactory(factory.django.DjangoModelFactory):
@@ -170,3 +164,25 @@ class TeamAccessFactory(factory.django.DjangoModelFactory):
    team = factory.SubFactory(TeamFactory)
    user = factory.SubFactory(UserFactory)
    role = factory.fuzzy.FuzzyChoice([r[0] for r in models.RoleChoices.choices])
+
+
+class TeamWebhookFactory(factory.django.DjangoModelFactory):
+    """Create fake team webhooks for testing."""
+
+    class Meta:
+        model = models.TeamWebhook
+
+    team = factory.SubFactory(TeamFactory)
+    url = factory.Sequence(lambda n: f"https://example.com/Groups/{n!s}")
+
+
+class InvitationFactory(factory.django.DjangoModelFactory):
+    """A factory to create invitations for a user"""
+
+    class Meta:
+        model = models.Invitation
+
+    team = factory.SubFactory(TeamFactory)
+    email = factory.Faker("email")
+    role = factory.fuzzy.FuzzyChoice([role[0] for role in models.RoleChoices.choices])
+    issuer = factory.SubFactory(UserFactory)
@@ -1,6 +1,6 @@
-# Generated by Django 5.0.1 on 2024-02-06 15:08
+# Generated by Django 5.0.3 on 2024-06-08 09:25

-import core.models
+import django.contrib.auth.models
 import django.core.validators
 import django.db.models.deletion
 import timezone_field.fields
@@ -27,7 +27,7 @@ class Migration(migrations.Migration):
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
                ('name', models.CharField(max_length=100)),
-                ('slug', models.SlugField(max_length=100, unique=True)),
+                ('slug', models.SlugField(editable=False, max_length=100, unique=True)),
            ],
            options={
                'verbose_name': 'Team',
@@ -45,7 +45,9 @@ class Migration(migrations.Migration):
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='email address')),
+                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
+                ('name', models.CharField(blank=True, max_length=100, null=True, verbose_name='name')),
                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
@@ -60,7 +62,7 @@ class Migration(migrations.Migration):
                'db_table': 'people_user',
            },
            managers=[
-                ('objects', core.models.UserManager()),
+                ('objects', django.contrib.auth.models.UserManager()),
            ],
        ),
        migrations.CreateModel(
@@ -88,21 +90,20 @@ class Migration(migrations.Migration):
            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='user', to='core.contact'),
        ),
        migrations.CreateModel(
-            name='Identity',
+            name='Invitation',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
-                ('is_main', models.BooleanField(default=False, help_text='Designates whether the email is the main one.', verbose_name='main')),
-                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='identities', to=settings.AUTH_USER_MODEL)),
+                ('email', models.EmailField(max_length=254, verbose_name='email address')),
+                ('role', models.CharField(choices=[('member', 'Member'), ('administrator', 'Administrator'), ('owner', 'Owner')], default='member', max_length=20)),
+                ('issuer', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invitations', to=settings.AUTH_USER_MODEL)),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invitations', to='core.team')),
            ],
            options={
-                'verbose_name': 'identity',
-                'verbose_name_plural': 'identities',
-                'db_table': 'people_identity',
-                'ordering': ('-is_main', 'email'),
+                'verbose_name': 'Team invitation',
+                'verbose_name_plural': 'Team invitations',
+                'db_table': 'people_invitation',
            },
        ),
        migrations.CreateModel(
@@ -126,6 +127,23 @@ class Migration(migrations.Migration):
            name='users',
            field=models.ManyToManyField(related_name='teams', through='core.TeamAccess', to=settings.AUTH_USER_MODEL),
        ),
+        migrations.CreateModel(
+            name='TeamWebhook',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('url', models.URLField(verbose_name='url')),
+                ('secret', models.CharField(blank=True, max_length=255, null=True, verbose_name='secret')),
+                ('status', models.CharField(choices=[('failure', 'Failure'), ('pending', 'Pending'), ('success', 'Success')], default='pending', max_length=10)),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webhooks', to='core.team')),
+            ],
+            options={
+                'verbose_name': 'Team webhook',
+                'verbose_name_plural': 'Team webhooks',
+                'db_table': 'people_team_webhook',
+            },
+        ),
        migrations.AddConstraint(
            model_name='contact',
            constraint=models.CheckConstraint(check=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
@@ -139,8 +157,8 @@ class Migration(migrations.Migration):
            unique_together={('owner', 'base')},
        ),
        migrations.AddConstraint(
-            model_name='identity',
-            constraint=models.UniqueConstraint(fields=('user', 'email'), name='unique_user_email', violation_error_message='This email address is already declared for this user.'),
+            model_name='invitation',
+            constraint=models.UniqueConstraint(fields=('email', 'team'), name='email_and_team_unique_together'),
        ),
        migrations.AddConstraint(
            model_name='teamaccess',
@@ -1,24 +1,35 @@
 """
 Declare and configure the models for the People core application
 """
+
 import json
 import os
+import smtplib
 import uuid
+from datetime import timedelta
+from logging import getLogger

 from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
+from django.contrib.sites.models import Site
 from django.core import exceptions, mail, validators
-from django.db import models
+from django.db import models, transaction
+from django.template.loader import render_to_string
+from django.utils import timezone
 from django.utils.functional import lazy
 from django.utils.text import slugify
 from django.utils.translation import gettext_lazy as _
+from django.utils.translation import override

 import jsonschema
-from rest_framework_simplejwt.exceptions import InvalidToken
-from rest_framework_simplejwt.settings import api_settings
 from timezone_field import TimeZoneField

+from core.enums import WebhookStatusChoices
+from core.utils.webhooks import scim_synchronizer
+
+logger = getLogger(__name__)
+
 current_dir = os.path.dirname(os.path.abspath(__file__))
 contact_schema_path = os.path.join(current_dir, "jsonschema", "contact_data.json")
 with open(contact_schema_path, "r", encoding="utf-8") as contact_schema_file:
@@ -67,7 +78,7 @@ class BaseModel(models.Model):
    def save(self, *args, **kwargs):
        """Call `full_clean` before saving."""
        self.full_clean()
-        super().save(*args, **kwargs)
+        return super().save(*args, **kwargs)


 class Contact(BaseModel):
@@ -147,20 +158,28 @@ class Contact(BaseModel):
            raise exceptions.ValidationError({"data": [error_message]}) from e


-class UserManager(auth_models.UserManager):
-    """
-    Override user manager to get the related contact in the same query by default (Contact model)
-    """
-
-    def get_queryset(self):
-        """Always select the related contact when doing a query on users."""
-        return super().get_queryset().select_related("profile_contact")
-
-
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
    """User model to work with OIDC only authentication."""

-    email = models.EmailField(_("email address"), unique=True, null=True, blank=True)
+    sub_validator = validators.RegexValidator(
+        regex=r"^[\w.@+-]+\Z",
+        message=_(
+            "Enter a valid sub. This value may contain only letters, "
+            "numbers, and @/./+/-/_ characters."
+        ),
+    )
+
+    sub = models.CharField(
+        _("sub"),
+        help_text=_(
+            "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
+        ),
+        max_length=255,
+        unique=True,
+        validators=[sub_validator],
+    )
+    email = models.EmailField(_("email address"), null=True, blank=True)
+    name = models.CharField(_("name"), max_length=100, null=True, blank=True)
    profile_contact = models.OneToOneField(
        Contact,
        on_delete=models.SET_NULL,
@@ -200,9 +219,9 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
        ),
    )

-    objects = UserManager()
+    objects = auth_models.UserManager()

-    USERNAME_FIELD = "email"
+    USERNAME_FIELD = "sub"
    REQUIRED_FIELDS = []

    class Meta:
@@ -211,103 +230,59 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
        verbose_name_plural = _("users")

    def __str__(self):
-        return (
-            str(self.profile_contact)
-            if self.profile_contact
-            else self.email or str(self.id)
-        )
+        return self.name if self.name else self.email or f"User {self.sub}"
+
+    def save(self, *args, **kwargs):
+        """
+        If it's a new user, give her access to the relevant teams.
+        """
+
+        if self._state.adding:
+            self._convert_valid_invitations()
+
+        super().save(*args, **kwargs)

    def clean(self):
        """Validate fields."""
        super().clean()
+        if self.email:
+            self.email = User.objects.normalize_email(self.email)

        if self.profile_contact_id and not self.profile_contact.owner == self:
            raise exceptions.ValidationError(
                "Users can only declare as profile a contact they own."
            )

-    def email_user(self, subject, message, from_email=None, **kwargs):
-        """Send an email to this user."""
-        main_identity = self.identities.get(is_main=True)
-        mail.send_mail(subject, message, from_email, [main_identity.email], **kwargs)
-
-    @classmethod
-    def get_email_field_name(cls):
+    def _convert_valid_invitations(self):
        """
-        Raise error when trying to get email field name from the user as we are using
-        a separate Email model to allow several emails per user.
+        Convert valid invitations to team accesses.
+        Expired invitations are ignored.
        """
-        raise NotImplementedError(
-            "This feature is deactivated to allow several emails per user."
-        )

-
-class Identity(BaseModel):
-    """User identity"""
-
-    sub_validator = validators.RegexValidator(
-        regex=r"^[\w.@+-]+\Z",
-        message=_(
-            "Enter a valid sub. This value may contain only letters, "
-            "numbers, and @/./+/-/_ characters."
-        ),
-    )
-
-    user = models.ForeignKey(User, related_name="identities", on_delete=models.CASCADE)
-    sub = models.CharField(
-        _("sub"),
-        help_text=_(
-            "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
-        ),
-        max_length=255,
-        unique=True,
-        validators=[sub_validator],
-    )
-    email = models.EmailField(_("email address"), null=True, blank=True)
-    is_main = models.BooleanField(
-        _("main"),
-        default=False,
-        help_text=_("Designates whether the email is the main one."),
-    )
-
-    class Meta:
-        db_table = "people_identity"
-        ordering = ("-is_main", "email")
-        verbose_name = _("identity")
-        verbose_name_plural = _("identities")
-        constraints = [
-            # Uniqueness
-            models.UniqueConstraint(
-                fields=["user", "email"],
-                name="unique_user_email",
-                violation_error_message=_(
-                    "This email address is already declared for this user."
-                ),
+        valid_invitations = Invitation.objects.filter(
+            email=self.email,
+            created_at__gte=(
+                timezone.now()
+                - timedelta(seconds=settings.INVITATION_VALIDITY_DURATION)
            ),
-        ]
+        ).select_related("team")

-    def __str__(self):
-        main_str = "[main]" if self.is_main else ""
-        return f"{self.email:s}{main_str:s}"
+        if not valid_invitations.exists():
+            return

-    def save(self, *args, **kwargs):
-        """Ensure users always have one and only one main identity."""
-        super().save(*args, **kwargs)
-        if self.is_main is True:
-            self.user.identities.exclude(id=self.id).update(is_main=False)
+        TeamAccess.objects.bulk_create(
+            [
+                TeamAccess(user=self, team=invitation.team, role=invitation.role)
+                for invitation in valid_invitations
+            ]
+        )
+        valid_invitations.delete()

-    def clean(self):
-        """Normalize the email field and clean the 'is_main' field."""
-        if self.email:
-            self.email = User.objects.normalize_email(self.email)
-        if not self.user.identities.exclude(pk=self.pk).filter(is_main=True).exists():
-            if not self.created_at:
-                self.is_main = True
-            elif not self.is_main:
-                raise exceptions.ValidationError(
-                    {"is_main": "A user should have one and only one main identity."}
-                )
-        super().clean()
+    def email_user(self, subject, message, from_email=None, **kwargs):
+        """Email this user."""
+        if not self.email:
+            raise ValueError("You must first set an email for the user.")
+        mail.send_mail(subject, message, from_email, [self.email], **kwargs)


 class Team(BaseModel):
@@ -335,7 +310,7 @@ class Team(BaseModel):
        return self.name

    def save(self, *args, **kwargs):
-        """Overriding save function to compute the slug."""
+        """Override save function to compute the slug."""
        self.slug = self.get_slug()
        return super().save(*args, **kwargs)

@@ -362,7 +337,7 @@ class Team(BaseModel):
            is_owner_or_admin = role in [RoleChoices.OWNER, RoleChoices.ADMIN]

        return {
-            "get": True,
+            "get": bool(role),
            "patch": is_owner_or_admin,
            "put": is_owner_or_admin,
            "delete": role == RoleChoices.OWNER,
@@ -402,6 +377,34 @@ class TeamAccess(BaseModel):
    def __str__(self):
        return f"{self.user!s} is {self.role:s} in team {self.team!s}"

+    def save(self, *args, **kwargs):
+        """
+        Override save function to fire webhooks on any addition or update
+        to a team access.
+        """
+
+        if self._state.adding:
+            self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
+            with transaction.atomic():
+                instance = super().save(*args, **kwargs)
+                scim_synchronizer.add_user_to_group(self.team, self.user)
+        else:
+            instance = super().save(*args, **kwargs)
+
+        return instance
+
+    def delete(self, *args, **kwargs):
+        """
+        Override delete method to fire webhooks on  to team accesses.
+        Don't allow deleting a team access until it is successfully synchronized with all
+        its webhooks.
+        """
+        self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
+        with transaction.atomic():
+            arguments = self.team, self.user
+            super().delete(*args, **kwargs)
+            scim_synchronizer.remove_user_from_group(*arguments)
+
    def get_abilities(self, user):
        """
        Compute and return abilities for a given user taking into account
@@ -452,38 +455,135 @@ class TeamAccess(BaseModel):
        }


-def oidc_user_getter(validated_token):
-    """
-    Given a valid OIDC token , retrieve, create or update corresponding user/contact/email from db.
+class TeamWebhook(BaseModel):
+    """Webhooks fired on changes in teams."""

-    The token is expected to have the following fields in payload:
-        - sub
-        - email
-        - ...
-    """
-    try:
-        user_id = validated_token[api_settings.USER_ID_CLAIM]
-    except KeyError as exc:
-        raise InvalidToken(
-            _("Token contained no recognizable user identification")
-        ) from exc
-
-    try:
-        email_param = {"email": validated_token["email"]}
-    except KeyError:
-        email_param = {}
-
-    user = (
-        User.objects.filter(identities__sub=user_id)
-        .annotate(identity_email=models.F("identities__email"))
-        .distinct()
-        .first()
+    team = models.ForeignKey(Team, related_name="webhooks", on_delete=models.CASCADE)
+    url = models.URLField(_("url"))
+    secret = models.CharField(_("secret"), max_length=255, null=True, blank=True)
+    status = models.CharField(
+        max_length=10,
+        default=WebhookStatusChoices.PENDING,
+        choices=WebhookStatusChoices.choices,
    )

-    if user is None:
-        user = User.objects.create(password="!", **email_param)  # noqa: S106
-        Identity.objects.create(user=user, sub=user_id, **email_param)
-    elif email_param and validated_token["email"] != user.identity_email:
-        Identity.objects.filter(sub=user_id).update(email=validated_token["email"])
+    class Meta:
+        db_table = "people_team_webhook"
+        verbose_name = _("Team webhook")
+        verbose_name_plural = _("Team webhooks")

-    return user
+    def __str__(self):
+        return f"Webhook to {self.url} for {self.team}"
+
+    def get_headers(self):
+        """Build header dict from webhook object."""
+        headers = {"Content-Type": "application/json"}
+        if self.secret:
+            headers["Authorization"] = f"Bearer {self.secret:s}"
+        return headers
+
+
+class Invitation(BaseModel):
+    """User invitation to teams."""
+
+    email = models.EmailField(_("email address"), null=False, blank=False)
+    team = models.ForeignKey(
+        Team,
+        on_delete=models.CASCADE,
+        related_name="invitations",
+    )
+    role = models.CharField(
+        max_length=20, choices=RoleChoices.choices, default=RoleChoices.MEMBER
+    )
+    issuer = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="invitations",
+    )
+
+    class Meta:
+        db_table = "people_invitation"
+        verbose_name = _("Team invitation")
+        verbose_name_plural = _("Team invitations")
+        constraints = [
+            models.UniqueConstraint(
+                fields=["email", "team"], name="email_and_team_unique_together"
+            )
+        ]
+
+    def __str__(self):
+        return f"{self.email} invited to {self.team}"
+
+    def save(self, *args, **kwargs):
+        """Make invitations read-only."""
+        if self.created_at:
+            raise exceptions.PermissionDenied()
+        super().save(*args, **kwargs)
+
+        self.email_invitation()
+
+    def clean(self):
+        """Validate fields."""
+        super().clean()
+
+        # Check if a user already exists for the provided email
+        if User.objects.filter(email=self.email).exists():
+            raise exceptions.ValidationError(
+                {"email": _("This email is already associated to a registered user.")}
+            )
+
+    @property
+    def is_expired(self):
+        """Calculate if invitation is still valid or has expired."""
+        if not self.created_at:
+            return None
+
+        validity_duration = timedelta(seconds=settings.INVITATION_VALIDITY_DURATION)
+        return timezone.now() > (self.created_at + validity_duration)
+
+    def get_abilities(self, user):
+        """Compute and return abilities for a given user."""
+        can_delete = False
+        role = None
+
+        if user.is_authenticated:
+            try:
+                role = self.user_role
+            except AttributeError:
+                try:
+                    role = self.team.accesses.filter(user=user).values("role")[0][
+                        "role"
+                    ]
+                except (self._meta.model.DoesNotExist, IndexError):
+                    role = None
+
+            can_delete = role in [RoleChoices.OWNER, RoleChoices.ADMIN]
+
+        return {
+            "delete": can_delete,
+            "get": bool(role),
+            "patch": False,
+            "put": False,
+        }
+
+    def email_invitation(self):
+        """Email invitation to the user."""
+        try:
+            with override(self.issuer.language):
+                template_vars = {
+                    "title": _("Invitation to join Desk!"),
+                    "site": Site.objects.get_current(),
+                }
+                msg_html = render_to_string("mail/html/invitation.html", template_vars)
+                msg_plain = render_to_string("mail/text/invitation.txt", template_vars)
+                mail.send_mail(
+                    _("Invitation to join Desk!"),
+                    msg_plain,
+                    settings.EMAIL_FROM,
+                    [self.email],
+                    html_message=msg_html,
+                    fail_silently=False,
+                )
+
+        except smtplib.SMTPException as exception:
+            logger.error("invitation to %s was not sent: %s", self.email, exception)
@@ -0,0 +1,58 @@
+"""Custom template tags for the core application of People."""
+
+import base64
+
+from django import template
+from django.contrib.staticfiles import finders
+
+from PIL import ImageFile as PillowImageFile
+
+register = template.Library()
+
+
+def image_to_base64(file_or_path, close=False):
+    """
+    Return the src string of the base64 encoding of an image represented by its path
+    or file opened or not.
+
+    Inspired by Django's "get_image_dimensions"
+    """
+    pil_parser = PillowImageFile.Parser()
+    if hasattr(file_or_path, "read"):
+        file = file_or_path
+        if file.closed and hasattr(file, "open"):
+            file_or_path.open()
+        file_pos = file.tell()
+        file.seek(0)
+    else:
+        try:
+            # pylint: disable=consider-using-with
+            file = open(file_or_path, "rb")
+        except OSError:
+            return ""
+        close = True
+
+    try:
+        image_data = file.read()
+        if not image_data:
+            return ""
+        pil_parser.feed(image_data)
+        if pil_parser.image:
+            mime_type = pil_parser.image.get_format_mimetype()
+            encoded_string = base64.b64encode(image_data)
+            return f"data:{mime_type:s};base64, {encoded_string.decode('utf-8'):s}"
+        return ""
+    finally:
+        if close:
+            file.close()
+        else:
+            file.seek(file_pos)
+
+
+@register.simple_tag
+def base64_static(path):
+    """Return a static file into a base64."""
+    full_path = finders.find(path)
+    if full_path:
+        return image_to_base64(full_path, True)
+    return ""
@@ -0,0 +1,171 @@
+"""Unit tests for the Authentication Backends."""
+
+from django.core.exceptions import SuspiciousOperation
+
+import pytest
+
+from core import factories, models
+from core.authentication.backends import OIDCAuthenticationBackend
+
+pytestmark = pytest.mark.django_db
+
+
+def test_authentication_getter_existing_user_no_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user matches the user's info sub, the user should be returned.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    user = factories.UserFactory()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": user.sub}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(1):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+
+
+def test_authentication_getter_existing_user_with_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    When the user's info contains an email and targets an existing user,
+    """
+    klass = OIDCAuthenticationBackend()
+    user = factories.UserFactory(name="John Doe")
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # Only 1 query because email and names have not changed
+    with django_assert_num_queries(1):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+
+
+@pytest.mark.parametrize(
+    "first_name, last_name, email",
+    [
+        ("Jack", "Doe", "john.doe@example.com"),
+        ("John", "Duy", "john.doe@example.com"),
+        ("John", "Doe", "jack.duy@example.com"),
+        ("Jack", "Duy", "jack.duy@example.com"),
+    ],
+)
+def test_authentication_getter_existing_user_change_fields(
+    first_name, last_name, email, django_assert_num_queries, monkeypatch
+):
+    """
+    It should update the email or name fields on the user when they change.
+    """
+    klass = OIDCAuthenticationBackend()
+    user = factories.UserFactory(name="John Doe", email="john.doe@example.com")
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": email,
+            "first_name": first_name,
+            "last_name": last_name,
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # One and only one additional update query when a field has changed
+    with django_assert_num_queries(2):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+    user.refresh_from_db()
+    assert user.email == email
+    assert user.name == f"{first_name:s} {last_name:s}"
+
+
+def test_authentication_getter_new_user_no_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    User's info doesn't contain an email/name, created user's email/name should be empty.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email is None
+    assert user.name is None
+    assert user.password == "!"
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_new_user_with_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    User's email and name should be set on the user.
+    """
+    klass = OIDCAuthenticationBackend()
+    email = "people@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": email, "first_name": "John", "last_name": "Doe"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email == email
+    assert user.name == "John Doe"
+    assert user.password == "!"
+    assert models.User.objects.count() == 1
+
+
+def test_models_oidc_user_getter_invalid_token(django_assert_num_queries, monkeypatch):
+    """The user's info doesn't contain a sub."""
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {
+            "test": "123",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(0),
+        pytest.raises(
+            SuspiciousOperation,
+            match="User info contained no recognizable user identification",
+        ),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.exists() is False
@@ -0,0 +1,10 @@
+"""Unit tests for the Authentication URLs."""
+
+from core.authentication.urls import urlpatterns
+
+
+def test_urls_override_default_mozilla_django_oidc():
+    """Custom URL patterns should override default ones from Mozilla Django OIDC."""
+
+    url_names = [u.name for u in urlpatterns]
+    assert url_names.index("oidc_logout_custom") < url_names.index("oidc_logout")
@@ -0,0 +1,231 @@
+"""Unit tests for the Authentication Views."""
+
+from unittest import mock
+from urllib.parse import parse_qs, urlparse
+
+from django.contrib.auth.models import AnonymousUser
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.core.exceptions import SuspiciousOperation
+from django.test import RequestFactory
+from django.test.utils import override_settings
+from django.urls import reverse
+from django.utils import crypto
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.authentication.views import OIDCLogoutCallbackView, OIDCLogoutView
+
+pytestmark = pytest.mark.django_db
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_anonymous():
+    """Anonymous users calling the logout url,
+    should be redirected to the specified LOGOUT_REDIRECT_URL."""
+
+    url = reverse("oidc_logout_custom")
+    response = APIClient().get(url)
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@mock.patch.object(
+    OIDCLogoutView, "construct_oidc_logout_url", return_value="/example-logout"
+)
+def test_view_logout(mocked_oidc_logout_url):
+    """Authenticated users should be redirected to OIDC provider for logout."""
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    url = reverse("oidc_logout_custom")
+    response = client.get(url)
+
+    mocked_oidc_logout_url.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/default-redirect-logout")
+@mock.patch.object(
+    OIDCLogoutView, "construct_oidc_logout_url", return_value="/default-redirect-logout"
+)
+def test_view_logout_no_oidc_provider(mocked_oidc_logout_url):
+    """Authenticated users should be logged out when no OIDC provider is available."""
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    url = reverse("oidc_logout_custom")
+
+    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
+        response = client.get(url)
+        mocked_oidc_logout_url.assert_called_once()
+        mock_logout.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/default-redirect-logout"
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_callback_anonymous():
+    """Anonymous users calling the logout callback url,
+    should be redirected to the specified LOGOUT_REDIRECT_URL."""
+
+    url = reverse("oidc_logout_callback")
+    response = APIClient().get(url)
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@pytest.mark.parametrize(
+    "initial_oidc_states",
+    [{}, {"other_state": "foo"}],
+)
+def test_view_logout_persist_state(initial_oidc_states):
+    """State value should be persisted in session's data."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    if initial_oidc_states:
+        request.session["oidc_states"] = initial_oidc_states
+        request.session.save()
+
+    mocked_state = "mock_state"
+
+    OIDCLogoutView().persist_state(request, mocked_state)
+
+    assert "oidc_states" in request.session
+    assert request.session["oidc_states"] == {
+        "mock_state": {},
+        **initial_oidc_states,
+    }
+
+
+@override_settings(OIDC_OP_LOGOUT_ENDPOINT="/example-logout")
+@mock.patch.object(OIDCLogoutView, "persist_state")
+@mock.patch.object(crypto, "get_random_string", return_value="mocked_state")
+def test_view_logout_construct_oidc_logout_url(
+    mocked_get_random_string, mocked_persist_state
+):
+    """Should construct the logout URL to initiate the logout flow with the OIDC provider."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    request.session["oidc_id_token"] = "mocked_oidc_id_token"
+    request.session.save()
+
+    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
+
+    mocked_persist_state.assert_called_once()
+    mocked_get_random_string.assert_called_once()
+
+    params = parse_qs(urlparse(redirect_url).query)
+
+    assert params["id_token_hint"][0] == "mocked_oidc_id_token"
+    assert params["state"][0] == "mocked_state"
+
+    url = reverse("oidc_logout_callback")
+    assert url in params["post_logout_redirect_uri"][0]
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/")
+def test_view_logout_construct_oidc_logout_url_none_id_token():
+    """If no ID token is available in the session,
+    the user should be redirected to the final URL."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
+
+    assert redirect_url == "/"
+
+
+@pytest.mark.parametrize(
+    "initial_state",
+    [None, {"other_state": "foo"}],
+)
+def test_view_logout_callback_wrong_state(initial_state):
+    """Should raise an error if OIDC state doesn't match session data."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    if initial_state:
+        request.session["oidc_states"] = initial_state
+        request.session.save()
+
+    callback_view = OIDCLogoutCallbackView.as_view()
+
+    with pytest.raises(SuspiciousOperation) as excinfo:
+        callback_view(request)
+
+    assert (
+        str(excinfo.value) == "OIDC callback state not found in session `oidc_states`!"
+    )
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_callback():
+    """If state matches, callback should clear OIDC state and redirects."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().get("/logout-callback/", data={"state": "mocked_state"})
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    mocked_state = "mocked_state"
+
+    request.session["oidc_states"] = {mocked_state: {}}
+    request.session.save()
+
+    callback_view = OIDCLogoutCallbackView.as_view()
+
+    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
+
+        def clear_user(request):
+            # Assert state is cleared prior to logout
+            assert request.session["oidc_states"] == {}
+            request.user = AnonymousUser()
+
+        mock_logout.side_effect = clear_user
+        response = callback_view(request)
+        mock_logout.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
@@ -1,6 +1,7 @@
 """
 Test suite for generated openapi schema.
 """
+
 import json
 from io import StringIO

@@ -32,7 +33,7 @@ def test_openapi_client_schema():
    )
    assert output.getvalue() == ""

-    response = Client().get("/v1.0/swagger.json")
+    response = Client().get("/api/v1.0/swagger.json")

    assert response.status_code == 200
    with open(
@@ -0,0 +1,228 @@
+"""
+Test for team accesses API endpoints in People's core app : create
+"""
+
+import json
+import random
+import re
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_create_anonymous():
+    """Anonymous users should not be allowed to create team accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+
+    response = APIClient().post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(user.id),
+            "team": str(team.id),
+            "role": random.choice(models.RoleChoices.choices)[0],
+        },
+        format="json",
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+    assert models.TeamAccess.objects.exists() is False
+
+
+def test_api_team_accesses_create_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to create team accesses for a team to
+    which they are not related.
+    """
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+    team = factories.TeamFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You are not allowed to manage accesses for this team."
+    }
+    assert not models.TeamAccess.objects.filter(user=other_user).exists()
+
+
+def test_api_team_accesses_create_authenticated_member():
+    """Members of a team should not be allowed to create team accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    other_user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    for role in [role[0] for role in models.RoleChoices.choices]:
+        response = client.post(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": role,
+            },
+            format="json",
+        )
+
+        assert response.status_code == 403
+        assert response.json() == {
+            "detail": "You are not allowed to manage accesses for this team."
+        }
+
+    assert not models.TeamAccess.objects.filter(user=other_user).exists()
+
+
+def test_api_team_accesses_create_authenticated_administrator():
+    """
+    Administrators of a team should be able to create team accesses except for the "owner" role.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    # It should not be allowed to create an owner access
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": "owner",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Only owners of a team can assign other users as owners."
+    }
+
+    # It should be allowed to create a lower access
+    role = random.choice(
+        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
+    )
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
+    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_team_access.get_abilities(user),
+        "id": str(new_team_access.id),
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+def test_api_team_accesses_create_authenticated_owner():
+    """
+    Owners of a team should be able to create team accesses whatever the role.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    other_user = factories.UserFactory()
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
+    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_team_access.get_abilities(user),
+        "id": str(new_team_access.id),
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+def test_api_team_accesses_create_webhook():
+    """
+    When the team has a webhook, creating a team access should fire a call.
+    """
+    user, other_user = factories.UserFactory.create_batch(2)
+
+    team = factories.TeamFactory(users=[(user, "owner")])
+    webhook = factories.TeamWebhookFactory(team=team)
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    client = APIClient()
+    client.force_login(user)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        response = client.post(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": role,
+            },
+            format="json",
+        )
+        assert response.status_code == 201
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(other_user.id),
+                            "email": other_user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
@@ -0,0 +1,215 @@
+"""
+Test for team accesses API endpoints in People's core app : delete
+"""
+
+import json
+import random
+import re
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_delete_anonymous():
+    """Anonymous users should not be allowed to destroy a team access."""
+    access = factories.TeamAccessFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_authenticated():
+    """
+    Authenticated users should not be allowed to delete a team access for a
+    team to which they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_member():
+    """
+    Authenticated users should not be allowed to delete a team access for a
+    team in which they are a simple member.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    access = factories.TeamAccessFactory(team=team)
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 2
+
+
+def test_api_team_accesses_delete_administrators():
+    """
+    Users who are administrators in a team should be allowed to delete an access
+    from the team provided it is not ownership.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_owners_except_owners():
+    """
+    Users should be able to delete the team access of another user
+    for a team of which they are owner provided it is not an owner access.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_owners_for_owners():
+    """
+    Users should not be allowed to delete the team access of another owner
+    even for a team in which they are direct owner.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(team=team, role="owner")
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 2
+
+
+def test_api_team_accesses_delete_owners_last_owner():
+    """
+    It should not be possible to delete the last owner access from a team
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
+    assert models.TeamAccess.objects.count() == 1
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_webhook():
+    """
+    When the team has a webhook, deleting a team access should fire a call.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    webhook = factories.TeamWebhookFactory(team=team)
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        response = client.delete(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        )
+        assert response.status_code == 204
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "remove",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": access.user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    assert models.TeamAccess.objects.count() == 1
+    assert models.TeamAccess.objects.filter(user=access.user).exists() is False
@@ -0,0 +1,367 @@
+"""
+Test for team accesses API endpoints in People's core app : list
+"""
+
+import pytest
+from rest_framework.status import HTTP_200_OK
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_list_anonymous():
+    """Anonymous users should not be allowed to list team accesses."""
+    team = factories.TeamFactory()
+    factories.TeamAccessFactory.create_batch(2, team=team)
+
+    response = APIClient().get(f"/api/v1.0/teams/{team.id!s}/accesses/")
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_accesses_list_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to list team accesses for a team
+    to which they are not related.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    factories.TeamAccessFactory.create_batch(3, team=team)
+
+    # Accesses for other teams to which the user is related should not be listed either
+    other_access = factories.TeamAccessFactory(user=user)
+    factories.TeamAccessFactory(team=other_access.team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
+
+
+def test_api_team_accesses_list_authenticated_related():
+    """
+    Authenticated users should be able to list team accesses for a team
+    to which they are related, with a given role.
+    """
+    user, administrator, owner = factories.UserFactory.create_batch(3)
+    team = factories.TeamFactory()
+
+    access1 = factories.TeamAccessFactory.create(team=team, user=owner, role="owner")
+    access2 = factories.TeamAccessFactory.create(
+        team=team, user=administrator, role="administrator"
+    )
+
+    # Ensure this user's role is different from other team members to test abilities' computation
+    user_access = models.TeamAccess.objects.create(team=team, user=user, role="member")
+
+    # Grant other team accesses to the user, they should not be listed either
+    other_access = factories.TeamAccessFactory(user=user)
+    factories.TeamAccessFactory(team=other_access.team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+    )
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 3
+    assert sorted(response.json()["results"], key=lambda x: x["id"]) == sorted(
+        [
+            {
+                "id": str(user_access.id),
+                "user": {
+                    "id": str(user_access.user.id),
+                    "email": str(user.email),
+                    "name": str(user.name),
+                },
+                "role": str(user_access.role),
+                "abilities": user_access.get_abilities(user),
+            },
+            {
+                "id": str(access1.id),
+                "user": {
+                    "id": str(access1.user.id),
+                    "email": str(owner.email),
+                    "name": str(owner.name),
+                },
+                "role": str(access1.role),
+                "abilities": access1.get_abilities(user),
+            },
+            {
+                "id": str(access2.id),
+                "user": {
+                    "id": str(access2.user.id),
+                    "email": str(administrator.email),
+                    "name": str(administrator.name),
+                },
+                "role": str(access2.role),
+                "abilities": access2.get_abilities(user),
+            },
+        ],
+        key=lambda x: x["id"],
+    )
+
+
+def test_api_team_accesses_list_find_members(django_assert_num_queries):
+    """
+    Authenticated users should be able to search users access with a case-insensitive and
+    partial query on the name.
+    """
+    dave = factories.UserFactory(name="dave bowman", email=None)
+    frank = factories.UserFactory(name="frank poole", email=None)
+    mary = factories.UserFactory(name="mary poole", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    factories.UserFactory(name="heywood floyd", email=None)
+    factories.UserFactory(name="Andrei Smyslov", email=None)
+    factories.TeamFactory.create_batch(10)
+
+    # Add Mary, Nicole and Dave in the same team
+    team = factories.TeamFactory(
+        name="Odyssey",
+        users=[
+            (mary, models.RoleChoices.OWNER),
+            (nicole, models.RoleChoices.ADMIN),
+            (dave, models.RoleChoices.MEMBER),
+        ],
+    )
+    factories.TeamFactory(users=[(frank, models.RoleChoices.MEMBER)])
+
+    # Search users in the team Odyssey
+    client = APIClient()
+    client.force_login(mary)
+
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: get all users, owner included (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 3
+
+    # We can find David Bowman
+    # 3 queries are needed here:
+    # - 1 query: user authenticated
+    # - 2 queries: search user query with match
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=bowman",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    dave_access = dave.accesses.get(team=team)
+    assert response.json()["results"][0]["id"] == str(dave_access.id)
+
+    # We can find Nicole
+    # 3 queries are needed here:
+    # - 1 query: user authenticated
+    # - 2 queries: search user query with match
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=nicol",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    nicole_access = nicole.accesses.get(team=team)
+    assert response.json()["results"][0]["id"] == str(nicole_access.id)
+
+    # We can find Nicole and Mary
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: search user query with match and the owner found (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=ool",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 2
+    user_access_ids = sorted([user["id"] for user in response.json()["results"]])
+    mary_access = mary.accesses.get(team=team)
+    assert sorted([str(mary_access.id), str(nicole_access.id)]) == user_access_ids
+
+    # We cannot find Andrei, because he isn't a member of the current team
+    # 2 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 1 query: search user query with no match
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=andrei",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 0
+
+    # We can find Mary
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: search user query with match and an owner found (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=mary",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert response.json()["results"][0]["id"] == str(mary_access.id)
+
+
+def test_api_team_accesses__list_find_members_by_email():
+    """
+    Authenticated users should be able to search users access with a case-insensitive and
+    partial query on the email.
+    """
+    user = factories.UserFactory(name=None)
+
+    # set all names to None to match only on emails
+    colleague1 = factories.UserFactory(name=None, email="prudence_crandall@edu.us")
+    colleague2 = factories.UserFactory(name=None, email="reinebrunehaut@gouv.fr")
+    colleague3 = factories.UserFactory(name=None, email="artemisia.gentileschi@arte.it")
+
+    # Add all colleague in the same team
+    team = factories.TeamFactory(
+        users=[
+            (user, models.RoleChoices.ADMIN),
+            (colleague1, models.RoleChoices.OWNER),
+            (colleague2, models.RoleChoices.ADMIN),
+            (colleague3, models.RoleChoices.MEMBER),
+        ],
+    )
+    factories.TeamAccessFactory.create_batch(4)
+
+    # Create another team with similar email
+    factories.TeamFactory(
+        users=[
+            (
+                factories.UserFactory(name=None, email="bruneau@gouv.fr"),
+                models.RoleChoices.ADMIN,
+            ),
+        ],
+    )
+
+    # Search users in the team Odyssey
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?q=BRUNE",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert response.json()["results"][0]["user"]["email"] == "reinebrunehaut@gouv.fr"
+
+
+def test_api_team_accesses_list_authenticated_constant_numqueries(
+    django_assert_num_queries,
+):
+    """
+    The number of queries should not depend on the amount of fetched accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)  # random role
+
+    client = APIClient()
+    client.force_login(user)
+    # Only 3 queries are needed to efficiently fetch team accesses,
+    # related users and identities :
+    # - query retrieving logged-in user for user_role annotation
+    # - count from pagination
+    # - distinct from viewset
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    # num queries should still be the same
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 21
+
+
+def test_api_team_accesses_list_authenticated_ordering():
+    """Team accesses can be ordered by "role"."""
+
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=role",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    results = [team_access["role"] for team_access in response.json()["results"]]
+    assert sorted(results) == results
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=-role",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    results = [team_access["role"] for team_access in response.json()["results"]]
+    assert sorted(results, reverse=True) == results
+
+
+@pytest.mark.parametrize("ordering_field", ["email", "name"])
+def test_api_team_accesses_list_authenticated_ordering_user(ordering_field):
+    """Team accesses can be ordered by user's fields."""
+
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=user__{ordering_field}",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    def normalize(x):
+        """Mimic Django order_by, which is case-insensitive and space-insensitive"""
+        return x.casefold().replace(" ", "")
+
+    results = [
+        team_access["user"][ordering_field]
+        for team_access in response.json()["results"]
+    ]
+    assert sorted(results, key=normalize) == results
@@ -0,0 +1,83 @@
+"""
+Test for team accesses API endpoints in People's core app : retrieve
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_retrieve_anonymous():
+    """
+    Anonymous users should not be allowed to retrieve a team access.
+    """
+    access = factories.TeamAccessFactory()
+
+    response = APIClient().get(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_accesses_retrieve_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to retrieve a team access for
+    a team to which they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(team=factories.TeamFactory())
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No TeamAccess matches the given query."}
+
+    # Accesses related to another team should be excluded even if the user is related to it
+    for other_access in [
+        factories.TeamAccessFactory(),
+        factories.TeamAccessFactory(user=user),
+    ]:
+        response = client.get(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{other_access.id!s}/",
+        )
+
+        assert response.status_code == 404
+        assert response.json() == {"detail": "No TeamAccess matches the given query."}
+
+
+def test_api_team_accesses_retrieve_authenticated_related():
+    """
+    A user who is related to a team should be allowed to retrieve the
+    associated team user accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(access.id),
+        "user": {
+            "id": str(access.user.id),
+            "email": str(user.email),
+            "name": str(user.name),
+        },
+        "role": str(access.role),
+        "abilities": access.get_abilities(user),
+    }
@@ -0,0 +1,325 @@
+"""
+Test for team accesses API endpoints in People's core app : update
+"""
+
+import random
+from uuid import uuid4
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_update_anonymous():
+    """Anonymous users should not be allowed to update a team access."""
+    access = factories.TeamAccessFactory()
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    for field, value in new_values.items():
+        response = APIClient().put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 401
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to update a team access for a team to which
+    they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory()
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_authenticated_member():
+    """Members of a team should not be allowed to update its accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    access = factories.TeamAccessFactory(team=team)
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_except_owner():
+    """
+    A user who is an administrator in a team should be allowed to update a user
+    access for this team, as long as they don't try to set the role to owner.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    access = factories.TeamAccessFactory(
+        team=team,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(["administrator", "member"]),
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_from_owner():
+    """
+    A user who is an administrator in a team, should not be allowed to update
+    the user access of an "owner" for this team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+    access = factories.TeamAccessFactory(team=team, user=other_user, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data={**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_to_owner():
+    """
+    A user who is an administrator in a team, should not be allowed to update
+    the user access of another user to grant team ownership.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+    access = factories.TeamAccessFactory(
+        team=team,
+        user=other_user,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": "owner",
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+        # We are not allowed or not really updating the role
+        if field == "role" or new_data["role"] == old_values["role"]:
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_except_owner():
+    """
+    A user who is an owner in a team should be allowed to update
+    a user access for this team except for existing "owner" accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    factories.UserFactory()
+    access = factories.TeamAccessFactory(
+        team=team,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_for_owners():
+    """
+    A user who is "owner" of a team should not be allowed to update
+    an existing owner access for this team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(team=team, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data={**old_values, field: value},
+            content_type="application/json",
+        )
+        assert response.status_code == 403
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_self():
+    """
+    A user who is owner of a team should be allowed to update
+    their own user access provided there are other owners in the team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+    new_role = random.choice(["administrator", "member"])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.put(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    access.refresh_from_db()
+    assert access.role == "owner"
+
+    # Add another owner and it should now work
+    factories.TeamAccessFactory(team=team, role="owner")
+
+    response = client.put(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    access.refresh_from_db()
+    assert access.role == new_role
@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: create
 """
+
 import pytest
 from rest_framework.status import (
    HTTP_201_CREATED,
@@ -9,9 +10,8 @@ from rest_framework.status import (
 )
 from rest_framework.test import APIClient

-from core.factories import IdentityFactory, TeamFactory
+from core.factories import TeamFactory, UserFactory
 from core.models import Team
-from core.tests.utils import OIDCToken

 pytestmark = pytest.mark.django_db

@@ -34,17 +34,17 @@ def test_api_teams_create_authenticated():
    Authenticated users should be able to create teams and should automatically be declared
    as the owner of the newly created team.
    """
-    identity = IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = UserFactory()

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/teams/",
        {
            "name": "my team",
        },
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_201_CREATED
@@ -57,13 +57,13 @@ def test_api_teams_create_authenticated_slugify_name():
    """
    Creating teams should automatically generate a slug.
    """
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = UserFactory()
+    client = APIClient()
+    client.force_login(user)

-    response = APIClient().post(
+    response = client.post(
        "/api/v1.0/teams/",
        {"name": "my team"},
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_201_CREATED
@@ -86,15 +86,16 @@ def test_api_teams_create_authenticated_expected_slug(param):
    """
    Creating teams should automatically create unaccented, no unicode, lower-case slug.
    """
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = UserFactory()

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/teams/",
        {
            "name": param[0],
        },
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_201_CREATED
@@ -108,15 +109,16 @@ def test_api_teams_create_authenticated_unique_slugs():
    Creating teams should raise an error if already existing slug.
    """
    TeamFactory(name="existing team")
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = UserFactory()

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/teams/",
        {
            "name": "èxisting team",
        },
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_400_BAD_REQUEST
@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: delete
 """
+
 import pytest
 from rest_framework.status import (
    HTTP_204_NO_CONTENT,
@@ -11,7 +12,6 @@ from rest_framework.status import (
 from rest_framework.test import APIClient

 from core import factories, models
-from core.tests.utils import OIDCToken

 pytestmark = pytest.mark.django_db

@@ -33,18 +33,19 @@ def test_api_teams_delete_authenticated_unrelated():
    Authenticated users should not be allowed to delete a team to which they are not
    related.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory()

-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/",
    )

    assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}
    assert models.Team.objects.count() == 1


@@ -53,14 +54,15 @@ def test_api_teams_delete_authenticated_member():
    Authenticated users should not be allowed to delete a team for which they are
    only a member.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "member")])

-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
    )

    assert response.status_code == HTTP_403_FORBIDDEN
@@ -75,14 +77,15 @@ def test_api_teams_delete_authenticated_administrator():
    Authenticated users should not be allowed to delete a team for which they are
    administrator.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "administrator")])

-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
    )

    assert response.status_code == HTTP_403_FORBIDDEN
@@ -97,14 +100,15 @@ def test_api_teams_delete_authenticated_owner():
    Authenticated users should be able to delete a team for which they are directly
    owner.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "owner")])

-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
    )

    assert response.status_code == HTTP_204_NO_CONTENT
@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: list
 """
+
 from unittest import mock

 import pytest
@@ -8,10 +9,7 @@ from rest_framework.pagination import PageNumberPagination
 from rest_framework.status import HTTP_200_OK, HTTP_401_UNAUTHORIZED
 from rest_framework.test import APIClient

-from core import factories, models
-from core.api import serializers
-
-from ..utils import OIDCToken
+from core import factories

 pytestmark = pytest.mark.django_db

@@ -29,10 +27,14 @@ def test_api_teams_list_anonymous():


 def test_api_teams_list_authenticated():
-    """Authenticated users should be able to list teams they are an owner/administrator/member of."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    """
+    Authenticated users should be able to list teams
+    they are an owner/administrator/member of.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    expected_ids = {
        str(access.team.id)
@@ -40,8 +42,8 @@ def test_api_teams_list_authenticated():
    }
    factories.TeamFactory.create_batch(2)  # Other teams

-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/",
    )

    assert response.status_code == HTTP_200_OK
@@ -56,9 +58,10 @@ def test_api_teams_list_pagination(
    _mock_page_size,
 ):
    """Pagination should work as expected."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team_ids = [
        str(access.team.id)
@@ -66,8 +69,8 @@ def test_api_teams_list_pagination(
    ]

    # Get page 1
-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/",
    )

    assert response.status_code == HTTP_200_OK
@@ -82,8 +85,8 @@ def test_api_teams_list_pagination(
        team_ids.remove(item["id"])

    # Get page 2
-    response = APIClient().get(
-        "/api/v1.0/teams/?page=2", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/?page=2",
    )

    assert response.status_code == HTTP_200_OK
@@ -100,19 +103,76 @@ def test_api_teams_list_pagination(

 def test_api_teams_list_authenticated_distinct():
    """A team with several related users should only be listed once."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    other_user = factories.UserFactory()

    team = factories.TeamFactory(users=[user, other_user])

-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/",
    )

    assert response.status_code == HTTP_200_OK
    content = response.json()
    assert len(content["results"]) == 1
    assert content["results"][0]["id"] == str(team.id)
+
+
+def test_api_teams_order():
+    """
+    Test that the endpoint GET teams is sorted in 'created_at' descending order by default.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    team_ids = [
+        str(team.id) for team in factories.TeamFactory.create_batch(5, users=[user])
+    ]
+
+    response = client.get(
+        "/api/v1.0/teams/",
+    )
+
+    assert response.status_code == 200
+
+    response_data = response.json()
+    response_team_ids = [team["id"] for team in response_data["results"]]
+
+    team_ids.reverse()
+    assert (
+        response_team_ids == team_ids
+    ), "created_at values are not sorted from newest to oldest"
+
+
+def test_api_teams_order_param():
+    """
+    Test that the 'created_at' field is sorted in ascending order
+    when the 'ordering' query parameter is set.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    team_ids = [
+        str(team.id) for team in factories.TeamFactory.create_batch(5, users=[user])
+    ]
+
+    response = client.get(
+        "/api/v1.0/teams/?ordering=created_at",
+    )
+    assert response.status_code == 200
+
+    response_data = response.json()
+
+    response_team_ids = [team["id"] for team in response_data["results"]]
+
+    assert (
+        response_team_ids == team_ids
+    ), "created_at values are not sorted from oldest to newest"
@@ -1,12 +1,12 @@
 """
 Tests for Teams API endpoint in People's core app: retrieve
 """
+
 import pytest
-from rest_framework.status import HTTP_200_OK, HTTP_401_UNAUTHORIZED, HTTP_404_NOT_FOUND
+from rest_framework import status
 from rest_framework.test import APIClient

 from core import factories
-from core.tests.utils import OIDCToken

 pytestmark = pytest.mark.django_db

@@ -16,7 +16,7 @@ def test_api_teams_retrieve_anonymous():
    team = factories.TeamFactory()
    response = APIClient().get(f"/api/v1.0/teams/{team.id}/")

-    assert response.status_code == HTTP_401_UNAUTHORIZED
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
    assert response.json() == {
        "detail": "Authentication credentials were not provided."
    }
@@ -27,17 +27,18 @@ def test_api_teams_retrieve_authenticated_unrelated():
    Authenticated users should not be allowed to retrieve a team to which they are
    not related.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory()

-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/",
    )
-    assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.json() == {"detail": "No Team matches the given query."}


 def test_api_teams_retrieve_authenticated_related():
@@ -45,39 +46,31 @@ def test_api_teams_retrieve_authenticated_related():
    Authenticated users should be allowed to retrieve a team to which they
    are related whatever the role.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory()
    access1 = factories.TeamAccessFactory(team=team, user=user)
    access2 = factories.TeamAccessFactory(team=team)

-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/",
    )
-    assert response.status_code == HTTP_200_OK
-    content = response.json()
-    assert sorted(content.pop("accesses"), key=lambda x: x["user"]) == sorted(
+
+    assert response.status_code == status.HTTP_200_OK
+    assert sorted(response.json().pop("accesses")) == sorted(
        [
-            {
-                "id": str(access1.id),
-                "user": str(user.id),
-                "role": access1.role,
-                "abilities": access1.get_abilities(user),
-            },
-            {
-                "id": str(access2.id),
-                "user": str(access2.user.id),
-                "role": access2.role,
-                "abilities": access2.get_abilities(user),
-            },
-        ],
-        key=lambda x: x["user"],
+            str(access1.id),
+            str(access2.id),
+        ]
    )
    assert response.json() == {
        "id": str(team.id),
        "name": team.name,
        "slug": team.slug,
        "abilities": team.get_abilities(user),
+        "created_at": team.created_at.isoformat().replace("+00:00", "Z"),
+        "updated_at": team.updated_at.isoformat().replace("+00:00", "Z"),
    }
@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: update
 """
+
 import random

 import pytest
@@ -15,7 +16,6 @@ from rest_framework.test import APIClient

 from core import factories
 from core.api import serializers
-from core.tests.utils import OIDCToken

 pytestmark = pytest.mark.django_db

@@ -45,23 +45,23 @@ def test_api_teams_update_authenticated_unrelated():
    """
    Authenticated users should not be allowed to update a team to which they are not related.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory()
    old_team_values = serializers.TeamSerializer(instance=team).data

    new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{team.id!s}/",
        new_team_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}

    team.refresh_from_db()
    team_values = serializers.TeamSerializer(instance=team).data
@@ -73,19 +73,19 @@ def test_api_teams_update_authenticated_members():
    Users who are members of a team but not administrators should
    not be allowed to update it.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "member")])
    old_team_values = serializers.TeamSerializer(instance=team).data

    new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{team.id!s}/",
        new_team_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_403_FORBIDDEN
@@ -100,28 +100,30 @@ def test_api_teams_update_authenticated_members():

 def test_api_teams_update_authenticated_administrators():
    """Administrators of a team should be allowed to update it."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "administrator")])
    initial_values = serializers.TeamSerializer(instance=team).data

    # generate new random values
    new_values = serializers.TeamSerializer(instance=factories.TeamFactory.build()).data
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{team.id!s}/",
        new_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )
    assert response.status_code == HTTP_200_OK

    team.refresh_from_db()
    final_values = serializers.TeamSerializer(instance=team).data
    for key, value in final_values.items():
-        if key in ["id", "accesses"]:  # pylint: disable=R1733
+        if key in ["id", "accesses", "created_at"]:
            assert value == initial_values[key]
+        elif key == "updated_at":
+            assert value > initial_values[key]
        else:
            # name, slug and abilities successfully modified
            assert value == new_values[key]
@@ -130,9 +132,10 @@ def test_api_teams_update_authenticated_administrators():
 def test_api_teams_update_authenticated_owners():
    """Administrators of a team should be allowed to update it,
    apart from read-only fields."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    team = factories.TeamFactory(users=[(user, "owner")])
    old_team_values = serializers.TeamSerializer(instance=team).data
@@ -140,19 +143,20 @@ def test_api_teams_update_authenticated_owners():
    new_team_values = serializers.TeamSerializer(
        instance=factories.TeamFactory.build()
    ).data
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{team.id!s}/",
        new_team_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )
    assert response.status_code == HTTP_200_OK

    team.refresh_from_db()
    team_values = serializers.TeamSerializer(instance=team).data
    for key, value in team_values.items():
-        if key in ["id", "accesses"]:
+        if key in ["id", "accesses", "created_at"]:
            assert value == old_team_values[key]
+        elif key == "updated_at":
+            assert value > old_team_values[key]
        else:
            # name, slug and abilities successfully modified
            assert value == new_team_values[key]
@@ -163,24 +167,24 @@ def test_api_teams_update_administrator_or_owner_of_another():
    Being administrator or owner of a team should not grant authorization to update
    another team.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    factories.TeamFactory(users=[(user, random.choice(["administrator", "owner"]))])
    team = factories.TeamFactory(name="Old name")
    old_team_values = serializers.TeamSerializer(instance=team).data

    new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{team.id!s}/",
        new_team_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}

    team.refresh_from_db()
    team_values = serializers.TeamSerializer(instance=team).data
@@ -192,9 +196,10 @@ def test_api_teams_update_existing_slug_should_return_error():
    Updating a team's name to an existing slug should return a bad request,
    instead of creating a duplicate.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    factories.TeamFactory(name="Existing team", users=[(user, "administrator")])
    my_team = factories.TeamFactory(name="New team", users=[(user, "administrator")])
@@ -202,11 +207,10 @@ def test_api_teams_update_existing_slug_should_return_error():
    updated_values = serializers.TeamSerializer(instance=my_team).data
    # Update my team's name for existing team. Creates a duplicate slug
    updated_values["name"] = "existing team"
-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/teams/{my_team.id!s}/",
        updated_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )
    assert response.status_code == HTTP_400_BAD_REQUEST
    assert response.json()["slug"] == ["Team with this Slug already exists."]
@@ -1,6 +1,7 @@
 """
 Test contacts API endpoints in People's core app.
 """
+
 from django.test.utils import override_settings

 import pytest
@@ -9,8 +10,6 @@ from rest_framework.test import APIClient
 from core import factories, models
 from core.api import serializers

-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db


@@ -70,12 +69,10 @@ def test_api_contacts_list_authenticated_no_query():
    Authenticated users should be able to list contacts without applying a query.
    Profile and base contacts should be excluded.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
+    user = factories.UserFactory()
    contact = factories.ContactFactory(owner=user)
    user.profile_contact = contact
    user.save()
-    jwt_token = OIDCToken.for_user(user)

    # Let's have 5 contacts in database:
    assert user.profile_contact is not None  # Excluded because profile contact
@@ -87,9 +84,10 @@ def test_api_contacts_list_authenticated_no_query():
        base=base_contact, owner=user, full_name="Bernard"
    )  # Included

-    response = APIClient().get(
-        "/api/v1.0/contacts/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/")

    assert response.status_code == 200
    assert response.json() == [
@@ -109,9 +107,7 @@ def test_api_contacts_list_authenticated_by_full_name():
    Authenticated users should be able to search users with a case insensitive and
    partial query on the full name.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    dave = factories.BaseContactFactory(full_name="David Bowman")
    nicole = factories.BaseContactFactory(full_name="Nicole Foole")
@@ -119,36 +115,31 @@ def test_api_contacts_list_authenticated_by_full_name():
    factories.BaseContactFactory(full_name="Heywood Floyd")

    # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=David%20Bowman", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/?q=David%20Bowman")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(dave.id)]

    # Partial query should work
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ank", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ank")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(frank.id)]

    # Result that matches a trigram twice ranks better than result that matches once
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ole", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ole")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    # "Nicole Foole" matches twice on "ole"
    assert contact_ids == [str(nicole.id), str(frank.id)]

-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ool", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ool")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
@@ -157,25 +148,22 @@ def test_api_contacts_list_authenticated_by_full_name():

 def test_api_contacts_list_authenticated_uppercase_content():
    """Upper case content should be found by lower case query."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    dave = factories.BaseContactFactory(full_name="EEE", short_name="AAA")

    # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=eee", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/?q=eee")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(dave.id)]

    # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=aaa", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=aaa")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
@@ -184,25 +172,22 @@ def test_api_contacts_list_authenticated_uppercase_content():

 def test_api_contacts_list_authenticated_capital_query():
    """Upper case query should find lower case content."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    dave = factories.BaseContactFactory(full_name="eee", short_name="aaa")

+    client = APIClient()
+    client.force_login(user)
+
    # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=EEE", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=EEE")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(dave.id)]

    # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=AAA", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=AAA")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
@@ -211,25 +196,22 @@ def test_api_contacts_list_authenticated_capital_query():

 def test_api_contacts_list_authenticated_accented_content():
    """Accented content should be found by unaccented query."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    dave = factories.BaseContactFactory(full_name="ééé", short_name="ààà")

+    client = APIClient()
+    client.force_login(user)
+
    # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=eee", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=eee")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(dave.id)]

    # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=aaa", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=aaa")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
@@ -238,25 +220,22 @@ def test_api_contacts_list_authenticated_accented_content():

 def test_api_contacts_list_authenticated_accented_query():
    """Accented query should find unaccented content."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    dave = factories.BaseContactFactory(full_name="eee", short_name="aaa")

+    client = APIClient()
+    client.force_login(user)
+
    # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ééé", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ééé")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
    assert contact_ids == [str(dave.id)]

    # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ààà", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ààà")

    assert response.status_code == 200
    contact_ids = [contact["id"] for contact in response.json()]
@@ -279,15 +258,13 @@ def test_api_contacts_retrieve_authenticated_owned():
    """
    Authenticated users should be allowed to retrieve a contact they own.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
    contact = factories.ContactFactory(owner=user)

-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")

    assert response.status_code == 200
    assert response.json() == {
@@ -304,14 +281,13 @@ def test_api_contacts_retrieve_authenticated_public():
    """
    Authenticated users should be able to retrieve public contacts.
    """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
+    user = factories.UserFactory()
    contact = factories.BaseContactFactory()

-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")
    assert response.status_code == 200
    assert response.json() == {
        "id": str(contact.id),
@@ -327,14 +303,13 @@ def test_api_contacts_retrieve_authenticated_other():
    """
    Authenticated users should not be allowed to retrieve another user's contacts.
    """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
+    user = factories.UserFactory()
    contact = factories.ContactFactory()

-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")
    assert response.status_code == 403
    assert response.json() == {
        "detail": "You do not have permission to perform this action."
@@ -356,18 +331,18 @@ def test_api_contacts_create_anonymous_forbidden():

 def test_api_contacts_create_authenticated_missing_base():
    """Anonymous users should be able to create users."""
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(profile_contact=None)

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/contacts/",
        {
            "full_name": "David Bowman",
            "short_name": "Dave",
        },
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )
    assert response.status_code == 400
    assert models.Contact.objects.exists() is False
@@ -377,16 +352,16 @@ def test_api_contacts_create_authenticated_missing_base():

 def test_api_contacts_create_authenticated_successful():
    """Authenticated users should be able to create contacts."""
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory(profile_contact=None)
    base_contact = factories.BaseContactFactory()

+    client = APIClient()
+    client.force_login(user)
+
    # Existing override for another user should not interfere
    factories.ContactFactory(base=base_contact)

-    response = APIClient().post(
+    response = client.post(
        "/api/v1.0/contacts/",
        {
            "base": str(base_contact.id),
@@ -395,7 +370,6 @@ def test_api_contacts_create_authenticated_successful():
            "data": CONTACT_DATA,
        },
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 201
@@ -424,14 +398,14 @@ def test_api_contacts_create_authenticated_existing_override():
    Trying to create a contact for base contact that is already overriden by the user
    should receive a 400 error.
    """
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory(profile_contact=None)
    base_contact = factories.BaseContactFactory()
    factories.ContactFactory(base=base_contact, owner=user)

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/contacts/",
        {
            "base": str(base_contact.id),
@@ -440,7 +414,6 @@ def test_api_contacts_create_authenticated_existing_override():
            "data": CONTACT_DATA,
        },
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 400
@@ -479,9 +452,10 @@ def test_api_contacts_update_authenticated_owned():
    """
    Authenticated users should be allowed to update their own contacts.
    """
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(profile_contact=None)
+
+    client = APIClient()
+    client.force_login(user)

    contact = factories.ContactFactory(owner=user)  # Owned by the logged-in user
    old_contact_values = serializers.ContactSerializer(instance=contact).data
@@ -491,11 +465,10 @@ def test_api_contacts_update_authenticated_owned():
    ).data
    new_contact_values["base"] = str(factories.ContactFactory().id)

-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/contacts/{contact.id!s}/",
        new_contact_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 200
@@ -511,11 +484,12 @@ def test_api_contacts_update_authenticated_owned():

 def test_api_contacts_update_authenticated_profile():
    """
-    Authenticated users should be allowed to update their prodile contact.
+    Authenticated users should be allowed to update their profile contact.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    contact = factories.ContactFactory(owner=user)
    user.profile_contact = contact
@@ -527,11 +501,10 @@ def test_api_contacts_update_authenticated_profile():
    ).data
    new_contact_values["base"] = str(factories.ContactFactory().id)

-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/contacts/{contact.id!s}/",
        new_contact_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 200
@@ -548,9 +521,10 @@ def test_api_contacts_update_authenticated_other():
    """
    Authenticated users should not be allowed to update contacts owned by other users.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    contact = factories.ContactFactory()  # owned by another user
    old_contact_values = serializers.ContactSerializer(instance=contact).data
@@ -560,11 +534,10 @@ def test_api_contacts_update_authenticated_other():
    ).data
    new_contact_values["base"] = str(factories.ContactFactory().id)

-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/contacts/{contact.id!s}/",
        new_contact_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 403
@@ -586,15 +559,14 @@ def test_api_contacts_delete_list_anonymous():

 def test_api_contacts_delete_list_authenticated():
    """Authenticated users should not be allowed to delete a list of contacts."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    factories.ContactFactory.create_batch(2)

-    response = APIClient().delete(
-        "/api/v1.0/contacts/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.delete("/api/v1.0/contacts/")

    assert response.status_code == 405
    assert models.Contact.objects.count() == 4
@@ -615,15 +587,15 @@ def test_api_contacts_delete_authenticated_public():
    """
    Authenticated users should not be allowed to delete a public contact.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    contact = factories.BaseContactFactory()

-    response = APIClient().delete(
+    response = client.delete(
        f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 403
@@ -634,15 +606,14 @@ def test_api_contacts_delete_authenticated_owner():
    """
    Authenticated users should be allowed to delete a contact they own.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
    contact = factories.ContactFactory(owner=user)

-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
        f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 204
@@ -654,17 +625,16 @@ def test_api_contacts_delete_authenticated_profile():
    """
    Authenticated users should be allowed to delete their profile contact.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
    contact = factories.ContactFactory(owner=user, base=None)
    user.profile_contact = contact
    user.save()

-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
        f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 204
@@ -675,15 +645,14 @@ def test_api_contacts_delete_authenticated_other():
    """
    Authenticated users should not be allowed to delete a contact they don't own.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
    contact = factories.ContactFactory()

-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
        f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == 403
@@ -1,843 +0,0 @@
-"""
-Test team accesses API endpoints for users in People's core app.
-"""
-import random
-from uuid import uuid4
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-from core.api import serializers
-
-from .utils import OIDCToken
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_team_accesses_list_anonymous():
-    """Anonymous users should not be allowed to list team accesses."""
-    team = factories.TeamFactory()
-    factories.TeamAccessFactory.create_batch(2, team=team)
-
-    response = APIClient().get(f"/api/v1.0/teams/{team.id!s}/accesses/")
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_team_accesses_list_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to list team accesses for a team
-    to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    factories.TeamAccessFactory.create_batch(3, team=team)
-
-    # Accesses for other teams to which the user is related should not be listed either
-    other_access = factories.TeamAccessFactory(user=user)
-    factories.TeamAccessFactory(team=other_access.team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-    assert response.status_code == 200
-    assert response.json() == {
-        "count": 0,
-        "next": None,
-        "previous": None,
-        "results": [],
-    }
-
-
-def test_api_team_accesses_list_authenticated_related():
-    """
-    Authenticated users should be able to list team accesses for a team
-    to which they are related, whatever their role in the team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    user_access = models.TeamAccess.objects.create(team=team, user=user)  # random role
-    access1, access2 = factories.TeamAccessFactory.create_batch(2, team=team)
-
-    # Accesses for other teams to which the user is related should not be listed either
-    other_access = factories.TeamAccessFactory(user=user)
-    factories.TeamAccessFactory(team=other_access.team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    content = response.json()
-    assert len(content["results"]) == 3
-    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
-        [
-            {
-                "id": str(user_access.id),
-                "user": str(user.id),
-                "role": user_access.role,
-                "abilities": user_access.get_abilities(user),
-            },
-            {
-                "id": str(access1.id),
-                "user": str(access1.user.id),
-                "role": access1.role,
-                "abilities": access1.get_abilities(user),
-            },
-            {
-                "id": str(access2.id),
-                "user": str(access2.user.id),
-                "role": access2.role,
-                "abilities": access2.get_abilities(user),
-            },
-        ],
-        key=lambda x: x["id"],
-    )
-
-
-def test_api_team_accesses_retrieve_anonymous():
-    """
-    Anonymous users should not be allowed to retrieve a team access.
-    """
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-    )
-
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_team_accesses_retrieve_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to retrieve a team access for
-    a team to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-    # Accesses related to another team should be excluded even if the user is related to it
-    for access in [
-        factories.TeamAccessFactory(),
-        factories.TeamAccessFactory(user=user),
-    ]:
-        response = APIClient().get(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        assert response.status_code == 404
-        assert response.json() == {"detail": "Not found."}
-
-
-def test_api_team_accesses_retrieve_authenticated_related():
-    """
-    A user who is related to a team should be allowed to retrieve the
-    associated team user accesses.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[user])
-    access = factories.TeamAccessFactory(team=team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {
-        "id": str(access.id),
-        "user": str(access.user.id),
-        "role": access.role,
-        "abilities": access.get_abilities(user),
-    }
-
-
-def test_api_team_accesses_create_anonymous():
-    """Anonymous users should not be allowed to create team accesses."""
-    user = factories.UserFactory()
-    team = factories.TeamFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(user.id),
-            "team": str(team.id),
-            "role": random.choice(models.RoleChoices.choices)[0],
-        },
-        format="json",
-    )
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-    assert models.TeamAccess.objects.exists() is False
-
-
-def test_api_team_accesses_create_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to create team accesses for a team to
-    which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    other_user = factories.UserFactory()
-    team = factories.TeamFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You are not allowed to manage accesses for this team."
-    }
-    assert not models.TeamAccess.objects.filter(user=other_user).exists()
-
-
-def test_api_team_accesses_create_authenticated_member():
-    """Members of a team should not be allowed to create team accesses."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    other_user = factories.UserFactory()
-
-    api_client = APIClient()
-    for role in [role[0] for role in models.RoleChoices.choices]:
-        response = api_client.post(
-            f"/api/v1.0/teams/{team.id!s}/accesses/",
-            {
-                "user": str(other_user.id),
-                "role": role,
-            },
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        assert response.status_code == 403
-        assert response.json() == {
-            "detail": "You are not allowed to manage accesses for this team."
-        }
-
-    assert not models.TeamAccess.objects.filter(user=other_user).exists()
-
-
-def test_api_team_accesses_create_authenticated_administrator():
-    """
-    Administrators of a team should be able to create team accesses except for the "owner" role.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-
-    api_client = APIClient()
-
-    # It should not be allowed to create an owner access
-    response = api_client.post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": "owner",
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Only owners of a team can assign other users as owners."
-    }
-
-    # It should be allowed to create a lower access
-    role = random.choice(
-        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
-    )
-
-    response = api_client.post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 201
-    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
-    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "abilities": new_team_access.get_abilities(user),
-        "id": str(new_team_access.id),
-        "role": role,
-        "user": str(other_user.id),
-    }
-
-
-def test_api_team_accesses_create_authenticated_owner():
-    """
-    Owners of a team should be able to create team accesses whatever the role.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    other_user = factories.UserFactory()
-
-    role = random.choice([role[0] for role in models.RoleChoices.choices])
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 201
-    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
-    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "abilities": new_team_access.get_abilities(user),
-        "id": str(new_team_access.id),
-        "role": role,
-        "user": str(other_user.id),
-    }
-
-
-def test_api_team_accesses_update_anonymous():
-    """Anonymous users should not be allowed to update a team access."""
-    access = factories.TeamAccessFactory()
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-        )
-        assert response.status_code == 401
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to update a team access for a team to which
-    they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    access = factories.TeamAccessFactory()
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_authenticated_member():
-    """Members of a team should not be allowed to update its accesses."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    access = factories.TeamAccessFactory(team=team)
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_except_owner():
-    """
-    A user who is an administrator in a team should be allowed to update a user
-    access for this team, as long as they don't try to set the role to owner.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    access = factories.TeamAccessFactory(
-        team=team,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(["administrator", "member"]),
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        if (
-            new_data["role"] == old_values["role"]
-        ):  # we are not really updating the role
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
-        else:
-            assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_from_owner():
-    """
-    A user who is an administrator in a team, should not be allowed to update
-    the user access of an "owner" for this team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-    access = factories.TeamAccessFactory(team=team, user=other_user, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data={**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_to_owner():
-    """
-    A user who is an administrator in a team, should not be allowed to update
-    the user access of another user to grant team ownership.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-    access = factories.TeamAccessFactory(
-        team=team,
-        user=other_user,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": "owner",
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        # We are not allowed or not really updating the role
-        if field == "role" or new_data["role"] == old_values["role"]:
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_except_owner():
-    """
-    A user who is an owner in a team should be allowed to update
-    a user access for this team except for existing "owner" accesses.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    factories.UserFactory()
-    access = factories.TeamAccessFactory(
-        team=team,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        if (
-            new_data["role"] == old_values["role"]
-        ):  # we are not really updating the role
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
-        else:
-            assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_for_owners():
-    """
-    A user who is "owner" of a team should not be allowed to update
-    an existing owner access for this team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(team=team, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data={**old_values, field: value},
-            content_type="application/json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_self():
-    """
-    A user who is owner of a team should be allowed to update
-    their own user access provided there are other owners in the team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-    new_role = random.choice(["administrator", "member"])
-
-    api_client = APIClient()
-    response = api_client.put(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        data={**old_values, "role": new_role},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    access.refresh_from_db()
-    assert access.role == "owner"
-
-    # Add another owner and it should now work
-    factories.TeamAccessFactory(team=team, role="owner")
-
-    response = api_client.put(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        data={**old_values, "role": new_role},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    access.refresh_from_db()
-    assert access.role == new_role
-
-
-# Delete
-
-
-def test_api_team_accesses_delete_anonymous():
-    """Anonymous users should not be allowed to destroy a team access."""
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-    )
-
-    assert response.status_code == 401
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_authenticated():
-    """
-    Authenticated users should not be allowed to delete a team access for a
-    team to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_member():
-    """
-    Authenticated users should not be allowed to delete a team access for a
-    team in which they are a simple member.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    access = factories.TeamAccessFactory(team=team)
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 2
-
-
-def test_api_team_accesses_delete_administrators():
-    """
-    Users who are administrators in a team should be allowed to delete an access
-    from the team provided it is not ownership.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    access = factories.TeamAccessFactory(
-        team=team, role=random.choice(["member", "administrator"])
-    )
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 204
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_owners_except_owners():
-    """
-    Users should be able to delete the team access of another user
-    for a team of which they are owner provided it is not an owner access.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(
-        team=team, role=random.choice(["member", "administrator"])
-    )
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 204
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_owners_for_owners():
-    """
-    Users should not be allowed to delete the team access of another owner
-    even for a team in which they are direct owner.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(team=team, role="owner")
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 2
-
-
-def test_api_team_accesses_delete_owners_last_owner():
-    """
-    It should not be possible to delete the last owner access from a team
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
-
-    assert models.TeamAccess.objects.count() == 1
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 1
@@ -0,0 +1,412 @@
+"""
+Unit tests for the Invitation model
+"""
+
+import time
+
+import pytest
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from core import factories
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_invitations__create__anonymous():
+    """Anonymous users should not be able to create invitations."""
+    team = factories.TeamFactory()
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    response = APIClient().post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_invitations__create__authenticated_outsider():
+    """Users outside of team should not be permitted to invite to team."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.parametrize(
+    "role",
+    ["owner", "administrator"],
+)
+def test_api_team_invitations__create__privileged_members(role):
+    """Owners and administrators should be able to invite new members."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, role)])
+
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+
+
+def test_api_team_invitations__create__members():
+    """
+    Members should not be able to invite new members.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.json() == {
+        "detail": "You are not allowed to manage invitation for this team."
+    }
+
+
+def test_api_team_invitations__create__issuer_and_team_automatically_added():
+    """Team and issuer fields should auto-complete."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+
+    # Generate a random invitation
+    invitation = factories.InvitationFactory.build()
+    invitation_data = {"email": invitation.email, "role": invitation.role}
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_data,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    # team and issuer automatically set
+    assert response.json()["team"] == str(team.id)
+    assert response.json()["issuer"] == str(user.id)
+
+
+def test_api_team_invitations__create__cannot_duplicate_invitation():
+    """An email should not be invited multiple times to the same team."""
+    existing_invitation = factories.InvitationFactory()
+    team = existing_invitation.team
+
+    # Grant privileged role on the Team to the user
+    user = factories.UserFactory()
+    factories.TeamAccessFactory(team=team, user=user, role="administrator")
+
+    # Create a new invitation to the same team with the exact same email address
+    duplicated_invitation = serializers.InvitationSerializer(
+        factories.InvitationFactory.build(email=existing_invitation.email)
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        duplicated_invitation,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["__all__"] == [
+        "Team invitation with this Email address and Team already exists."
+    ]
+
+
+def test_api_team_invitations__create__cannot_invite_existing_users():
+    """
+    Should not be able to invite already existing users.
+    """
+    user, existing_user = factories.UserFactory.create_batch(2)
+    team = factories.TeamFactory(users=[(user, "administrator")])
+
+    # Build an invitation to the email of an exising identity in the db
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build(email=existing_user.email, team=team)
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["email"] == [
+        "This email is already associated to a registered user."
+    ]
+
+
+def test_api_team_invitations__list__anonymous_user():
+    """Anonymous users should not be able to list invitations."""
+    team = factories.TeamFactory()
+    response = APIClient().get(f"/api/v1.0/teams/{team.id}/invitations/")
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__list__authenticated():
+    """
+    Authenticated user should be able to list invitations
+    in teams they belong to, including from other issuers.
+    """
+    user, other_user = factories.UserFactory.create_batch(2)
+    team = factories.TeamFactory(users=[(user, "administrator"), (other_user, "owner")])
+    invitation = factories.InvitationFactory(
+        team=team, role="administrator", issuer=user
+    )
+    other_invitations = factories.InvitationFactory.create_batch(
+        2, team=team, role="member", issuer=other_user
+    )
+
+    # invitations from other teams should not be listed
+    other_team = factories.TeamFactory()
+    factories.InvitationFactory.create_batch(2, team=other_team, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+    )
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json()["count"] == 3
+    assert sorted(response.json()["results"], key=lambda x: x["created_at"]) == sorted(
+        [
+            {
+                "id": str(i.id),
+                "created_at": i.created_at.isoformat().replace("+00:00", "Z"),
+                "email": str(i.email),
+                "team": str(team.id),
+                "role": i.role,
+                "issuer": str(i.issuer.id),
+                "is_expired": False,
+            }
+            for i in [invitation, *other_invitations]
+        ],
+        key=lambda x: x["created_at"],
+    )
+
+
+def test_api_team_invitations__list__expired_invitations_still_listed(settings):
+    """
+    Expired invitations are still listed.
+    """
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+
+    team = factories.TeamFactory(users=[(user, "administrator"), (other_user, "owner")])
+
+    # override settings to accelerate validation expiration
+    settings.INVITATION_VALIDITY_DURATION = 1  # second
+    expired_invitation = factories.InvitationFactory(
+        team=team,
+        role="member",
+        issuer=user,
+    )
+    time.sleep(1)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+    )
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert sorted(response.json()["results"], key=lambda x: x["created_at"]) == sorted(
+        [
+            {
+                "id": str(expired_invitation.id),
+                "created_at": expired_invitation.created_at.isoformat().replace(
+                    "+00:00", "Z"
+                ),
+                "email": str(expired_invitation.email),
+                "team": str(team.id),
+                "role": expired_invitation.role,
+                "issuer": str(expired_invitation.issuer.id),
+                "is_expired": True,
+            },
+        ],
+        key=lambda x: x["created_at"],
+    )
+
+
+def test_api_team_invitations__retrieve__anonymous_user():
+    """
+    Anonymous user should not be able to retrieve invitations.
+    """
+
+    invitation = factories.InvitationFactory()
+    response = APIClient().get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__retrieve__unrelated_user():
+    """
+    Authenticated unrelated users should not be able to retrieve invitations.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_api_team_invitations__retrieve__team_member():
+    """
+    Authenticated team members should be able to retrieve invitations
+    whatever their role in the team.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+    factories.TeamAccessFactory(team=invitation.team, user=user, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {
+        "id": str(invitation.id),
+        "created_at": invitation.created_at.isoformat().replace("+00:00", "Z"),
+        "email": invitation.email,
+        "team": str(invitation.team.id),
+        "role": str(invitation.role),
+        "issuer": str(invitation.issuer.id),
+        "is_expired": False,
+    }
+
+
+@pytest.mark.parametrize(
+    "method",
+    ["put", "patch"],
+)
+def test_api_team_invitations__update__forbidden(method):
+    """
+    Update of invitations is currently forbidden.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+    factories.TeamAccessFactory(team=invitation.team, user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = None
+    if method == "put":
+        response = client.put(
+            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+        )
+    if method == "patch":
+        response = client.patch(
+            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+        )
+    assert response is not None
+    assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
+    assert response.json()["detail"] == f'Method "{method.upper()}" not allowed.'
+
+
+def test_api_team_invitations__delete__anonymous():
+    """Anonymous user should not be able to delete invitations."""
+    invitation = factories.InvitationFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__delete__authenticated_outsider():
+    """Members outside of team should not cancel invitations."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.parametrize("role", ["owner", "administrator"])
+def test_api_team_invitations__delete__privileged_members(role):
+    """Privileged member should be able to cancel invitation."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, role)])
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_204_NO_CONTENT
+
+
+def test_api_team_invitations__delete__members():
+    """Member should not be able to cancel invitation."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert (
+        response.json()["detail"]
+        == "You do not have permission to perform this action."
+    )
@@ -1,6 +1,7 @@
 """
 Test users API endpoints in the People core app.
 """
+
 from unittest import mock

 import pytest
@@ -16,8 +17,6 @@ from core import factories, models
 from core.api import serializers
 from core.api.viewsets import Pagination

-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db


@@ -36,12 +35,14 @@ def test_api_users_list_authenticated():
    """
    Authenticated users should be able to list all users.
    """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    factories.UserFactory.create_batch(2)
-    response = APIClient().get(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/",
    )
    assert response.status_code == HTTP_200_OK
    assert len(response.json()["results"]) == 3
@@ -52,189 +53,292 @@ def test_api_users_authenticated_list_by_email():
    Authenticated users should be able to search users with a case-insensitive and
    partial query on the email.
    """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(email="david.bowman@work.com", name=None)
+    nicole = factories.UserFactory(email="nicole_foole@work.com", name=None)
+    frank = factories.UserFactory(email="frank_poole@work.com", name=None)
+    factories.UserFactory(email="heywood_floyd@work.com", name=None)

-    dave = factories.IdentityFactory(email="david.bowman@work.com")
-    nicole = factories.IdentityFactory(email="nicole_foole@work.com")
-    frank = factories.IdentityFactory(email="frank_poole@work.com")
-    factories.IdentityFactory(email="heywood_floyd@work.com")
+    client = APIClient()
+    client.force_login(user)

    # Full query should work
-    response = APIClient().get(
+    response = client.get(
        "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids[0] == str(dave.user.id)
+    assert user_ids[0] == str(dave.id)

    # Partial query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=fran", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/users/?q=fran")

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids[0] == str(frank.user.id)
+    assert user_ids[0] == str(frank.id)

    # Result that matches a trigram twice ranks better than result that matches once
-    response = APIClient().get(
-        "/api/v1.0/users/?q=ole", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/users/?q=ole")

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
    # "Nicole Foole" matches twice on "ole"
-    assert user_ids == [str(nicole.user.id), str(frank.user.id)]
+    assert user_ids == [str(nicole.id), str(frank.id)]

    # Even with a low similarity threshold, query should match expected emails
-    response = APIClient().get(
-        "/api/v1.0/users/?q=ool", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get("/api/v1.0/users/?q=ool")
+
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["results"] == [
+        {
+            "id": str(nicole.id),
+            "email": nicole.email,
+            "name": nicole.name,
+            "is_device": nicole.is_device,
+            "is_staff": nicole.is_staff,
+            "language": nicole.language,
+            "timezone": str(nicole.timezone),
+        },
+        {
+            "id": str(frank.id),
+            "email": frank.email,
+            "name": frank.name,
+            "is_device": frank.is_device,
+            "is_staff": frank.is_staff,
+            "language": frank.language,
+            "timezone": str(frank.timezone),
+        },
+    ]
+
+
+def test_api_users_authenticated_list_by_name():
+    """
+    Authenticated users should be able to search users with a case-insensitive and
+    partial query on the name.
+    """
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(name="dave bowman", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    frank = factories.UserFactory(name="frank poole", email=None)
+    factories.UserFactory(name="heywood floyd", email=None)
+
+    client = APIClient()
+    client.force_login(user)
+
+    # Full query should work
+    response = client.get(
+        "/api/v1.0/users/?q=david.bowman@work.com",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(nicole.user.id), str(frank.user.id)]
+    assert user_ids[0] == str(dave.id)

-
-def test_api_users_authenticated_list_multiple_identities_single_user():
-    """
-    User with multiple identities should appear only once in results.
-    """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
-
-    dave = factories.UserFactory()
-    factories.IdentityFactory(user=dave, email="david.bowman@work.com")
-    factories.IdentityFactory(user=dave, email="david.bowman@fun.fr")
-
-    # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
+    # Partial query should work
+    response = client.get("/api/v1.0/users/?q=fran")

    assert response.status_code == HTTP_200_OK
-    # A single user is returned, despite similarity matching both emails
-    assert response.json()["count"] == 1
-    assert response.json()["results"][0]["id"] == str(dave.id)
-
-
-def test_api_users_authenticated_list_multiple_identities_multiple_users():
-    """
-    User with multiple identities should be ranked
-    on their best matching identity.
-    """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
-
-    dave = factories.UserFactory()
-    davina = factories.UserFactory()
-    prudence = factories.UserFactory()
-    factories.IdentityFactory(user=dave, email="david.bowman@work.com")
-    factories.IdentityFactory(user=dave, email="babibou@ehehe.com")
-    factories.IdentityFactory(user=davina, email="davina.bowan@work.com")
-    factories.IdentityFactory(user=prudence, email="prudence.crandall@work.com")
-
-    # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == HTTP_200_OK
-    assert response.json()["count"] == 3
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.id), str(davina.id), str(prudence.id)]
+    assert user_ids[0] == str(frank.id)
+
+    # Result that matches a trigram twice ranks better than result that matches once
+    response = client.get("/api/v1.0/users/?q=ole")
+
+    assert response.status_code == HTTP_200_OK
+    user_ids = [user["id"] for user in response.json()["results"]]
+    # "Nicole Foole" matches twice on "ole"
+    assert user_ids == [str(nicole.id), str(frank.id)]
+
+    # Even with a low similarity threshold, query should match expected user
+    response = client.get("/api/v1.0/users/?q=ool")
+
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["results"] == [
+        {
+            "id": str(nicole.id),
+            "email": nicole.email,
+            "name": nicole.name,
+            "is_device": nicole.is_device,
+            "is_staff": nicole.is_staff,
+            "language": nicole.language,
+            "timezone": str(nicole.timezone),
+        },
+        {
+            "id": str(frank.id),
+            "email": frank.email,
+            "name": frank.name,
+            "is_device": frank.is_device,
+            "is_staff": frank.is_staff,
+            "language": frank.language,
+            "timezone": str(frank.timezone),
+        },
+    ]
+
+
+def test_api_users_authenticated_list_by_name_and_email():
+    """
+    Authenticated users should be able to search users with a case-insensitive and
+    partial query on the name and email.
+    """
+
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    nicole = factories.UserFactory(email="nicole_foole@work.com", name="nicole foole")
+    frank = factories.UserFactory(email="oleg_poole@work.com", name=None)
+    david = factories.UserFactory(email=None, name="david role")
+
+    client = APIClient()
+    client.force_login(user)
+
+    # Result that matches a trigram in name and email ranks better than result that matches once
+    response = client.get("/api/v1.0/users/?q=ole")
+
+    assert response.status_code == HTTP_200_OK
+    user_ids = [user["id"] for user in response.json()["results"]]
+
+    # "Nicole Foole" matches twice on "ole" in her name and twice on "ole" in her email
+    # "Oleg poole" matches twice on "ole" in her email
+    # "David role" matches once on "ole" in his name
+    assert user_ids == [str(nicole.id), str(frank.id), str(david.id)]
+
+
+def test_api_users_authenticated_list_exclude_users_already_in_team(
+    django_assert_num_queries,
+):
+    """
+    Authenticated users should be able to search users
+    but the result should exclude all users already in the given team.
+    """
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(name="dave bowman", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    frank = factories.UserFactory(name="frank poole", email=None)
+    mary = factories.UserFactory(name="mary poole", email=None)
+    factories.UserFactory(name="heywood floyd", email=None)
+    factories.UserFactory(name="Andrei Smyslov", email=None)
+    factories.TeamFactory.create_batch(10)
+
+    client = APIClient()
+    client.force_login(user)
+
+    # Add Dave and Frank in the same team
+    team = factories.TeamFactory(
+        users=[
+            (dave, models.RoleChoices.MEMBER),
+            (frank, models.RoleChoices.MEMBER),
+        ]
+    )
+    factories.TeamFactory(users=[(nicole, models.RoleChoices.MEMBER)])
+
+    # Search user to add him/her to a team, we give a team id to the request
+    # to exclude all users already in the team
+
+    # We can't find David Bowman because he is already a member of the given team
+    # 2 queries are needed here:
+    # - user authenticated
+    # - search user query
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/users/?q=bowman&team_id={team.id}",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["results"] == []
+
+    # We can only find Nicole and Mary because Frank is already a member of the given team
+    # 4 queries are needed here:
+    # - user authenticated
+    # - search user query
+    # - User
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/users/?q=ool&team_id={team.id}",
+        )
+    assert response.status_code == HTTP_200_OK
+    user_ids = sorted([user["id"] for user in response.json()["results"]])
+    assert user_ids == sorted([str(mary.id), str(nicole.id)])


 def test_api_users_authenticated_list_uppercase_content():
    """Upper case content should be found by lower case query."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="eva karl")
+    dave = factories.UserFactory(
+        email="DAVID.BOWMAN@INTENSEWORK.COM", name="DAVID BOWMAN"
+    )

-    dave = factories.IdentityFactory(email="DAVID.BOWMAN@INTENSEWORK.COM")
+    client = APIClient()
+    client.force_login(user)

    # Unaccented full address
-    response = APIClient().get(
+    response = client.get(
        "/api/v1.0/users/?q=david.bowman@intensework.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]

    # Partial query
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=david",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]


 def test_api_users_list_authenticated_capital_query():
    """Upper case query should find lower case content."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="eva karl")
+    dave = factories.UserFactory(email="david.bowman@work.com", name="david bowman")

-    dave = factories.IdentityFactory(email="david.bowman@work.com")
+    client = APIClient()
+    client.force_login(user)

    # Full uppercase query
-    response = APIClient().get(
+    response = client.get(
        "/api/v1.0/users/?q=DAVID.BOWMAN@WORK.COM",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]

    # Partial uppercase email
-    response = APIClient().get(
-        "/api/v1.0/users/?q=DAVID", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=DAVID",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]


 def test_api_contacts_list_authenticated_accented_query():
    """Accented content should be found by unaccented query."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    helene = factories.UserFactory(email="helene.bowman@work.com", name="helene bowman")

-    helene = factories.IdentityFactory(email="helene.bowman@work.com")
+    client = APIClient()
+    client.force_login(user)

    # Accented full query
-    response = APIClient().get(
+    response = client.get(
        "/api/v1.0/users/?q=hélène.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(helene.user.id)]
+    assert user_ids == [str(helene.id)]

    # Unaccented partial email
-    response = APIClient().get(
-        "/api/v1.0/users/?q=hélène", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=hélène",
    )

    assert response.status_code == HTTP_200_OK
    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(helene.user.id)]
+    assert user_ids == [str(helene.id)]


@mock.patch.object(Pagination, "get_page_size", return_value=3)
@@ -242,15 +346,16 @@ def test_api_users_list_pagination(
    _mock_page_size,
 ):
    """Pagination should work as expected."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    factories.UserFactory.create_batch(4)

    # Get page 1
-    response = APIClient().get(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/",
    )

    assert response.status_code == HTTP_200_OK
@@ -262,8 +367,8 @@ def test_api_users_list_pagination(
    assert content["previous"] is None

    # Get page 2
-    response = APIClient().get(
-        "/api/v1.0/users/?page=2", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?page=2",
    )

    assert response.status_code == HTTP_200_OK
@@ -276,6 +381,56 @@ def test_api_users_list_pagination(
    assert len(content["results"]) == 2


+@pytest.mark.parametrize("page_size", [1, 10, 99, 100])
+def test_api_users_list_pagination_page_size(
+    page_size,
+):
+    """Page's size on pagination should work as expected."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(page_size):
+        factories.UserFactory.create(email=f"user-{i}@people.com")
+
+    response = client.get(
+        f"/api/v1.0/users/?page_size={page_size}",
+    )
+
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+
+    assert content["count"] == page_size + 1
+    assert len(content["results"]) == page_size
+
+
+@pytest.mark.parametrize("page_size", [101, 200])
+def test_api_users_list_pagination_wrong_page_size(
+    page_size,
+):
+    """Page's size on pagination should be limited to "max_page_size"."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(page_size):
+        factories.UserFactory.create(email=f"user-{i}@people.com")
+
+    response = client.get(
+        f"/api/v1.0/users/?page_size={page_size}",
+    )
+
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+
+    assert content["count"] == page_size + 1
+
+    # Length should not exceed "max_page_size" default value
+    assert len(content["results"]) == 100
+
+
 def test_api_users_retrieve_me_anonymous():
    """Anonymous users should not be allowed to list users."""
    factories.UserFactory.create_batch(2)
@@ -289,9 +444,10 @@ def test_api_users_retrieve_me_anonymous():

 def test_api_users_retrieve_me_authenticated():
    """Authenticated users should be able to retrieve their own user via the "/users/me" path."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    # Define profile contact
    contact = factories.ContactFactory(owner=user)
@@ -299,19 +455,19 @@ def test_api_users_retrieve_me_authenticated():
    user.save()

    factories.UserFactory.create_batch(2)
-    response = APIClient().get(
-        "/api/v1.0/users/me/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/me/",
    )

    assert response.status_code == HTTP_200_OK
    assert response.json() == {
        "id": str(user.id),
+        "name": str(user.name),
        "email": str(user.email),
        "language": user.language,
        "timezone": str(user.timezone),
        "is_device": False,
        "is_staff": False,
-        "data": user.profile_contact.data,
    }


@@ -332,12 +488,13 @@ def test_api_users_retrieve_authenticated_self():
    Authenticated users should be allowed to retrieve their own user.
    The returned object should not contain the password.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

-    response = APIClient().get(
-        f"/api/v1.0/users/{user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/users/{user.id!s}/",
    )
    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
    assert response.json() == {"detail": 'Method "GET" not allowed.'}
@@ -348,13 +505,13 @@ def test_api_users_retrieve_authenticated_other():
    Authenticated users should be able to retrieve another user's detail view with
    limited information.
    """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user, other_user = factories.UserFactory.create_batch(2)

-    other_user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)

-    response = APIClient().get(
-        f"/api/v1.0/users/{other_user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/users/{other_user.id!s}/",
    )
    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
    assert response.json() == {"detail": 'Method "GET" not allowed.'}
@@ -378,18 +535,18 @@ def test_api_users_create_anonymous():

 def test_api_users_create_authenticated():
    """Authenticated users should not be able to create users via the API."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
        "/api/v1.0/users/",
        {
            "language": "fr-fr",
            "password": "mypassword",
        },
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )
    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
    assert response.json() == {"detail": 'Method "POST" not allowed.'}
@@ -425,20 +582,20 @@ def test_api_users_update_authenticated_self():
    Authenticated users should be able to update their own user but only "language"
    and "timezone" fields.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    old_user_values = dict(serializers.UserSerializer(instance=user).data)
    new_user_values = dict(
        serializers.UserSerializer(instance=factories.UserFactory()).data
    )

-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/users/{user.id!s}/",
        new_user_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_200_OK
@@ -453,18 +610,19 @@ def test_api_users_update_authenticated_self():

 def test_api_users_update_authenticated_other():
    """Authenticated users should not be allowed to update other users."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    user = factories.UserFactory()
    old_user_values = dict(serializers.UserSerializer(instance=user).data)
    new_user_values = serializers.UserSerializer(instance=factories.UserFactory()).data

-    response = APIClient().put(
+    response = client.put(
        f"/api/v1.0/users/{user.id!s}/",
        new_user_values,
        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
    )

    assert response.status_code == HTTP_403_FORBIDDEN
@@ -505,9 +663,10 @@ def test_api_users_patch_authenticated_self():
    Authenticated users should be able to patch their own user but only "language"
    and "timezone" fields.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)

    old_user_values = dict(serializers.UserSerializer(instance=user).data)
    new_user_values = dict(
@@ -515,11 +674,10 @@ def test_api_users_patch_authenticated_self():
    )

    for key, new_value in new_user_values.items():
-        response = APIClient().patch(
+        response = client.patch(
            f"/api/v1.0/users/{user.id!s}/",
            {key: new_value},
            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
        )
        assert response.status_code == HTTP_200_OK

@@ -534,26 +692,27 @@ def test_api_users_patch_authenticated_self():

 def test_api_users_patch_authenticated_other():
    """Authenticated users should not be allowed to patch other users."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
    user = factories.UserFactory()
-    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    old_user_values = dict(serializers.UserSerializer(instance=other_user).data)
    new_user_values = dict(
        serializers.UserSerializer(instance=factories.UserFactory()).data
    )

    for key, new_value in new_user_values.items():
-        response = APIClient().put(
-            f"/api/v1.0/users/{user.id!s}/",
+        response = client.put(
+            f"/api/v1.0/users/{other_user.id!s}/",
            {key: new_value},
            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
        )
        assert response.status_code == HTTP_403_FORBIDDEN

-    user.refresh_from_db()
-    user_values = dict(serializers.UserSerializer(instance=user).data)
+    other_user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=other_user).data)
    for key, value in user_values.items():
        assert value == old_user_values[key]

@@ -571,13 +730,14 @@ def test_api_users_delete_list_anonymous():

 def test_api_users_delete_list_authenticated():
    """Authenticated users should not be allowed to delete a list of users."""
+    user = factories.UserFactory()
    factories.UserFactory.create_batch(2)
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)

    client = APIClient()
+    client.force_login(user)
+
    response = client.delete(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+        "/api/v1.0/users/",
    )

    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
@@ -598,13 +758,12 @@ def test_api_users_delete_authenticated():
    """
    Authenticated users should not be allowed to delete a user other than themselves.
    """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-    other_user = factories.UserFactory()
+    user, other_user = factories.UserFactory.create_batch(2)

-    response = APIClient().delete(
-        f"/api/v1.0/users/{other_user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(f"/api/v1.0/users/{other_user.id!s}/")

    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
    assert models.User.objects.count() == 2
@@ -612,12 +771,13 @@ def test_api_users_delete_authenticated():

 def test_api_users_delete_self():
    """Authenticated users should not be able to delete their own user."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()

-    response = APIClient().delete(
-        f"/api/v1.0/users/{identity.user.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/users/{user.id!s}/",
    )

    assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
@@ -1,6 +1,7 @@
 """
 Unit tests for the Contact model
 """
+
 from django.core.exceptions import ValidationError

 import pytest
@@ -52,7 +53,7 @@ def test_models_contacts_base_to_base():


 def test_models_contacts_owner_base_unique():
-    """Their should be only one contact deriving from a given base contact for a given owner."""
+    """There should be only one contact deriving from a given base contact for a given owner."""
    contact = factories.ContactFactory()

    with pytest.raises(ValidationError) as excinfo:
@@ -1,182 +0,0 @@
-"""
-Unit tests for the Identity model
-"""
-from django.core.exceptions import ValidationError
-
-import pytest
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_models_identities_str_main():
-    """The str representation should be the email address with indication that it is main."""
-    identity = factories.IdentityFactory(email="david@example.com")
-    assert str(identity) == "david@example.com[main]"
-
-
-def test_models_identities_str_secondary():
-    """The str representation of a secondary email should be the email address."""
-    main_identity = factories.IdentityFactory()
-    secondary_identity = factories.IdentityFactory(
-        user=main_identity.user, email="david@example.com"
-    )
-    assert str(secondary_identity) == "david@example.com"
-
-
-def test_models_identities_is_main_automatic():
-    """The first identity created for a user should automatically be set as main."""
-    user = factories.UserFactory()
-    identity = models.Identity.objects.create(
-        user=user, sub="123", email="david@example.com"
-    )
-    assert identity.is_main is True
-
-
-def test_models_identities_is_main_exists():
-    """A user should always keep one and only one of its identities as main."""
-    user = factories.UserFactory()
-    main_identity, _secondary_identity = factories.IdentityFactory.create_batch(
-        2, user=user
-    )
-
-    assert main_identity.is_main is True
-
-    main_identity.is_main = False
-    with pytest.raises(
-        ValidationError, match="A user should have one and only one main identity."
-    ):
-        main_identity.save()
-
-
-def test_models_identities_is_main_switch():
-    """Setting a secondary identity as main should reset the existing main identity."""
-    user = factories.UserFactory()
-    first_identity, second_identity = factories.IdentityFactory.create_batch(
-        2, user=user
-    )
-
-    assert first_identity.is_main is True
-
-    second_identity.is_main = True
-    second_identity.save()
-
-    second_identity.refresh_from_db()
-    assert second_identity.is_main is True
-
-    first_identity.refresh_from_db()
-    assert first_identity.is_main is False
-
-
-def test_models_identities_email_not_required():
-    """The "email" field can be blank."""
-    user = factories.UserFactory()
-    models.Identity.objects.create(user=user, sub="123", email=None)
-
-
-def test_models_identities_user_required():
-    """The "user" field is required."""
-    with pytest.raises(models.User.DoesNotExist, match="Identity has no user."):
-        models.Identity.objects.create(user=None, email="david@example.com")
-
-
-def test_models_identities_email_unique_same_user():
-    """The "email" field should be unique for a given user."""
-    email = factories.IdentityFactory()
-
-    with pytest.raises(
-        ValidationError,
-        match="Identity with this User and Email address already exists.",
-    ):
-        factories.IdentityFactory(user=email.user, email=email.email)
-
-
-def test_models_identities_email_unique_different_users():
-    """The "email" field should not be unique among users."""
-    email = factories.IdentityFactory()
-    factories.IdentityFactory(email=email.email)
-
-
-def test_models_identities_email_normalization():
-    """The email field should be automatically normalized upon saving."""
-    email = factories.IdentityFactory()
-    email.email = "Thomas.Jefferson@Example.com"
-    email.save()
-    assert email.email == "Thomas.Jefferson@example.com"
-
-
-def test_models_identities_ordering():
-    """Identitys should be returned ordered by main status then by their email address."""
-    user = factories.UserFactory()
-    factories.IdentityFactory.create_batch(5, user=user)
-
-    emails = models.Identity.objects.all()
-
-    assert emails[0].is_main is True
-    for i in range(3):
-        assert emails[i + 1].is_main is False
-        assert emails[i + 2].email >= emails[i + 1].email
-
-
-def test_models_identities_sub_null():
-    """The "sub" field should not be null."""
-    user = factories.UserFactory()
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        models.Identity.objects.create(user=user, sub=None)
-
-
-def test_models_identities_sub_blank():
-    """The "sub" field should not be blank."""
-    user = factories.UserFactory()
-    with pytest.raises(ValidationError, match="This field cannot be blank."):
-        models.Identity.objects.create(user=user, email="david@example.com", sub="")
-
-
-def test_models_identities_sub_unique():
-    """The "sub" field should be unique."""
-    user = factories.UserFactory()
-    identity = factories.IdentityFactory()
-    with pytest.raises(ValidationError, match="Identity with this Sub already exists."):
-        models.Identity.objects.create(user=user, sub=identity.sub)
-
-
-def test_models_identities_sub_max_length():
-    """The sub field should be 255 characters maximum."""
-    factories.IdentityFactory(sub="a" * 255)
-    with pytest.raises(ValidationError) as excinfo:
-        factories.IdentityFactory(sub="a" * 256)
-
-    assert (
-        str(excinfo.value)
-        == "{'sub': ['Ensure this value has at most 255 characters (it has 256).']}"
-    )
-
-
-def test_models_identities_sub_special_characters():
-    """The sub field should accept periods, dashes, +, @ and underscores."""
-    identity = factories.IdentityFactory(sub="dave.bowman-1+2@hal_9000")
-    assert identity.sub == "dave.bowman-1+2@hal_9000"
-
-
-def test_models_identities_sub_spaces():
-    """The sub field should not accept spaces."""
-    with pytest.raises(ValidationError) as excinfo:
-        factories.IdentityFactory(sub="a b")
-
-    assert str(excinfo.value) == (
-        "{'sub': ['Enter a valid sub. This value may contain only letters, numbers, "
-        "and @/./+/-/_ characters.']}"
-    )
-
-
-def test_models_identities_sub_upper_case():
-    """The sub field should accept upper case characters."""
-    identity = factories.IdentityFactory(sub="John")
-    assert identity.sub == "John"
-
-
-def test_models_identities_sub_ascii():
-    """The sub field should accept non ASCII letters."""
-    identity = factories.IdentityFactory(sub="rené")
-    assert identity.sub == "rené"
@@ -0,0 +1,300 @@
+"""
+Unit tests for the Invitation model
+"""
+
+import smtplib
+import time
+import uuid
+from logging import Logger
+from unittest import mock
+
+from django.contrib.auth.models import AnonymousUser
+from django.core import exceptions, mail
+
+import pytest
+from faker import Faker
+from freezegun import freeze_time
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+fake = Faker()
+
+
+def test_models_invitations_readonly_after_create():
+    """Existing invitations should be readonly."""
+    invitation = factories.InvitationFactory()
+    with pytest.raises(exceptions.PermissionDenied):
+        invitation.save()
+
+
+def test_models_invitations_email_no_empty_mail():
+    """The "email" field should not be empty."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be blank"):
+        factories.InvitationFactory(email="")
+
+
+def test_models_invitations_email_no_null_mail():
+    """The "email" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be null"):
+        factories.InvitationFactory(email=None)
+
+
+def test_models_invitations_team_required():
+    """The "team" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be null"):
+        factories.InvitationFactory(team=None)
+
+
+def test_models_invitations_team_should_be_team_instance():
+    """The "team" field should be a team instance."""
+    with pytest.raises(ValueError, match='Invitation.team" must be a "Team" instance'):
+        factories.InvitationFactory(team="ee")
+
+
+def test_models_invitations_role_required():
+    """The "role" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be blank"):
+        factories.InvitationFactory(role="")
+
+
+def test_models_invitations_role_among_choices():
+    """The "role" field should be a valid choice."""
+    with pytest.raises(
+        exceptions.ValidationError, match="Value 'boss' is not a valid choice"
+    ):
+        factories.InvitationFactory(role="boss")
+
+
+def test_models_invitations__is_expired(settings):
+    """
+    The 'is_expired' property should return False until validity duration
+    is exceeded and True afterwards.
+    """
+    expired_invitation = factories.InvitationFactory()
+    assert expired_invitation.is_expired is False
+
+    settings.INVITATION_VALIDITY_DURATION = 1
+    time.sleep(1)
+
+    assert expired_invitation.is_expired is True
+
+
+def test_models_invitation__new_user__convert_invitations_to_accesses():
+    """
+    Upon creating a new user, invitations linked to that email
+    should be converted to accesses and then deleted.
+    """
+    # Two invitations to the same mail but to different teams
+    invitation_to_team1 = factories.InvitationFactory()
+    invitation_to_team2 = factories.InvitationFactory(email=invitation_to_team1.email)
+
+    other_invitation = factories.InvitationFactory(
+        team=invitation_to_team2.team
+    )  # another person invited to team2
+
+    new_user = factories.UserFactory(email=invitation_to_team1.email)
+
+    # The invitation regarding
+    assert models.TeamAccess.objects.filter(
+        team=invitation_to_team1.team, user=new_user
+    ).exists()
+    assert models.TeamAccess.objects.filter(
+        team=invitation_to_team2.team, user=new_user
+    ).exists()
+    assert not models.Invitation.objects.filter(
+        team=invitation_to_team1.team, email=invitation_to_team1.email
+    ).exists()  # invitation "consumed"
+    assert not models.Invitation.objects.filter(
+        team=invitation_to_team2.team, email=invitation_to_team2.email
+    ).exists()  # invitation "consumed"
+    assert models.Invitation.objects.filter(
+        team=invitation_to_team2.team, email=other_invitation.email
+    ).exists()  # the other invitation remains
+
+
+def test_models_invitation__new_user__filter_expired_invitations():
+    """
+    Upon creating a new user, valid invitations should be converted into accesses
+    and expired invitations should remain unchanged.
+    """
+    with freeze_time("2020-01-01"):
+        expired_invitation = factories.InvitationFactory()
+    user_email = expired_invitation.email
+    valid_invitation = factories.InvitationFactory(email=user_email)
+
+    new_user = factories.UserFactory(email=user_email)
+
+    # valid invitation should have granted access to the related team
+    assert models.TeamAccess.objects.filter(
+        team=valid_invitation.team, user=new_user
+    ).exists()
+    assert not models.Invitation.objects.filter(
+        team=valid_invitation.team, email=user_email
+    ).exists()
+
+    # expired invitation should not have been consumed
+    assert not models.TeamAccess.objects.filter(
+        team=expired_invitation.team, user=new_user
+    ).exists()
+    assert models.Invitation.objects.filter(
+        team=expired_invitation.team, email=user_email
+    ).exists()
+
+
+@pytest.mark.parametrize("num_invitations, num_queries", [(0, 4), (1, 7), (20, 7)])
+def test_models_invitation__new_user__user_creation_constant_num_queries(
+    django_assert_num_queries, num_invitations, num_queries
+):
+    """
+    The number of queries executed during user creation should not be proportional
+    to the number of invitations being processed.
+    """
+    user_email = fake.email()
+
+    if num_invitations != 0:
+        for _ in range(0, num_invitations):
+            factories.InvitationFactory(email=user_email, team=factories.TeamFactory())
+
+    factories.UserFactory()
+
+    # with no invitation, we skip an "if", resulting in 8 requests
+    # otherwise, we should have 11 queries with any number of invitations
+    with django_assert_num_queries(num_queries):
+        models.User.objects.create(
+            email=user_email,
+            password="!",
+            name="Prudence C.",
+            sub=uuid.uuid4(),
+        )
+
+
+# get_abilities
+
+
+def test_models_team_invitations_get_abilities_anonymous():
+    """Check abilities returned for an anonymous user."""
+    access = factories.InvitationFactory()
+    abilities = access.get_abilities(AnonymousUser())
+    assert abilities == {
+        "delete": False,
+        "get": False,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_get_abilities_authenticated():
+    """Check abilities returned for an authenticated user."""
+    access = factories.InvitationFactory()
+    user = factories.UserFactory()
+    abilities = access.get_abilities(user)
+    assert abilities == {
+        "delete": False,
+        "get": False,
+        "patch": False,
+        "put": False,
+    }
+
+
+@pytest.mark.parametrize("role", ["administrator", "owner"])
+def test_models_team_invitations_get_abilities_privileged_member(role):
+    """Check abilities for a team member with a privileged role."""
+
+    pivileged_access = factories.TeamAccessFactory(role=role)
+    team = pivileged_access.team
+
+    factories.TeamAccessFactory(team=team)  # another one
+
+    invitation = factories.InvitationFactory(team=team)
+    abilities = invitation.get_abilities(pivileged_access.user)
+
+    assert abilities == {
+        "delete": True,
+        "get": True,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_get_abilities_member():
+    """Check abilities for a team member with 'member' role."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    factories.TeamAccessFactory(team=team)  # another one
+
+    invitation = factories.InvitationFactory(team=team)
+    abilities = invitation.get_abilities(member_access.user)
+
+    assert abilities == {
+        "delete": False,
+        "get": True,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_email():
+    """Check email invitation during invitation creation."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    factories.TeamAccessFactory(team=team)
+    invitation = factories.InvitationFactory(team=team, email="john@people.com")
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 1
+
+    # pylint: disable-next=no-member
+    email = mail.outbox[0]
+
+    assert email.to == [invitation.email]
+    assert email.subject == "Invitation to join Desk!"
+
+    email_content = " ".join(email.body.split())
+    assert "Invitation to join Desk!" in email_content
+    assert "[//example.com]" in email_content
+
+
+@mock.patch(
+    "django.core.mail.send_mail",
+    side_effect=smtplib.SMTPException("Error SMTPException"),
+)
+@mock.patch.object(Logger, "error")
+def test_models_team_invitations_email_failed(mock_logger, _mock_send_mail):
+    """Check invitation behavior when an SMTP error occurs during invitation creation."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    factories.TeamAccessFactory(team=team)
+
+    # No error should be raised
+    invitation = factories.InvitationFactory(team=team, email="john@people.com")
+
+    # No email has been sent
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    # Logger should be called
+    mock_logger.assert_called_once()
+
+    (
+        _,
+        email,
+        exception,
+    ) = mock_logger.call_args.args
+
+    assert email == invitation.email
+    assert isinstance(exception, smtplib.SMTPException)
@@ -1,107 +0,0 @@
-"""Unit tests for the `oidc_user_getter` function."""
-import pytest
-from rest_framework_simplejwt.exceptions import InvalidToken
-from rest_framework_simplejwt.tokens import AccessToken
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_models_oidc_user_getter_existing_user_no_email(django_assert_num_queries):
-    """
-    When a valid token is passed, an existing user matching the token's sub should be returned.
-    """
-    identity = factories.IdentityFactory()
-    factories.IdentityFactory(user=identity.user)  # another identity for the user
-    token = AccessToken()
-    token["sub"] = str(identity.sub)
-
-    with django_assert_num_queries(1):
-        user = models.oidc_user_getter(token)
-
-    identity.refresh_from_db()
-    assert user == identity.user
-
-
-def test_models_oidc_user_getter_existing_user_with_email(django_assert_num_queries):
-    """
-    When the valid token passed contains an email and targets an existing user,
-    it should update the email on the identity but not on the user.
-    """
-    identity = factories.IdentityFactory()
-    factories.IdentityFactory(user=identity.user)  # another identity for the user
-    user_email = identity.user.email
-    assert models.User.objects.count() == 1
-
-    token = AccessToken()
-    token["sub"] = str(identity.sub)
-
-    # Only 1 query if the email has not changed
-    token["email"] = identity.email
-    with django_assert_num_queries(1):
-        user = models.oidc_user_getter(token)
-
-    # Additional update query if the email has changed
-    new_email = "people@example.com"
-    token["email"] = new_email
-    with django_assert_num_queries(2):
-        user = models.oidc_user_getter(token)
-
-    identity.refresh_from_db()
-    assert identity.email == new_email
-
-    assert models.User.objects.count() == 1
-    assert user == identity.user
-    assert user.email == user_email
-
-
-def test_models_oidc_user_getter_new_user_no_email():
-    """
-    When a valid token is passed, a user should be created if the sub
-    does not match any existing user.
-    """
-    token = AccessToken()
-    token["sub"] = "123"
-
-    user = models.oidc_user_getter(token)
-
-    identity = user.identities.get()
-    assert identity.sub == "123"
-    assert identity.email is None
-
-    assert user.email is None
-    assert user.password == "!"
-    assert models.User.objects.count() == 1
-
-
-def test_models_oidc_user_getter_new_user_with_email():
-    """
-    When the valid token passed contains an email and a new user is created,
-    the email should be set on the user and on the identity.
-    """
-    email = "people@example.com"
-    token = AccessToken()
-    token["sub"] = "123"
-    token["email"] = email
-
-    user = models.oidc_user_getter(token)
-
-    identity = user.identities.get()
-    assert identity.sub == "123"
-    assert identity.email == email
-
-    assert user.email == email
-    assert models.User.objects.count() == 1
-
-
-def test_models_oidc_user_getter_invalid_token(django_assert_num_queries):
-    """The token passed in argument should contain the configured user id claim."""
-    token = AccessToken()
-
-    with django_assert_num_queries(0), pytest.raises(
-        InvalidToken, match="Token contained no recognizable user identification"
-    ):
-        models.oidc_user_getter(token)
-
-    assert models.User.objects.exists() is False
@@ -1,12 +1,17 @@
 """
 Unit tests for the TeamAccess model
 """
+
+import json
+import re
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError

 import pytest
+import responses

-from core import factories
+from core import factories, models

 pytestmark = pytest.mark.django_db

@@ -15,16 +20,13 @@ def test_models_team_accesses_str():
    """
    The str representation should include user name, team full name and role.
    """
-    contact = factories.ContactFactory(full_name="David Bowman")
-    user = contact.owner
-    user.profile_contact = contact
-    user.save()
+    user = factories.UserFactory()
    access = factories.TeamAccessFactory(
        role="member",
        user=user,
        team__name="admins",
    )
-    assert str(access) == "David Bowman is member in team admins"
+    assert str(access) == f"{user} is {access.role} in team {access.team}"


 def test_models_team_accesses_unique():
@@ -38,6 +40,94 @@ def test_models_team_accesses_unique():
        factories.TeamAccessFactory(user=access.user, team=access.team)


+def test_models_team_accesses_create_webhook():
+    """
+    When the team has a webhook, creating a team access should fire a call.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    webhook = factories.TeamWebhookFactory(team=team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        models.TeamAccess.objects.create(user=user, team=team)
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(user.id),
+                            "email": user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+
+def test_models_team_accesses_delete_webhook():
+    """
+    When the team has a webhook, deleting a team access should fire a call.
+    """
+    team = factories.TeamFactory()
+    webhook = factories.TeamWebhookFactory(team=team)
+    access = factories.TeamAccessFactory(team=team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        access.delete()
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "remove",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": access.user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    assert models.TeamAccess.objects.exists() is False
+
+
 # get_abilities


@@ -1,6 +1,7 @@
 """
 Unit tests for the Team model
 """
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError

@@ -61,7 +62,7 @@ def test_models_teams_get_abilities_anonymous():
    abilities = team.get_abilities(AnonymousUser())
    assert abilities == {
        "delete": False,
-        "get": True,
+        "get": False,
        "patch": False,
        "put": False,
        "manage_accesses": False,
@@ -74,7 +75,7 @@ def test_models_teams_get_abilities_authenticated():
    abilities = team.get_abilities(factories.UserFactory())
    assert abilities == {
        "delete": False,
-        "get": True,
+        "get": False,
        "patch": False,
        "put": False,
        "manage_accesses": False,
@@ -1,6 +1,7 @@
 """
 Unit tests for the User model
 """
+
 from unittest import mock

 from django.core.exceptions import ValidationError
@@ -13,13 +14,18 @@ pytestmark = pytest.mark.django_db


 def test_models_users_str():
-    """The str representation should be the full name."""
+    """
+    user str representation should return name or email when avalaible.
+    Otherwise, it should return the sub.
+    """
    user = factories.UserFactory()
-    contact = factories.ContactFactory(full_name="david bowman", owner=user)
-    user.profile_contact = contact
-    user.save()
+    assert str(user) == user.name

-    assert str(user) == "david bowman"
+    no_name_user = factories.UserFactory(name=None)
+    assert str(no_name_user) == no_name_user.email
+
+    no_name_no_email_user = factories.UserFactory(name=None, email=None)
+    assert str(no_name_no_email_user) == f"User {no_name_no_email_user.sub}"


 def test_models_users_id_unique():
@@ -29,23 +35,101 @@ def test_models_users_id_unique():
        factories.UserFactory(id=user.id)


-def test_models_users_email_unique():
-    """The "email" field should be unique except for the null value."""
+def test_models_users_sub_null():
+    """The 'sub' field should not be null."""
+    with pytest.raises(ValidationError, match="This field cannot be null.") as excinfo:
+        models.User.objects.create(sub=None, password="password")
+
+    assert str(excinfo.value) == "{'sub': ['This field cannot be null.']}"
+
+
+def test_models_users_sub_blank():
+    """The 'sub' field should not be blank."""
+    with pytest.raises(ValidationError, match="This field cannot be blank.") as excinfo:
+        models.User.objects.create(sub="", password="password")
+
+    assert str(excinfo.value) == "{'sub': ['This field cannot be blank.']}"
+
+
+def test_models_users_sub_unique():
+    """The 'sub' field should be unique."""
    user = factories.UserFactory()
-    with pytest.raises(
-        ValidationError, match="User with this Email address already exists."
-    ):
-        factories.UserFactory(email=user.email)
+    with pytest.raises(ValidationError, match="User with this Sub already exists."):
+        models.User.objects.create(sub=user.sub, password="password")
+
+
+def test_models_users_sub_max_length():
+    """The 'sub' field should be 255 characters maximum."""
+    factories.UserFactory(sub="a" * 255)
+    with pytest.raises(ValidationError) as excinfo:
+        factories.UserFactory(sub="a" * 256)
+
+    assert (
+        str(excinfo.value)
+        == "{'sub': ['Ensure this value has at most 255 characters (it has 256).']}"
+    )
+
+
+def test_models_users_sub_special_characters():
+    """The 'sub' field should accept periods, dashes, +, @ and underscores."""
+    user = factories.UserFactory(sub="dave.bowman-1+2@hal_9000")
+    assert user.sub == "dave.bowman-1+2@hal_9000"
+
+
+def test_models_users_sub_spaces():
+    """The 'sub' field should not accept spaces."""
+    with pytest.raises(ValidationError) as excinfo:
+        factories.UserFactory(sub="a b")
+
+    assert str(excinfo.value) == (
+        "{'sub': ['Enter a valid sub. This value may contain only letters, numbers, "
+        "and @/./+/-/_ characters.']}"
+    )
+
+
+def test_models_users_sub_upper_case():
+    """The 'sub' field should accept upper case characters."""
+    user = factories.UserFactory(sub="John")
+    assert user.sub == "John"
+
+
+def test_models_users_sub_ascii():
+    """The 'sub' field should accept non ASCII letters."""
+    user = factories.UserFactory(sub="rené")
+    assert user.sub == "rené"
+
+
+def test_models_users_email_not_required():
+    """The 'email' field can be blank."""
+    user = factories.UserFactory(email=None)
+    assert user.email is None
+
+
+def test_models_users_email_normalization():
+    """The 'email' field should be automatically normalized upon saving."""
+    user = factories.UserFactory()
+    user.email = "Thomas.Jefferson@Example.com"
+    user.save()
+
+    assert user.email == "Thomas.Jefferson@example.com"


 def test_models_users_email_several_null():
    """Several users with a null value for the "email" field can co-exist."""
    factories.UserFactory(email=None)
-    factories.UserFactory(email=None)
+    models.User.objects.create(email=None, sub="123", password="foo.")

    assert models.User.objects.filter(email__isnull=True).count() == 2


+def test_models_users_email_not_unique():
+    """The 'email' field should not necessarily be unique among users."""
+    user = factories.UserFactory()
+    other_user = factories.UserFactory(email=user.email)
+
+    assert user.email == other_user.email
+
+
 def test_models_users_profile_not_owned():
    """A user cannot declare as profile a contact that not is owned."""
    user = factories.UserFactory()
@@ -77,10 +161,9 @@ def test_models_users_profile_owned_by_other():


 def test_models_users_send_mail_main_existing():
-    """The "email_user' method should send mail to the user's main email address."""
-    main_email = factories.IdentityFactory(email="dave@example.com")
-    user = main_email.user
-    factories.IdentityFactory.create_batch(2, user=user)
+    """The 'email_user' method should send mail to the user's email address."""
+    user = factories.UserFactory(email="dave@example.com")
+    factories.UserFactory.create_batch(2)

    with mock.patch("django.core.mail.send_mail") as mock_send:
        user.email_user("my subject", "my message")
@@ -90,11 +173,23 @@ def test_models_users_send_mail_main_existing():
    )


-def test_models_users_send_mail_main_missing():
-    """The "email_user' method should fail if the user has no email address."""
+def test_models_users_send_mail_main_admin():
+    """
+    The 'email_user' method should send mail to the user's email address.
+    """
    user = factories.UserFactory()

-    with pytest.raises(models.Identity.DoesNotExist) as excinfo:
+    with mock.patch("django.core.mail.send_mail") as mock_send:
        user.email_user("my subject", "my message")

-    assert str(excinfo.value) == "Identity matching query does not exist."
+    mock_send.assert_called_once_with("my subject", "my message", None, [user.email])
+
+
+def test_models_users_send_mail_main_missing():
+    """The 'email_user' method should fail if the user has no email address."""
+    user = factories.UserFactory(email=None)
+
+    with pytest.raises(ValueError) as excinfo:
+        user.email_user("my subject", "my message")
+
+    assert str(excinfo.value) == "You must first set an email for the user."
@@ -1,6 +1,7 @@
 """
 Test Throttle in People's app.
 """
+
 import pytest
 from rest_framework.test import APIClient

@@ -8,8 +9,6 @@ from core import factories

 from people.settings import REST_FRAMEWORK  # pylint: disable=E0611

-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db


@@ -17,11 +16,10 @@ def test_throttle():
    """
    Throttle protection should block requests if too many.
    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()

    client = APIClient()
+    client.force_login(user)
    endpoint = "/api/v1.0/users/"

    # loop to activate throttle protection
@@ -29,8 +27,8 @@ def test_throttle():
        REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["burst"].replace("/minute", "")
    )
    for _ in range(0, throttle_limit):
-        client.get(endpoint, HTTP_AUTHORIZATION=f"Bearer {jwt_token}")
+        client.get(endpoint)

    # this call should err
-    response = client.get(endpoint, HTTP_AUTHORIZATION=f"Bearer {jwt_token}")
+    response = client.get(endpoint)
    assert response.status_code == 429  # too many requests
@@ -0,0 +1,341 @@
+"""Test Team synchronization webhooks."""
+
+import json
+import random
+import re
+from logging import Logger
+from unittest import mock
+
+import pytest
+import responses
+
+from core import factories
+from core.utils.webhooks import scim_synchronizer
+
+pytestmark = pytest.mark.django_db
+
+
+def test_utils_webhooks_add_user_to_group_no_webhooks():
+    """If no webhook is declared on the team, the function should not make any request."""
+    access = factories.TeamAccessFactory()
+
+    with responses.RequestsMock():
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+    assert len(responses.calls) == 0
+
+
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_success(mock_info):
+    """The user passed to the function should get added."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+            # Check headers
+            headers = rsps.calls[i].request.headers
+            assert "Authorization" not in headers
+            assert headers["Content-Type"] == "application/json"
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert mock_info.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_info.call_args_list[i][0] == (
+            "%s synchronization succeeded with %s",
+            "add_user_to_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_remove_user_from_group_success(mock_info):
+    """The user passed to the function should get removed."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.remove_user_from_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "remove",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert mock_info.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_info.call_args_list[i][0] == (
+            "%s synchronization succeeded with %s",
+            "remove_user_from_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_failure(mock_info, mock_error):
+    """The logger should be called on webhook call failure."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Simulate webhook failure using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=random.choice([404, 301, 302]),
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert not mock_info.called
+    assert mock_error.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_error.call_args_list[i][0] == (
+            "%s synchronization failed with %s",
+            "add_user_to_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "failure"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_retries(mock_info, mock_error):
+    """webhooks synchronization supports retries."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team)
+
+    url = re.compile(r".*/Groups/.*")
+    with responses.RequestsMock() as rsps:
+        # Make webhook fail 3 times before succeeding using "responses"
+        all_rsps = [
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=200, content_type="application/json"),
+        ]
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i in range(4):
+            assert all_rsps[i].call_count == 1
+            assert rsps.calls[i].request.url == webhook.url
+            payload = json.loads(rsps.calls[i].request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert not mock_error.called
+    assert mock_info.call_count == 1
+    assert mock_info.call_args_list[0][0] == (
+        "%s synchronization succeeded with %s",
+        "add_user_to_group",
+        webhook.url,
+    )
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_synchronize_course_runs_max_retries_exceeded(mock_info, mock_error):
+    """Webhooks synchronization has exceeded max retries and should get logged."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Simulate webhook temporary failure using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=random.choice([500, 502]),
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        assert rsp.call_count == 5
+        assert rsps.calls[0].request.url == webhook.url
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    # Logger
+    assert not mock_info.called
+    assert mock_error.call_count == 1
+    assert mock_error.call_args_list[0][0] == (
+        "%s synchronization failed due to max retries exceeded with url %s",
+        "add_user_to_group",
+        webhook.url,
+    )
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "failure"
+
+
+def test_utils_webhooks_add_user_to_group_authorization():
+    """Secret token should be passed in authorization header when set."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team, secret="123")
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Check headers
+        headers = rsps.calls[0].request.headers
+        assert headers["Authorization"] == "Bearer 123"
+        assert headers["Content-Type"] == "application/json"
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "success"
@@ -1,25 +0,0 @@
-"""Utils for tests in the People core application"""
-from rest_framework_simplejwt.tokens import AccessToken
-
-
-class OIDCToken(AccessToken):
-    """Set payload on token from user/contact/email"""
-
-    @classmethod
-    def for_user(cls, user):
-        """Returns an authorization token for the given user for testing."""
-        identity = user.identities.filter(is_main=True).first()
-
-        token = cls()
-        token["first_name"] = (
-            user.profile_contact.short_name if user.profile_contact else "David"
-        )
-        token["last_name"] = (
-            " ".join(user.profile_contact.full_name.split()[1:])
-            if user.profile_contact
-            else "Bowman"
-        )
-        token["sub"] = str(identity.sub)
-        token["email"] = user.email
-
-        return token
@@ -1,10 +0,0 @@
-"""Tokens for Magnify's core app."""
-from rest_framework_simplejwt.settings import api_settings
-from rest_framework_simplejwt.tokens import Token
-
-
-class BearerToken(Token):
-    """Bearer token as emitted by Keycloak OIDC for example."""
-
-    token_type = "Bearer"  # noqa: S105
-    lifetime = api_settings.ACCESS_TOKEN_LIFETIME
@@ -0,0 +1,70 @@
+"""A minimalist SCIM client to synchronize with remote service providers."""
+
+import logging
+
+import requests
+from urllib3.util import Retry
+
+logger = logging.getLogger(__name__)
+
+adapter = requests.adapters.HTTPAdapter(
+    max_retries=Retry(
+        total=4,
+        backoff_factor=0.1,
+        status_forcelist=[500, 502],
+        allowed_methods=["PATCH"],
+    )
+)
+
+session = requests.Session()
+session.mount("http://", adapter)
+session.mount("https://", adapter)
+
+
+class SCIMClient:
+    """A minimalist SCIM client for our needs."""
+
+    def add_user_to_group(self, webhook, user):
+        """Add a user to a group from its ID or email."""
+        payload = {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {"value": str(user.id), "email": user.email, "type": "User"}
+                    ],
+                }
+            ],
+        }
+
+        return session.patch(
+            webhook.url,
+            json=payload,
+            headers=webhook.get_headers(),
+            verify=False,
+            timeout=3,
+        )
+
+    def remove_user_from_group(self, webhook, user):
+        """Remove a user from a group by its ID or email."""
+        payload = {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "remove",
+                    "path": "members",
+                    "value": [
+                        {"value": str(user.id), "email": user.email, "type": "User"}
+                    ],
+                }
+            ],
+        }
+        return session.patch(
+            webhook.url,
+            json=payload,
+            headers=webhook.get_headers(),
+            verify=False,
+            timeout=3,
+        )
@@ -0,0 +1,75 @@
+"""Fire webhooks with synchronous retries"""
+
+import logging
+
+import requests
+
+from core.enums import WebhookStatusChoices
+
+from .scim import SCIMClient
+
+logger = logging.getLogger(__name__)
+
+
+class WebhookSCIMClient:
+    """Wraps the SCIM client to record call results on webhooks."""
+
+    def __getattr__(self, name):
+        """Handle calls from webhooks to synchronize a team access with a distant application."""
+
+        def wrapper(team, user):
+            """
+            Wrap SCIMClient calls to handle retries, error handling and storing result in the
+            calling Webhook instance.
+            """
+            for webhook in team.webhooks.all():
+                if not webhook.url:
+                    continue
+
+                client = SCIMClient()
+                status = WebhookStatusChoices.FAILURE
+                try:
+                    response = getattr(client, name)(webhook, user)
+
+                except requests.exceptions.RetryError as exc:
+                    logger.error(
+                        "%s synchronization failed due to max retries exceeded with url %s",
+                        name,
+                        webhook.url,
+                        exc_info=exc,
+                    )
+                except requests.exceptions.RequestException as exc:
+                    logger.error(
+                        "%s synchronization failed with %s.",
+                        name,
+                        webhook.url,
+                        exc_info=exc,
+                    )
+                else:
+                    extra = {
+                        "response": response.content,
+                    }
+                    # pylint: disable=no-member
+                    if response.status_code == requests.codes.ok:
+                        logger.info(
+                            "%s synchronization succeeded with %s",
+                            name,
+                            webhook.url,
+                            extra=extra,
+                        )
+
+                        status = WebhookStatusChoices.SUCCESS
+                    else:
+                        logger.error(
+                            "%s synchronization failed with %s",
+                            name,
+                            webhook.url,
+                            extra=extra,
+                        )
+
+                webhook._meta.model.objects.filter(id=webhook.id).update(status=status)  # noqa
+
+        return wrapper
+
+
+scim_synchronizer = WebhookSCIMClient()
@@ -0,0 +1,21 @@
+"""Debug Urls to check the layout of emails"""
+
+from django.urls import path
+
+from .views import (
+    DebugViewHtml,
+    DebugViewTxt,
+)
+
+urlpatterns = [
+    path(
+        "__debug__/mail/invitation_html",
+        DebugViewHtml.as_view(),
+        name="debug.mail.invitation_html",
+    ),
+    path(
+        "__debug__/mail/invitation_txt",
+        DebugViewTxt.as_view(),
+        name="debug.mail.invitation_txt",
+    ),
+]
@@ -0,0 +1,27 @@
+"""Debug Views to check the layout of emails"""
+
+from django.views.generic.base import TemplateView
+
+
+class DebugBaseView(TemplateView):
+    """Debug View to check the layout of emails"""
+
+    def get_context_data(self, **kwargs):
+        """Generates sample datas to have a valid debug email"""
+
+        context = super().get_context_data(**kwargs)
+        context["title"] = "Development email preview"
+
+        return context
+
+
+class DebugViewHtml(DebugBaseView):
+    """Debug View for HTML Email Layout"""
+
+    template_name = "mail/html/invitation.html"
+
+
+class DebugViewTxt(DebugBaseView):
+    """Debug View for Text Email Layout"""
+
+    template_name = "mail/text/invitation.txt"
@@ -3,6 +3,5 @@
 NB_OBJECTS = {
    "users": 1000,
    "teams": 100,
-    "max_identities_per_user": 3,
    "max_users_per_team": 100,
 }
@@ -11,10 +11,14 @@ from django import db
 from django.conf import settings
 from django.core.management.base import BaseCommand, CommandError

+from faker import Faker
+
 from core import models

 from demo import defaults

+fake = Faker()
+
 logger = logging.getLogger("people.commands.demo.create_demo")


@@ -111,7 +115,9 @@ def create_demo(stdout):
        for i in range(defaults.NB_OBJECTS["users"]):
            queue.push(
                models.User(
-                    email=f"user{i:d}@example.com",
+                    sub=uuid4(),
+                    email=f"user{i:d}@example.com" if random.random() < 0.97 else None,
+                    name=fake.name() if random.random() < 0.97 else None,
                    password="!",
                    is_superuser=False,
                    is_active=True,
@@ -121,23 +127,6 @@ def create_demo(stdout):
            )
        queue.flush()

-    with Timeit(stdout, "Creating identities"):
-        users_values = list(models.User.objects.values("id", "email"))
-        for user_dict in users_values:
-            for i in range(
-                random.randint(0, defaults.NB_OBJECTS["max_identities_per_user"])
-            ):
-                user_email = user_dict["email"]
-                queue.push(
-                    models.Identity(
-                        user_id=user_dict["id"],
-                        sub=uuid4(),
-                        email=f"identity{i:d}{user_email:s}",
-                        is_main=(i == 0),
-                    )
-                )
-        queue.flush()
-
    with Timeit(stdout, "Creating teams"):
        for i in range(defaults.NB_OBJECTS["teams"]):
            queue.push(
@@ -2,6 +2,7 @@
 Management command overriding the "createsuperuser" command to allow creating users
 with their email and no username.
 """
+
 from django.contrib.auth import get_user_model
 from django.core.management.base import BaseCommand

@@ -9,15 +10,17 @@ User = get_user_model()


 class Command(BaseCommand):
-    """Management command to create superusers from an email and a password"""
+    """
+    Management command to create superusers from a username and a password for demo purposes.
+    """

-    help = "Create a superuser with an email and a password"
+    help = "Create a superuser with a username and a password for demo purposes"

    def add_arguments(self, parser):
-        """Define required arguments "email" and "password"."""
+        """Define required arguments "username" and "password"."""
        parser.add_argument(
-            "--email",
-            help=("Email for the user."),
+            "--username",
+            help=("Username for the user."),
        )
        parser.add_argument(
            "--password",
@@ -29,11 +32,11 @@ class Command(BaseCommand):
        Given an email and a password, create a superuser or upgrade the existing
        user to superuser status.
        """
-        email = options.get("email")
+        username = options.get("username")
        try:
-            user = User.objects.get(email=email)
+            user = User.objects.get(sub=username)
        except User.DoesNotExist:
-            user = User(email=email)
+            user = User(sub=username)
            message = "Superuser created successfully."
        else:
            if user.is_superuser and user.is_staff:
@@ -1,4 +1,5 @@
 """Test the `create_demo` management command"""
+
 from unittest import mock

 from django.core.management import call_command
@@ -27,6 +28,18 @@ def test_commands_create_demo():
    call_command("create_demo")

    assert models.User.objects.count() == 5
-    assert models.Identity.objects.exists()
    assert models.Team.objects.count() == 3
    assert models.TeamAccess.objects.count() >= 3
+
+
+def test_commands_createsuperuser():
+    """
+    The createsuperuser management command should create a user
+    with superuser permissions.
+    """
+
+    call_command("createsuperuser", username="admin", password="admin")
+
+    assert models.User.objects.count() == 1
+    user = models.User.objects.get()
+    assert user.sub == "admin"
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-people\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-01-03 23:15+0000\n"
+"POT-Creation-Date: 2024-03-21 19:26+0000\n"
 "PO-Revision-Date: 2024-01-03 23:15\n"
 "Last-Translator: \n"
 "Language-Team: French\n"
@@ -17,175 +17,322 @@ msgstr ""
 "X-Crowdin-File: backend.pot\n"
 "X-Crowdin-File-ID: 2\n"

-#: core/models.py:30
+#: core/admin.py:70
+msgid "Personal info"
+msgstr ""
+
+#: core/admin.py:72
+msgid "Permissions"
+msgstr ""
+
+#: core/admin.py:84
+msgid "Important dates"
+msgstr ""
+
+#: core/authentication.py:81
+msgid "User info contained no recognizable user identification"
+msgstr ""
+
+#: core/authentication.py:114
+msgid "Claims contained no recognizable user identification"
+msgstr ""
+
+#: core/models.py:38
 msgid "Member"
 msgstr ""

-#: core/models.py:31
+#: core/models.py:39
 msgid "Administrator"
 msgstr ""

-#: core/models.py:32
+#: core/models.py:40
 msgid "Owner"
 msgstr ""

-#: core/models.py:44
+#: core/models.py:52
 msgid "id"
 msgstr ""

-#: core/models.py:45
+#: core/models.py:53
 msgid "primary key for the record as UUID"
 msgstr ""

-#: core/models.py:51
+#: core/models.py:59
 msgid "created at"
 msgstr ""

-#: core/models.py:52
+#: core/models.py:60
 msgid "date and time at which a record was created"
 msgstr ""

-#: core/models.py:57
+#: core/models.py:65
 msgid "updated at"
 msgstr ""

-#: core/models.py:58
+#: core/models.py:66
 msgid "date and time at which a record was last updated"
 msgstr ""

-#: core/models.py:89
+#: core/models.py:97
 msgid "full name"
 msgstr ""

-#: core/models.py:90
+#: core/models.py:98
 msgid "short name"
 msgstr ""

-#: core/models.py:95
+#: core/models.py:103
 msgid "contact information"
 msgstr ""

-#: core/models.py:96
+#: core/models.py:104
 msgid "A JSON object containing the contact information"
 msgstr ""

-#: core/models.py:110
+#: core/models.py:118
 msgid "contact"
 msgstr ""

-#: core/models.py:111
+#: core/models.py:119
 msgid "contacts"
 msgstr ""

-#: core/models.py:173
-msgid "language"
-msgstr ""
-
-#: core/models.py:174
-msgid "The language in which the user wants to see the interface."
-msgstr ""
-
-#: core/models.py:180
-msgid "The timezone in which the user wants to see times."
-msgstr ""
-
-#: core/models.py:183
-msgid "device"
-msgstr ""
-
-#: core/models.py:185
-msgid "Whether the user is a device or a real user."
-msgstr ""
-
-#: core/models.py:188
-msgid "staff status"
-msgstr ""
-
-#: core/models.py:190
-msgid "Whether the user can log into this admin site."
-msgstr ""
-
-#: core/models.py:193
-msgid "active"
-msgstr ""
-
-#: core/models.py:196
-msgid "Whether this user should be treated as active. Unselect this instead of deleting accounts."
-msgstr ""
-
-#: core/models.py:208
-msgid "user"
-msgstr ""
-
-#: core/models.py:209
-msgid "users"
-msgstr ""
-
-#: core/models.py:245
-msgid "Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters."
-msgstr ""
-
-#: core/models.py:252
-msgid "sub"
-msgstr ""
-
-#: core/models.py:254
-msgid "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
-msgstr ""
-
-#: core/models.py:260
+#: core/models.py:160 core/models.py:263 core/models.py:483
 msgid "email address"
 msgstr ""

-#: core/models.py:262
-msgid "main"
+#: core/models.py:172
+msgid "language"
+msgstr ""
+
+#: core/models.py:173
+msgid "The language in which the user wants to see the interface."
+msgstr ""
+
+#: core/models.py:179
+msgid "The timezone in which the user wants to see times."
+msgstr ""
+
+#: core/models.py:182
+msgid "device"
+msgstr ""
+
+#: core/models.py:184
+msgid "Whether the user is a device or a real user."
+msgstr ""
+
+#: core/models.py:187
+msgid "staff status"
+msgstr ""
+
+#: core/models.py:189
+msgid "Whether the user can log into this admin site."
+msgstr ""
+
+#: core/models.py:192
+msgid "active"
+msgstr ""
+
+#: core/models.py:195
+msgid ""
+"Whether this user should be treated as active. Unselect this instead of "
+"deleting accounts."
+msgstr ""
+
+#: core/models.py:207
+msgid "user"
+msgstr ""
+
+#: core/models.py:208
+msgid "users"
+msgstr ""
+
+#: core/models.py:248
+msgid ""
+"Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/"
+"_ characters."
+msgstr ""
+
+#: core/models.py:255
+msgid "sub"
+msgstr ""
+
+#: core/models.py:257
+msgid ""
+"Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ "
+"characters only."
 msgstr ""

 #: core/models.py:264
+msgid "name"
+msgstr ""
+
+#: core/models.py:266
+msgid "main"
+msgstr ""
+
+#: core/models.py:268
 msgid "Designates whether the email is the main one."
 msgstr ""

-#: core/models.py:270
+#: core/models.py:274
 msgid "identity"
 msgstr ""

-#: core/models.py:271
+#: core/models.py:275
 msgid "identities"
 msgstr ""

-#: core/models.py:278
+#: core/models.py:282
 msgid "This email address is already declared for this user."
 msgstr ""

-#: core/models.py:323
+#: core/models.py:356
 msgid "Team"
 msgstr ""

-#: core/models.py:324
+#: core/models.py:357
 msgid "Teams"
 msgstr ""

-#: core/models.py:375
+#: core/models.py:417
 msgid "Team/user relation"
 msgstr ""

-#: core/models.py:376
+#: core/models.py:418
 msgid "Team/user relations"
 msgstr ""

-#: core/models.py:381
+#: core/models.py:423
 msgid "This user is already in this team."
 msgstr ""

-#: core/models.py:451
-msgid "Token contained no recognizable user identification"
+#: core/models.py:500
+msgid "Team invitation"
 msgstr ""

-#: people/settings.py:132
-msgid "English"
+#: core/models.py:501
+msgid "Team invitations"
+msgstr ""
+
+#: core/models.py:526
+msgid "This email is already associated to a registered user."
+msgstr ""
+
+#: core/models.py:568 core/models.py:573
+msgid "Invitation to join Desk!"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:160
+#: core/templates/mail/text/invitation.txt:3
+msgid "La Suite Numérique"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:190
+#: core/templates/mail/text/invitation.txt:5
+msgid "Invitation to join a team"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:198
+#: core/templates/mail/text/invitation.txt:8
+msgid "Welcome to"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:216
+#: core/templates/mail/text/invitation.txt:12
+msgid "Logo"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:226
+#: core/templates/mail/text/invitation.txt:14
+msgid ""
+"We are delighted to welcome you to our community on Equipes, your new "
+"companion to simplify the management of your groups efficiently, "
+"intuitively, and securely."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:231
+#: core/templates/mail/text/invitation.txt:15
+msgid ""
+"Our application is designed to help you organize, collaborate, and manage "
+"permissions."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:236
+#: core/templates/mail/text/invitation.txt:16
+msgid "With Equipes, you will be able to:"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:237
+#: core/templates/mail/text/invitation.txt:17
+msgid "Create customized groups according to your specific needs."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:238
+#: core/templates/mail/text/invitation.txt:18
+msgid "Invite members of your team or community in just a few clicks."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:239
+#: core/templates/mail/text/invitation.txt:19
+msgid ""
+"Plan events, meetings, or activities effortlessly with our integrated "
+"calendar."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:240
+#: core/templates/mail/text/invitation.txt:20
+msgid "Share documents, photos, and important information securely."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:241
+#: core/templates/mail/text/invitation.txt:21
+msgid ""
+"Facilitate exchanges and communication with our messaging and group "
+"discussion tools."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:252
+#: core/templates/mail/text/invitation.txt:23
+msgid "Visit Equipes"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:261
+#: core/templates/mail/text/invitation.txt:25
+msgid ""
+"We are confident that Equipes will help you increase efficiency and "
+"productivity while strengthening the bond among members."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:266
+#: core/templates/mail/text/invitation.txt:26
+msgid ""
+"Feel free to explore all the features of the application and share your "
+"feedback and suggestions with us. Your feedback is valuable to us and will "
+"enable us to continually improve our service."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:271
+#: core/templates/mail/text/invitation.txt:27
+msgid ""
+"Once again, welcome aboard! We are eager to accompany you on this group "
+"management adventure."
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:278
+#: core/templates/mail/text/invitation.txt:29
+msgid "Sincerely,"
+msgstr ""
+
+#: core/templates/mail/html/invitation.html:279
+#: core/templates/mail/text/invitation.txt:31
+msgid "The La Suite Numérique Team"
 msgstr ""

 #: people/settings.py:133
-msgid "French"
+msgid "English"
 msgstr ""

+#: people/settings.py:134
+msgid "French"
+msgstr ""
@@ -0,0 +1,41 @@
+"""Admin classes and registrations for People's mailbox manager app."""
+
+from django.contrib import admin
+from django.utils.translation import gettext_lazy as _
+
+from mailbox_manager import models
+
+
+@admin.register(models.MailDomain)
+class MailDomainAdmin(admin.ModelAdmin):
+    """Mail domain admin interface declaration."""
+
+    list_display = (
+        "name",
+        "created_at",
+        "updated_at",
+        "slug",
+        "status",
+    )
+    search_fields = ("name",)
+    readonly_fields = ["created_at", "slug"]
+
+
+@admin.register(models.MailDomainAccess)
+class MailDomainAccessAdmin(admin.ModelAdmin):
+    """Admin for mail domain accesses model."""
+
+    list_display = (
+        "user",
+        "domain",
+        "role",
+        "created_at",
+        "updated_at",
+    )
+
+
+@admin.register(models.Mailbox)
+class MailboxAdmin(admin.ModelAdmin):
+    """Admin for mailbox model."""
+
+    list_display = ("__str__", "first_name", "last_name")
@@ -0,0 +1,23 @@
+"""Permission handlers for the People mailbox manager app."""
+
+from core.api import permissions as core_permissions
+
+from mailbox_manager import models
+
+
+class AccessPermission(core_permissions.IsAuthenticated):
+    """Permission class for access objects."""
+
+    def has_object_permission(self, request, view, obj):
+        """Check permission for a given object."""
+        abilities = obj.get_abilities(request.user)
+        return abilities.get(request.method.lower(), False)
+
+
+class MailBoxPermission(core_permissions.IsAuthenticated):
+    """Permission class to manage mailboxes for a mail domain"""
+
+    def has_permission(self, request, view):
+        domain = models.MailDomain.objects.get(slug=view.kwargs.get("domain_slug", ""))
+        abilities = domain.get_abilities(request.user)
+        return abilities.get(request.method.lower(), False)
@@ -0,0 +1,64 @@
+"""Client serializers for People's mailbox manager app."""
+
+from rest_framework import serializers
+
+from mailbox_manager import models
+
+
+class MailboxSerializer(serializers.ModelSerializer):
+    """Serialize mailbox."""
+
+    class Meta:
+        model = models.Mailbox
+        fields = ["id", "first_name", "last_name", "local_part", "secondary_email"]
+        # everything is actually read-only as we do not allow update for now
+        read_only_fields = ["id"]
+
+
+class MailDomainSerializer(serializers.ModelSerializer):
+    """Serialize mail domain."""
+
+    abilities = serializers.SerializerMethodField(read_only=True)
+
+    class Meta:
+        model = models.MailDomain
+        lookup_field = "slug"
+        fields = [
+            "id",
+            "name",
+            "slug",
+            "status",
+            "abilities",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = [
+            "id",
+            "slug",
+            "status",
+            "abilities",
+            "created_at",
+            "updated_at",
+        ]
+
+    def get_abilities(self, domain) -> dict:
+        """Return abilities of the logged-in user on the instance."""
+        request = self.context.get("request")
+        if request:
+            return domain.get_abilities(request.user)
+        return {}
+
+
+class MailDomainAccessSerializer(serializers.ModelSerializer):
+    """Serialize mail domain accesses."""
+
+    class Meta:
+        model = models.MailDomainAccess
+        fields = [
+            "id",
+            "user",
+            "role",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = ["id"]
@@ -0,0 +1,110 @@
+"""API endpoints"""
+
+from rest_framework import filters, mixins, viewsets
+from rest_framework import permissions as drf_permissions
+
+from core import models as core_models
+
+from mailbox_manager import models
+from mailbox_manager.api import permissions, serializers
+
+
+# pylint: disable=too-many-ancestors
+class MailDomainViewSet(
+    mixins.CreateModelMixin,
+    mixins.ListModelMixin,
+    mixins.RetrieveModelMixin,
+    viewsets.GenericViewSet,
+):
+    """
+    MailDomain viewset.
+
+    GET /api/<version>/mail-domains/
+        Return a list of mail domains user has access to.
+
+    GET /api/<version>/mail-domains/<domain-slug>/
+        Return details for a mail domain user has access to.
+
+    POST /api/<version>/mail-domains/ with expected data:
+        - name: str
+        Return newly created domain
+    """
+
+    permission_classes = [permissions.AccessPermission]
+    serializer_class = serializers.MailDomainSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["created_at", "name"]
+    ordering = ["-created_at"]
+    lookup_field = "slug"
+    queryset = models.MailDomain.objects.all()
+
+    def get_queryset(self):
+        return self.queryset.filter(accesses__user=self.request.user)
+
+    def perform_create(self, serializer):
+        """Set the current user as owner of the newly created mail domain."""
+
+        domain = serializer.save()
+        models.MailDomainAccess.objects.create(
+            user=self.request.user,
+            domain=domain,
+            role=core_models.RoleChoices.OWNER,
+        )
+
+
+# pylint: disable=too-many-ancestors
+class MailDomainAccessViewSet(
+    mixins.ListModelMixin,
+    viewsets.GenericViewSet,
+):
+    """
+    MailDomainAccess viewset.
+    """
+
+    permission_classes = [drf_permissions.IsAuthenticated]
+    serializer_class = serializers.MailDomainAccessSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["created_at", "user", "domain", "role"]
+    ordering = ["-created_at"]
+    queryset = models.MailDomainAccess.objects.all()
+
+
+class MailBoxViewSet(
+    mixins.CreateModelMixin,
+    mixins.ListModelMixin,
+    viewsets.GenericViewSet,
+):
+    """MailBox ViewSet
+
+    GET /api/<version>/mail-domains/<domain-slug>/mailboxes/
+        Return a list of mailboxes on the domain
+
+    POST /api/<version>/mail-domains/<domain-slug>/mailboxes/ with expected data:
+        - first_name: str
+        - last_name: str
+        - local_part: str
+        - secondary_email: str
+        Sends request to email provisioning API and returns newly created mailbox
+    """
+
+    permission_classes = [permissions.MailBoxPermission]
+    serializer_class = serializers.MailboxSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering = ["-created_at"]
+    queryset = models.Mailbox.objects.all()
+
+    def get_queryset(self):
+        """Custom queryset to get mailboxes related to a mail domain."""
+        domain_slug = self.kwargs.get("domain_slug", "")
+        if domain_slug:
+            return self.queryset.filter(domain__slug=domain_slug)
+        return self.queryset
+
+    def perform_create(self, serializer):
+        """Create new mailbox."""
+        domain_slug = self.kwargs.get("domain_slug", "")
+        if domain_slug:
+            serializer.validated_data["domain"] = models.MailDomain.objects.get(
+                slug=domain_slug
+            )
+        super().perform_create(serializer)
@@ -0,0 +1 @@
+"""People additionnal application, to manage email adresses."""
@@ -0,0 +1,23 @@
+"""
+Application enums declaration
+"""
+
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+
+
+class MailDomainRoleChoices(models.TextChoices):
+    """Defines the possible roles a user can have to access to a mail domain."""
+
+    VIEWER = "viewer", _("Viewer")
+    ADMIN = "administrator", _("Administrator")
+    OWNER = "owner", _("Owner")
+
+
+class MailDomainStatusChoices(models.TextChoices):
+    """Defines the possible statuses in which a mail domain can be."""
+
+    PENDING = "pending", _("Pending")
+    ENABLED = "enabled", _("Enabled")
+    FAILED = "failed", _("Failed")
+    DISABLED = "disabled", _("Disabled")
@@ -0,0 +1,114 @@
+"""
+Mailbox manager application factories
+"""
+
+import re
+
+from django.utils.text import slugify
+
+import factory.fuzzy
+import responses
+from faker import Faker
+from rest_framework import status
+
+from core import factories as core_factories
+from core import models as core_models
+
+from mailbox_manager import enums, models
+
+fake = Faker()
+
+
+class MailDomainFactory(factory.django.DjangoModelFactory):
+    """A factory to create mail domain. Please not this is a factory to create mail domain with
+    default values. So the status is pending and no mailbox can be created from it,
+    until the mail domain is enabled."""
+
+    class Meta:
+        model = models.MailDomain
+        django_get_or_create = ("name",)
+        skip_postgeneration_save = True
+
+    name = factory.Faker("domain_name")
+    slug = factory.LazyAttribute(lambda o: slugify(o.name))
+    secret = factory.Faker("password")
+
+    @factory.post_generation
+    def users(self, create, extracted, **kwargs):
+        """Add users to domain from a given list of users with or without roles."""
+        if not create or not extracted:
+            return
+        for user_entry in extracted:
+            if isinstance(user_entry, core_models.User):
+                MailDomainAccessFactory(domain=self, user=user_entry)
+            else:
+                MailDomainAccessFactory(
+                    domain=self, user=user_entry[0], role=user_entry[1]
+                )
+
+
+class MailDomainEnabledFactory(MailDomainFactory):
+    """A factory to create mail domain enabled."""
+
+    status = enums.MailDomainStatusChoices.ENABLED
+
+
+class MailDomainAccessFactory(factory.django.DjangoModelFactory):
+    """A factory to create mail domain accesses."""
+
+    class Meta:
+        model = models.MailDomainAccess
+
+    user = factory.SubFactory(core_factories.UserFactory)
+    domain = factory.SubFactory(MailDomainEnabledFactory)
+    role = factory.fuzzy.FuzzyChoice(
+        [r[0] for r in enums.MailDomainRoleChoices.choices]
+    )
+
+
+class MailboxFactory(factory.django.DjangoModelFactory):
+    """A factory to create mailboxes for a mail domain."""
+
+    class Meta:
+        model = models.Mailbox
+
+    first_name = factory.Faker("first_name", locale="fr_FR")
+    last_name = factory.Faker("last_name", locale="de_DE")
+
+    local_part = factory.LazyAttribute(
+        lambda a: f"{slugify(a.first_name)}.{slugify(a.last_name)}"
+    )
+    domain = factory.SubFactory(MailDomainEnabledFactory)
+    secondary_email = factory.Faker("email")
+
+    @classmethod
+    def _create(cls, model_class, *args, use_mock=True, **kwargs):
+        domain = kwargs["domain"]
+        if use_mock and isinstance(domain, models.MailDomain):
+            with responses.RequestsMock() as rsps:
+                # Ensure successful response using "responses":
+                rsps.add(
+                    rsps.GET,
+                    re.compile(r".*/token/"),
+                    body='{"access_token": "domain_owner_token"}',
+                    status=status.HTTP_200_OK,
+                    content_type="application/json",
+                )
+                rsps.add(
+                    rsps.POST,
+                    re.compile(rf".*/domains/{domain.name}/mailboxes/"),
+                    body=str(
+                        {
+                            "email": f"{kwargs['local_part']}@{domain.name}",
+                            "password": "newpass",
+                            "uuid": "uuid",
+                        }
+                    ),
+                    status=status.HTTP_201_CREATED,
+                    content_type="application/json",
+                )
+
+                result = super()._create(model_class, *args, **kwargs)
+        else:
+            result = super()._create(model_class, *args, **kwargs)
+        return result
@@ -0,0 +1,67 @@
+# Generated by Django 5.0.3 on 2024-04-16 12:51
+
+import django.core.validators
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='MailDomain',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('name', models.CharField(max_length=150, unique=True, verbose_name='name')),
+            ],
+            options={
+                'verbose_name': 'Mail domain',
+                'verbose_name_plural': 'Mail domains',
+                'db_table': 'people_mail_domain',
+            },
+        ),
+        migrations.CreateModel(
+            name='Mailbox',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('local_part', models.CharField(max_length=150, validators=[django.core.validators.RegexValidator(regex='^[a-zA-Z0-9_.+-]+$')], verbose_name='local_part')),
+                ('secondary_email', models.EmailField(max_length=254, verbose_name='secondary email address')),
+                ('domain', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain', to='mailbox_manager.maildomain')),
+            ],
+            options={
+                'verbose_name': 'Mailbox',
+                'verbose_name_plural': 'Mailboxes',
+                'db_table': 'people_mail_box',
+                'unique_together': {('local_part', 'domain')},
+            },
+        ),
+        migrations.CreateModel(
+            name='MailDomainAccess',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('role', models.CharField(choices=[('member', 'Member'), ('administrator', 'Administrator'), ('owner', 'Owner')], default='member', max_length=20)),
+                ('domain', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain_accesses', to='mailbox_manager.maildomain')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain_accesses', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'User/mail domain relation',
+                'verbose_name_plural': 'User/mail domain relations',
+                'db_table': 'people_mail_domain_accesses',
+                'unique_together': {('user', 'domain')},
+            },
+        ),
+    ]
@@ -0,0 +1,19 @@
+# Generated by Django 5.0.3 on 2024-04-17 11:58
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='maildomainaccess',
+            name='domain',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='accesses', to='mailbox_manager.maildomain'),
+        ),
+    ]
@@ -0,0 +1,18 @@
+# Generated by Django 5.0.6 on 2024-06-03 14:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0002_alter_maildomainaccess_domain'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='maildomain',
+            name='slug',
+            field=models.SlugField(blank=True, max_length=80),
+        ),
+    ]
@@ -0,0 +1,23 @@
+# Generated by Django 5.0.6 on 2024-06-03 14:14
+
+from django.db import migrations, models
+from django.utils.text import slugify
+
+
+def populate_slug(apps, schema_editor):
+    MailDomain = apps.get_model('mailbox_manager', 'MailDomain')
+    for mail_domain in MailDomain.objects.filter(slug=''):
+        mail_domain.slug = slugify(mail_domain.name)
+        mail_domain.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0003_maildomain_slug'),
+    ]
+
+    operations = [
+        migrations.RunPython(populate_slug, reverse_code=migrations.RunPython.noop),
+
+    ]
@@ -0,0 +1,18 @@
+# Generated by Django 5.0.6 on 2024-06-03 14:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0004_maildomain_fill_slug'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='maildomain',
+            name='slug',
+            field=models.SlugField(max_length=80, unique=True),
+        ),
+    ]
@@ -0,0 +1,18 @@
+# Generated by Django 5.0.6 on 2024-07-06 23:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0005_alter_maildomain_slug'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='maildomain',
+            name='status',
+            field=models.CharField(choices=[('pending', 'Pending'), ('enabled', 'Enabled'), ('failed', 'Failed'), ('disabled', 'Disabled')], default='pending', max_length=10),
+        ),
+    ]
@@ -0,0 +1,18 @@
+# Generated by Django 5.0.6 on 2024-08-02 15:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0006_maildomain_status'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='maildomainaccess',
+            name='role',
+            field=models.CharField(choices=[('viewer', 'Viewer'), ('administrator', 'Administrator'), ('owner', 'Owner')], default='viewer', max_length=20),
+        ),
+    ]
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`"""People additionnal application, to manage email adresses."""`