🔖(minor) release version 1.5.0

Update all version files and changelog for minor release.

.dockerignore

@@ -31,3 +31,6 @@ db.sqlite3
 .mypy_cache
 .pylint.d
 .pytest_cache
+
+# Frontend dependencies
+node_modules

.github/workflows/deploy.yml

@@ -0,0 +1,52 @@
+name: Deploy
+
+on:
+  push:
+    tags:
+      - 'preprod'
+      - 'production'
+
+
+jobs:
+  notify-argocd:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
+
+  start-test-on-preprod:
+    needs:
+      - notify-argocd
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.ref, 'refs/tags/preprod')
+    steps:
+      -
+        name: Debug
+        run: |
+          echo "Start test when preprod is ready"

.github/workflows/docker-hub.yml

@@ -1,4 +1,5 @@
 name: Docker Hub Workflow
+run-name: Docker Hub Workflow
 
 on:
   workflow_dispatch:
@@ -11,24 +12,76 @@ on:
     branches:
       - 'main'
 
+env:
+  DOCKER_USER: 1001:127
+
 jobs:
-  build-and-push:
+  trivy-scan:
     runs-on: ubuntu-latest
     steps:
       -
-        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
       -
         name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: lasuite/people
+          images: |
+            lasuite/people-backend
+            lasuite/people-frontend
+      -
+        name: Run trivy scan (backend)
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: 'docker.io/lasuite/people-backend:${{ github.sha }}'
+      -
+        name: Run trivy scan (frontend)
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target frontend-production -f Dockerfile'
+          docker-image-name: 'docker.io/lasuite/people-frontend:${{ github.sha }}'
+
+  build-and-push-backend:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/people-backend
       -
         name: Load sops secrets
         uses: rouja/actions-sops@main
         with:
-          secret-file: .github/workflows/secrets.enc.env
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
           age-key: ${{ secrets.SOPS_PRIVATE }}
       -
         name: Login to DockerHub
@@ -36,9 +89,89 @@ jobs:
         run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
+          target: backend-production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/people-frontend
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: frontend-production
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  notify-argocd:
+    needs:
+      - build-and-push-frontend
+      - build-and-push-backend
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "people,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL

.github/workflows/helmfile-linter.yml

@@ -0,0 +1,22 @@
+name: Helmfile lint
+run-name: Helmfile lint
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  helmfile-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/helmfile/helmfile:latest
+    steps:
+      -
+        uses: numerique-gouv/action-helmfile-lint@main
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          helmfile-src: "src/helm"
+          repositories: "people,secrets"

.github/workflows/people.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-    tags:
-      - 'v*'
   pull_request:
     branches:
       - '*'
@@ -16,9 +14,9 @@ jobs:
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
-            fetch-depth: 0
+          fetch-depth: 0
       - name: show
         run: git log
       - name: Enforce absence of print statements in code
@@ -39,9 +37,9 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
-            fetch-depth: 0
+          fetch-depth: 0
       - name: Check that the CHANGELOG has been modified in the current branch
         run: git whatchanged --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
 
@@ -49,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -58,11 +56,9 @@ jobs:
             exit 1
           fi
 
-  test-front:
+  install-front:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/frontend/
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -71,89 +67,165 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
 
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        if: steps.front-node_modules.outputs.cache-hit != 'true'
+        run: cd src/frontend/ && yarn install --frozen-lockfile
+
+      - name: Cache install frontend
+        if: steps.front-node_modules.outputs.cache-hit != 'true'
+        uses: actions/cache@v4
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+  build-front:
+    runs-on: ubuntu-latest
+    needs: install-front
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+      - name: Build CI App
+        run: cd src/frontend/ && yarn ci:build
+
+      - name: Cache build frontend
+        uses: actions/cache@v4
+        with:
+          path: src/frontend/apps/desk/out/
+          key: build-front-${{ github.run_id }}
+
+  test-front:
+    runs-on: ubuntu-latest
+    needs: install-front
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
 
       - name: Test App
-        run: yarn app:test
-
-      - name: Test Translations
-        run: yarn i18n:test
+        run: cd src/frontend/ && yarn app:test
 
   lint-front:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/frontend/
+    needs: install-front
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
         with:
-          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
 
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile
-        
       - name: Check linting
-        run: yarn lint
+        run: cd src/frontend/ && yarn lint
 
   test-e2e:
     runs-on: ubuntu-latest
+    needs: [build-mails, build-front]
     timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        shardIndex: [1, 2, 3, 4]
+        shardTotal: [4]
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-            
+
       - name: Set services env variables
         run: |
           make create-env-files
+          cat env.d/development/common.e2e.dist >> env.d/development/common
+
+      - name: Download mails' templates
+        uses: actions/download-artifact@v4
+        with:
+          name: mails-templates
+          path: src/backend/core/templates/mail
+
+      - name: Restore the frontend cache
+        uses: actions/cache@v4
+        id: front-node_modules
+        with:
+          path: 'src/frontend/**/node_modules'
+          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
+
+      - name: Restore the build cache
+        uses: actions/cache@v4
+        id: cache-build
+        with:
+          path: src/frontend/apps/desk/out/
+          key: build-front-${{ github.run_id }}
 
       - name: Build and Start Docker Servers
         env:
           DOCKER_BUILDKIT: 1
           COMPOSE_DOCKER_CLI_BUILD: 1
         run: |
-          docker-compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
+          docker compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
           make run
-        
-      - name: Apply DRH migrations 
+
+      - name: Apply DRF migrations
         run: |
           make migrate
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
-
-      - name: Install dependencies
-        run: cd src/frontend/ && yarn install --frozen-lockfile
+      - name: Add dummy data
+        run: |
+          make demo FLUSH_ARGS='--no-input'
 
       - name: Install Playwright Browsers
         run: cd src/frontend/apps/e2e && yarn install
 
-      - name: Build CI App
-        run: cd src/frontend/ && yarn ci:build
-
       - name: Run e2e tests
-        run: cd src/frontend/ && yarn e2e:test
+        run: cd src/frontend/ && yarn e2e:test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
 
-      - uses: actions/upload-artifact@v3
+      - name: Save logs
+        if: always()
+        run: docker compose logs > src/frontend/apps/e2e/report/logs.txt
+
+      - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: playwright-report
+          name: playwright-report-${{ matrix.shardIndex }}
           path: src/frontend/apps/e2e/report/
           retention-days: 7
 
+  tests-e2e-feedback:
+    runs-on: ubuntu-latest
+    needs: [test-e2e]
+    if: always()
+    steps:
+      - name: All tests ok
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Some tests failed
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1
+
   build-mails:
     runs-on: ubuntu-latest
     defaults:
@@ -161,7 +233,7 @@ jobs:
         working-directory: src/mail
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Node.js
         uses: actions/setup-node@v4
         with:
@@ -172,6 +244,11 @@ jobs:
         run: yarn install --frozen-lockfile
       - name: Build mails
         run: yarn build
+      - name: Persist mails' templates
+        uses: actions/upload-artifact@v4
+        with:
+          name: mails-templates
+          path: src/backend/core/templates/mail
 
   lint-back:
     runs-on: ubuntu-latest
@@ -180,9 +257,9 @@ jobs:
         working-directory: src/backend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: '3.10'
       - name: Install development dependencies
@@ -196,6 +273,7 @@ jobs:
 
   test-back:
     runs-on: ubuntu-latest
+    needs: build-mails
     defaults:
       run:
         working-directory: src/backend
@@ -216,7 +294,7 @@ jobs:
       DJANGO_CONFIGURATION: Test
       DJANGO_SETTINGS_MODULE: people.settings
       DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
-      DJANGO_JWT_PRIVATE_SIGNING_KEY: ThisIsAnExampleKeyForDevPurposeOnly
+      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
       DB_HOST: localhost
       DB_NAME: people
       DB_USER: dinum
@@ -225,13 +303,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Create writable /data
         run: |
           sudo mkdir -p /data/media && \
           sudo mkdir -p /data/static
+      - name: Download mails' templates
+        uses: actions/download-artifact@v4
+        with:
+          name: mails-templates
+          path: src/backend/core/templates/mail
       - name: Install Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: '3.10'
       - name: Install development dependencies
@@ -244,67 +327,3 @@ jobs:
         run: python manage.py compilemessages
       - name: Run tests
         run: ~/.local/bin/pytest -n 2
-
-  i18n-crowdin:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
-        
-      - name: Install gettext (required to make messages)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-      
-      - name: Install Python
-        uses: actions/setup-python@v3
-        with:
-          python-version: '3.10'
-
-      - name: Install development dependencies
-        working-directory: src/backend
-        run: pip install --user .[dev]
-
-      - name: Generate the translation base file
-        run: ~/.local/bin/django-admin makemessages --keep-pot --all
-        
-      - name: Load sops secrets
-        uses: rouja/actions-sops@main
-        with:
-          secret-file: .github/workflows/secrets.enc.env
-          age-key: ${{ secrets.SOPS_PRIVATE }}
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.x'
-          cache: 'yarn'
-          cache-dependency-path: src/frontend/yarn.lock
-
-      - name: Install dependencies
-        run: cd src/frontend/ && yarn install --frozen-lockfile
-
-      - name: Download sources from Crowdin to stay synchronized
-        run: |
-          docker run \
-          --rm \
-          -e CROWDIN_API_TOKEN=$CROWDIN_API_TOKEN \
-          -e CROWDIN_PROJECT_ID=$CROWDIN_PROJECT_ID \
-          -e CROWDIN_BASE_PATH=$CROWDIN_BASE_PATH \
-          -v "${{ github.workspace }}:/app" \
-          crowdin/cli:3.16.0 \
-          crowdin download sources -c /app/crowdin/config.yml
-      
-      - name: Extract the frontend translation
-        run: make frontend-i18n-extract
-      
-      - name: Upload files to Crowdin
-        run: |
-          docker run \
-          --rm \
-          -e CROWDIN_API_TOKEN=$CROWDIN_API_TOKEN \
-          -e CROWDIN_PROJECT_ID=$CROWDIN_PROJECT_ID \
-          -e CROWDIN_BASE_PATH=$CROWDIN_BASE_PATH \
-          -v "${{ github.workspace }}:/app" \
-          crowdin/cli:3.16.0 \
-          crowdin upload sources -c /app/crowdin/config.yml

.github/workflows/secrets.enc.env

@@ -1,20 +0,0 @@
-SOPS_PRIVATE=ENC[AES256_GCM,data:uMsnbpi1FFxO430iptp2axlH/souCPCJ/afCqh/kIDWs8xWHu0xJ2o6PlNOgb4l1gHF8sy4eSHFOW5HPKVbZ9gafRIL0JYHJr3A=,iv:IgaHDad7IuW2wFoxGALLDCs+UiSd3rEYwGNSX38wUfI=,tag:zs4wn4hDm5fghfI/7iH6CQ==,type:str]
-CROWDIN_API_TOKEN=ENC[AES256_GCM,data:tZRGFs792GjKYGit+oNubCwPbjWarhlgcyQ7oStO8K3nao0lEzLrm3+ARaOEXkzEkKSal2N1c+vlYIjRyzV1X7WZ7nZQWBiihEJgAfF3NGM=,iv:hohak/1niu5kV/W4XA0KEE3UB0BuNCDxbRxb0O+Aocs=,tag:Ssi0HyEhCKb9+WFyp3/yBQ==,type:str]
-CROWDIN_BASE_PATH=ENC[AES256_GCM,data:m44KrW5xJDE=,iv:bSyKrKQ0Z1yzrNaejAUyD+n1Z9z+ci92GoyS5KiiFKI=,tag:dDtpbn+6LkPwsg+qgMNWvA==,type:str]
-CROWDIN_PROJECT_ID=ENC[AES256_GCM,data:Gonh6ps7,iv:yUqPty+R060m6CYrDf7na2f6h0aRpIhRCXZoJW4ThJg=,tag:ewupoenajsc9o0Aj0r/niw==,type:str]
-DOCKER_HUB_PASSWORD=ENC[AES256_GCM,data:CBjUvS/UQcqdEv8=,iv:zJKGyyRnq+zxhKkYS5h3zw/J1320zrAqpiObcwiHWsA=,tag:OoQNe+4K63KXTWNsvjRZNQ==,type:str]
-DOCKER_HUB_USER=ENC[AES256_GCM,data:ivs7oeBBdA==,iv:cKAQJ071XhcRuFyeHhZkscvvz7sHrKIPJg5pt76hCXg=,tag:2VRmp1ULWvVH8NHcBifBGA==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbkIyRi9jTGEzL2RZcGFS\nVkhuN2xMN1FBcm04eGJQUnpvQVRpdmFmaFF3CjdoNVhSM0lrb0lTSXAyUytSKzhG\nNERYaC80OThmUUxCSmt2U2Q0Mno3b0kKLS0tIFRjQzYyOEcwTnRScGhzaGxwaGFL\namxEUXNaeVhWUjYwbzR2Z1Uzb3JsTlEK6tyhbRmcUP4Aql49DPkrYb5tbwvK2EdA\ntvyPQo4pPit+pzgqsVgW+O8Wo4/rYLlITfuVRrOfHEaH3wmf6hziSw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_0__map_recipient=age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIL2NwVjVtVmd1ZE15WmFC\nVGl5cnU1OHVUcXAxWmZCQXBJbXBlcXFUN0RzClpOVXBTek9wbVB6M2s5TWlFbUo3\nelZrT3dsK3p6cEJGTGJoSTRvaEh4NW8KLS0tIGlsL29oSEthU28xV0RERFIxTnZR\nSSs3YjdUT0NyTEtlbjlmZXVOaTd3SzgK5jFJGREfJ/HVytWsCKWFsqM5JoaFSnhv\n538KzzldzcbtWfnY+bQ6A2EBjETwOzCTuQB8axAMj0URXPI+qelKIQ==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_1__map_recipient=age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOWtwSytMNGRmSHNQN0Zz\nV1RTWktXT1c5VjYvNTg2V0x1U3JSTFA1dmtvCnc4RHRodjVxSzcrZXJycCtJMGNy\nZ3ZwbTFDTUc4TTMxbm8rNXQ1ME90Q1UKLS0tIERPUmg1dSt5OWQwaXV0Y2FiYWdt\nVzlhcFNvUS9Nd3A5ZTYwT2lLUU5WVU0KGHSm1BQ3voKs98WiXNLO6hlqoiQmi1/F\n2RCBkE4/gOVyAmJAjOFizaF0Dhd7Ba4KS5l5QylFHloL8XtyixEhog==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_2__map_recipient=age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYlB6cEZKK3NLbm5Ob0hi\nS3M0OFoyTHhVYVA1WmcvSHc2MUErQ2JyaUh3Cnp1NlYvU1BPUnVON29UZWUvWmEz\nOW85N013VUJ3Q1ZZUmMvTWdYclBZTUkKLS0tIG1KODdkazhTUHRPMXZXQnJFNXJY\nOFlSNjZCbkpxcm9tN1dFTkZ4K1lETFUKhiPwKEG71OlTcK/Ul1GKGayLy025vAmo\nNgQUhbqXf7KmqDAmrQNzXTsLsOpRi33l66jFSGkTsFtiXNlmjFljKg==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_3__map_recipient=age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
-sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJUzI2eDB0MU41YWoxcjAv\nOU8yMlowb3IybCtzcFBBTEVlUzdBczZkQlFNCk5tbnhLR2kweGNFZmx1OFgwaWZU\nTzRKZTBZamJjRFNYOUJlYmxTUVg4S2MKLS0tIDNGdlVVc0hLK1BPTUJVc0tPb1lK\ndVVWVi9GRkxwYXR1cXMrdnlsejJBeGsKKmVWvIMrBYH+UrDMkZPxN8KWnCgA6WK2\nbexMYr2AIF2QMbhck7XW2NuvAwvwjbJMfcd+cp9boe+EcC4YjdJZlw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_4__map_recipient=age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
-sops_lastmodified=2024-02-05T17:45:08Z
-sops_mac=ENC[AES256_GCM,data:WMsYYvGId0UlRhiw5C4TTpP/7oIIgWteGRtX7Nlo3qQwBc1LSUyN+7kblkXWD+nNG51B0xfl9E5QdXO3Ao2WskQZZEJqqkmt6wSw/ScSPcH56FoIqBhoGsPKyJOZkK0zojnCJQLniTDlISG0UiiJ4KHh8FJDWYbzAy2zFEm3Et8=,iv:zB2hyxnKiA3flsMQ7XFOT/fR9hamd6YWo3BNwce4oWM=,tag:uZ2Ia8sR5R8fmURtJ+PojA==,type:str]
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.8.1

.gitignore

@@ -66,6 +66,7 @@ src/frontend/tsclient
 
 # Test & lint
 .coverage
+coverage.json
 .pylint.d
 .pytest_cache
 db.sqlite3
@@ -79,3 +80,4 @@ db.sqlite3
 .vscode/
 *.iml
 .devcontainer/
+.tool-versions

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "secrets"]
+	path = secrets
+	url = ../secrets

.sops.yaml

@@ -1,13 +1,11 @@
 creation_rules:
-  # Here we have
-  # - Jacques key-id: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
-  # - github-repo key-id: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
-  # - Anthony Le-Courric key-id: age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
-  # - Antoine Lebaud key-id: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
-  # - Marie Pupo Jeammet key-id: age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
-  - age:
-      age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x,
-      age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7,
-      age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv,
-      age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3,
-      age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
+  - path_regex: ./*
+    key_groups:
+    - age:
+      - age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x # jacques
+      - age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7 # github-repo
+      - age1plkp8td6zzfcavjusmsfrlk54t9vn8jjxm8zaz7cmnr7kzl2nfnsd54hwg # Anthony Le-Courric
+      - age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3 # Antoine Lebaud
+      - age1hnhuzj96ktkhpyygvmz0x9h8mfvssz7ss6emmukags644mdhf4msajk93r # Samuel Paccoud
+      - age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa # Marie Pupo Jeammet
+      - age1rjchule5sncn8r8gfph07muee6vzx4wqfrtldt5jjzke4vlfxy2qqplfvc # Quentin Bey

CHANGELOG.md

@@ -7,3 +7,159 @@ and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [1.5.0] - 2024-11-14
+
+### Removed
+
+- ⬆️(dependencies) remove unneeded dependencies
+- 🔥(teams) remove pagination of teams listing
+- 🔥(teams) remove search users by trigram
+
+### Added
+
+- ✨(dimail) synchronize mailboxes from dimail to our db #453
+- ✨(ci) add security scan #429
+- ✨(teams) register contacts on admin views
+
+### Fixed
+
+- 🐛(mail) fix display button on outlook
+- 💚(ci) improve E2E tests #492
+- 🔧(sentry) restore default integrations
+- 🔇(backend) remove Sentry duplicated warning/errors
+- 👷(ci) add sharding e2e tests  #467
+
+### Removed
+
+- 🗃️(teams) remove `slug` field
+
+## [1.4.1] - 2024-10-23
+
+### Fixed
+
+- 🚑️(frontend) fix MailDomainsLayout
+
+## [1.4.0] - 2024-10-23
+
+### Added
+
+- ✨(frontend) add tabs inside #466
+
+### Fixed
+
+- ✏️(mail) fix typo into mailbox creation email
+- 🐛(sentry) fix duplicated sentry errors #479
+- 🐛(script) improve and fix release script
+
+## [1.3.1] - 2024-10-18
+
+## [1.3.0] - 2024-10-18
+
+### Added
+
+- ✨(api) add RELEASE version on config endpoint #459
+- ✨(backend) manage roles on domain admin view
+- ✨(frontend) show version number in footer #369
+- 👔(backend) add Organization model
+
+### Changed
+
+- 🛂(backend) match email if no existing user matches the sub
+
+### Fixed
+
+- 💄(mail) improve mailbox creation email #462
+- 🐛(frontend) fix update accesses form #448
+- 🛂(backend) do not duplicate user when disabled
+
+## [1.2.1] - 2024-10-03
+
+### Fixed
+
+- 🔧(mail) use new scaleway email gateway #435 
+
+
+## [1.2.0] - 2024-09-30
+
+
+### Added
+
+- ✨(ci) add helmfile linter and fix argocd sync #424 
+- ✨(domains) add endpoint to list and retrieve domain accesses #404
+- 🍱(dev) embark dimail-api as container #366
+- ✨(dimail) allow la regie to request a token for another user #416
+- ✨(frontend) show username on AccountDropDown #412
+- 🥅(frontend) improve add & update group forms error handling #387
+- ✨(frontend) allow group members filtering #363
+- ✨(mailbox) send new mailbox confirmation email #397
+- ✨(domains) domain accesses update API #423
+- ✨(backend) domain accesses create API #428
+- 🥅(frontend) catch new errors on mailbox creation #392
+- ✨(api) domain accesses delete API #433
+- ✨(frontend) add mail domain access management #413
+
+### Fixed
+
+- ♿️(frontend) fix left nav panel #396
+- 🔧(backend) fix configuration to avoid different ssl warning #432 
+
+### Changed
+
+- ♻️(serializers) move business logic to serializers #414 
+
+## [1.1.0] - 2024-09-10
+
+### Added
+
+- 📈(monitoring) configure sentry monitoring #378
+- 🥅(frontend) improve api error handling #355
+
+### Changed
+
+- 🗃️(models) move dimail 'secret' to settings #372 
+
+### Fixed
+
+- 🐛(dimail) improve handling of dimail errors on failed mailbox creation #377
+- 💬(frontend) fix group member removal text #382
+- 💬(frontend) fix add mail domain text #382
+- 🐛(frontend) fix keyboard navigation #379
+- 🐛(frontend) fix add mail domain form submission #355
+
+## [1.0.2] - 2024-08-30
+
+### Added
+
+- 🔧Runtime config for the frontend (#345)
+- 🔧(helm) configure resource server in staging
+
+### Fixed 
+
+- 👽️(mailboxes) fix mailbox creation after dimail api improvement (#360)
+
+## [1.0.1] - 2024-08-19
+
+### Fixed
+
+- ✨(frontend) user can add mail domains
+
+## [1.0.0] - 2024-08-09
+
+### Added
+
+- ✨(domains) create and manage domains on admin + API
+- ✨(domains) mailbox creation + link to email provisioning API
+
+[unreleased]: https://github.com/numerique-gouv/people/compare/v1.5.0...main
+[1.5.0]: https://github.com/numerique-gouv/people/releases/v1.5.0
+[1.4.1]: https://github.com/numerique-gouv/people/releases/v1.4.1
+[1.4.0]: https://github.com/numerique-gouv/people/releases/v1.4.0
+[1.3.1]: https://github.com/numerique-gouv/people/releases/v1.3.1
+[1.3.0]: https://github.com/numerique-gouv/people/releases/v1.3.0
+[1.2.1]: https://github.com/numerique-gouv/people/releases/v1.2.1
+[1.2.0]: https://github.com/numerique-gouv/people/releases/v1.2.0
+[1.1.0]: https://github.com/numerique-gouv/people/releases/v1.1.0
+[1.0.2]: https://github.com/numerique-gouv/people/releases/v1.0.2
+[1.0.1]: https://github.com/numerique-gouv/people/releases/v1.0.1
+[1.0.0]: https://github.com/numerique-gouv/people/releases/v1.0.0

Dockerfile

@@ -1,15 +1,63 @@
 # Django People
 
 # ---- base image to inherit from ----
-FROM python:3.10-slim-bullseye as base
+FROM python:3.12.6-alpine3.20 as base
 
 # Upgrade pip to its latest release to speed up dependencies installation
-RUN python -m pip install --upgrade pip
+RUN python -m pip install --upgrade pip setuptools
 
 # Upgrade system packages to install security updates
-RUN apt-get update && \
-  apt-get -y upgrade && \
-  rm -rf /var/lib/apt/lists/*
+RUN apk update && \
+  apk upgrade
+
+### ---- Front-end dependencies image ----
+FROM node:20 as frontend-deps
+
+WORKDIR /deps
+
+COPY ./src/frontend/package.json ./package.json
+COPY ./src/frontend/yarn.lock ./yarn.lock
+COPY ./src/frontend/apps/desk/package.json ./apps/desk/package.json
+COPY ./src/frontend/packages/i18n/package.json ./packages/i18n/package.json
+COPY ./src/frontend/packages/eslint-config-people/package.json ./packages/eslint-config-people/package.json
+
+RUN yarn --frozen-lockfile
+
+### ---- Front-end builder dev image ----
+FROM node:20 as frontend-builder-dev
+
+WORKDIR /builder
+
+COPY --from=frontend-deps /deps/node_modules ./node_modules
+COPY ./src/frontend .
+
+WORKDIR ./apps/desk
+
+### ---- Front-end builder image ----
+FROM frontend-builder-dev as frontend-builder
+
+RUN yarn build
+
+# ---- Front-end image ----
+FROM nginxinc/nginx-unprivileged:1.26-alpine as frontend-production
+
+# Un-privileged user running the application
+ARG DOCKER_USER
+USER ${DOCKER_USER}
+
+COPY --from=frontend-builder \
+    /builder/apps/desk/out \
+    /usr/share/nginx/html
+
+COPY ./src/frontend/apps/desk/conf/default.conf /etc/nginx/conf.d
+
+# Copy entrypoint
+COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
+
+ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
+
+CMD ["nginx", "-g", "daemon off;"]
+
 
 # ---- Back-end builder image ----
 FROM base as back-builder
@@ -24,7 +72,7 @@ RUN mkdir /install && \
 
 
 # ---- mails ----
-FROM node:18 as mail-builder
+FROM node:20 as mail-builder
 
 COPY ./src/mail /mail/app
 
@@ -39,11 +87,9 @@ FROM base as link-collector
 ARG PEOPLE_STATIC_ROOT=/data/static
 
 # Install libpangocairo & rdfind
-RUN apt-get update && \
-    apt-get install -y \
-      libpangocairo-1.0-0 \
-      rdfind && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk add \
+  pango \
+  rdfind
 
 # Copy installed python dependencies
 COPY --from=back-builder /install /usr/local
@@ -67,16 +113,13 @@ FROM base as core
 ENV PYTHONUNBUFFERED=1
 
 # Install required system libs
-RUN apt-get update && \
-    apt-get install -y \
-      gettext \
-      libcairo2 \
-      libffi-dev \
-      libgdk-pixbuf2.0-0 \
-      libpango-1.0-0 \
-      libpangocairo-1.0-0 \
-      shared-mime-info && \
-  rm -rf /var/lib/apt/lists/*
+RUN apk add \
+  gettext \
+  cairo \
+  libffi-dev \
+  gdk-pixbuf \
+  pango \
+  shared-mime-info
 
 # Copy entrypoint
 COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
@@ -100,15 +143,13 @@ WORKDIR /app
 ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
 
 # ---- Development image ----
-FROM core as development
+FROM core as backend-development
 
 # Switch back to the root user to install development dependencies
 USER root:root
 
 # Install psql
-RUN apt-get update && \
-    apt-get install -y postgresql-client && \
-    rm -rf /var/lib/apt/lists/*
+RUN apk add postgresql-client
 
 # Uninstall people and re-install it in editable mode along with development
 # dependencies
@@ -125,10 +166,10 @@ ENV DB_HOST=postgresql \
     DB_PORT=5432
 
 # Run django development server
-CMD python manage.py runserver 0.0.0.0:8000
+CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
 
 # ---- Production image ----
-FROM core as production
+FROM core as backend-production
 
 ARG PEOPLE_STATIC_ROOT=/data/static
 
@@ -147,4 +188,4 @@ COPY --from=link-collector ${PEOPLE_STATIC_ROOT} ${PEOPLE_STATIC_ROOT}
 COPY --from=mail-builder /mail/backend/core/templates/mail /app/core/templates/mail
 
 # The default command runs gunicorn WSGI server in people's main module
-CMD gunicorn -c /usr/local/etc/gunicorn/people.py people.wsgi:application
+CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/people.py", "people.wsgi:application"]

Makefile

@@ -88,6 +88,7 @@ bootstrap: \
 	back-i18n-compile \
 	mails-install \
 	mails-build \
+	dimail-setup-db \
 	install-front-desk
 .PHONY: bootstrap
 
@@ -109,6 +110,7 @@ run: ## start the wsgi (production) and development server
 	@$(COMPOSE) up --force-recreate -d app-dev
 	@$(COMPOSE) up --force-recreate -d celery-dev
 	@$(COMPOSE) up --force-recreate -d keycloak
+	@$(COMPOSE) up -d dimail
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_KC_DB)
 	@$(WAIT_DB)
@@ -129,6 +131,7 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo
 
+
 # Nota bene: Black should come after isort just in case they don't agree...
 lint: ## lint back-end python sources
 lint: \
@@ -166,24 +169,35 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel
 
+test-coverage: ## compute, display and save test coverage
+	bin/pytest --cov=. --cov-report json .
+.PHONY: test-coverage
 
 makemigrations:  ## run django makemigrations for the people project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) makemigrations
+	@$(MANAGE) makemigrations $(ARGS)
 .PHONY: makemigrations
 
 migrate:  ## run django migrations for the people project.
 	@echo "$(BOLD)Running migrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) migrate
+	@$(MANAGE) migrate $(ARGS)
 .PHONY: migrate
 
+showmigrations:  ## run django showmigrations for the people project.
+	@echo "$(BOLD)Running showmigrations$(RESET)"
+	@$(COMPOSE) up -d postgresql
+	@$(WAIT_DB)
+	@$(MANAGE) showmigrations $(ARGS)
+.PHONY: showmigrations
+
 superuser: ## Create an admin superuser with password "admin"
 	@echo "$(BOLD)Creating a Django superuser$(RESET)"
-	@$(MANAGE) createsuperuser --email admin@example.com --password admin
+	$(MANAGE) createsuperuser --username admin --password admin
+
 .PHONY: superuser
 
 back-i18n-compile: ## compile the gettext files
@@ -204,9 +218,10 @@ dbshell: ## connect to database shell
 	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell
 
+resetdb: FLUSH_ARGS ?=
 resetdb: ## flush database and create a superuser "admin"
 	@echo "$(BOLD)Flush database$(RESET)"
-	@$(MANAGE) flush
+	@$(MANAGE) flush $(FLUSH_ARGS)
 	@${MAKE} superuser
 .PHONY: resetdb
 
@@ -260,6 +275,17 @@ i18n-generate-and-upload: \
   crowdin-upload
 .PHONY: i18n-generate-and-upload
 
+# -- INTEROPERABILTY
+# -- Dimail configuration
+
+recreate-dimail-container:
+	@$(COMPOSE) up --force-recreate -d dimail
+.PHONY: recreate-dimail-container
+
+dimail-setup-db:
+	@echo "$(BOLD)Populating database of local dimail API container$(RESET)"
+	@$(MANAGE) setup_dimail_db
+.PHONY: dimail-setup-db
 
 # -- Mail generator
 
@@ -322,3 +348,16 @@ frontend-i18n-generate: \
 frontend-i18n-compile: ## Format the crowin json files used deploy to the apps
 	cd $(PATH_FRONT) && yarn i18n:deploy
 .PHONY: frontend-i18n-compile
+
+# -- K8S
+start-kind: ## Create the kubernetes cluster
+	./bin/start-kind.sh
+.PHONY: start-kind
+
+tilt-up: ## start tilt - k8s local development
+	tilt up -f ./bin/Tiltfile
+.PHONY: tilt-up
+
+release:  ## helper for release and deployment
+	python scripts/release.py
+.PHONY: release

README.md

@@ -1,12 +1,12 @@
 # People
 
-People is an application to handle users and teams. 
+People is an application to handle users and teams, and distribute permissions accross [La Suite](https://lasuite.numerique.gouv.fr/).
 
-This project is as of yet **not ready for production**. Expect breaking changes.
-
-People is built on top of [Django Rest
+It is built on top of [Django Rest
 Framework](https://www.django-rest-framework.org/).
 
+All interoperabilities will be described in `docs/interoperability`.
+
 ## Getting started
 
 ### Prerequisite
@@ -25,7 +25,7 @@ $ docker compose -v
 > ⚠️ You may need to run the following commands with `sudo` but this can be
 > avoided by assigning your user to the `docker` group.
 
-### Project bootstrap
+### Bootstrap project
 
 The easiest way to start working on the project is to use GNU Make:
 
@@ -38,7 +38,7 @@ database migrations and compile translations. It's a good idea to use this
 command each time you are pulling code from the project repository to avoid
 dependency-related or migration-related issues.
 
-Your Docker services should now be up and running 🎉
+Your Docker services should now be up and running! 🎉
 
 Note that if you need to run them afterward, you can use the eponym Make rule:
 
@@ -46,13 +46,7 @@ Note that if you need to run them afterward, you can use the eponym Make rule:
 $ make run
 ```
 
-### Adding content
-
-You can create a basic demo site by running:
-
-    $ make demo
-
-Finally, you can check all available Make rules using:
+You can check all available Make rules using:
 
 ```bash
 $ make help
@@ -69,6 +63,37 @@ You first need to create a superuser account:
 $ make superuser
 ```
 
+You can then login with sub `admin` and password `admin`.
+
+### Adding demo content
+
+You can create a basic demo site by running:
+
+```bash
+$ make demo
+```
+
+### Setting dimail database 
+
+To ease local development when working on interoperability between people and dimail, we embark dimail-api in a container running in "fake" mode. 
+
+To populate dimail local database with users/domains/permissions needed for basic development:
+- log in with "people" user
+- run `make dimail-setup-db`
+
+
+### Run frontend
+
+Run the front with:
+
+```bash
+$ make run-front-desk
+```
+
+Then access [http://localhost:3000](http://localhost:3000) with :
+user: people
+password: people
+
 ## Contributing
 
 This project is intended to be community-driven, so please, do not hesitate to

bin/Tiltfile

@@ -0,0 +1,58 @@
+load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
+load('ext://namespace', 'namespace_create', 'namespace_inject')
+namespace_create('desk')
+
+docker_build(
+    'localhost:5001/people-backend:latest',
+    context='..',
+    dockerfile='../Dockerfile',
+    only=['./src/backend', './src/mail', './docker'],
+    target = 'backend-production',
+    live_update=[
+        sync('../src/backend', '/app'),
+        run(
+            'pip install -r /app/requirements.txt',
+            trigger=['./api/requirements.txt']
+        )
+    ]
+)
+
+docker_build(
+    'localhost:5001/people-frontend:latest',
+    context='..',
+    dockerfile='../Dockerfile',
+    build_args={'ENV': 'dev'},
+    only=['./src/frontend', './src/mail', './docker'],
+    target = 'frontend-builder-dev',
+    live_update=[
+        sync('../src/frontend', '/builder'),
+    ]
+)
+
+k8s_yaml(local('cd ../src/helm && helmfile -n desk -e dev template .'))
+
+migration = '''
+set -eu
+# get k8s pod name from tilt resource name
+POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
+kubectl -n desk exec "$POD_NAME" -- python manage.py makemigrations
+'''
+cmd_button('Make migration',
+           argv=['sh', '-c', migration],
+           resource='desk-backend',
+           icon_name='developer_board',
+           text='Run makemigration',
+)
+
+pod_migrate = '''
+set -eu
+# get k8s pod name from tilt resource name
+POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
+kubectl -n desk exec "$POD_NAME" -- python manage.py migrate --no-input
+'''
+cmd_button('Migrate db',
+           argv=['sh', '-c', pod_migrate],
+           resource='desk-backend',
+           icon_name='developer_board',
+           text='Run database migration',
+)

bin/start-kind.sh

@@ -0,0 +1,102 @@
+#!/bin/sh
+set -o errexit
+
+CURRENT_DIR=$(pwd)
+
+# 0. Create ca
+echo "0. Create ca"
+mkcert -install
+cd /tmp
+mkcert "127.0.0.1.nip.io" "*.127.0.0.1.nip.io"
+cd $CURRENT_DIR
+
+# 1. Create registry container unless it already exists
+echo "1. Create registry container unless it already exists"
+reg_name='kind-registry'
+reg_port='5001'
+if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
+	docker run \
+		-d --restart=always -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
+		registry:2
+fi
+
+# 2. Create kind cluster with containerd registry config dir enabled
+echo "2. Create kind cluster with containerd registry config dir enabled"
+# TODO: kind will eventually enable this by default and this patch will
+# be unnecessary.
+#
+# See:
+# https://github.com/kubernetes-sigs/kind/issues/2875
+# https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
+# See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
+cat <<EOF | kind create cluster --config=-
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+containerdConfigPatches:
+- |-
+  [plugins."io.containerd.grpc.v1.cri".registry]
+    config_path = "/etc/containerd/certs.d"
+nodes:
+- role: control-plane
+  image: kindest/node:v1.27.3
+  kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        node-labels: "ingress-ready=true"
+  extraPortMappings:
+  - containerPort: 80
+    hostPort: 80
+    protocol: TCP
+  - containerPort: 443
+    hostPort: 443
+    protocol: TCP
+- role: worker
+  image: kindest/node:v1.27.3
+- role: worker
+  image: kindest/node:v1.27.3
+EOF
+
+# 3. Add the registry config to the nodes
+echo "3. Add the registry config to the nodes"
+#
+# This is necessary because localhost resolves to loopback addresses that are
+# network-namespace local.
+# In other words: localhost in the container is not localhost on the host.
+#
+# We want a consistent name that works from both ends, so we tell containerd to
+# alias localhost:${reg_port} to the registry container when pulling images
+REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
+for node in $(kind get nodes); do
+	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
+	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
+[host."http://${reg_name}:5000"]
+EOF
+done
+
+# 4. Connect the registry to the cluster network if not already connected
+echo "4. Connect the registry to the cluster network if not already connected"
+# This allows kind to bootstrap the network but ensures they're on the same network
+if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
+	docker network connect "kind" "${reg_name}"
+fi
+
+# 5. Document the local registry
+echo "5. Document the local registry"
+# https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: local-registry-hosting
+  namespace: kube-public
+data:
+  localRegistryHosting.v1: |
+    host: "localhost:${reg_port}"
+    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
+EOF
+
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
+kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
+kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   postgresql:
     image: postgres:16
@@ -19,11 +17,11 @@ services:
   app-dev:
     build:
       context: .
-      target: development
+      target: backend-development
       args:
         DOCKER_USER: ${DOCKER_USER:-1000}
     user: ${DOCKER_USER:-1000}
-    image: people:development
+    image: people:backend-development
     environment:
       - PYLINTHOME=/app/.pylint.d
       - DJANGO_CONFIGURATION=Development
@@ -43,7 +41,7 @@ services:
   
   celery-dev:
     user: ${DOCKER_USER:-1000}
-    image: people:development
+    image: people:backend-development
     command: ["celery", "-A", "people.celery_app", "worker", "-l", "DEBUG"]
     environment:
       - DJANGO_CONFIGURATION=Development
@@ -60,13 +58,13 @@ services:
   app:
     build:
       context: .
-      target: production
+      target: backend-production
       args:
         DOCKER_USER: ${DOCKER_USER:-1000}
     user: ${DOCKER_USER:-1000}
-    image: people:production
+    image: people:backend-production
     environment:
-      - DJANGO_CONFIGURATION=ContinuousIntegration
+      - DJANGO_CONFIGURATION=Demo
     env_file:
       - env.d/development/common
       - env.d/development/postgresql
@@ -78,10 +76,10 @@ services:
 
   celery:
     user: ${DOCKER_USER:-1000}
-    image: people:production
+    image: people:backend-production
     command: ["celery", "-A", "people.celery_app", "worker", "-l", "INFO"]
     environment:
-      - DJANGO_CONFIGURATION=ContinuousIntegration
+      - DJANGO_CONFIGURATION=Demo
     env_file:
       - env.d/development/common
       - env.d/development/postgresql
@@ -91,14 +89,12 @@ services:
   nginx:
     image: nginx:1.25
     ports:
-      - "8082:8082"
-      - "8088:8088"
+      - "8083:8083"
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
-      - ./src/frontend/apps/desk/out:/home/desk
-      - ./data/media:/data/media:ro
     depends_on:
       - app
+      - keycloak
 
   dockerize:
     image: jwilder/dockerize
@@ -138,7 +134,6 @@ services:
 
   kc_postgresql:
       image: postgres:14.3
-      platform: linux/amd64
       ports:
         - "5433:5432"
       env_file:
@@ -152,6 +147,11 @@ services:
       - start-dev
       - --features=preview
       - --import-realm
+      - --proxy=edge
+      - --hostname-url=http://localhost:8083
+      - --hostname-admin-url=http://localhost:8083/
+      - --hostname-strict=false
+      - --hostname-strict-https=false
     environment:
       KEYCLOAK_ADMIN: admin
       KEYCLOAK_ADMIN_PASSWORD: admin
@@ -161,7 +161,16 @@ services:
       KC_DB_PASSWORD: pass
       KC_DB_USERNAME: people
       KC_DB_SCHEMA: public
+      PROXY_ADDRESS_FORWARDING: 'true'
     ports:
       - "8080:8080"
     depends_on:
       - kc_postgresql
+
+  dimail: 
+    image: registry.mim-libre.fr/dimail/dimail-api:latest
+    environment:
+      DIMAIL_MODE: FAKE
+      DIMAIL_JWT_SECRET: fake_jwt_secret
+    ports:
+      - "8001:8000"

docker/auth/realm.json

@@ -46,6 +46,9 @@
   "users": [
     {
       "username": "people",
+      "email": "people@people.world",
+      "firstName": "John",
+      "lastName": "Doe",
       "enabled": true,
       "credentials": [
         {
@@ -56,12 +59,43 @@
       "realmRoles": ["user"]
     },
     {
-      "username": "user-e2e",
+      "username": "user-e2e-chromium",
+      "email": "user@chromium.e2e",
+      "firstName": "E2E",
+      "lastName": "Chromium",
       "enabled": true,
       "credentials": [
         {
           "type": "password",
-          "value": "password-e2e"
+          "value": "password-e2e-chromium"
+        }
+      ],
+      "realmRoles": ["user"]
+    },
+    {
+      "username": "user-e2e-webkit",
+      "email": "user@webkit.e2e",
+      "firstName": "E2E",
+      "lastName": "Webkit",
+      "enabled": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "password-e2e-webkit"
+        }
+      ],
+      "realmRoles": ["user"]
+    },
+    {
+      "username": "user-e2e-firefox",
+      "email": "user@firefox.e2e",
+      "firstName": "E2E",
+      "lastName": "Firefox",
+      "enabled": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "password-e2e-firefox"
         }
       ],
       "realmRoles": ["user"]
@@ -313,7 +347,6 @@
       ],
       "security-admin-console": [],
       "admin-cli": [],
-      "people-front": [],
       "account-console": [],
       "broker": [
         {
@@ -326,6 +359,7 @@
           "attributes": {}
         }
       ],
+      "people": [],
       "account": [
         {
           "id": "63b1a4e1-a594-4571-99c3-7c5c3efd61ce",
@@ -580,7 +614,9 @@
       "publicClient": true,
       "frontchannelLogout": false,
       "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
@@ -618,7 +654,9 @@
       "publicClient": false,
       "frontchannelLogout": false,
       "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
@@ -638,7 +676,7 @@
     },
     {
       "id": "869481d0-5774-4e64-bc30-fedc7c58958f",
-      "clientId": "people-front",
+      "clientId": "people",
       "name": "",
       "description": "",
       "rootUrl": "",
@@ -648,9 +686,10 @@
       "enabled": true,
       "alwaysDisplayInConsole": false,
       "clientAuthenticatorType": "client-secret",
+      "secret": "ThisIsAnExampleKeyForDevPurposeOnly",
       "redirectUris": [
-        "",
         "http://localhost:8070/*",
+        "http://localhost:8071/*",
         "http://localhost:3200/*",
         "http://localhost:8088/*",
         "http://localhost:3000/*"
@@ -666,18 +705,29 @@
       "consentRequired": false,
       "standardFlowEnabled": true,
       "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
+      "directAccessGrantsEnabled": false,
       "serviceAccountsEnabled": false,
-      "publicClient": true,
+      "publicClient": false,
       "frontchannelLogout": true,
       "protocol": "openid-connect",
       "attributes": {
+        "access.token.lifespan": "-1",
+        "client.secret.creation.time": "1707820779",
+        "user.info.response.signature.alg": "RS256",
+        "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
+        "oauth2.device.authorization.grant.enabled": "false",
+        "use.jwks.url": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "use.refresh.tokens": "true",
+        "tls-client-certificate-bound-access-tokens": "false",
         "oidc.ciba.grant.enabled": "false",
         "backchannel.logout.session.required": "true",
-        "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
+        "client_credentials.use_refresh_token": "false",
+        "acr.loa.map": "{}",
+        "require.pushed.authorization.requests": "false",
         "display.on.consent.screen": "false",
-        "oauth2.device.authorization.grant.enabled": "false",
-        "backchannel.logout.revoke.offline.tokens": "false"
+        "client.session.idle.timeout": "-1",
+        "token.response.type.bearer.lower-case": "false"
       },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": true,
@@ -716,7 +766,9 @@
       "publicClient": false,
       "frontchannelLogout": false,
       "protocol": "openid-connect",
-      "attributes": {},
+      "attributes": {
+        "post.logout.redirect.uris": "+"
+      },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
@@ -887,7 +939,8 @@
           "consentRequired": false,
           "config": {
             "id.token.claim": "true",
-            "access.token.claim": "true"
+            "access.token.claim": "true",
+            "userinfo.token.claim": "true"
           }
         }
       ]
@@ -1057,7 +1110,7 @@
         },
         {
           "id": "79712bcf-b7f7-4ca3-b97c-418f48fded9b",
-          "name": "given name",
+          "name": "first name",
           "protocol": "openid-connect",
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
@@ -1066,7 +1119,7 @@
             "user.attribute": "firstName",
             "id.token.claim": "true",
             "access.token.claim": "true",
-            "claim.name": "given_name",
+            "claim.name": "first_name",
             "jsonType.label": "String"
           }
         },
@@ -1087,7 +1140,7 @@
         },
         {
           "id": "7f741e96-41fe-4021-bbfd-506e7eb94e69",
-          "name": "family name",
+          "name": "last name",
           "protocol": "openid-connect",
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
@@ -1096,7 +1149,7 @@
             "user.attribute": "lastName",
             "id.token.claim": "true",
             "access.token.claim": "true",
-            "claim.name": "family_name",
+            "claim.name": "last_name",
             "jsonType.label": "String"
           }
         },
@@ -1207,6 +1260,7 @@
           "consentRequired": false,
           "config": {
             "multivalued": "true",
+            "userinfo.token.claim": "true",
             "user.attribute": "foo",
             "id.token.claim": "true",
             "access.token.claim": "true",

docker/files/etc/nginx/conf.d/default.conf

@@ -1,34 +1,13 @@
-server {
 
-    listen 8082;
+server {
+    listen 8083;
     server_name localhost;
     charset utf-8;
 
-    location /media {
-        alias /data/media;
+    location / {
+        proxy_pass http://keycloak:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
-
-    # location / {
-    #     proxy_pass http://app:8000;
-    #     proxy_set_header Host $host;
-    #     proxy_set_header X-Real-IP $remote_addr;
-    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    # }
 }
-
-server {
-  listen 8088;
-  server_name localhost;
- 
-  root /home/desk;
- 
-  location / {
-      try_files $uri index.html $uri/ =404;
-  }
- 
-  error_page 404 /404.html;
-  location = /404.html {
-      internal;
-  }
-}
-

docs/interoperability/dimail.md

@@ -0,0 +1,35 @@
+# dimail 
+
+## What is dimail ? 
+
+The mailing solution provided in La Suite is [Open-XChange](https://www.open-xchange.com/) (OX). 
+OX not having a provisioning API, 'dimail-api' or 'dimail' was created to allow mail-provisioning through People.
+
+API and its documentation can be found [here](https://api.dev.ox.numerique.gouv.fr/docs#/).
+
+## Architectural links of dimail
+
+As dimail's primary goal is to act as an interface between People and OX, its architecture is similar to that of People. A series of requests are sent from People to dimail upon creating domains, users and accesses.
+
+### Domains
+
+Upon creating a domain on People, the same domain is created on dimail and will undergo a series of checks. When all checks have passed, the domain is considered valid and mailboxes can be created on it. 
+
+### Users
+
+The ones issuing requests. Dimail users will reflect domains owners and administrators on People, for logging purposes and to allow direct use of dimail, if desired. User reconciliation is made on user uuid provided by ProConnect.
+
+### Accesses
+
+As for People, an access - a permissions (or "allows" in dimail) - grants an user permission to create objects on a domain.
+
+Permissions requests are sent automatically upon : 
+- dimail database initialisation: 
+    + permission for dimail user People to create users and domains
+- domain creation : 
+    + permission for dimail user People to manage domain
+    + permission for new owner on new domain
+- user creation:
+    + permission for People to manage user
+- access creation, if owner or admin:
+    + permission for this user to manage domain

docs/resourceServer.md

@@ -0,0 +1,164 @@
+## Resource Server
+
+For detailed information, please refer to the [OAuth 2.0 Resource Server documentation](https://www.oauth.com/oauth2-servers/the-resource-server/) and review the relevant commits that implement the resource server backend.
+
+---
+#### Overview
+
+A resource server is a crucial component in an OAuth 2.0 ecosystem. It is responsible for accepting access tokens issued by the authorization server (in this case, Agent Connect), introspecting and validating those tokens, and then returning the requested protected resources to the client.
+
+By implementing a resource server, we can securely share data between different services within La Suite. This ensures that only clients with the appropriate scopes and permissions can access specific resources, thereby enhancing security and maintaining proper access control across services.
+
+---
+#### Disclaimer
+
+- Currently compatible only with Agent Connect.
+- The development setup requires simplification, with dependencies on Agent Connect ideally mocked.
+- Terminology aligns with the specification: what is referred to as a "resource server" is known as a "data provider" in Agent Connect.
+- This documentation is WIP.
+
+---
+## Running Locally
+
+#### Prerequisites
+
+- **Agent Connect Stack**: Ensure the local Agent Connect stack is running. A solid understanding of its configuration and operation is recommended (advanced level).
+- **People Stack**: Make sure the People stack is up and running.
+- **Ngrok**: Install and set up Ngrok for secure tunneling.
+
+
+---
+
+### Update People's configurations
+
+#### Environment variables
+
+
+Agent Connect includes two pre-configured mocked data providers in its default stack (`bdd-fca-low`).
+
+Use the client ID and client secret from one of these data providers. **Note:** Make sure to retrieve the decrypted secret, as it is stored encrypted in the database. You can find these values in the `dp.js` fixture file, where they are exposed in a comment.
+
+Configure your environment with the following values from Agent Connect:
+
+```
+OIDC_RS_CLIENT_ID=<your-client-id-from-ac>
+OIDC_RS_CLIENT_SECRET=<your-decrypted-client-secret-from-ac>
+
+# In development, the resource server use insecure settings
+OIDC_VERIFY_SSL=False
+
+# Update the endpoints as follows
+OIDC_OP_JWKS_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/jwks
+OIDC_OP_INTROSPECTION_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/checktoken
+OIDC_OP_URL=https://core-fca-low.docker.dev-franceconnect.fr/api/v2
+```
+
+#### Docker Network Configuration
+
+To enable communication between the Docker networks for People and Agent Connect, update your docker-compose configuration. This setup is required because the Authorization Server and Resource Server will exchange requests over a back-channel, necessitating their accessibility to each other.
+
+1. **Create a Network**: Define a new network to bridge the two Docker networks.
+
+    ```yaml
+    networks:
+      authorization_server:
+        external: true
+        driver: bridge
+        name: "${DESK_NETWORK:-fc_public}"
+    ```
+
+2. **Update Network for `app-dev`**: Ensure your `app-dev` service is connected to both the default network and the new `authorization_server` network.
+
+    ```yaml
+    app-dev:
+      ...
+      networks:
+        - default
+        - authorization_server
+    ```
+
+
+#### Ngrok
+
+To expose your local resource server through an HTTP tunnel, use Ngrok. This is necessary because, in the Agent Connect development stack, the resource server needs to be accessible to a user agent via a publicly accessible URL.
+
+```
+$ ngrok http 8071
+```
+
+---
+
+
+### Update AgentConnect's configurations
+
+Modify the AgentConnect configuration to include the local resource server settings.
+
+**Update `fsa1-low` Environment File**:
+
+Add your Ngrok URL and configure the `DATA_APIS` list with the appropriate values.
+
+ ```env
+ App_DATA_APIS=[{"name":"Data Provider 1","url":"https://your-ngrok-url/api/v1.0/any-path","secret":"***"}, ...]
+ ```
+
+**Update Fixture in `dp.js`**:
+
+Adjust the configuration for the data provider to match your local setup. Ensure that the `client_id`, `client_secret`, and other parameters are correctly set and aligned with your environment. This can be configured through environment variables.
+
+ ```javascript
+ const dps = [
+   // Data Provider Configuration
+   {
+     uid: "6f21b751-ed06-48b6-a59c-36e1300a368a",
+     title: "Mock Data Provider - 1",
+     active: true,
+     slug: "DESK",
+     client_id: "***",
+     client_secret: "***",
+       // client_secret decrypted : ****
+     jwks_uri: "https://your-ngrok-url/api/v1.0/jwks", // Update this line
+     checktoken_signed_response_alg: "ES256",
+     checktoken_encrypted_response_alg: "RSA-OAEP",
+     checktoken_encrypted_response_enc: "A256GCM",
+   },
+ ];
+ ```
+
+**Note**: Ensure that the `jwks_uri` and other cryptographic parameters (e.g., `checktoken_signed_response_alg`, `checktoken_encrypted_response_alg`, and `checktoken_encrypted_response_enc`) match your actual setup and are configured via environment variables where necessary.
+
+---
+
+### Usage
+
+This section is a work in progress. Please note the following important points:
+
+#### User `sub` Matching
+
+Ensure that the `sub` (subject) field for users in AgentConnect matches the corresponding value in the People database. To synchronize this, you can run `make demo`, then edit the user's `sub` field to match the value returned by AgentConnect. For this, you'll need to update the editable field in Django Admin, specifically in `admin.py`. Adjust the `get_readonly_fields` method as follows:
+
+```python
+def get_readonly_fields(self, request, obj=None):
+    """The 'sub' field should only be editable during creation, not for updates."""
+    if obj:
+        return self.readonly_fields
+    return self.readonly_fields + ["sub"]  # update this line adding 'sub'
+```
+
+#### Scope for `groups`
+Ensure that the `groups` scope is requested from the service provider during authentication with AgentConnect.
+
+#### Resource Server Requests
+By default, the `fsa1-low` environment calls the resource server using a POST request.
+
+#### Testing
+
+Most of the testing has been done using the `/users/me` endpoint. Update the `api/viewset.py` configuration to allow both GET and POST methods for this endpoint:
+
+```python
+@decorators.action(
+    detail=False,
+    methods=["get", "post"], # update this line adding 'post'
+    url_name="me",
+    url_path="me",
+)
+```

env.d/development/common.dist

@@ -7,9 +7,6 @@ DJANGO_SUPERUSER_PASSWORD=admin
 # Python
 PYTHONPATH=/app
 
-#JWT
-DJANGO_JWT_PRIVATE_SIGNING_KEY=ThisIsAnExampleKeyForDevPurposeOnly
-
 # People settings
 
 # Mail
@@ -19,5 +16,52 @@ DJANGO_EMAIL_PORT=1025
 # Backend url
 PEOPLE_BASE_URL="http://localhost:8072"
 
-# Keycloak
-SIMPLE_JWT_JWK_URL="http://keycloak:8080/realms/people/protocol/openid-connect/certs"
+# OIDC
+OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/certs
+OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/people/protocol/openid-connect/auth
+OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/token
+OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/userinfo
+
+OIDC_RP_CLIENT_ID=people
+OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
+OIDC_RP_SIGN_ALGO=RS256
+OIDC_RP_SCOPES="openid email"
+
+LOGIN_REDIRECT_URL=http://localhost:3000
+LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
+LOGOUT_REDIRECT_URL=http://localhost:3000
+
+OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
+OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
+
+OIDC_RS_CLIENT_ID=people
+OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
+OIDC_RS_PRIVATE_KEY_STR="-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3boG1kwEGUYL+
+U58RPrVToIsF9jHB64S6WJIIInPmAclBciXFb6BWG11mbRIgo8ha3WVnC/tGHbXb
+ndiKdrH2vKHOsDhV9AmgHgNgWaUK9L0uuKEb/xMLePYWsYlgzcQJx8RZY7RQyWqE
+20WfzFxeuCE7QMb6VXSOgwQMnJsKocguIh3VCI9RIBq3B1kdgW35AD63YKOygmGx
+qjcWwbjhKLvkF7LpBdlyAEzOKqg4T5uCcHMfksMW2+foTJx70RrZM/KHU+Zysuw7
+uhhVsgPBG+CsqBSjHQhs7jzymqxtQAfe1FkrCRxOq5Pv2Efr7kgtVSkJJiX3KutM
+vnWuEypxAgMBAAECggEAGqKS9pbrN+vnmb7yMsqYgVVnQn0aggZNHlLkl4ZLLnuV
+aemlhur7zO0JzajqUC+AFQOfaQxiFu8S/FoJ+qccFdATrcPEVmTKbgPVqSyzLKlX
+fByGll5eOVT95NMwN8yBGgt2HSW/ZditXS/KxxahVgamGqjAC9MTSutGz/8Ae1U+
+DNDBJCc6RAqu3T02tV9A2pSpVC1rSktDMpLUTscnsfxpaEQATd9DJUcHEvIwoX8q
+GJpycPEhNhdPXqpln5SoMHcf/zS5ssF/Mce0lJJXYyE0LnEk9X12jMWyBqmLqXUY
+cKLyynaFbis0DpQppwKx2y8GpL76k+Ci4dOHIvFknQKBgQDj/2WRMcWOvfBrggzj
+FHpcme2gSo5A5c0CVyI+Xkf1Zab6UR6T7GiImEoj9tq0+o2WEix9rwoypgMBq8rz
+/rrJAPSZjgv6z71k4EnO2FIB5R03vQmoBRCN8VlgvLM0xv52zyjV4Wx66Q4MDjyH
+EgkpHyB0FzRZh0UzhnE/pYSetQKBgQDN9eLB1nA4CBSr1vMGNfQyfBQl3vpO9EP4
+VSS3KnUqCIjJeLu682Ylu7SFxcJAfzUpy5S43hEvcuJsagsVKfmCAGcYZs9/xq3I
+vzYyhaEOS5ezNxLSh4+yCNBPlmrmDyoazag0t8H8YQFBN6BVcxbATHqdWGUhIhYN
+eEpEMOh2TQKBgGBr7kRNTENlyHtu8IxIaMcowfn8DdUcWmsW9oBx1vTNHKTYEZp1
+bG/4F8LF7xCCtcY1wWMV17Y7xyG5yYcOv2eqY8dc72wO1wYGZLB5g5URlB2ycJcC
+LVIaM7ZZl2BGl+8fBSIOx5XjYfFvQ+HLmtwtMchm19jVAEseHF7SXRfRAoGAK15j
+aT2mU6Yf9C9G7T/fM+I8u9zACHAW/+ut14PxN/CkHQh3P16RW9CyqpiB1uLyZuKf
+Zm4cYElotDuAKey0xVMgYlsDxnwni+X3m5vX1hLE1s/5/qrc7zg75QZfbCI1U3+K
+s88d4e7rPLhh4pxhZgy0pP1ADkIHMr7ppIJH8OECgYEApNfbgsJVPAMzucUhJoJZ
+OmZHbyCtJvs4b+zxnmhmSbopifNCgS4zjXH9qC7tsUph1WE6L2KXvtApHGD5H4GQ
+IH5em4M/pHIcsqCi1qggBMbdvzHBUtC3R4sK0CpEFHlN+Y59aGazidcN2FPupNJv
+MbyqKyC6DAzv4jEEhHaN7oY=
+-----END PRIVATE KEY-----
+"

env.d/development/common.e2e.dist

@@ -0,0 +1,3 @@
+# For the CI job test-e2e
+SUSTAINED_THROTTLE_RATES="200/hour"
+BURST_THROTTLE_RATES="200/minute"

env.d/development/kc_postgresql.dist

@@ -8,4 +8,4 @@ DB_HOST=kc_postgresql
 DB_NAME=keycloak
 DB_USER=people
 DB_PASSWORD=pass
-DB_PORT=5433
+DB_PORT=5433

env.d/development/postgresql.dist

@@ -8,4 +8,4 @@ DB_HOST=postgresql
 DB_NAME=people
 DB_USER=dinum
 DB_PASSWORD=pass
-DB_PORT=5432
+DB_PORT=5432

renovate.json

@@ -1,6 +1,7 @@
 {
   "extends": ["github>numerique-gouv/renovate-configuration"],
   "dependencyDashboard": true,
+  "labels": ["dependencies", "noChangeLog"],
   "packageRules": [
     {
       "enabled": false,
@@ -12,7 +13,7 @@
       "enabled": false,
       "groupName": "ignored js dependencies",
       "matchManagers": ["npm"],
-      "matchPackageNames": ["node", "node-fetch", "i18next-parser"]
+      "matchPackageNames": ["fetch-mock", "node", "node-fetch", "eslint"]
     }
   ]
 }

scripts/release.py

@@ -0,0 +1,120 @@
+# pylint: disable=line-too-long
+
+import datetime
+import os
+import re
+import sys
+
+from utils import run_command
+
+
+RELEASE_KINDS = {'p': 'patch', 'm': 'minor', 'mj': 'major'}
+
+
+def update_files(version):
+    """Update all files needed with new release version"""
+    # pyproject.toml
+    sys.stdout.write("Update pyproject.toml...\n")
+    path = "src/backend/pyproject.toml"
+    with open(path, 'r') as file:
+        lines = file.readlines()
+        for index, line in enumerate(lines):
+            if line.startswith("version = "):
+                lines[index] = re.sub(r'\"(.*?)\"', f'"{version}"', line)
+    with open(path, 'w+') as file:
+        file.writelines(lines)
+
+    # helm files
+    sys.stdout.write("Update helm files...\n")
+    for env in ["preprod", "production"]:
+        path = f"src/helm/env.d/{env}/values.desk.yaml.gotmpl"
+        with open(path, 'r') as file:
+            lines = file.readlines()
+            for index, line in enumerate(lines):
+                if "tag:" in line:
+                    lines[index] = re.sub(r'\"(.*?)\"', f'"v{version}"', line)
+        with open(path, 'w+') as file:
+            file.writelines(lines)
+
+    # frontend package.json
+    sys.stdout.write("Update package.json...\n")
+    files_to_modify = []
+    filename = "package.json"
+    for root, _dir, files in os.walk("src/frontend"):
+        if filename in files and "node_modules" not in root and ".next" not in root:
+            files_to_modify.append(os.path.join(root, filename))
+
+    for path in files_to_modify:
+        with open(path, 'r') as file:
+            lines = file.readlines()
+            for index, line in enumerate(lines):
+                if "version" in line:
+                    lines[index] = re.sub(r'"version": \"(.*?)\"', f'"version": "{version}"', line)
+        with open(path, 'w+') as file:
+            file.writelines(lines)
+    return
+
+
+def update_changelog(path, version):
+    """Update changelog file with release info
+    """
+    sys.stdout.write("Update CHANGELOG...\n")
+    with open(path, 'r') as file:
+        lines = file.readlines()
+        for index, line in enumerate(lines):
+            if "## [Unreleased]" in line:
+                today = datetime.date.today()
+                lines.insert(index + 1, f"\n## [{version}] - {today}\n")
+            if line.startswith("[unreleased]"):
+                last_version = lines[index + 1].split("]")[0][1:]
+                new_unreleased_line = line.replace(last_version, version)
+                new_release_line = lines[index + 1].replace(last_version, version)
+                lines[index] = new_unreleased_line
+                lines.insert(index + 1, new_release_line)
+                break
+
+    with open(path, 'w+') as file:
+        file.writelines(lines)
+
+
+def prepare_release(version, kind):
+    sys.stdout.write('Let\'s go to create branch to release\n')
+    branch_to_release = f"release/{version}"
+    run_command(f"git checkout -b {branch_to_release}", shell=True)
+    run_command("git pull --rebase origin main", shell=True)
+
+    update_changelog("CHANGELOG.md", version)
+    update_files(version)
+
+    run_command("git add CHANGELOG.md", shell=True)
+    run_command("git add src/", shell=True)
+    message = f"""🔖({RELEASE_KINDS[kind]}) release version {version}
+
+    Update all version files and changelog for {RELEASE_KINDS[kind]} release."""
+    run_command(f"git commit -m '{message}'", shell=True)
+    confirm = input(f"\nNEXT COMMAND: \n>> git push origin {branch_to_release}\nContinue ? (y,n) ")
+    if confirm == 'y':
+        run_command(f"git push origin {branch_to_release}", shell=True)
+    sys.stdout.write(f"""
+    PLEASE DO THE FOLLOWING INSTRUCTIONS:
+    --> Please submit PR and merge code to main 
+    --> Then do:
+    >> git checkout main
+    >> git pull
+    >> git tag -a v{version} 
+    >> git push origin v{version} 
+    --> Please check and wait for the docker image v{version} to be published here: https://hub.docker.com/r/lasuite/people-backend/tags
+    >> git tag -d preprod
+    >> git tag preprod
+    >> git push -f origin preprod
+    --> Now please generate release on github interface for the current tag v{version}
+""")
+
+
+if __name__ == "__main__":
+    version, kind = None, None
+    while not version:
+        version = input("Enter your release version:")
+    while kind not in RELEASE_KINDS:
+        kind = input("Enter kind of release (p:patch, m:minor, mj:major):")
+    prepare_release(version, kind)

scripts/update-git-submodule.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+git submodule update --init --recursive
+git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

scripts/utils.py

@@ -0,0 +1,14 @@
+import subprocess
+import sys
+
+
+def run_command(cmd, msg=None, shell=False, cwd='.', stdout=None):
+    if msg is None:
+        msg = f"# Running: {cmd}"
+    if stdout is not None:
+        stdout.write(msg + '\n')
+        if stdout != sys.stdout:
+            sys.stdout(msg)
+    subprocess.check_call(cmd, shell=shell, cwd=cwd, stdout=stdout, stderr=stdout)
+    if stdout is not None:
+        stdout.flush()

src/backend/.pylintrc

@@ -363,7 +363,8 @@ name-group=
 
 # Regular expression which should only match function or class names that do
 # not require a docstring.
-no-docstring-rgx=^_
+# Ignore: private stuff and `Params` class from FactoryBoy
+no-docstring-rgx=(^_|^Params$)
 
 # List of decorators that produce properties, such as abc.abstractproperty. Add
 # to this list to register other decorators that produce valid properties.

src/backend/__init__.py

@@ -0,0 +1 @@
+"""Root module."""

src/backend/core/__init__.py

@@ -0,0 +1 @@
+"""Core root module."""

src/backend/core/admin.py

@@ -1,48 +1,14 @@
 """Admin classes and registrations for People's core app."""
-from django import forms
+
 from django.contrib import admin
 from django.contrib.auth import admin as auth_admin
 from django.utils.translation import gettext_lazy as _
 
+from mailbox_manager.admin import MailDomainAccessInline
+
 from . import models
 
 
-class IdentityFormSet(forms.BaseInlineFormSet):
-    """
-    Make the "is_main" field readonly when it is True so that declaring another identity
-    works in the admin.
-    """
-
-    def add_fields(self, form, index):
-        """Disable the "is_main" field when it is set to True"""
-        super().add_fields(form, index)
-        is_main_value = form.instance.is_main if form.instance else False
-        form.fields["is_main"].disabled = is_main_value
-
-
-class IdentityInline(admin.TabularInline):
-    """Inline admin class for user identities."""
-
-    fields = (
-        "sub",
-        "email",
-        "is_main",
-        "created_at",
-        "updated_at",
-    )
-    formset = IdentityFormSet
-    model = models.Identity
-    extra = 0
-    readonly_fields = ("email", "created_at", "sub", "updated_at")
-
-    def has_add_permission(self, request, obj):
-        """
-        Identities are automatically created on successful OIDC logins.
-        Disable creating identities via the admin.
-        """
-        return False
-
-
 class TeamAccessInline(admin.TabularInline):
     """Inline admin class for team accesses."""
 
@@ -52,21 +18,41 @@ class TeamAccessInline(admin.TabularInline):
     readonly_fields = ("created_at", "updated_at")
 
 
+class OrganizationAccessInline(admin.TabularInline):
+    """Inline admin class for organization accesses."""
+
+    autocomplete_fields = ["user", "organization"]
+    extra = 0
+    model = models.OrganizationAccess
+    readonly_fields = ("created_at", "updated_at")
+
+
+class TeamWebhookInline(admin.TabularInline):
+    """Inline admin class for team webhooks."""
+
+    extra = 0
+    autocomplete_fields = ["team"]
+    model = models.TeamWebhook
+    readonly_fields = ("created_at", "updated_at")
+
+
 @admin.register(models.User)
 class UserAdmin(auth_admin.UserAdmin):
     """Admin class for the User model"""
 
+    autocomplete_fields = ["organization"]
     fieldsets = (
         (
             None,
             {
                 "fields": (
                     "id",
+                    "sub",
                     "password",
                 )
             },
         ),
-        (_("Personal info"), {"fields": ("email", "language", "timezone")}),
+        (_("Personal info"), {"fields": ("name", "email", "language", "timezone")}),
         (
             _("Permissions"),
             {
@@ -82,9 +68,19 @@ class UserAdmin(auth_admin.UserAdmin):
         ),
         (_("Important dates"), {"fields": ("created_at", "updated_at")}),
     )
-    inlines = (IdentityInline, TeamAccessInline)
+    add_fieldsets = (
+        (
+            None,
+            {
+                "classes": ("wide",),
+                "fields": ("sub", "email", "password1", "password2"),
+            },
+        ),
+    )
+    inlines = (TeamAccessInline, MailDomainAccessInline, OrganizationAccessInline)
     list_display = (
-        "email",
+        "get_user",
+        "organization",
         "created_at",
         "updated_at",
         "is_active",
@@ -94,19 +90,126 @@ class UserAdmin(auth_admin.UserAdmin):
     )
     list_filter = ("is_staff", "is_superuser", "is_device", "is_active")
     ordering = ("is_active", "-is_superuser", "-is_staff", "-is_device", "-updated_at")
-    readonly_fields = ("id", "created_at", "updated_at")
-    search_fields = ("id", "email", "identities__sub", "identities__email")
+    readonly_fields = ["id", "created_at", "updated_at"]
+    search_fields = ("id", "email", "sub", "name")
+
+    def get_readonly_fields(self, request, obj=None):
+        """The sub should only be editable for a create, not for updates."""
+        if obj:
+            return self.readonly_fields + ["sub"]
+        return self.readonly_fields
+
+    def get_user(self, obj):
+        """Provide a nice display for user"""
+        return (
+            obj.name if obj.name else (obj.email if obj.email else f"[sub] {obj.sub}")
+        )
+
+    get_user.short_description = _("User")
 
 
 @admin.register(models.Team)
 class TeamAdmin(admin.ModelAdmin):
     """Team admin interface declaration."""
 
-    inlines = (TeamAccessInline,)
+    inlines = (TeamAccessInline, TeamWebhookInline)
     list_display = (
         "name",
-        "slug",
         "created_at",
         "updated_at",
     )
     search_fields = ("name",)
+
+
+@admin.register(models.TeamAccess)
+class TeamAccessAdmin(admin.ModelAdmin):
+    """Team access admin interface declaration."""
+
+    list_display = (
+        "user",
+        "team",
+        "role",
+        "created_at",
+        "updated_at",
+    )
+
+
+@admin.register(models.Invitation)
+class InvitationAdmin(admin.ModelAdmin):
+    """Admin interface to handle invitations."""
+
+    fields = (
+        "email",
+        "team",
+        "role",
+        "created_at",
+        "issuer",
+    )
+    readonly_fields = (
+        "created_at",
+        "is_expired",
+        "issuer",
+    )
+    list_display = (
+        "email",
+        "team",
+        "created_at",
+        "is_expired",
+    )
+
+    def get_readonly_fields(self, request, obj=None):
+        """Mark all fields read only, i.e. disable update."""
+        if obj:
+            return self.fields
+        return self.readonly_fields
+
+    def change_view(self, request, object_id, form_url="", extra_context=None):
+        """Custom edit form. Remove 'save' buttons."""
+        extra_context = extra_context or {}
+        extra_context["show_save_and_continue"] = False
+        extra_context["show_save"] = False
+        extra_context["show_save_and_add_another"] = False
+        return super().change_view(request, object_id, extra_context=extra_context)
+
+    def save_model(self, request, obj, form, change):
+        """Fill in current logged-in user as issuer."""
+        obj.issuer = request.user
+        obj.save()
+
+
+@admin.register(models.Contact)
+class ContactAdmin(admin.ModelAdmin):
+    """Contact admin interface declaration."""
+
+    list_display = (
+        "full_name",
+        "owner",
+        "base",
+    )
+
+
+@admin.register(models.Organization)
+class OrganizationAdmin(admin.ModelAdmin):
+    """Admin interface for organizations."""
+
+    list_display = (
+        "name",
+        "created_at",
+        "updated_at",
+    )
+    search_fields = ("name",)
+    inlines = (OrganizationAccessInline,)
+
+
+@admin.register(models.OrganizationAccess)
+class OrganizationAccessAdmin(admin.ModelAdmin):
+    """Organization access admin interface declaration."""
+
+    autocomplete_fields = ("user", "organization")
+    list_display = (
+        "user",
+        "organization",
+        "role",
+        "created_at",
+        "updated_at",
+    )

src/backend/core/api/__init__.py

@@ -1,4 +1,5 @@
 """People core API endpoints"""
+
 from django.conf import settings
 from django.core.exceptions import ValidationError
 
@@ -22,6 +23,8 @@ def exception_handler(exc, context):
             detail = exc.message
         elif hasattr(exc, "messages"):
             detail = exc.messages
+        else:
+            detail = ""
 
         exc = drf_exceptions.ValidationError(detail=detail)
 

src/backend/core/api/permissions.py

@@ -1,4 +1,5 @@
 """Permission handlers for the People core app."""
+
 from django.core import exceptions
 
 from rest_framework import permissions
@@ -11,13 +12,13 @@ class IsAuthenticated(permissions.BasePermission):
     """
 
     def has_permission(self, request, view):
+        """Check auth token first."""
         return bool(request.auth) if request.auth else request.user.is_authenticated
 
 
 class IsSelf(IsAuthenticated):
     """
-    Allows access only to authenticated users. Alternative method checking the presence
-    of the auth token to avoid hitting the database.
+    Allows access only to user's own data.
     """
 
     def has_object_permission(self, request, view, obj):

src/backend/core/api/serializers.py

@@ -1,4 +1,5 @@
 """Client serializers for the People core app."""
+
 from rest_framework import exceptions, serializers
 from timezone_field.rest_framework import TimeZoneSerializerField
 
@@ -26,28 +27,48 @@ class ContactSerializer(serializers.ModelSerializer):
         return super().update(instance, validated_data)
 
 
-class UserSerializer(serializers.ModelSerializer):
+class DynamicFieldsModelSerializer(serializers.ModelSerializer):
+    """
+    A ModelSerializer that takes an additional `fields` argument that
+    controls which fields should be displayed.
+    """
+
+    def __init__(self, *args, **kwargs):
+        """Pass arguments to superclass except 'fields', then drop fields not listed therein."""
+
+        # Don't pass the 'fields' arg up to the superclass
+        fields = kwargs.pop("fields", None)
+
+        # Instantiate the superclass normally
+        super().__init__(*args, **kwargs)
+
+        if fields is not None:
+            # Drop any fields that are not specified in the `fields` argument.
+            allowed = set(fields)
+            existing = set(self.fields)
+            for field_name in existing - allowed:
+                self.fields.pop(field_name)
+
+
+class UserSerializer(DynamicFieldsModelSerializer):
     """Serialize users."""
 
-    data = serializers.SerializerMethodField(read_only=True)
     timezone = TimeZoneSerializerField(use_pytz=False, required=True)
+    email = serializers.ReadOnlyField()
+    name = serializers.ReadOnlyField()
 
     class Meta:
         model = models.User
         fields = [
             "id",
             "email",
-            "data",
             "language",
+            "name",
             "timezone",
             "is_device",
             "is_staff",
         ]
-        read_only_fields = ["id", "email", "data", "is_device", "is_staff"]
-
-    def get_data(self, user) -> dict:
-        """Return contact data for the user."""
-        return user.profile_contact.data if user.profile_contact else {}
+        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]
 
 
 class TeamAccessSerializer(serializers.ModelSerializer):
@@ -126,17 +147,57 @@ class TeamAccessSerializer(serializers.ModelSerializer):
         return attrs
 
 
+class TeamAccessReadOnlySerializer(TeamAccessSerializer):
+    """Serialize team accesses for list and retrieve actions."""
+
+    user = UserSerializer(read_only=True, fields=["id", "name", "email"])
+
+    class Meta:
+        model = models.TeamAccess
+        fields = [
+            "id",
+            "user",
+            "role",
+            "abilities",
+        ]
+        read_only_fields = [
+            "id",
+            "user",
+            "role",
+            "abilities",
+        ]
+
+
 class TeamSerializer(serializers.ModelSerializer):
     """Serialize teams."""
 
     abilities = serializers.SerializerMethodField(read_only=True)
-    accesses = TeamAccessSerializer(many=True, read_only=True)
-    slug = serializers.SerializerMethodField()
 
     class Meta:
         model = models.Team
-        fields = ["id", "name", "accesses", "abilities", "slug"]
-        read_only_fields = ["id", "accesses", "abilities", "slug"]
+        fields = [
+            "id",
+            "name",
+            "accesses",
+            "abilities",
+            "created_at",
+            "updated_at",
+        ]
+        read_only_fields = [
+            "id",
+            "accesses",
+            "abilities",
+            "created_at",
+            "updated_at",
+        ]
+
+    def create(self, validated_data):
+        """Create a new team with organization enforcement."""
+        # Note: this is not the purpose of this API to check the user has an organization
+        return super().create(
+            validated_data=validated_data
+            | {"organization_id": self.context["request"].user.organization_id}
+        )
 
     def get_abilities(self, team) -> dict:
         """Return abilities of the logged-in user on the instance."""
@@ -145,6 +206,37 @@ class TeamSerializer(serializers.ModelSerializer):
             return team.get_abilities(request.user)
         return {}
 
-    def get_slug(self, instance):
-        """Return slug from the team's name."""
-        return instance.get_slug()
+
+class InvitationSerializer(serializers.ModelSerializer):
+    """Serialize invitations."""
+
+    class Meta:
+        model = models.Invitation
+        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
+        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
+
+    def validate(self, attrs):
+        """Validate and restrict invitation to new user based on email."""
+
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+
+        try:
+            team_id = self.context["team_id"]
+        except KeyError as exc:
+            raise exceptions.ValidationError(
+                "You must set a team ID in kwargs to create a new team invitation."
+            ) from exc
+
+        if not models.TeamAccess.objects.filter(
+            team=team_id,
+            user=user,
+            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
+        ).exists():
+            raise exceptions.PermissionDenied(
+                "You are not allowed to manage invitation for this team."
+            )
+
+        attrs["team_id"] = team_id
+        attrs["issuer"] = user
+        return attrs

src/backend/core/api/utils.py

@@ -1,14 +0,0 @@
-"""
-Utils that can be useful throughout the People core app
-"""
-from rest_framework_simplejwt.tokens import RefreshToken
-
-
-def get_tokens_for_user(user):
-    """Get JWT tokens for user authentication."""
-    refresh = RefreshToken.for_user(user)
-
-    return {
-        "refresh": str(refresh),
-        "access": str(refresh.access_token),
-    }

src/backend/core/api/viewsets.py

@@ -1,24 +1,28 @@
 """API endpoints"""
+
+from django.conf import settings
 from django.contrib.postgres.search import TrigramSimilarity
 from django.db.models import Func, Max, OuterRef, Q, Subquery, Value
+from django.db.models.functions import Coalesce
 
 from rest_framework import (
     decorators,
     exceptions,
+    filters,
     mixins,
     pagination,
     response,
+    throttling,
+    views,
     viewsets,
 )
-from rest_framework.throttling import UserRateThrottle
+from rest_framework.permissions import AllowAny
 
 from core import models
 
 from . import permissions, serializers
 
-EMAIL_SIMILARITY_THRESHOLD = 0.01
-# TrigramSimilarity threshold is lower for searching email than for names,
-# to improve matching results
+SIMILARITY_THRESHOLD = 0.04
 
 
 class NestedGenericViewSet(viewsets.GenericViewSet):
@@ -96,12 +100,11 @@ class SerializerPerActionMixin:
 class Pagination(pagination.PageNumberPagination):
     """Pagination to display no more than 100 objects per page sorted by creation date."""
 
-    ordering = "-created_on"
     max_page_size = 100
     page_size_query_param = "page_size"
 
 
-class BurstRateThrottle(UserRateThrottle):
+class BurstRateThrottle(throttling.UserRateThrottle):
     """
     Throttle rate for minutes. See DRF section in settings for default value.
     """
@@ -109,7 +112,7 @@ class BurstRateThrottle(UserRateThrottle):
     scope = "burst"
 
 
-class SustainedRateThrottle(UserRateThrottle):
+class SustainedRateThrottle(throttling.UserRateThrottle):
     """
     Throttle rate for hours. See DRF section in settings for default value.
     """
@@ -179,13 +182,11 @@ class UserViewSet(
     User viewset for all interactions with user infos and teams.
 
     GET /api/users/&q=query
-        Return a list of users whose email matches the query. Similarity is
-        calculated using trigram similarity, allowing for partial,
-        case-insensitive matches and accented queries.
+        Return a list of users whose email or name matches the query.
     """
 
     permission_classes = [permissions.IsSelf]
-    queryset = models.User.objects.all().select_related("profile_contact")
+    queryset = models.User.objects.all().order_by("-created_at")
     serializer_class = serializers.UserSerializer
     throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
     pagination_class = Pagination
@@ -200,18 +201,15 @@ class UserViewSet(
                 is_active=True,
             )
 
-            # Search by case-insensitive and accent-insensitive trigram similarity
+            # Exclude all users already in the given team
+            if team_id := self.request.GET.get("team_id", ""):
+                queryset = queryset.exclude(teams__id=team_id)
+
+            # Search by case-insensitive and accent-insensitive
             if query := self.request.GET.get("q", ""):
-                similarity = Max(
-                    TrigramSimilarity(
-                        Func("identities__email", function="unaccent"),
-                        Func(Value(query), function="unaccent"),
-                    )
-                )
-                queryset = (
-                    queryset.annotate(similarity=similarity)
-                    .filter(similarity__gte=EMAIL_SIMILARITY_THRESHOLD)
-                    .order_by("-similarity")
+                queryset = queryset.filter(
+                    Q(name__unaccent__icontains=query)
+                    | Q(email__unaccent__icontains=query)
                 )
 
         return queryset
@@ -226,9 +224,9 @@ class UserViewSet(
         """
         Return information on currently logged user
         """
-        context = {"request": request}
+        user = request.user
         return response.Response(
-            self.serializer_class(request.user, context=context).data
+            self.serializer_class(user, context={"request": request}).data
         )
 
 
@@ -244,7 +242,11 @@ class TeamViewSet(
 
     permission_classes = [permissions.AccessPermission]
     serializer_class = serializers.TeamSerializer
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["created_at"]
+    ordering = ["-created_at"]
     queryset = models.Team.objects.all()
+    pagination_class = None
 
     def get_queryset(self):
         """Custom queryset to get user related teams."""
@@ -300,8 +302,15 @@ class TeamAccessViewSet(
     lookup_field = "pk"
     pagination_class = Pagination
     permission_classes = [permissions.AccessPermission]
-    queryset = models.TeamAccess.objects.all().select_related("user")
-    serializer_class = serializers.TeamAccessSerializer
+    queryset = (
+        models.TeamAccess.objects.all().select_related("user").order_by("-created_at")
+    )
+    list_serializer_class = serializers.TeamAccessReadOnlySerializer
+    detail_serializer_class = serializers.TeamAccessSerializer
+
+    filter_backends = [filters.OrderingFilter]
+    ordering = ["role"]
+    ordering_fields = ["role", "user__email", "user__name"]
 
     def get_permissions(self):
         """User only needs to be authenticated to list team accesses"""
@@ -318,23 +327,51 @@ class TeamAccessViewSet(
         context["team_id"] = self.kwargs["team_id"]
         return context
 
+    def get_serializer_class(self):
+        """Chooses list or detail serializer according to the action."""
+        if self.action in {"list", "retrieve"}:
+            return self.list_serializer_class
+        return self.detail_serializer_class
+
     def get_queryset(self):
         """Return the queryset according to the action."""
         queryset = super().get_queryset()
         queryset = queryset.filter(team=self.kwargs["team_id"])
 
-        if self.action == "list":
-            # Limit to team access instances related to a team THAT also has a team access
-            # instance for the logged-in user (we don't want to list only the team access
-            # instances pointing to the logged-in user)
+        if self.action in {"list", "retrieve"}:
+            if query := self.request.GET.get("q", ""):
+                similarity = Max(
+                    TrigramSimilarity(
+                        Coalesce(Func("user__email", function="unaccent"), Value("")),
+                        Func(Value(query), function="unaccent"),
+                    )
+                    + TrigramSimilarity(
+                        Coalesce(Func("user__name", function="unaccent"), Value("")),
+                        Func(Value(query), function="unaccent"),
+                    )
+                )
+                queryset = (
+                    queryset.annotate(similarity=similarity)
+                    .filter(similarity__gte=SIMILARITY_THRESHOLD)
+                    .order_by("-similarity")
+                )
+
+            # Determine which role the logged-in user has in the team
             user_role_query = models.TeamAccess.objects.filter(
-                team__accesses__user=self.request.user
+                user=self.request.user, team=self.kwargs["team_id"]
             ).values("role")[:1]
+
             queryset = (
+                # The logged-in user should be part of a team to see its accesses
                 queryset.filter(
                     team__accesses__user=self.request.user,
                 )
-                .annotate(user_role=Subquery(user_role_query))
+                # Abilities are computed based on logged-in user's role and
+                # the user role on each team access
+                .annotate(
+                    user_role=Subquery(user_role_query),
+                )
+                .select_related("user")
                 .distinct()
             )
         return queryset
@@ -372,3 +409,95 @@ class TeamAccessViewSet(
                 raise exceptions.ValidationError({"role": message})
 
         serializer.save()
+
+
+class InvitationViewset(
+    mixins.CreateModelMixin,
+    mixins.ListModelMixin,
+    mixins.RetrieveModelMixin,
+    mixins.DestroyModelMixin,
+    viewsets.GenericViewSet,
+):
+    """API ViewSet for user invitations to team.
+
+    GET /api/v1.0/teams/<team_id>/invitations/:<invitation_id>/
+        Return list of invitations related to that team or or one
+        team access if an id is provided.
+
+    POST /api/v1.0/teams/<team_id>/invitations/ with expected data:
+        - email: str
+        - role: str [owner|admin|member]
+        - issuer : User, automatically added from user making query, if allowed
+        - team : Team, automatically added from requested URI
+        Return newly created invitation
+
+    PUT / PATCH : Not permitted. Instead of updating your invitation,
+        delete and create a new one.
+
+    DELETE  /api/v1.0/teams/<team_id>/invitations/<invitation_id>/
+        Delete targeted invitation
+    """
+
+    lookup_field = "id"
+    pagination_class = Pagination
+    permission_classes = [permissions.AccessPermission]
+    queryset = (
+        models.Invitation.objects.all().select_related("team").order_by("-created_at")
+    )
+    serializer_class = serializers.InvitationSerializer
+
+    def get_permissions(self):
+        """User only needs to be authenticated to list invitations"""
+        if self.action == "list":
+            permission_classes = [permissions.IsAuthenticated]
+        else:
+            return super().get_permissions()
+
+        return [permission() for permission in permission_classes]
+
+    def get_serializer_context(self):
+        """Extra context provided to the serializer class."""
+        context = super().get_serializer_context()
+        context["team_id"] = self.kwargs["team_id"]
+        return context
+
+    def get_queryset(self):
+        """Return the queryset according to the action."""
+        queryset = super().get_queryset()
+        queryset = queryset.filter(team=self.kwargs["team_id"])
+
+        if self.action == "list":
+            # Determine which role the logged-in user has in the team
+            user_role_query = models.TeamAccess.objects.filter(
+                user=self.request.user, team=self.kwargs["team_id"]
+            ).values("role")[:1]
+
+            queryset = (
+                # The logged-in user should be part of a team to see its accesses
+                queryset.filter(
+                    team__accesses__user=self.request.user,
+                )
+                # Abilities are computed based on logged-in user's role and
+                # the user role on each team access
+                .annotate(user_role=Subquery(user_role_query))
+                .distinct()
+            )
+        return queryset
+
+
+class ConfigView(views.APIView):
+    """API ViewSet for sharing some public settings."""
+
+    permission_classes = [AllowAny]
+
+    def get(self, request):
+        """
+        GET /api/v1.0/config/
+            Return a dictionary of public settings.
+        """
+        array_settings = ["LANGUAGES", "FEATURES", "RELEASE"]
+        dict_settings = {}
+        for setting in array_settings:
+            dict_settings[setting] = getattr(settings, setting)
+
+        return response.Response(dict_settings)

src/backend/core/authentication.py

@@ -1,59 +0,0 @@
-"""Authentication for the People core app."""
-from django.conf import settings
-from django.utils.functional import SimpleLazyObject
-from django.utils.module_loading import import_string
-from django.utils.translation import gettext_lazy as _
-
-from drf_spectacular.authentication import SessionScheme, TokenScheme
-from drf_spectacular.plumbing import build_bearer_security_scheme_object
-from rest_framework import authentication
-from rest_framework_simplejwt.authentication import JWTAuthentication
-
-
-class DelegatedJWTAuthentication(JWTAuthentication):
-    """Override JWTAuthentication to create missing users on the fly."""
-
-    def get_user(self, validated_token):
-        """
-        Return the user related to the given validated token, creating or updating it if necessary.
-        """
-        get_user = import_string(settings.JWT_USER_GETTER)
-        return SimpleLazyObject(lambda: get_user(validated_token))
-
-
-class OpenApiJWTAuthenticationExtension(TokenScheme):
-    """Extension for specifying JWT authentication schemes."""
-
-    target_class = "core.authentication.DelegatedJWTAuthentication"
-    name = "DelegatedJWTAuthentication"
-
-    def get_security_definition(self, auto_schema):
-        """Return the security definition for JWT authentication."""
-        return build_bearer_security_scheme_object(
-            header_name="Authorization",
-            token_prefix="Bearer",  # noqa S106
-        )
-
-
-class SessionAuthenticationWithAuthenticateHeader(authentication.SessionAuthentication):
-    """
-    This class is needed, because REST Framework's default SessionAuthentication does
-    never return 401's, because they cannot fill the WWW-Authenticate header with a
-    valid value in the 401 response. As a result, we cannot distinguish calls that are
-    not unauthorized (401 unauthorized) and calls for which the user does not have
-    permission (403 forbidden).
-    See https://github.com/encode/django-rest-framework/issues/5968
-
-    We do set authenticate_header function in SessionAuthentication, so that a value
-    for the WWW-Authenticate header can be retrieved and the response code is
-    automatically set to 401 in case of unauthenticated requests.
-    """
-
-    def authenticate_header(self, request):
-        return "Session"
-
-
-class OpenApiSessionAuthenticationExtension(SessionScheme):
-    """Extension for specifying session authentication schemes."""
-
-    target_class = "core.api.authentication.SessionAuthenticationWithAuthenticateHeader"

src/backend/core/authentication/__init__.py

@@ -0,0 +1 @@
+"""Authentication module."""

src/backend/core/authentication/backends.py

@@ -0,0 +1,232 @@
+"""Authentication Backends for the People core app."""
+
+import logging
+from email.headerregistry import Address
+from typing import Optional
+
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.core.exceptions import SuspiciousOperation
+from django.utils.translation import gettext_lazy as _
+
+import requests
+from mozilla_django_oidc.auth import (
+    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
+)
+
+from core.models import Organization, OrganizationAccess, OrganizationRoleChoices
+
+logger = logging.getLogger(__name__)
+
+User = get_user_model()
+
+
+def get_domain_from_email(email: Optional[str]) -> Optional[str]:
+    """Extract domain from email."""
+    try:
+        return Address(addr_spec=email).domain
+    except (ValueError, AttributeError):
+        return None
+
+
+class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
+    """Custom OpenID Connect (OIDC) Authentication Backend.
+
+    This class overrides the default OIDC Authentication Backend to accommodate differences
+    in the User model, and handles signed and/or encrypted UserInfo response.
+    """
+
+    def get_userinfo(self, access_token, id_token, payload):
+        """Return user details dictionary.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The id token (unused).
+        - payload (dict): The token payload (unused).
+
+        Note: The id_token and payload parameters are unused in this implementation,
+        but were kept to preserve base method signature.
+
+        Note: It handles signed and/or encrypted UserInfo Response. It is required by
+        Agent Connect, which follows the OIDC standard. It forces us to override the
+        base method, which deal with 'application/json' response.
+
+        Returns:
+        - dict: User details dictionary obtained from the OpenID Connect user endpoint.
+        """
+
+        user_response = requests.get(
+            self.OIDC_OP_USER_ENDPOINT,
+            headers={"Authorization": f"Bearer {access_token}"},
+            verify=self.get_settings("OIDC_VERIFY_SSL", True),
+            timeout=self.get_settings("OIDC_TIMEOUT", None),
+            proxies=self.get_settings("OIDC_PROXY", None),
+        )
+        user_response.raise_for_status()
+        userinfo = self.verify_token(user_response.text)
+        return userinfo
+
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Return a User based on userinfo. Create a new user if no match is found.
+
+        Parameters:
+        - access_token (str): The access token.
+        - id_token (str): The ID token.
+        - payload (dict): The user payload.
+
+        Returns:
+        - User: An existing or newly created User instance.
+
+        Raises:
+        - Exception: Raised when user creation is not allowed and no existing user is found.
+        """
+
+        user_info = self.get_userinfo(access_token, id_token, payload)
+
+        sub = user_info.get("sub")
+        if not sub:
+            raise SuspiciousOperation(
+                _("User info contained no recognizable user identification")
+            )
+
+        # Get user's full name from OIDC fields defined in settings
+        full_name = self.compute_full_name(user_info)
+        email = user_info.get("email")
+
+        claims = {
+            "sub": sub,
+            "email": email,
+            "name": full_name,
+        }
+        if settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD:
+            claims[settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD] = user_info.get(
+                settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD
+            )
+
+        # if sub is absent, try matching on email
+        user = self.get_existing_user(sub, email)
+
+        if user:
+            if not user.is_active:
+                raise SuspiciousOperation(_("User account is disabled"))
+            self.update_user_if_needed(user, claims)
+        elif self.get_settings("OIDC_CREATE_USER", True):
+            user = self.create_user(claims)
+
+        # Data cleaning, to be removed when user organization is null=False
+        # or all users have an organization.
+        # See https://github.com/numerique-gouv/people/issues/504
+        if not user.organization_id:
+            organization_registration_id = claims.get(
+                settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD
+            )
+            domain = get_domain_from_email(email)
+            try:
+                organization, organization_created = (
+                    Organization.objects.get_or_create_from_user_claims(
+                        registration_id=organization_registration_id,
+                        domain=domain,
+                    )
+                )
+                if organization_created:
+                    logger.info("Organization %s created", organization)
+                    # For this case, we don't create an OrganizationAccess we will
+                    # manage this manually later, because we don't want the first
+                    # user who log in after the release to be the admin of their
+                    # organization. We will keep organization without admin, and
+                    # we will have to manually clean things up (while there is
+                    # not that much organization in the database).
+            except ValueError as exc:
+                # Raised when there is no recognizable organization
+                # identifier (domain or registration_id)
+                logger.warning("Unable to update user organization: %s", exc)
+            else:
+                user.organization = organization
+                user.save()
+                logger.info(
+                    "User %s updated with organization %s", user.pk, organization
+                )
+
+        return user
+
+    def create_user(self, claims):
+        """Return a newly created User instance."""
+        sub = claims.get("sub")
+        if sub is None:
+            raise SuspiciousOperation(
+                _("Claims contained no recognizable user identification")
+            )
+        email = claims.get("email")
+        name = claims.get("name")
+
+        # Extract or create the organization from the data
+        organization_registration_id = claims.get(
+            settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD
+        )
+        domain = get_domain_from_email(email)
+        try:
+            organization, organization_created = (
+                Organization.objects.get_or_create_from_user_claims(
+                    registration_id=organization_registration_id,
+                    domain=domain,
+                )
+            )
+        except ValueError as exc:
+            raise SuspiciousOperation(
+                _("Claims contained no recognizable organization identification")
+            ) from exc
+
+        if organization_created:
+            logger.info("Organization %s created", organization)
+
+        logger.info("Creating user %s / %s", sub, email)
+
+        user = self.UserModel.objects.create(
+            organization=organization,
+            password="!",  # noqa: S106
+            sub=sub,
+            email=email,
+            name=name,
+        )
+        if organization_created:
+            # Warning: we may remove this behavior in the near future when we
+            # add a feature to claim the organization ownership.
+            OrganizationAccess.objects.create(
+                organization=organization,
+                user=user,
+                role=OrganizationRoleChoices.ADMIN,
+            )
+        return user
+
+    def compute_full_name(self, user_info):
+        """Compute user's full name based on OIDC fields in settings."""
+        name_fields = settings.USER_OIDC_FIELDS_TO_NAME
+        full_name = " ".join(
+            user_info[field] for field in name_fields if user_info.get(field)
+        )
+        return full_name or None
+
+    def get_existing_user(self, sub, email):
+        """Fetch existing user by sub or email."""
+        try:
+            return User.objects.get(sub=sub)
+        except User.DoesNotExist:
+            if email and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION:
+                try:
+                    return User.objects.get(email=email)
+                except User.DoesNotExist:
+                    pass
+        return None
+
+    def update_user_if_needed(self, user, claims):
+        """Update user claims if they have changed."""
+        has_changed = any(
+            value and value != getattr(user, key)
+            for key, value in claims.items()
+            if key != "sub"
+        )
+        if has_changed:
+            updated_claims = {
+                key: value for key, value in claims.items() if value and key != "sub"
+            }
+            self.UserModel.objects.filter(sub=user.sub).update(**updated_claims)

src/backend/core/authentication/urls.py

@@ -0,0 +1,18 @@
+"""Authentication URLs for the People core app."""
+
+from django.urls import path
+
+from mozilla_django_oidc.urls import urlpatterns as mozzila_oidc_urls
+
+from .views import OIDCLogoutCallbackView, OIDCLogoutView
+
+urlpatterns = [
+    # Override the default 'logout/' path from Mozilla Django OIDC with our custom view.
+    path("logout/", OIDCLogoutView.as_view(), name="oidc_logout_custom"),
+    path(
+        "logout-callback/",
+        OIDCLogoutCallbackView.as_view(),
+        name="oidc_logout_callback",
+    ),
+    *mozzila_oidc_urls,
+]

src/backend/core/authentication/views.py

@@ -0,0 +1,137 @@
+"""Authentication Views for the People core app."""
+
+from urllib.parse import urlencode
+
+from django.contrib import auth
+from django.core.exceptions import SuspiciousOperation
+from django.http import HttpResponseRedirect
+from django.urls import reverse
+from django.utils import crypto
+
+from mozilla_django_oidc.utils import (
+    absolutify,
+)
+from mozilla_django_oidc.views import (
+    OIDCLogoutView as MozillaOIDCOIDCLogoutView,
+)
+
+
+class OIDCLogoutView(MozillaOIDCOIDCLogoutView):
+    """Custom logout view for handling OpenID Connect (OIDC) logout flow.
+
+    Adds support for handling logout callbacks from the identity provider (OP)
+    by initiating the logout flow if the user has an active session.
+
+    The Django session is retained during the logout process to persist the 'state' OIDC parameter.
+    This parameter is crucial for maintaining the integrity of the logout flow between this call
+    and the subsequent callback.
+    """
+
+    @staticmethod
+    def persist_state(request, state):
+        """Persist the given 'state' parameter in the session's 'oidc_states' dictionary
+
+        This method is used to store the OIDC state parameter in the session, according to the
+        structure expected by Mozilla Django OIDC's 'add_state_and_verifier_and_nonce_to_session'
+        utility function.
+        """
+
+        if "oidc_states" not in request.session or not isinstance(
+            request.session["oidc_states"], dict
+        ):
+            request.session["oidc_states"] = {}
+
+        request.session["oidc_states"][state] = {}
+        request.session.save()
+
+    def construct_oidc_logout_url(self, request):
+        """Create the redirect URL for interfacing with the OIDC provider.
+
+        Retrieves the necessary parameters from the session and constructs the URL
+        required to initiate logout with the OpenID Connect provider.
+
+        If no ID token is found in the session, the logout flow will not be initiated,
+        and the method will return the default redirect URL.
+
+        The 'state' parameter is generated randomly and persisted in the session to ensure
+        its integrity during the subsequent callback.
+        """
+
+        oidc_logout_endpoint = self.get_settings("OIDC_OP_LOGOUT_ENDPOINT")
+
+        if not oidc_logout_endpoint:
+            return self.redirect_url
+
+        reverse_url = reverse("oidc_logout_callback")
+        id_token = request.session.get("oidc_id_token", None)
+
+        if not id_token:
+            return self.redirect_url
+
+        query = {
+            "id_token_hint": id_token,
+            "state": crypto.get_random_string(self.get_settings("OIDC_STATE_SIZE", 32)),
+            "post_logout_redirect_uri": absolutify(request, reverse_url),
+        }
+
+        self.persist_state(request, query["state"])
+
+        return f"{oidc_logout_endpoint}?{urlencode(query)}"
+
+    def post(self, request):
+        """Handle user logout.
+
+        If the user is not authenticated, redirects to the default logout URL.
+        Otherwise, constructs the OIDC logout URL and redirects the user to start
+        the logout process.
+
+        If the user is redirected to the default logout URL, ensure her Django session
+        is terminated.
+        """
+
+        logout_url = self.redirect_url
+
+        if request.user.is_authenticated:
+            logout_url = self.construct_oidc_logout_url(request)
+
+        # If the user is not redirected to the OIDC provider, ensure logout
+        if logout_url == self.redirect_url:
+            auth.logout(request)
+
+        return HttpResponseRedirect(logout_url)
+
+
+class OIDCLogoutCallbackView(MozillaOIDCOIDCLogoutView):
+    """Custom view for handling the logout callback from the OpenID Connect (OIDC) provider.
+
+    Handles the callback after logout from the identity provider (OP).
+    Verifies the state parameter and performs necessary logout actions.
+
+    The Django session is maintained during the logout process to ensure the integrity
+    of the logout flow initiated in the previous step.
+    """
+
+    http_method_names = ["get"]
+
+    def get(self, request):
+        """Handle the logout callback.
+
+        If the user is not authenticated, redirects to the default logout URL.
+        Otherwise, verifies the state parameter and performs necessary logout actions.
+        """
+
+        if not request.user.is_authenticated:
+            return HttpResponseRedirect(self.redirect_url)
+
+        state = request.GET.get("state")
+
+        if state not in request.session.get("oidc_states", {}):
+            msg = "OIDC callback state not found in session `oidc_states`!"
+            raise SuspiciousOperation(msg)
+
+        del request.session["oidc_states"][state]
+        request.session.save()
+
+        auth.logout(request)
+
+        return HttpResponseRedirect(self.redirect_url)

src/backend/core/enums.py

@@ -1,7 +1,9 @@
 """
 Core application enums declaration
 """
+
 from django.conf import global_settings, settings
+from django.db import models
 from django.utils.translation import gettext_lazy as _
 
 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
@@ -13,3 +15,11 @@ ALL_LANGUAGES = getattr(
     "ALL_LANGUAGES",
     [(language, _(name)) for language, name in global_settings.LANGUAGES],
 )
+
+
+class WebhookStatusChoices(models.TextChoices):
+    """Defines the possible statuses in which a webhook can be."""
+
+    FAILURE = "failure", _("Failure")
+    PENDING = "pending", _("Pending")
+    SUCCESS = "success", _("Success")

src/backend/core/factories.py

@@ -2,6 +2,7 @@
 """
 Core application factories
 """
+
 from django.conf import settings
 from django.contrib.auth.hashers import make_password
 
@@ -118,27 +119,44 @@ class ContactFactory(BaseContactFactory):
     owner = factory.SubFactory("core.factories.UserFactory", profile_contact=None)
 
 
+class OrganizationFactory(factory.django.DjangoModelFactory):
+    """Factory to create organizations for testing purposes."""
+
+    name = factory.Faker("company")
+
+    class Meta:
+        model = models.Organization
+
+    class Params:  # pylint: disable=missing-class-docstring
+        with_registration_id = factory.Trait(
+            registration_id_list=factory.List(
+                [factory.Sequence(lambda n: f"{n:014d}")]
+            ),
+        )
+        with_domain = factory.Trait(
+            domain_list=factory.List([factory.Faker("domain_name")]),
+        )
+
+
 class UserFactory(factory.django.DjangoModelFactory):
-    """A factory to random users for testing purposes."""
+    """A factory to create random users for testing purposes."""
 
     class Meta:
         model = models.User
-
-    email = factory.Faker("email")
-    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
-    password = make_password("password")
-
-
-class IdentityFactory(factory.django.DjangoModelFactory):
-    """A factory to create identities for a user"""
-
-    class Meta:
-        model = models.Identity
         django_get_or_create = ("sub",)
 
-    user = factory.SubFactory(UserFactory)
+    class Params:
+        with_organization = factory.Trait(
+            organization=factory.SubFactory(
+                OrganizationFactory, with_registration_id=True
+            ),
+        )
+
     sub = factory.Sequence(lambda n: f"user{n!s}")
     email = factory.Faker("email")
+    name = factory.Faker("name")
+    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
+    password = make_password("password")
 
 
 class TeamFactory(factory.django.DjangoModelFactory):
@@ -147,18 +165,20 @@ class TeamFactory(factory.django.DjangoModelFactory):
     class Meta:
         model = models.Team
         django_get_or_create = ("name",)
+        skip_postgeneration_save = True
 
     name = factory.Sequence(lambda n: f"team{n}")
 
     @factory.post_generation
     def users(self, create, extracted, **kwargs):
         """Add users to team from a given list of users with or without roles."""
-        if create and extracted:
-            for item in extracted:
-                if isinstance(item, models.User):
-                    TeamAccessFactory(team=self, user=item)
-                else:
-                    TeamAccessFactory(team=self, user=item[0], role=item[1])
+        if not create or not extracted:
+            return
+        for user_entry in extracted:
+            if isinstance(user_entry, models.User):
+                TeamAccessFactory(team=self, user=user_entry)
+            else:
+                TeamAccessFactory(team=self, user=user_entry[0], role=user_entry[1])
 
 
 class TeamAccessFactory(factory.django.DjangoModelFactory):
@@ -170,3 +190,25 @@ class TeamAccessFactory(factory.django.DjangoModelFactory):
     team = factory.SubFactory(TeamFactory)
     user = factory.SubFactory(UserFactory)
     role = factory.fuzzy.FuzzyChoice([r[0] for r in models.RoleChoices.choices])
+
+
+class TeamWebhookFactory(factory.django.DjangoModelFactory):
+    """Create fake team webhooks for testing."""
+
+    class Meta:
+        model = models.TeamWebhook
+
+    team = factory.SubFactory(TeamFactory)
+    url = factory.Sequence(lambda n: f"https://example.com/Groups/{n!s}")
+
+
+class InvitationFactory(factory.django.DjangoModelFactory):
+    """A factory to create invitations for a user"""
+
+    class Meta:
+        model = models.Invitation
+
+    team = factory.SubFactory(TeamFactory)
+    email = factory.Faker("email")
+    role = factory.fuzzy.FuzzyChoice([role[0] for role in models.RoleChoices.choices])
+    issuer = factory.SubFactory(UserFactory)

src/backend/core/migrations/0001_initial.py

@@ -1,6 +1,6 @@
-# Generated by Django 5.0.1 on 2024-02-06 15:08
+# Generated by Django 5.0.3 on 2024-06-08 09:25
 
-import core.models
+import django.contrib.auth.models
 import django.core.validators
 import django.db.models.deletion
 import timezone_field.fields
@@ -27,7 +27,7 @@ class Migration(migrations.Migration):
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
                 ('name', models.CharField(max_length=100)),
-                ('slug', models.SlugField(max_length=100, unique=True)),
+                ('slug', models.SlugField(editable=False, max_length=100, unique=True)),
             ],
             options={
                 'verbose_name': 'Team',
@@ -45,7 +45,9 @@ class Migration(migrations.Migration):
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='email address')),
+                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
+                ('name', models.CharField(blank=True, max_length=100, null=True, verbose_name='name')),
                 ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                 ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                 ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
@@ -60,7 +62,7 @@ class Migration(migrations.Migration):
                 'db_table': 'people_user',
             },
             managers=[
-                ('objects', core.models.UserManager()),
+                ('objects', django.contrib.auth.models.UserManager()),
             ],
         ),
         migrations.CreateModel(
@@ -88,21 +90,20 @@ class Migration(migrations.Migration):
             field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='user', to='core.contact'),
         ),
         migrations.CreateModel(
-            name='Identity',
+            name='Invitation',
             fields=[
                 ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('sub', models.CharField(help_text='Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only.', max_length=255, unique=True, validators=[django.core.validators.RegexValidator(message='Enter a valid sub. This value may contain only letters, numbers, and @/./+/-/_ characters.', regex='^[\\w.@+-]+\\Z')], verbose_name='sub')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='email address')),
-                ('is_main', models.BooleanField(default=False, help_text='Designates whether the email is the main one.', verbose_name='main')),
-                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='identities', to=settings.AUTH_USER_MODEL)),
+                ('email', models.EmailField(max_length=254, verbose_name='email address')),
+                ('role', models.CharField(choices=[('member', 'Member'), ('administrator', 'Administrator'), ('owner', 'Owner')], default='member', max_length=20)),
+                ('issuer', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invitations', to=settings.AUTH_USER_MODEL)),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='invitations', to='core.team')),
             ],
             options={
-                'verbose_name': 'identity',
-                'verbose_name_plural': 'identities',
-                'db_table': 'people_identity',
-                'ordering': ('-is_main', 'email'),
+                'verbose_name': 'Team invitation',
+                'verbose_name_plural': 'Team invitations',
+                'db_table': 'people_invitation',
             },
         ),
         migrations.CreateModel(
@@ -126,21 +127,38 @@ class Migration(migrations.Migration):
             name='users',
             field=models.ManyToManyField(related_name='teams', through='core.TeamAccess', to=settings.AUTH_USER_MODEL),
         ),
-        migrations.AddConstraint(
-            model_name='contact',
-            constraint=models.CheckConstraint(check=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
+        migrations.CreateModel(
+            name='TeamWebhook',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('url', models.URLField(verbose_name='url')),
+                ('secret', models.CharField(blank=True, max_length=255, null=True, verbose_name='secret')),
+                ('status', models.CharField(choices=[('failure', 'Failure'), ('pending', 'Pending'), ('success', 'Success')], default='pending', max_length=10)),
+                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webhooks', to='core.team')),
+            ],
+            options={
+                'verbose_name': 'Team webhook',
+                'verbose_name_plural': 'Team webhooks',
+                'db_table': 'people_team_webhook',
+            },
         ),
         migrations.AddConstraint(
             model_name='contact',
-            constraint=models.CheckConstraint(check=models.Q(('base', models.F('id')), _negated=True), name='base_not_self', violation_error_message='A contact cannot be based on itself.'),
+            constraint=models.CheckConstraint(condition=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
+        ),
+        migrations.AddConstraint(
+            model_name='contact',
+            constraint=models.CheckConstraint(condition=models.Q(('base', models.F('id')), _negated=True), name='base_not_self', violation_error_message='A contact cannot be based on itself.'),
         ),
         migrations.AlterUniqueTogether(
             name='contact',
             unique_together={('owner', 'base')},
         ),
         migrations.AddConstraint(
-            model_name='identity',
-            constraint=models.UniqueConstraint(fields=('user', 'email'), name='unique_user_email', violation_error_message='This email address is already declared for this user.'),
+            model_name='invitation',
+            constraint=models.UniqueConstraint(fields=('email', 'team'), name='email_and_team_unique_together'),
         ),
         migrations.AddConstraint(
             model_name='teamaccess',

src/backend/core/migrations/0002_add_organization_and_more.py

@@ -0,0 +1,62 @@
+# Generated by Django 5.1.1 on 2024-10-22 10:07
+
+import core.models
+import django.contrib.postgres.fields
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Organization',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('name', models.CharField(max_length=100, verbose_name='name')),
+                ('registration_id_list', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(max_length=128), blank=True, default=list, size=None, validators=[core.models.validate_unique_registration_id], verbose_name='registration ID list')),
+                ('domain_list', django.contrib.postgres.fields.ArrayField(base_field=models.CharField(max_length=256), blank=True, default=list, size=None, validators=[core.models.validate_unique_domain], verbose_name='domain list')),
+            ],
+            options={
+                'verbose_name': 'organization',
+                'verbose_name_plural': 'organizations',
+                'db_table': 'people_organization',
+                'constraints': [models.CheckConstraint(condition=models.Q(('registration_id_list__len__gt', 0), ('domain_list__len__gt', 0), _connector='OR'), name='registration_id_or_domain', violation_error_message='An organization must have at least a registration ID or a domain.')],
+            },
+        ),
+        migrations.AddField(
+            model_name='team',
+            name='organization',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='teams', to='core.organization'),
+        ),
+        migrations.AddField(
+            model_name='user',
+            name='organization',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='users', to='core.organization'),
+        ),
+        migrations.CreateModel(
+            name='OrganizationAccess',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
+                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
+                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
+                ('role', models.CharField(choices=[('administrator', 'Administrator')], default='administrator', max_length=20)),
+                ('organization', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='organization_accesses', to='core.organization')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='organization_accesses', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'verbose_name': 'Organization/user relation',
+                'verbose_name_plural': 'Organization/user relations',
+                'db_table': 'people_organization_access',
+                'constraints': [models.UniqueConstraint(fields=('user', 'organization'), name='unique_organization_user', violation_error_message='This user is already in this organization.')],
+            },
+        ),
+    ]

src/backend/core/migrations/0003_team_slug_nullable.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.1.2 on 2024-11-04 14:25
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0002_add_organization_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='team',
+            name='slug',
+            field=models.SlugField(max_length=100, null=True),
+        ),
+    ]

src/backend/core/models.py

@@ -1,24 +1,39 @@
 """
 Declare and configure the models for the People core application
 """
+
 import json
 import os
+import smtplib
 import uuid
+from contextlib import suppress
+from datetime import timedelta
+from logging import getLogger
+from typing import Tuple
 
 from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
+from django.contrib.postgres.fields import ArrayField
+from django.contrib.sites.models import Site
 from django.core import exceptions, mail, validators
-from django.db import models
+from django.core.exceptions import ValidationError
+from django.db import models, transaction
+from django.template.loader import render_to_string
+from django.utils import timezone
 from django.utils.functional import lazy
-from django.utils.text import slugify
 from django.utils.translation import gettext_lazy as _
+from django.utils.translation import override
 
 import jsonschema
-from rest_framework_simplejwt.exceptions import InvalidToken
-from rest_framework_simplejwt.settings import api_settings
 from timezone_field import TimeZoneField
 
+from core.enums import WebhookStatusChoices
+from core.utils.webhooks import scim_synchronizer
+from core.validators import get_field_validators_from_setting
+
+logger = getLogger(__name__)
+
 current_dir = os.path.dirname(os.path.abspath(__file__))
 contact_schema_path = os.path.join(current_dir, "jsonschema", "contact_data.json")
 with open(contact_schema_path, "r", encoding="utf-8") as contact_schema_file:
@@ -33,6 +48,17 @@ class RoleChoices(models.TextChoices):
     OWNER = "owner", _("Owner")
 
 
+class OrganizationRoleChoices(models.TextChoices):
+    """
+    Defines the possible roles a user can have in an organization.
+    For now, we only have one role, but we might add more in the future.
+
+    administrator: The user can manage the organization: change name, add/remove users.
+    """
+
+    ADMIN = "administrator", _("Administrator")
+
+
 class BaseModel(models.Model):
     """
     Serves as an abstract base model for other models, ensuring that records are validated
@@ -67,7 +93,7 @@ class BaseModel(models.Model):
     def save(self, *args, **kwargs):
         """Call `full_clean` before saving."""
         self.full_clean()
-        super().save(*args, **kwargs)
+        return super().save(*args, **kwargs)
 
 
 class Contact(BaseModel):
@@ -113,12 +139,12 @@ class Contact(BaseModel):
         unique_together = ("owner", "base")
         constraints = [
             models.CheckConstraint(
-                check=~models.Q(base__isnull=False, owner__isnull=True),
+                condition=~models.Q(base__isnull=False, owner__isnull=True),
                 name="base_owner_constraint",
                 violation_error_message="A contact overriding a base contact must be owned.",
             ),
             models.CheckConstraint(
-                check=~models.Q(base=models.F("id")),
+                condition=~models.Q(base=models.F("id")),
                 name="base_not_self",
                 violation_error_message="A contact cannot be based on itself.",
             ),
@@ -147,20 +173,162 @@ class Contact(BaseModel):
             raise exceptions.ValidationError({"data": [error_message]}) from e
 
 
-class UserManager(auth_models.UserManager):
+class OrganizationManager(models.Manager):
     """
-    Override user manager to get the related contact in the same query by default (Contact model)
+    Custom manager for the Organization model, to manage complexity/automation.
     """
 
-    def get_queryset(self):
-        """Always select the related contact when doing a query on users."""
-        return super().get_queryset().select_related("profile_contact")
+    def get_or_create_from_user_claims(
+        self, registration_id: str = None, domain: str = None, **kwargs
+    ) -> Tuple["Organization", bool]:
+        """
+        Get or create an organization using the most fitting information from the user's claims.
+
+        We expect to have only one organization per registration_id, but
+        the registration_id might not be provided.
+        When the registration_id is not provided, we use the domain to identify the organization.
+
+        If both are provided, we use the registration_id first to create missing organization.
+
+        Dev note: When a registration_id is provided by the Identity Provider, we don't want
+        to use the domain to create the organization, because it is less reliable: for example,
+        a professional user, may have a personal email address, and the domain would be gmail.com
+        which is not a good identifier for an organization. The domain email is just a fallback
+        when the registration_id is not provided by the Identity Provider. We can use the domain
+        to create the organization manually when we are sure about the "safety" of it.
+        """
+        if not any([registration_id, domain]):
+            raise ValueError("You must provide either a registration_id or a domain.")
+
+        filters = models.Q()
+        if registration_id:
+            filters |= models.Q(registration_id_list__icontains=registration_id)
+        if domain:
+            filters |= models.Q(domain_list__icontains=domain)
+
+        with suppress(self.model.DoesNotExist):
+            # If there are several organizations, we must raise an error and fix the data
+            # If there is an organization, we return it
+            return self.get(filters, **kwargs), False
+
+        # Manage the case where the organization does not exist: we create one
+        if registration_id:
+            return self.create(
+                name=registration_id, registration_id_list=[registration_id], **kwargs
+            ), True
+
+        if domain:
+            return self.create(name=domain, domain_list=[domain], **kwargs), True
+
+        raise ValueError("Should never reach this point.")
+
+
+def validate_unique_registration_id(value):
+    """
+    Validate that the registration ID values in an array field are unique across all instances.
+    """
+    if Organization.objects.filter(registration_id_list__overlap=value).exists():
+        raise ValidationError(
+            "registration_id_list value must be unique across all instances."
+        )
+
+
+def validate_unique_domain(value):
+    """
+    Validate that the domain values in an array field are unique across all instances.
+    """
+    if Organization.objects.filter(domain_list__overlap=value).exists():
+        raise ValidationError("domain_list value must be unique across all instances.")
+
+
+class Organization(BaseModel):
+    """
+    Organization model used to regroup Teams.
+
+    Each User have an Organization, which corresponds actually to a default organization
+    because a user can belong to a Team from another organization.
+    Each Team have an Organization, which is the Organization from the User who created
+    the Team.
+
+    Organization is managed automatically, the User should never choose their Organization.
+    When creating a User, you must use the `get_or_create` method from the
+    OrganizationManager to find the proper Organization.
+
+    An Organization can have several registration IDs and domains but during automatic
+    creation process, only one will be used. We may want to allow (manual) organization merge
+    later, to regroup several registration IDs or domain in the same Organization.
+    """
+
+    name = models.CharField(_("name"), max_length=100)
+    registration_id_list = ArrayField(
+        models.CharField(
+            max_length=128,
+            validators=get_field_validators_from_setting(
+                "ORGANIZATION_REGISTRATION_ID_VALIDATORS"
+            ),
+        ),
+        verbose_name=_("registration ID list"),
+        default=list,
+        blank=True,
+        validators=[
+            validate_unique_registration_id,
+        ],
+    )
+    domain_list = ArrayField(
+        models.CharField(max_length=256),
+        verbose_name=_("domain list"),
+        default=list,
+        blank=True,
+        validators=[validate_unique_domain],
+    )
+
+    objects = OrganizationManager()
+
+    class Meta:
+        db_table = "people_organization"
+        verbose_name = _("organization")
+        verbose_name_plural = _("organizations")
+        constraints = [
+            models.CheckConstraint(
+                name="registration_id_or_domain",
+                condition=models.Q(registration_id_list__len__gt=0)
+                | models.Q(domain_list__len__gt=0),
+                violation_error_message=_(
+                    "An organization must have at least a registration ID or a domain."
+                ),
+            ),
+            # Check a registration ID str can only be present in one
+            # organization registration ID list
+            # Check a domain str can only be present in one organization domain list
+            # Those checks cannot be done with Django constraints
+        ]
+
+    def __str__(self):
+        return f"{self.name} (# {self.pk})"
 
 
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
     """User model to work with OIDC only authentication."""
 
-    email = models.EmailField(_("email address"), unique=True, null=True, blank=True)
+    sub_validator = validators.RegexValidator(
+        regex=r"^[\w.@+-]+\Z",
+        message=_(
+            "Enter a valid sub. This value may contain only letters, "
+            "numbers, and @/./+/-/_ characters."
+        ),
+    )
+
+    sub = models.CharField(
+        _("sub"),
+        help_text=_(
+            "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
+        ),
+        max_length=255,
+        unique=True,
+        validators=[sub_validator],
+    )
+    email = models.EmailField(_("email address"), null=True, blank=True)
+    name = models.CharField(_("name"), max_length=100, null=True, blank=True)
     profile_contact = models.OneToOneField(
         Contact,
         on_delete=models.SET_NULL,
@@ -199,10 +367,17 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
             "Unselect this instead of deleting accounts."
         ),
     )
+    organization = models.ForeignKey(
+        Organization,
+        on_delete=models.PROTECT,
+        related_name="users",
+        null=True,  # Need to be set to False when everything is migrated
+        blank=True,  # Need to be set to False when everything is migrated
+    )
 
-    objects = UserManager()
+    objects = auth_models.UserManager()
 
-    USERNAME_FIELD = "email"
+    USERNAME_FIELD = "sub"
     REQUIRED_FIELDS = []
 
     class Meta:
@@ -211,103 +386,97 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
         verbose_name_plural = _("users")
 
     def __str__(self):
-        return (
-            str(self.profile_contact)
-            if self.profile_contact
-            else self.email or str(self.id)
-        )
+        return self.name if self.name else self.email or f"User {self.sub}"
+
+    def save(self, *args, **kwargs):
+        """
+        If it's a new user, give her access to the relevant teams.
+        """
+
+        if self._state.adding:
+            self._convert_valid_invitations()
+
+        super().save(*args, **kwargs)
 
     def clean(self):
         """Validate fields."""
         super().clean()
+        if self.email:
+            self.email = User.objects.normalize_email(self.email)
 
         if self.profile_contact_id and not self.profile_contact.owner == self:
             raise exceptions.ValidationError(
                 "Users can only declare as profile a contact they own."
             )
 
-    def email_user(self, subject, message, from_email=None, **kwargs):
-        """Send an email to this user."""
-        main_identity = self.identities.get(is_main=True)
-        mail.send_mail(subject, message, from_email, [main_identity.email], **kwargs)
+    def _convert_valid_invitations(self):
+        """
+        Convert valid invitations to team accesses.
+        Expired invitations are ignored.
+        """
 
-    @classmethod
-    def get_email_field_name(cls):
-        """
-        Raise error when trying to get email field name from the user as we are using
-        a separate Email model to allow several emails per user.
-        """
-        raise NotImplementedError(
-            "This feature is deactivated to allow several emails per user."
+        valid_invitations = Invitation.objects.filter(
+            email=self.email,
+            created_at__gte=(
+                timezone.now()
+                - timedelta(seconds=settings.INVITATION_VALIDITY_DURATION)
+            ),
+        ).select_related("team")
+
+        if not valid_invitations.exists():
+            return
+
+        TeamAccess.objects.bulk_create(
+            [
+                TeamAccess(user=self, team=invitation.team, role=invitation.role)
+                for invitation in valid_invitations
+            ]
         )
+        valid_invitations.delete()
+
+    def email_user(self, subject, message, from_email=None, **kwargs):
+        """Email this user."""
+        if not self.email:
+            raise ValueError("You must first set an email for the user.")
+        mail.send_mail(subject, message, from_email, [self.email], **kwargs)
 
 
-class Identity(BaseModel):
-    """User identity"""
+class OrganizationAccess(BaseModel):
+    """
+    Link table between organization and users,
+    only for user with specific rights on Organization.
+    """
 
-    sub_validator = validators.RegexValidator(
-        regex=r"^[\w.@+-]+\Z",
-        message=_(
-            "Enter a valid sub. This value may contain only letters, "
-            "numbers, and @/./+/-/_ characters."
-        ),
+    organization = models.ForeignKey(
+        Organization,
+        on_delete=models.CASCADE,
+        related_name="organization_accesses",
     )
-
-    user = models.ForeignKey(User, related_name="identities", on_delete=models.CASCADE)
-    sub = models.CharField(
-        _("sub"),
-        help_text=_(
-            "Required. 255 characters or fewer. Letters, numbers, and @/./+/-/_ characters only."
-        ),
-        max_length=255,
-        unique=True,
-        validators=[sub_validator],
+    user = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="organization_accesses",
     )
-    email = models.EmailField(_("email address"), null=True, blank=True)
-    is_main = models.BooleanField(
-        _("main"),
-        default=False,
-        help_text=_("Designates whether the email is the main one."),
+    role = models.CharField(
+        max_length=20,
+        choices=OrganizationRoleChoices.choices,
+        default=OrganizationRoleChoices.ADMIN,
     )
 
     class Meta:
-        db_table = "people_identity"
-        ordering = ("-is_main", "email")
-        verbose_name = _("identity")
-        verbose_name_plural = _("identities")
+        db_table = "people_organization_access"
+        verbose_name = _("Organization/user relation")
+        verbose_name_plural = _("Organization/user relations")
         constraints = [
-            # Uniqueness
             models.UniqueConstraint(
-                fields=["user", "email"],
-                name="unique_user_email",
-                violation_error_message=_(
-                    "This email address is already declared for this user."
-                ),
+                fields=["user", "organization"],
+                name="unique_organization_user",
+                violation_error_message=_("This user is already in this organization."),
             ),
         ]
 
     def __str__(self):
-        main_str = "[main]" if self.is_main else ""
-        return f"{self.email:s}{main_str:s}"
-
-    def save(self, *args, **kwargs):
-        """Ensure users always have one and only one main identity."""
-        super().save(*args, **kwargs)
-        if self.is_main is True:
-            self.user.identities.exclude(id=self.id).update(is_main=False)
-
-    def clean(self):
-        """Normalize the email field and clean the 'is_main' field."""
-        if self.email:
-            self.email = User.objects.normalize_email(self.email)
-        if not self.user.identities.exclude(pk=self.pk).filter(is_main=True).exists():
-            if not self.created_at:
-                self.is_main = True
-            elif not self.is_main:
-                raise exceptions.ValidationError(
-                    {"is_main": "A user should have one and only one main identity."}
-                )
-        super().clean()
+        return f"{self.user!s} is {self.role:s} in organization {self.organization!s}"
 
 
 class Team(BaseModel):
@@ -316,7 +485,6 @@ class Team(BaseModel):
     """
 
     name = models.CharField(max_length=100)
-    slug = models.SlugField(max_length=100, unique=True, null=False, editable=False)
 
     users = models.ManyToManyField(
         User,
@@ -324,6 +492,13 @@ class Team(BaseModel):
         through_fields=("team", "user"),
         related_name="teams",
     )
+    organization = models.ForeignKey(
+        Organization,
+        on_delete=models.PROTECT,
+        related_name="teams",
+        null=True,  # Need to be set to False when everything is migrated
+        blank=True,  # Need to be set to False when everything is migrated
+    )
 
     class Meta:
         db_table = "people_team"
@@ -334,15 +509,6 @@ class Team(BaseModel):
     def __str__(self):
         return self.name
 
-    def save(self, *args, **kwargs):
-        """Overriding save function to compute the slug."""
-        self.slug = self.get_slug()
-        return super().save(*args, **kwargs)
-
-    def get_slug(self):
-        """Compute slug value from name."""
-        return slugify(self.name)
-
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user on the team.
@@ -362,7 +528,7 @@ class Team(BaseModel):
             is_owner_or_admin = role in [RoleChoices.OWNER, RoleChoices.ADMIN]
 
         return {
-            "get": True,
+            "get": bool(role),
             "patch": is_owner_or_admin,
             "put": is_owner_or_admin,
             "delete": role == RoleChoices.OWNER,
@@ -402,6 +568,34 @@ class TeamAccess(BaseModel):
     def __str__(self):
         return f"{self.user!s} is {self.role:s} in team {self.team!s}"
 
+    def save(self, *args, **kwargs):
+        """
+        Override save function to fire webhooks on any addition or update
+        to a team access.
+        """
+
+        if self._state.adding:
+            self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
+            with transaction.atomic():
+                instance = super().save(*args, **kwargs)
+                scim_synchronizer.add_user_to_group(self.team, self.user)
+        else:
+            instance = super().save(*args, **kwargs)
+
+        return instance
+
+    def delete(self, *args, **kwargs):
+        """
+        Override delete method to fire webhooks on  to team accesses.
+        Don't allow deleting a team access until it is successfully synchronized with all
+        its webhooks.
+        """
+        self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
+        with transaction.atomic():
+            arguments = self.team, self.user
+            super().delete(*args, **kwargs)
+            scim_synchronizer.remove_user_from_group(*arguments)
+
     def get_abilities(self, user):
         """
         Compute and return abilities for a given user taking into account
@@ -452,38 +646,135 @@ class TeamAccess(BaseModel):
         }
 
 
-def oidc_user_getter(validated_token):
-    """
-    Given a valid OIDC token , retrieve, create or update corresponding user/contact/email from db.
+class TeamWebhook(BaseModel):
+    """Webhooks fired on changes in teams."""
 
-    The token is expected to have the following fields in payload:
-        - sub
-        - email
-        - ...
-    """
-    try:
-        user_id = validated_token[api_settings.USER_ID_CLAIM]
-    except KeyError as exc:
-        raise InvalidToken(
-            _("Token contained no recognizable user identification")
-        ) from exc
-
-    try:
-        email_param = {"email": validated_token["email"]}
-    except KeyError:
-        email_param = {}
-
-    user = (
-        User.objects.filter(identities__sub=user_id)
-        .annotate(identity_email=models.F("identities__email"))
-        .distinct()
-        .first()
+    team = models.ForeignKey(Team, related_name="webhooks", on_delete=models.CASCADE)
+    url = models.URLField(_("url"))
+    secret = models.CharField(_("secret"), max_length=255, null=True, blank=True)
+    status = models.CharField(
+        max_length=10,
+        default=WebhookStatusChoices.PENDING,
+        choices=WebhookStatusChoices.choices,
     )
 
-    if user is None:
-        user = User.objects.create(password="!", **email_param)  # noqa: S106
-        Identity.objects.create(user=user, sub=user_id, **email_param)
-    elif email_param and validated_token["email"] != user.identity_email:
-        Identity.objects.filter(sub=user_id).update(email=validated_token["email"])
+    class Meta:
+        db_table = "people_team_webhook"
+        verbose_name = _("Team webhook")
+        verbose_name_plural = _("Team webhooks")
 
-    return user
+    def __str__(self):
+        return f"Webhook to {self.url} for {self.team}"
+
+    def get_headers(self):
+        """Build header dict from webhook object."""
+        headers = {"Content-Type": "application/json"}
+        if self.secret:
+            headers["Authorization"] = f"Bearer {self.secret:s}"
+        return headers
+
+
+class Invitation(BaseModel):
+    """User invitation to teams."""
+
+    email = models.EmailField(_("email address"), null=False, blank=False)
+    team = models.ForeignKey(
+        Team,
+        on_delete=models.CASCADE,
+        related_name="invitations",
+    )
+    role = models.CharField(
+        max_length=20, choices=RoleChoices.choices, default=RoleChoices.MEMBER
+    )
+    issuer = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="invitations",
+    )
+
+    class Meta:
+        db_table = "people_invitation"
+        verbose_name = _("Team invitation")
+        verbose_name_plural = _("Team invitations")
+        constraints = [
+            models.UniqueConstraint(
+                fields=["email", "team"], name="email_and_team_unique_together"
+            )
+        ]
+
+    def __str__(self):
+        return f"{self.email} invited to {self.team}"
+
+    def save(self, *args, **kwargs):
+        """Make invitations read-only."""
+        if self.created_at:
+            raise exceptions.PermissionDenied()
+        super().save(*args, **kwargs)
+
+        self.email_invitation()
+
+    def clean(self):
+        """Validate fields."""
+        super().clean()
+
+        # Check if a user already exists for the provided email
+        if User.objects.filter(email=self.email).exists():
+            raise exceptions.ValidationError(
+                {"email": _("This email is already associated to a registered user.")}
+            )
+
+    @property
+    def is_expired(self):
+        """Calculate if invitation is still valid or has expired."""
+        if not self.created_at:
+            return None
+
+        validity_duration = timedelta(seconds=settings.INVITATION_VALIDITY_DURATION)
+        return timezone.now() > (self.created_at + validity_duration)
+
+    def get_abilities(self, user):
+        """Compute and return abilities for a given user."""
+        can_delete = False
+        role = None
+
+        if user.is_authenticated:
+            try:
+                role = self.user_role
+            except AttributeError:
+                try:
+                    role = self.team.accesses.filter(user=user).values("role")[0][
+                        "role"
+                    ]
+                except (self._meta.model.DoesNotExist, IndexError):
+                    role = None
+
+            can_delete = role in [RoleChoices.OWNER, RoleChoices.ADMIN]
+
+        return {
+            "delete": can_delete,
+            "get": bool(role),
+            "patch": False,
+            "put": False,
+        }
+
+    def email_invitation(self):
+        """Email invitation to the user."""
+        try:
+            with override(self.issuer.language):
+                template_vars = {
+                    "title": _("Invitation to join Desk!"),
+                    "site": Site.objects.get_current(),
+                }
+                msg_html = render_to_string("mail/html/invitation.html", template_vars)
+                msg_plain = render_to_string("mail/text/invitation.txt", template_vars)
+                mail.send_mail(
+                    _("Invitation to join Desk!"),
+                    msg_plain,
+                    settings.EMAIL_FROM,
+                    [self.email],
+                    html_message=msg_html,
+                    fail_silently=False,
+                )
+
+        except smtplib.SMTPException as exception:
+            logger.error("invitation to %s was not sent: %s", self.email, exception)

src/backend/core/resource_server/__init__.py

@@ -0,0 +1 @@
+"""Backend resource server module."""

src/backend/core/resource_server/authentication.py

@@ -0,0 +1,55 @@
+"""Resource Server Authentication"""
+
+import base64
+import binascii
+import logging
+
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+from mozilla_django_oidc.contrib.drf import OIDCAuthentication
+
+from .backend import ResourceServerBackend, ResourceServerImproperlyConfiguredBackend
+from .clients import AuthorizationServerClient
+
+logger = logging.getLogger(__name__)
+
+
+class ResourceServerAuthentication(OIDCAuthentication):
+    """Authenticate clients using the token received from the authorization server."""
+
+    def __init__(self):
+        """Require authentication to be configured in order to instantiate."""
+        super().__init__()
+
+        try:
+            authorization_server_client = AuthorizationServerClient(
+                url=settings.OIDC_OP_URL,
+                verify_ssl=settings.OIDC_VERIFY_SSL,
+                timeout=settings.OIDC_TIMEOUT,
+                proxy=settings.OIDC_PROXY,
+                url_jwks=settings.OIDC_OP_JWKS_ENDPOINT,
+                url_introspection=settings.OIDC_OP_INTROSPECTION_ENDPOINT,
+            )
+            self.backend = ResourceServerBackend(authorization_server_client)
+
+        except ImproperlyConfigured as err:
+            message = "Resource Server authentication is disabled"
+            logger.debug("%s. Exception: %s", message, err)
+            self.backend = ResourceServerImproperlyConfiguredBackend()
+
+    def get_access_token(self, request):
+        """Retrieve and decode the access token from the request.
+
+        This method overrides the 'get_access_token' method from the parent class,
+        to support service providers that would base64 encode the bearer token.
+        """
+
+        access_token = super().get_access_token(request)
+
+        try:
+            access_token = base64.b64decode(access_token).decode("utf-8")
+        except (binascii.Error, TypeError):
+            pass
+
+        return access_token

src/backend/core/resource_server/backend.py

@@ -0,0 +1,224 @@
+"""Resource Server Backend"""
+
+import logging
+
+from django.conf import settings
+from django.contrib import auth
+from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
+
+from joserfc import jwe as jose_jwe
+from joserfc import jwt as jose_jwt
+from joserfc.errors import InvalidClaimError, InvalidTokenError
+from requests.exceptions import HTTPError
+from rest_framework.exceptions import AuthenticationFailed
+
+from . import utils
+
+logger = logging.getLogger(__name__)
+
+
+class ResourceServerBackend:
+    """Backend of an OAuth 2.0 resource server.
+
+    This backend is designed to authenticate resource owners to our API using the access token
+    they received from the authorization server.
+
+    In the context of OAuth 2.0, a resource server is a server that hosts protected resources and
+    is capable of accepting and responding to protected resource requests using access tokens.
+    The resource server verifies the validity of the access tokens issued by the authorization
+    server to ensure secure access to the resources.
+
+    For more information, visit: https://www.oauth.com/oauth2-servers/the-resource-server/
+    """
+
+    # pylint: disable=too-many-instance-attributes
+    def __init__(self, authorization_server_client):
+        """Require client_id, client_secret set and authorization_server_client provided."""
+        # pylint: disable=invalid-name
+        self.UserModel = auth.get_user_model()
+
+        self._client_id = settings.OIDC_RS_CLIENT_ID
+        self._client_secret = settings.OIDC_RS_CLIENT_SECRET
+        self._encryption_encoding = settings.OIDC_RS_ENCRYPTION_ENCODING
+        self._encryption_algorithm = settings.OIDC_RS_ENCRYPTION_ALGO
+        self._signing_algorithm = settings.OIDC_RS_SIGNING_ALGO
+        self._scopes = settings.OIDC_RS_SCOPES
+
+        if (
+            not self._client_id
+            or not self._client_secret
+            or not authorization_server_client
+        ):
+            raise ImproperlyConfigured(
+                "Could not instantiate ResourceServerBackend, some parameters are missing."
+            )
+
+        self._authorization_server_client = authorization_server_client
+
+        self._claims_registry = jose_jwt.JWTClaimsRegistry(
+            iss={"essential": True, "value": self._authorization_server_client.url},
+            aud={"essential": True, "value": self._client_id},
+            token_introspection={"essential": True},
+        )
+
+    # pylint: disable=unused-argument
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Maintain API compatibility with OIDCAuthentication class from mozilla-django-oidc
+
+        Params 'id_token', 'payload' won't be used, and our implementation will only
+        support 'get_user', not 'get_or_create_user'.
+        """
+
+        return self.get_user(access_token)
+
+    def get_user(self, access_token):
+        """Get user from an access token emitted by the authorization server.
+
+        This method will submit the access token to the authorization server for
+        introspection, to ensure its validity and obtain the associated metadata.
+
+        It follows the specifications outlined in RFC7662 https://www.rfc-editor.org/info/rfc7662,
+        https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-introspection-response-12.
+
+        In our eGovernment applications, the standard RFC 7662 doesn't provide sufficient security.
+        Its introspection response is a plain JSON object. Therefore, we use the draft RFC
+        that extends RFC 7662 by returning a signed and encrypted JWT for stronger assurance that
+        the authorization server issued the token introspection response.
+        """
+        jwt = self._introspect(access_token)
+        claims = self._verify_claims(jwt)
+        user_info = self._verify_user_info(claims["token_introspection"])
+
+        sub = user_info.get("sub")
+        if sub is None:
+            message = "User info contained no recognizable user identification"
+            logger.debug(message)
+            raise SuspiciousOperation(message)
+        try:
+            user = self.UserModel.objects.get(sub=sub)
+        except self.UserModel.DoesNotExist:
+            logger.debug("Login failed: No user with %s found", sub)
+            return None
+
+        return user
+
+    def _verify_user_info(self, introspection_response):
+        """Verify the 'introspection_response' to get valid and relevant user info.
+
+        The 'introspection_response' should be still active, and while authenticating
+        the resource owner should have requested relevant scope to access her data in
+        our resource server.
+
+        Scope should be configured to match between the AS and the RS. The AS will filter
+        all the scopes the resource owner requested to expose only the relevant ones to
+        our resource server.
+        """
+
+        active = introspection_response.get("active", None)
+
+        if not active:
+            message = "Introspection response is not active."
+            logger.debug(message)
+            raise SuspiciousOperation(message)
+
+        requested_scopes = introspection_response.get("scope", None).split(" ")
+        if set(self._scopes).isdisjoint(set(requested_scopes)):
+            message = "Introspection response contains any required scopes."
+            logger.debug(message)
+            raise SuspiciousOperation(message)
+
+        return introspection_response
+
+    def _introspect(self, token):
+        """Introspect an access token to the authorization server."""
+        try:
+            jwe = self._authorization_server_client.get_introspection(
+                self._client_id,
+                self._client_secret,
+                token,
+            )
+        except HTTPError as err:
+            message = "Could not fetch introspection"
+            logger.debug("%s. Exception:", message, exc_info=True)
+            raise SuspiciousOperation(message) from err
+
+        private_key = utils.import_private_key_from_settings()
+        jws = self._decrypt(jwe, private_key=private_key)
+
+        try:
+            public_key_set = self._authorization_server_client.import_public_keys()
+        except (TypeError, ValueError, AttributeError, HTTPError) as err:
+            message = "Could get authorization server JWKS"
+            logger.debug("%s. Exception:", message, exc_info=True)
+            raise SuspiciousOperation(message) from err
+
+        jwt = self._decode(jws, public_key_set)
+
+        return jwt
+
+    def _decrypt(self, encrypted_token, private_key):
+        """Decrypt the token encrypted by the Authorization Server (AS).
+
+        Resource Server (RS)'s public key is used for encryption, and its private
+        key is used for decryption. The RS's public key is exposed to the AS via a JWKS endpoint.
+        Encryption Algorithm and Encoding should be configured to match between the AS
+        and the RS.
+        """
+
+        try:
+            decrypted_token = jose_jwe.decrypt_compact(
+                encrypted_token,
+                private_key,
+                algorithms=[self._encryption_algorithm, self._encryption_encoding],
+            )
+        except Exception as err:
+            message = "Token decryption failed"
+            logger.debug("%s. Exception:", message, exc_info=True)
+            raise SuspiciousOperation(message) from err
+
+        return decrypted_token
+
+    def _decode(self, encoded_token, public_key_set):
+        """Decode the token signed by the Authorization Server (AS).
+
+        AS's private key is used for signing, and its public key is used for decoding.
+        The AS public key is exposed via a JWK endpoint.
+        Signing Algorithm should be configured to match between the AS and the RS.
+        """
+        try:
+            token = jose_jwt.decode(
+                encoded_token.plaintext,
+                public_key_set,
+                algorithms=[self._signing_algorithm],
+            )
+        except ValueError as err:
+            message = "Token decoding failed"
+            logger.debug("%s. Exception:", message, exc_info=True)
+            raise SuspiciousOperation(message) from err
+
+        return token
+
+    def _verify_claims(self, token):
+        """Verify the claims of the token to ensure authentication security.
+
+        By verifying these claims, we ensure that the token was issued by a
+        trusted authorization server and is intended for this specific
+        resource server. This prevents various types of attacks, such as
+        token substitution or misuse of tokens issued for different clients.
+        """
+        try:
+            self._claims_registry.validate(token.claims)
+        except (InvalidClaimError, InvalidTokenError) as err:
+            message = "Failed to validate token's claims"
+            logger.debug("%s. Exception:", message, exc_info=True)
+            raise SuspiciousOperation(message) from err
+
+        return token.claims
+
+
+class ResourceServerImproperlyConfiguredBackend:
+    """Fallback backend for improperly configured Resource Servers."""
+
+    def get_or_create_user(self, access_token, id_token, payload):
+        """Indicate that the Resource Server is improperly configured."""
+        raise AuthenticationFailed("Resource Server is improperly configured")

src/backend/core/resource_server/clients.py

@@ -0,0 +1,97 @@
+"""Resource Server Clients classes"""
+
+from django.core.exceptions import ImproperlyConfigured
+
+import requests
+from joserfc.jwk import KeySet
+
+
+class AuthorizationServerClient:
+    """Client for interacting with an OAuth 2.0 authorization server.
+
+    An authorization server issues access tokens to client applications after authenticating
+    and obtaining authorization from the resource owner. It also provides endpoints for token
+    introspection and JSON Web Key Sets (JWKS) to validate and decode tokens.
+
+    This client facilitates communication with the authorization server, including:
+    - Fetching token introspection responses.
+    - Fetching JSON Web Key Sets (JWKS) for token validation.
+    - Setting appropriate headers for secure communication as recommended by RFC drafts.
+    """
+
+    # ruff: noqa: PLR0913 PLR0917
+    # pylint: disable=too-many-positional-arguments
+    # pylint: disable=too-many-arguments
+    def __init__(
+        self,
+        url,
+        url_jwks,
+        url_introspection,
+        verify_ssl,
+        timeout,
+        proxy,
+    ):
+        """Require at a minimum url, url_jwks and url_introspection."""
+
+        if not url or not url_jwks or not url_introspection:
+            raise ImproperlyConfigured(
+                "Could not instantiate AuthorizationServerClient, some parameters are missing."
+            )
+
+        self.url = url
+        self._url_introspection = url_introspection
+        self._url_jwks = url_jwks
+        self._verify_ssl = verify_ssl
+        self._timeout = timeout
+        self._proxy = proxy
+
+    @property
+    def _introspection_headers(self):
+        """Get HTTP header for the introspection request.
+
+        Notify the authorization server that we expect a signed and encrypted response
+        by setting the appropriate 'Accept' header.
+
+        This follows the recommendation from the draft RFC:
+        https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwt-introspection-response-12.
+        """
+        return {
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Accept": "application/token-introspection+jwt",
+        }
+
+    def get_introspection(self, client_id, client_secret, token):
+        """Retrieve introspection response about a token."""
+        response = requests.post(
+            self._url_introspection,
+            data={
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "token": token,
+            },
+            headers=self._introspection_headers,
+            verify=self._verify_ssl,
+            timeout=self._timeout,
+            proxies=self._proxy,
+        )
+        response.raise_for_status()
+        return response.text
+
+    def get_jwks(self):
+        """Retrieve Authorization Server JWKS."""
+        response = requests.get(
+            self._url_jwks,
+            verify=self._verify_ssl,
+            timeout=self._timeout,
+            proxies=self._proxy,
+        )
+        response.raise_for_status()
+        return response.json()
+
+    def import_public_keys(self):
+        """Retrieve and import Authorization Server JWKS."""
+
+        jwks = self.get_jwks()
+        public_keys = KeySet.import_key_set(jwks)
+
+        return public_keys

src/backend/core/resource_server/urls.py

@@ -0,0 +1,9 @@
+"""Resource Server URL Configuration"""
+
+from django.urls import path
+
+from .views import JWKSView
+
+urlpatterns = [
+    path("jwks", JWKSView.as_view(), name="resource_server_jwks"),
+]

src/backend/core/resource_server/utils.py

@@ -0,0 +1,48 @@
+"""Resource Server utils functions"""
+
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+from joserfc.jwk import JWKRegistry
+
+
+def import_private_key_from_settings():
+    """Import the private key used by the resource server when interacting with the OIDC provider.
+
+    This private key is crucial; its public components are exposed in the JWK endpoints,
+    while its private component is used for decrypting the introspection token retrieved
+    from the OIDC provider.
+
+    By default, we recommend using RSAKey for asymmetric encryption,
+    known for its strong security features.
+
+    Note:
+        - The function requires the 'OIDC_RS_PRIVATE_KEY_STR' setting to be configured.
+        - The 'OIDC_RS_ENCRYPTION_KEY_TYPE' and 'OIDC_RS_ENCRYPTION_ALGO' settings can be customized
+          based on the chosen key type.
+
+    Raises:
+        ImproperlyConfigured: If the private key setting is missing, empty, or incorrect.
+
+    Returns:
+        joserfc.jwk.JWK: The imported private key as a JWK object.
+    """
+
+    private_key_str = getattr(settings, "OIDC_RS_PRIVATE_KEY_STR", None)
+    if not private_key_str:
+        raise ImproperlyConfigured(
+            "OIDC_RS_PRIVATE_KEY_STR setting is missing or empty."
+        )
+
+    private_key_pem = private_key_str.encode()
+
+    try:
+        private_key = JWKRegistry.import_key(
+            private_key_pem,
+            key_type=settings.OIDC_RS_ENCRYPTION_KEY_TYPE,
+            parameters={"alg": settings.OIDC_RS_ENCRYPTION_ALGO, "use": "enc"},
+        )
+    except ValueError as err:
+        raise ImproperlyConfigured("OIDC_RS_PRIVATE_KEY_STR setting is wrong.") from err
+
+    return private_key

src/backend/core/resource_server/views.py

@@ -0,0 +1,40 @@
+"""Resource Server views"""
+
+from django.core.exceptions import ImproperlyConfigured
+
+from joserfc.jwk import KeySet
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from . import utils
+
+
+class JWKSView(APIView):
+    """
+    API endpoint for retrieving a JSON Web Keys Set (JWKS).
+
+    Returns:
+        Response: JSON response containing the JWKS data.
+    """
+
+    authentication_classes = []  # disable authentication
+    permission_classes = []  # disable permission
+
+    def get(self, request):
+        """Handle GET requests to retrieve JSON Web Keys Set (JWKS).
+
+        Returns:
+            Response: JSON response containing the JWKS data.
+        """
+
+        try:
+            private_key = utils.import_private_key_from_settings()
+        except (ImproperlyConfigured, ValueError) as err:
+            return Response({"error": str(err)}, status=500)
+
+        try:
+            jwk = KeySet([private_key]).as_dict(private=False)
+        except (TypeError, ValueError, AttributeError):
+            return Response({"error": "Could not load key"}, status=500)
+
+        return Response(jwk)

src/backend/core/templatetags/__init__.py

@@ -0,0 +1 @@
+"""Core template tags module."""

src/backend/core/templatetags/extra_tags.py

@@ -0,0 +1,58 @@
+"""Custom template tags for the core application of People."""
+
+import base64
+
+from django import template
+from django.contrib.staticfiles import finders
+
+from PIL import ImageFile as PillowImageFile
+
+register = template.Library()
+
+
+def image_to_base64(file_or_path, close=False):
+    """
+    Return the src string of the base64 encoding of an image represented by its path
+    or file opened or not.
+
+    Inspired by Django's "get_image_dimensions"
+    """
+    pil_parser = PillowImageFile.Parser()
+    if hasattr(file_or_path, "read"):
+        file = file_or_path
+        if file.closed and hasattr(file, "open"):
+            file_or_path.open()
+        file_pos = file.tell()
+        file.seek(0)
+    else:
+        try:
+            # pylint: disable=consider-using-with
+            file = open(file_or_path, "rb")
+        except OSError:
+            return ""
+        close = True
+
+    try:
+        image_data = file.read()
+        if not image_data:
+            return ""
+        pil_parser.feed(image_data)
+        if pil_parser.image:
+            mime_type = pil_parser.image.get_format_mimetype()
+            encoded_string = base64.b64encode(image_data)
+            return f"data:{mime_type:s};base64, {encoded_string.decode('utf-8'):s}"
+        return ""
+    finally:
+        if close:
+            file.close()
+        else:
+            file.seek(file_pos)
+
+
+@register.simple_tag
+def base64_static(path):
+    """Return a static file into a base64."""
+    full_path = finders.find(path)
+    if full_path:
+        return image_to_base64(full_path, True)
+    return ""

src/backend/core/tests/__init__.py

@@ -0,0 +1 @@
+"""Core tests."""

src/backend/core/tests/authentication/__init__.py

@@ -0,0 +1 @@
+"""Core authentication tests."""

src/backend/core/tests/authentication/test_backends.py

@@ -0,0 +1,383 @@
+"""Unit tests for the Authentication Backends."""
+
+from django.contrib.auth import get_user_model
+from django.core.exceptions import SuspiciousOperation
+
+import pytest
+
+from core import factories, models
+from core.authentication.backends import OIDCAuthenticationBackend
+
+pytestmark = pytest.mark.django_db
+User = get_user_model()
+
+
+def test_authentication_getter_existing_user_no_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user matches the user's info sub, the user should be returned.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    user = factories.UserFactory()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": user.sub}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(1):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+
+
+def test_authentication_getter_existing_user_with_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    When the user's info contains an email and targets an existing user,
+    """
+    klass = OIDCAuthenticationBackend()
+
+    user = factories.UserFactory(name="John Doe", with_organization=True)
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # Only 1 query because email and names have not changed
+    with django_assert_num_queries(1):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+
+
+@pytest.mark.parametrize(
+    "first_name, last_name, email",
+    [
+        ("Jack", "Doe", "john.doe@example.com"),
+        ("John", "Duy", "john.doe@example.com"),
+        ("John", "Doe", "jack.duy@example.com"),
+        ("Jack", "Duy", "jack.duy@example.com"),
+    ],
+)
+def test_authentication_getter_existing_user_change_fields(
+    first_name, last_name, email, django_assert_num_queries, monkeypatch
+):
+    """
+    It should update the email or name fields on the user when they change.
+    """
+    klass = OIDCAuthenticationBackend()
+    user = factories.UserFactory(
+        name="John Doe", email="john.doe@example.com", with_organization=True
+    )
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": user.sub,
+            "email": email,
+            "first_name": first_name,
+            "last_name": last_name,
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    # One and only one additional update query when a field has changed
+    with django_assert_num_queries(2):
+        authenticated_user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == authenticated_user
+    user.refresh_from_db()
+    assert user.email == email
+    assert user.name == f"{first_name:s} {last_name:s}"
+
+
+def test_authentication_getter_existing_user_via_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user doesn't match the sub but matches the email,
+    the user should be returned.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = factories.UserFactory(with_organization=True)
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": db_user.email}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(2):
+        user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == db_user
+
+
+def test_authentication_getter_existing_user_no_fallback_to_email(
+    settings, monkeypatch
+):
+    """
+    When the "OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION" setting is set to False,
+    the system should not match users by email, even if the email matches.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = factories.UserFactory()
+
+    # Set the setting to False
+    settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION = False
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": db_user.email}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    # Since the sub doesn't match, it should create a new user
+    assert models.User.objects.count() == 2
+    assert user != db_user
+    assert user.sub == "123"
+
+
+def test_authentication_getter_new_user_no_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should not be created without email
+    nor organization registration ID.
+    """
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123"}  # No email, no organization registration ID
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        pytest.raises(
+            SuspiciousOperation,
+            match="Claims contained no recognizable organization identification",
+        ),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+
+def test_authentication_getter_new_user_with_email(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    User's email and name should be set on the user.
+    """
+    klass = OIDCAuthenticationBackend()
+    email = "people@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": email, "first_name": "John", "last_name": "Doe"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.sub == "123"
+    assert user.email == email
+    assert user.name == "John Doe"
+    assert user.password == "!"
+    assert models.User.objects.count() == 1
+
+
+def test_models_oidc_user_getter_invalid_token(django_assert_num_queries, monkeypatch):
+    """The user's info doesn't contain a sub."""
+    klass = OIDCAuthenticationBackend()
+
+    def get_userinfo_mocked(*args):
+        return {
+            "test": "123",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(0),
+        pytest.raises(
+            SuspiciousOperation,
+            match="User info contained no recognizable user identification",
+        ),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.exists() is False
+
+
+def test_authentication_getter_existing_disabled_user_via_sub(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user matches the sub but is disabled,
+    an error should be raised and a user should not be created.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = factories.UserFactory(name="John Doe", is_active=False)
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": db_user.sub,
+            "email": db_user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(1),
+        pytest.raises(SuspiciousOperation, match="User account is disabled"),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_existing_disabled_user_via_email(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user does not matches the sub but match the email and is disabled,
+    an error should be raised and a user should not be created.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = factories.UserFactory(name="John Doe", is_active=False)
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "random",
+            "email": db_user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with (
+        django_assert_num_queries(2),
+        pytest.raises(SuspiciousOperation, match="User account is disabled"),
+    ):
+        klass.get_or_create_user(access_token="test-token", id_token=None, payload=None)
+
+    assert models.User.objects.count() == 1
+
+
+def test_authentication_getter_new_user_with_email_new_organization(monkeypatch):
+    """
+    If no user matches the user's info sub, a user should be created.
+    If the corresponding organization doesn't exist, it should be created.
+    """
+    klass = OIDCAuthenticationBackend()
+    email = "people@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {"sub": "123", "email": email, "first_name": "John", "last_name": "Doe"}
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.organization is not None
+    assert user.organization.domain_list == ["example.com"]
+    assert user.organization.registration_id_list == []
+
+
+@pytest.mark.parametrize(
+    "registration_id_setting,expected_registration_id_list,expected_domain_list",
+    [
+        (None, [], ["example.com"]),
+        ("missing-claim", [], ["example.com"]),
+        ("registration_number", ["12345678901234"], []),
+    ],
+)
+def test_authentication_getter_new_user_with_registration_id_new_organization(
+    monkeypatch,
+    settings,
+    registration_id_setting,
+    expected_registration_id_list,
+    expected_domain_list,
+):
+    """
+    If no user matches the user's info sub, a user should be created.
+    If the corresponding organization doesn't exist, it should be created.
+    """
+    settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD = registration_id_setting
+
+    klass = OIDCAuthenticationBackend()
+    email = "people@example.com"
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": "123",
+            "email": email,
+            "first_name": "John",
+            "last_name": "Doe",
+            "registration_number": "12345678901234",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    user = klass.get_or_create_user(
+        access_token="test-token", id_token=None, payload=None
+    )
+
+    assert user.organization is not None
+    assert user.organization.domain_list == expected_domain_list
+    assert user.organization.registration_id_list == expected_registration_id_list
+
+
+def test_authentication_getter_existing_user_via_email_update_organization(
+    django_assert_num_queries, monkeypatch
+):
+    """
+    If an existing user already exists without organization, the organization must be updated.
+    """
+
+    klass = OIDCAuthenticationBackend()
+    db_user = factories.UserFactory(name="John Doe", email="toto@my-domain.com")
+
+    def get_userinfo_mocked(*args):
+        return {
+            "sub": db_user.sub,
+            "email": db_user.email,
+            "first_name": "John",
+            "last_name": "Doe",
+        }
+
+    monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
+
+    with django_assert_num_queries(9):
+        user = klass.get_or_create_user(
+            access_token="test-token", id_token=None, payload=None
+        )
+
+    assert user == db_user
+    assert user.organization is not None
+    assert user.organization.domain_list == ["my-domain.com"]

src/backend/core/tests/authentication/test_urls.py

@@ -0,0 +1,10 @@
+"""Unit tests for the Authentication URLs."""
+
+from core.authentication.urls import urlpatterns
+
+
+def test_urls_override_default_mozilla_django_oidc():
+    """Custom URL patterns should override default ones from Mozilla Django OIDC."""
+
+    url_names = [u.name for u in urlpatterns]
+    assert url_names.index("oidc_logout_custom") < url_names.index("oidc_logout")

src/backend/core/tests/authentication/test_views.py

@@ -0,0 +1,231 @@
+"""Unit tests for the Authentication Views."""
+
+from unittest import mock
+from urllib.parse import parse_qs, urlparse
+
+from django.contrib.auth.models import AnonymousUser
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.core.exceptions import SuspiciousOperation
+from django.test import RequestFactory
+from django.test.utils import override_settings
+from django.urls import reverse
+from django.utils import crypto
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+from core.authentication.views import OIDCLogoutCallbackView, OIDCLogoutView
+
+pytestmark = pytest.mark.django_db
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_anonymous():
+    """Anonymous users calling the logout url,
+    should be redirected to the specified LOGOUT_REDIRECT_URL."""
+
+    url = reverse("oidc_logout_custom")
+    response = APIClient().get(url)
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@mock.patch.object(
+    OIDCLogoutView, "construct_oidc_logout_url", return_value="/example-logout"
+)
+def test_view_logout(mocked_oidc_logout_url):
+    """Authenticated users should be redirected to OIDC provider for logout."""
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    url = reverse("oidc_logout_custom")
+    response = client.get(url)
+
+    mocked_oidc_logout_url.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/default-redirect-logout")
+@mock.patch.object(
+    OIDCLogoutView, "construct_oidc_logout_url", return_value="/default-redirect-logout"
+)
+def test_view_logout_no_oidc_provider(mocked_oidc_logout_url):
+    """Authenticated users should be logged out when no OIDC provider is available."""
+
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    url = reverse("oidc_logout_custom")
+
+    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
+        response = client.get(url)
+        mocked_oidc_logout_url.assert_called_once()
+        mock_logout.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/default-redirect-logout"
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_callback_anonymous():
+    """Anonymous users calling the logout callback url,
+    should be redirected to the specified LOGOUT_REDIRECT_URL."""
+
+    url = reverse("oidc_logout_callback")
+    response = APIClient().get(url)
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"
+
+
+@pytest.mark.parametrize(
+    "initial_oidc_states",
+    [{}, {"other_state": "foo"}],
+)
+def test_view_logout_persist_state(initial_oidc_states):
+    """State value should be persisted in session's data."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    if initial_oidc_states:
+        request.session["oidc_states"] = initial_oidc_states
+        request.session.save()
+
+    mocked_state = "mock_state"
+
+    OIDCLogoutView().persist_state(request, mocked_state)
+
+    assert "oidc_states" in request.session
+    assert request.session["oidc_states"] == {
+        "mock_state": {},
+        **initial_oidc_states,
+    }
+
+
+@override_settings(OIDC_OP_LOGOUT_ENDPOINT="/example-logout")
+@mock.patch.object(OIDCLogoutView, "persist_state")
+@mock.patch.object(crypto, "get_random_string", return_value="mocked_state")
+def test_view_logout_construct_oidc_logout_url(
+    mocked_get_random_string, mocked_persist_state
+):
+    """Should construct the logout URL to initiate the logout flow with the OIDC provider."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    request.session["oidc_id_token"] = "mocked_oidc_id_token"
+    request.session.save()
+
+    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
+
+    mocked_persist_state.assert_called_once()
+    mocked_get_random_string.assert_called_once()
+
+    params = parse_qs(urlparse(redirect_url).query)
+
+    assert params["id_token_hint"][0] == "mocked_oidc_id_token"
+    assert params["state"][0] == "mocked_state"
+
+    url = reverse("oidc_logout_callback")
+    assert url in params["post_logout_redirect_uri"][0]
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/")
+def test_view_logout_construct_oidc_logout_url_none_id_token():
+    """If no ID token is available in the session,
+    the user should be redirected to the final URL."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
+
+    assert redirect_url == "/"
+
+
+@pytest.mark.parametrize(
+    "initial_state",
+    [None, {"other_state": "foo"}],
+)
+def test_view_logout_callback_wrong_state(initial_state):
+    """Should raise an error if OIDC state doesn't match session data."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().request()
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    if initial_state:
+        request.session["oidc_states"] = initial_state
+        request.session.save()
+
+    callback_view = OIDCLogoutCallbackView.as_view()
+
+    with pytest.raises(SuspiciousOperation) as excinfo:
+        callback_view(request)
+
+    assert (
+        str(excinfo.value) == "OIDC callback state not found in session `oidc_states`!"
+    )
+
+
+@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
+def test_view_logout_callback():
+    """If state matches, callback should clear OIDC state and redirects."""
+
+    user = factories.UserFactory()
+
+    request = RequestFactory().get("/logout-callback/", data={"state": "mocked_state"})
+    request.user = user
+
+    middleware = SessionMiddleware(get_response=lambda x: x)
+    middleware.process_request(request)
+
+    mocked_state = "mocked_state"
+
+    request.session["oidc_states"] = {mocked_state: {}}
+    request.session.save()
+
+    callback_view = OIDCLogoutCallbackView.as_view()
+
+    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
+
+        def clear_user(request):
+            # Assert state is cleared prior to logout
+            assert request.session["oidc_states"] == {}
+            request.user = AnonymousUser()
+
+        mock_logout.side_effect = clear_user
+        response = callback_view(request)
+        mock_logout.assert_called_once()
+
+    assert response.status_code == 302
+    assert response.url == "/example-logout"

src/backend/core/tests/resource_server/__init__.py

@@ -0,0 +1 @@
+"""Core resource server tests."""

src/backend/core/tests/resource_server/test_backend.py

@@ -0,0 +1,447 @@
+"""
+Test for the Resource Server (RS) Backend.
+"""
+
+
+# pylint: disable=W0212
+
+from logging import Logger
+from unittest.mock import Mock, patch
+
+from django.contrib import auth
+from django.core.exceptions import SuspiciousOperation
+from django.test.utils import override_settings
+
+import pytest
+from joserfc.errors import InvalidClaimError, InvalidTokenError
+from joserfc.jwt import JWTClaimsRegistry
+from requests.exceptions import HTTPError
+
+from core.resource_server.backend import ResourceServerBackend
+
+
+@pytest.fixture(name="mock_authorization_server")
+def fixture_mock_authorization_server():
+    """Mock an Authorization Server client."""
+    mock_server = Mock()
+    mock_server.url = "https://auth.server.com"
+    return mock_server
+
+
+@pytest.fixture(name="mock_token")
+def fixture_mock_token():
+    """Mock a token"""
+    mock_token = Mock()
+    mock_token.claims = {"sub": "user123", "iss": "https://auth.server.com"}
+    return mock_token
+
+
+@pytest.fixture(name="resource_server_backend")
+def fixture_resource_server_backend(settings, mock_authorization_server):
+    """Generate a Resource Server backend."""
+
+    settings.OIDC_RS_CLIENT_ID = "client_id"
+    settings.OIDC_RS_CLIENT_SECRET = "client_secret"
+    settings.OIDC_RS_ENCRYPTION_ENCODING = "A256GCM"
+    settings.OIDC_RS_ENCRYPTION_ALGO = "RSA-OAEP"
+    settings.OIDC_RS_SIGNING_ALGO = "ES256"
+    settings.OIDC_RS_SCOPES = ["groups"]
+
+    return ResourceServerBackend(mock_authorization_server)
+
+
+@override_settings(OIDC_RS_CLIENT_ID="client_id")
+@override_settings(OIDC_RS_CLIENT_SECRET="client_secret")
+@override_settings(OIDC_RS_ENCRYPTION_ENCODING="A256GCM")
+@override_settings(OIDC_RS_ENCRYPTION_ALGO="RSA-OAEP")
+@override_settings(OIDC_RS_SIGNING_ALGO="RS256")
+@override_settings(OIDC_RS_SCOPES=["scopes"])
+@patch.object(auth, "get_user_model", return_value="foo")
+def test_backend_initialization(mock_get_user_model, mock_authorization_server):
+    """Test the ResourceServerBackend initialization."""
+
+    backend = ResourceServerBackend(mock_authorization_server)
+
+    mock_get_user_model.assert_called_once()
+    assert backend.UserModel == "foo"
+
+    assert backend._client_id == "client_id"
+    assert backend._client_secret == "client_secret"
+    assert backend._encryption_encoding == "A256GCM"
+    assert backend._encryption_algorithm == "RSA-OAEP"
+    assert backend._signing_algorithm == "RS256"
+    assert backend._scopes == ["scopes"]
+
+    assert backend._authorization_server_client == mock_authorization_server
+    assert isinstance(backend._claims_registry, JWTClaimsRegistry)
+
+    assert backend._claims_registry.options == {
+        "iss": {"essential": True, "value": "https://auth.server.com"},
+        "aud": {"essential": True, "value": "client_id"},
+        "token_introspection": {"essential": True},
+    }
+
+
+@patch.object(ResourceServerBackend, "get_user", return_value="user")
+def test_get_or_create_user(mock_get_user, resource_server_backend):
+    """Test 'get_or_create_user' method."""
+
+    access_token = "access_token"
+    res = resource_server_backend.get_or_create_user(access_token, None, None)
+
+    mock_get_user.assert_called_once_with(access_token)
+    assert res == "user"
+
+
+def test_verify_claims_success(resource_server_backend, mock_token):
+    """Test '_verify_claims' method with a successful response."""
+
+    with patch.object(
+        resource_server_backend._claims_registry, "validate"
+    ) as mock_validate:
+        resource_server_backend._verify_claims(mock_token)
+        mock_validate.assert_called_once_with(mock_token.claims)
+
+
+def test_verify_claims_invalid_claim_error(resource_server_backend, mock_token):
+    """Test '_verify_claims' method with an invalid claim error."""
+
+    with patch.object(
+        resource_server_backend._claims_registry, "validate"
+    ) as mock_validate:
+        mock_validate.side_effect = InvalidClaimError("claim_name")
+
+        expected_message = "Failed to validate token's claims"
+        with patch.object(Logger, "debug") as mock_logger_debug:
+            with pytest.raises(SuspiciousOperation, match=expected_message):
+                resource_server_backend._verify_claims(mock_token)
+            mock_logger_debug.assert_called_once_with(
+                "%s. Exception:", expected_message, exc_info=True
+            )
+
+
+def test_verify_claims_invalid_token_error(resource_server_backend, mock_token):
+    """Test '_verify_claims' method with an invalid token error."""
+
+    with patch.object(
+        resource_server_backend._claims_registry, "validate"
+    ) as mock_validate:
+        mock_validate.side_effect = InvalidTokenError
+
+        expected_message = "Failed to validate token's claims"
+        with patch.object(Logger, "debug") as mock_logger_debug:
+            with pytest.raises(SuspiciousOperation, match=expected_message):
+                resource_server_backend._verify_claims(mock_token)
+            mock_logger_debug.assert_called_once_with(
+                "%s. Exception:", expected_message, exc_info=True
+            )
+
+
+def test_decode_success(resource_server_backend):
+    """Test '_decode' method with a successful response."""
+
+    encoded_token = Mock()
+    encoded_token.plaintext = "valid_encoded_token"
+    public_key_set = Mock()
+
+    expected_decoded_token = {"sub": "user123"}
+
+    with patch(
+        "joserfc.jwt.decode", return_value=expected_decoded_token
+    ) as mock_decode:
+        decoded_token = resource_server_backend._decode(encoded_token, public_key_set)
+
+        mock_decode.assert_called_once_with(
+            "valid_encoded_token", public_key_set, algorithms=["ES256"]
+        )
+
+        assert decoded_token == expected_decoded_token
+
+
+def test_decode_failure(resource_server_backend):
+    """Test '_decode' method with a ValueError"""
+    encoded_token = Mock()
+    encoded_token.plaintext = "invalid_encoded_token"
+    public_key_set = Mock()
+
+    with patch("joserfc.jwt.decode", side_effect=ValueError):
+        with patch.object(Logger, "debug") as mock_logger_debug:
+            with pytest.raises(SuspiciousOperation, match="Token decoding failed"):
+                resource_server_backend._decode(encoded_token, public_key_set)
+
+            mock_logger_debug.assert_called_once_with(
+                "%s. Exception:", "Token decoding failed", exc_info=True
+            )
+
+
+def test_decrypt_success(resource_server_backend):
+    """Test '_decrypt' method with a successful response."""
+    encrypted_token = "valid_encrypted_token"
+    private_key = "private_key"
+
+    expected_decrypted_token = {"sub": "user123"}
+
+    with patch(
+        "joserfc.jwe.decrypt_compact", return_value=expected_decrypted_token
+    ) as mock_decrypt:
+        decrypted_token = resource_server_backend._decrypt(encrypted_token, private_key)
+        mock_decrypt.assert_called_once_with(
+            encrypted_token, private_key, algorithms=["RSA-OAEP", "A256GCM"]
+        )
+
+        assert decrypted_token == expected_decrypted_token
+
+
+def test_decrypt_failure(resource_server_backend):
+    """Test '_decrypt' method with an Exception."""
+    encrypted_token = "invalid_encrypted_token"
+    private_key = "private_key"
+
+    with patch(
+        "joserfc.jwe.decrypt_compact", side_effect=Exception("Decryption error")
+    ):
+        expected_message = "Token decryption failed"
+        with patch.object(Logger, "debug") as mock_logger_debug:
+            with pytest.raises(SuspiciousOperation, match=expected_message):
+                resource_server_backend._decrypt(encrypted_token, private_key)
+            mock_logger_debug.assert_called_once_with(
+                "%s. Exception:", expected_message, exc_info=True
+            )
+
+
+@patch(
+    "core.resource_server.utils.import_private_key_from_settings",
+    return_value="private_key",
+)
+# pylint: disable=unused-argument
+def test_introspect_success(
+    mock_import_private_key_from_settings, resource_server_backend
+):
+    """Test '_introspect' method with a successful response."""
+    token = "valid_token"
+    jwe = "valid_jwe"
+    jws = "valid_jws"
+    jwt = {"sub": "user123"}
+
+    resource_server_backend._authorization_server_client.get_introspection = Mock(
+        return_value=jwe
+    )
+    resource_server_backend._decrypt = Mock(return_value=jws)
+    resource_server_backend._authorization_server_client.import_public_keys = Mock(
+        return_value="public_key_set"
+    )
+    resource_server_backend._decode = Mock(return_value=jwt)
+
+    result = resource_server_backend._introspect(token)
+
+    assert result == jwt
+    resource_server_backend._authorization_server_client.get_introspection.assert_called_once_with(
+        "client_id", "client_secret", token
+    )
+    resource_server_backend._decrypt.assert_called_once_with(
+        jwe, private_key="private_key"
+    )
+    resource_server_backend._authorization_server_client.import_public_keys.assert_called_once()
+    resource_server_backend._decode.assert_called_once_with(jws, "public_key_set")
+
+
+def test_introspect_introspection_failure(resource_server_backend):
+    """Test '_introspect' method when introspection to the AS fails."""
+    token = "invalid_token"
+    resource_server_backend._authorization_server_client.get_introspection.side_effect = HTTPError(
+        "Introspection error"
+    )
+
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        expected_message = "Could not fetch introspection"
+        with pytest.raises(SuspiciousOperation, match=expected_message):
+            resource_server_backend._introspect(token)
+
+        mock_logger_debug.assert_called_once_with(
+            "%s. Exception:", expected_message, exc_info=True
+        )
+
+
+@patch(
+    "core.resource_server.utils.import_private_key_from_settings",
+    return_value="private_key",
+)
+# pylint: disable=unused-argument
+def test_introspect_public_key_import_failure(
+    mock_import_private_key_from_settings, resource_server_backend
+):
+    """Test '_introspect' method when fetching AS's jwks fails."""
+    token = "valid_token"
+    jwe = "valid_jwe"
+    jws = "valid_jws"
+
+    resource_server_backend._authorization_server_client.get_introspection = Mock(
+        return_value=jwe
+    )
+    resource_server_backend._decrypt = Mock(return_value=jws)
+
+    resource_server_backend._authorization_server_client.import_public_keys.side_effect = HTTPError(
+        "Public key error"
+    )
+
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        expected_message = "Could get authorization server JWKS"
+        with pytest.raises(SuspiciousOperation, match=expected_message):
+            resource_server_backend._introspect(token)
+
+        mock_logger_debug.assert_called_once_with(
+            "%s. Exception:", expected_message, exc_info=True
+        )
+
+
+def test_verify_user_info_success(resource_server_backend):
+    """Test '_verify_user_info' with a successful response."""
+    introspection_response = {"active": True, "scope": "groups"}
+
+    result = resource_server_backend._verify_user_info(introspection_response)
+    assert result == introspection_response
+
+
+def test_verify_user_info_inactive(resource_server_backend):
+    """Test '_verify_user_info' with an inactive introspection response."""
+
+    introspection_response = {"active": False, "scope": "groups"}
+
+    expected_message = "Introspection response is not active."
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        with pytest.raises(SuspiciousOperation, match=expected_message):
+            resource_server_backend._verify_user_info(introspection_response)
+
+        mock_logger_debug.assert_called_once_with(expected_message)
+
+
+def test_verify_user_info_wrong_scopes(resource_server_backend):
+    """Test '_verify_user_info' with wrong requested scopes."""
+
+    introspection_response = {"active": True, "scope": "wrong-scopes"}
+
+    expected_message = "Introspection response contains any required scopes."
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        with pytest.raises(SuspiciousOperation, match=expected_message):
+            resource_server_backend._verify_user_info(introspection_response)
+
+        mock_logger_debug.assert_called_once_with(expected_message)
+
+
+def test_get_user_success(resource_server_backend):
+    """Test '_get_user' with a successful response."""
+
+    access_token = "valid_access_token"
+    mock_jwt = Mock()
+    mock_claims = {"token_introspection": {"sub": "user123"}}
+    mock_user = Mock()
+
+    resource_server_backend._introspect = Mock(return_value=mock_jwt)
+    resource_server_backend._verify_claims = Mock(return_value=mock_claims)
+    resource_server_backend._verify_user_info = Mock(
+        return_value=mock_claims["token_introspection"]
+    )
+    resource_server_backend.UserModel.objects.get = Mock(return_value=mock_user)
+
+    user = resource_server_backend.get_user(access_token)
+
+    assert user == mock_user
+    resource_server_backend._introspect.assert_called_once_with(access_token)
+    resource_server_backend._verify_claims.assert_called_once_with(mock_jwt)
+    resource_server_backend._verify_user_info.assert_called_once_with(
+        mock_claims["token_introspection"]
+    )
+    resource_server_backend.UserModel.objects.get.assert_called_once_with(sub="user123")
+
+
+def test_get_user_could_not_introspect(resource_server_backend):
+    """Test '_get_user' with introspection failing."""
+
+    access_token = "valid_access_token"
+
+    resource_server_backend._introspect = Mock(
+        side_effect=SuspiciousOperation("Invalid jwt")
+    )
+    resource_server_backend._verify_claims = Mock()
+    resource_server_backend._verify_user_info = Mock()
+
+    with pytest.raises(SuspiciousOperation, match="Invalid jwt"):
+        resource_server_backend.get_user(access_token)
+
+    resource_server_backend._introspect.assert_called_once_with(access_token)
+    resource_server_backend._verify_claims.assert_not_called()
+    resource_server_backend._verify_user_info.assert_not_called()
+
+
+def test_get_user_invalid_introspection_response(resource_server_backend):
+    """Test '_get_user' with an invalid introspection response."""
+
+    access_token = "valid_access_token"
+    mock_jwt = Mock()
+
+    resource_server_backend._introspect = Mock(return_value=mock_jwt)
+    resource_server_backend._verify_claims = Mock(
+        side_effect=SuspiciousOperation("Invalid claims")
+    )
+    resource_server_backend._verify_user_info = Mock()
+
+    with pytest.raises(SuspiciousOperation, match="Invalid claims"):
+        resource_server_backend.get_user(access_token)
+
+    resource_server_backend._introspect.assert_called_once_with(access_token)
+    resource_server_backend._verify_claims.assert_called_once_with(mock_jwt)
+    resource_server_backend._verify_user_info.assert_not_called()
+
+
+def test_get_user_user_not_found(resource_server_backend):
+    """Test '_get_user' if the user is not found."""
+
+    access_token = "valid_access_token"
+    mock_jwt = Mock()
+    mock_claims = {"token_introspection": {"sub": "user123"}}
+
+    resource_server_backend._introspect = Mock(return_value=mock_jwt)
+    resource_server_backend._verify_claims = Mock(return_value=mock_claims)
+    resource_server_backend._verify_user_info = Mock(
+        return_value=mock_claims["token_introspection"]
+    )
+    resource_server_backend.UserModel.objects.get = Mock(
+        side_effect=resource_server_backend.UserModel.DoesNotExist
+    )
+
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        user = resource_server_backend.get_user(access_token)
+        assert user is None
+        resource_server_backend._introspect.assert_called_once_with(access_token)
+        resource_server_backend._verify_claims.assert_called_once_with(mock_jwt)
+        resource_server_backend._verify_user_info.assert_called_once_with(
+            mock_claims["token_introspection"]
+        )
+        resource_server_backend.UserModel.objects.get.assert_called_once_with(
+            sub="user123"
+        )
+
+        mock_logger_debug.assert_called_once_with(
+            "Login failed: No user with %s found", "user123"
+        )
+
+
+def test_get_user_no_user_identification(resource_server_backend):
+    """Test '_get_user' if the response miss a user identification."""
+
+    access_token = "valid_access_token"
+    mock_jwt = Mock()
+    mock_claims = {"token_introspection": {}}
+
+    resource_server_backend._introspect = Mock(return_value=mock_jwt)
+    resource_server_backend._verify_claims = Mock(return_value=mock_claims)
+    resource_server_backend._verify_user_info = Mock(
+        return_value=mock_claims["token_introspection"]
+    )
+
+    expected_message = "User info contained no recognizable user identification"
+    with patch.object(Logger, "debug") as mock_logger_debug:
+        with pytest.raises(SuspiciousOperation, match=expected_message):
+            resource_server_backend.get_user(access_token)
+
+        mock_logger_debug.assert_called_once_with(expected_message)

src/backend/core/tests/resource_server/test_clients.py

@@ -0,0 +1,187 @@
+"""
+Test for the Resource Server (RS) clients classes.
+"""
+
+# pylint: disable=W0212
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+from joserfc.jwk import KeySet, RSAKey
+from requests.exceptions import HTTPError
+
+from core.resource_server.clients import AuthorizationServerClient
+
+
+@pytest.fixture(name="client")
+def fixture_client():
+    """Generate an Authorization Server client."""
+    return AuthorizationServerClient(
+        url="https://auth.example.com/api/v2",
+        url_jwks="https://auth.example.com/api/v2/jwks",
+        url_introspection="https://auth.example.com/api/v2/introspect",
+        verify_ssl=True,
+        timeout=5,
+        proxy=None,
+    )
+
+
+def test_authorization_server_client_initialization():
+    """Test the AuthorizationServerClient initialization."""
+
+    new_client = AuthorizationServerClient(
+        url="https://auth.example.com/api/v2",
+        url_jwks="https://auth.example.com/api/v2/jwks",
+        url_introspection="https://auth.example.com/api/v2/checktoken/foo",
+        verify_ssl=True,
+        timeout=5,
+        proxy=None,
+    )
+
+    assert new_client.url == "https://auth.example.com/api/v2"
+    assert (
+        new_client._url_introspection
+        == "https://auth.example.com/api/v2/checktoken/foo"
+    )
+    assert new_client._url_jwks == "https://auth.example.com/api/v2/jwks"
+    assert new_client._verify_ssl is True
+    assert new_client._timeout == 5
+    assert new_client._proxy is None
+
+
+def test_introspection_headers(client):
+    """Test the introspection headers to ensure they match the expected values."""
+    assert client._introspection_headers == {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Accept": "application/token-introspection+jwt",
+    }
+
+
+@patch("requests.post")
+def test_get_introspection_success(mock_post, client):
+    """Test 'get_introspection' method with a successful response."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.return_value = None
+    mock_response.text = "introspection response"
+    mock_post.return_value = mock_response
+
+    result = client.get_introspection("client_id", "client_secret", "token")
+    assert result == "introspection response"
+
+    mock_post.assert_called_once_with(
+        "https://auth.example.com/api/v2/introspect",
+        data={
+            "client_id": "client_id",
+            "client_secret": "client_secret",
+            "token": "token",
+        },
+        headers={
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Accept": "application/token-introspection+jwt",
+        },
+        verify=True,
+        timeout=5,
+        proxies=None,
+    )
+
+
+@patch("requests.post", side_effect=HTTPError())
+# pylint: disable=(unused-argument
+def test_get_introspection_error(mock_post, client):
+    """Test 'get_introspection' method with an HTTPError."""
+    with pytest.raises(HTTPError):
+        client.get_introspection("client_id", "client_secret", "token")
+
+
+@patch("requests.get")
+def test_get_jwks_success(mock_get, client):
+    """Test 'get_jwks' method with a successful response."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.return_value = None
+    mock_response.json.return_value = {"jwks": "foo"}
+    mock_get.return_value = mock_response
+
+    result = client.get_jwks()
+    assert result == {"jwks": "foo"}
+
+    mock_get.assert_called_once_with(
+        "https://auth.example.com/api/v2/jwks",
+        verify=client._verify_ssl,
+        timeout=client._timeout,
+        proxies=client._proxy,
+    )
+
+
+@patch("requests.get")
+def test_get_jwks_error(mock_get, client):
+    """Test 'get_jwks' method with an HTTPError."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.side_effect = HTTPError(
+        response=MagicMock(status=500)
+    )
+    mock_get.return_value = mock_response
+
+    with pytest.raises(HTTPError):
+        client.get_jwks()
+
+
+@patch("requests.get")
+def test_import_public_keys_valid(mock_get, client):
+    """Test 'import_public_keys' method with a successful response."""
+
+    mocked_key = RSAKey.generate_key(2048)
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.return_value = None
+    mock_response.json.return_value = {"keys": [mocked_key.as_dict()]}
+    mock_get.return_value = mock_response
+
+    response = client.import_public_keys()
+
+    assert isinstance(response, KeySet)
+    assert response.as_dict() == KeySet([mocked_key]).as_dict()
+
+
+@patch("requests.get")
+def test_import_public_keys_http_error(mock_get, client):
+    """Test 'import_public_keys' method with an HTTPError."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.side_effect = HTTPError(
+        response=MagicMock(status=500)
+    )
+    mock_get.return_value = mock_response
+
+    with pytest.raises(HTTPError):
+        client.import_public_keys()
+
+
+@patch("requests.get")
+def test_import_public_keys_empty_jwks(mock_get, client):
+    """Test 'import_public_keys' method with empty keys response."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.return_value = None
+    mock_response.json.return_value = {"keys": []}
+    mock_get.return_value = mock_response
+
+    response = client.import_public_keys()
+
+    assert isinstance(response, KeySet)
+    assert response.as_dict() == {"keys": []}
+
+
+@patch("requests.get")
+def test_import_public_keys_invalid_jwks(mock_get, client):
+    """Test 'import_public_keys' method with invalid keys response."""
+
+    mock_response = MagicMock()
+    mock_response.raise_for_status.return_value = None
+    mock_response.json.return_value = {"keys": [{"foo": "foo"}]}
+    mock_get.return_value = mock_response
+
+    with pytest.raises(ValueError):
+        client.import_public_keys()

src/backend/core/tests/resource_server/test_utils.py

@@ -0,0 +1,88 @@
+"""
+Test for the Resource Server (RS) utils functions.
+"""
+
+from django.core.exceptions import ImproperlyConfigured
+from django.test.utils import override_settings
+
+import pytest
+from joserfc.jwk import ECKey, RSAKey
+
+from core.resource_server.utils import import_private_key_from_settings
+
+PRIVATE_KEY_STR_MOCKED = """-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3boG1kwEGUYL+
+U58RPrVToIsF9jHB64S6WJIIInPmAclBciXFb6BWG11mbRIgo8ha3WVnC/tGHbXb
+ndiKdrH2vKHOsDhV9AmgHgNgWaUK9L0uuKEb/xMLePYWsYlgzcQJx8RZY7RQyWqE
+20WfzFxeuCE7QMb6VXSOgwQMnJsKocguIh3VCI9RIBq3B1kdgW35AD63YKOygmGx
+qjcWwbjhKLvkF7LpBdlyAEzOKqg4T5uCcHMfksMW2+foTJx70RrZM/KHU+Zysuw7
+uhhVsgPBG+CsqBSjHQhs7jzymqxtQAfe1FkrCRxOq5Pv2Efr7kgtVSkJJiX3KutM
+vnWuEypxAgMBAAECggEAGqKS9pbrN+vnmb7yMsqYgVVnQn0aggZNHlLkl4ZLLnuV
+aemlhur7zO0JzajqUC+AFQOfaQxiFu8S/FoJ+qccFdATrcPEVmTKbgPVqSyzLKlX
+fByGll5eOVT95NMwN8yBGgt2HSW/ZditXS/KxxahVgamGqjAC9MTSutGz/8Ae1U+
+DNDBJCc6RAqu3T02tV9A2pSpVC1rSktDMpLUTscnsfxpaEQATd9DJUcHEvIwoX8q
+GJpycPEhNhdPXqpln5SoMHcf/zS5ssF/Mce0lJJXYyE0LnEk9X12jMWyBqmLqXUY
+cKLyynaFbis0DpQppwKx2y8GpL76k+Ci4dOHIvFknQKBgQDj/2WRMcWOvfBrggzj
+FHpcme2gSo5A5c0CVyI+Xkf1Zab6UR6T7GiImEoj9tq0+o2WEix9rwoypgMBq8rz
+/rrJAPSZjgv6z71k4EnO2FIB5R03vQmoBRCN8VlgvLM0xv52zyjV4Wx66Q4MDjyH
+EgkpHyB0FzRZh0UzhnE/pYSetQKBgQDN9eLB1nA4CBSr1vMGNfQyfBQl3vpO9EP4
+VSS3KnUqCIjJeLu682Ylu7SFxcJAfzUpy5S43hEvcuJsagsVKfmCAGcYZs9/xq3I
+vzYyhaEOS5ezNxLSh4+yCNBPlmrmDyoazag0t8H8YQFBN6BVcxbATHqdWGUhIhYN
+eEpEMOh2TQKBgGBr7kRNTENlyHtu8IxIaMcowfn8DdUcWmsW9oBx1vTNHKTYEZp1
+bG/4F8LF7xCCtcY1wWMV17Y7xyG5yYcOv2eqY8dc72wO1wYGZLB5g5URlB2ycJcC
+LVIaM7ZZl2BGl+8fBSIOx5XjYfFvQ+HLmtwtMchm19jVAEseHF7SXRfRAoGAK15j
+aT2mU6Yf9C9G7T/fM+I8u9zACHAW/+ut14PxN/CkHQh3P16RW9CyqpiB1uLyZuKf
+Zm4cYElotDuAKey0xVMgYlsDxnwni+X3m5vX1hLE1s/5/qrc7zg75QZfbCI1U3+K
+s88d4e7rPLhh4pxhZgy0pP1ADkIHMr7ppIJH8OECgYEApNfbgsJVPAMzucUhJoJZ
+OmZHbyCtJvs4b+zxnmhmSbopifNCgS4zjXH9qC7tsUph1WE6L2KXvtApHGD5H4GQ
+IH5em4M/pHIcsqCi1qggBMbdvzHBUtC3R4sK0CpEFHlN+Y59aGazidcN2FPupNJv
+MbyqKyC6DAzv4jEEhHaN7oY=
+-----END PRIVATE KEY-----
+"""
+
+
+@override_settings(OIDC_RS_PRIVATE_KEY_STR=PRIVATE_KEY_STR_MOCKED)
+@pytest.mark.parametrize("mocked_private_key", [None, ""])
+def test_import_private_key_from_settings_missing_or_empty_key(
+    settings, mocked_private_key
+):
+    """Should raise an exception if the settings 'OIDC_RS_PRIVATE_KEY_STR' is missing or empty."""
+    settings.OIDC_RS_PRIVATE_KEY_STR = mocked_private_key
+
+    with pytest.raises(
+        ImproperlyConfigured,
+        match="OIDC_RS_PRIVATE_KEY_STR setting is missing or empty.",
+    ):
+        import_private_key_from_settings()
+
+
+@pytest.mark.parametrize("mocked_private_key", ["123", "foo", "invalid_key"])
+@override_settings(OIDC_RS_PRIVATE_KEY_STR=PRIVATE_KEY_STR_MOCKED)
+@override_settings(OIDC_RS_ENCRYPTION_KEY_TYPE="RSA")
+@override_settings(OIDC_RS_ENCRYPTION_ALGO="RS256")
+def test_import_private_key_from_settings_incorrect_key(settings, mocked_private_key):
+    """Should raise an exception if the setting 'OIDC_RS_PRIVATE_KEY_STR' has an incorrect value."""
+    settings.OIDC_RS_PRIVATE_KEY_STR = mocked_private_key
+
+    with pytest.raises(
+        ImproperlyConfigured, match="OIDC_RS_PRIVATE_KEY_STR setting is wrong."
+    ):
+        import_private_key_from_settings()
+
+
+@override_settings(OIDC_RS_PRIVATE_KEY_STR=PRIVATE_KEY_STR_MOCKED)
+@override_settings(OIDC_RS_ENCRYPTION_KEY_TYPE="RSA")
+@override_settings(OIDC_RS_ENCRYPTION_ALGO="RS256")
+def test_import_private_key_from_settings_success_rsa_key():
+    """Should import private key string as an RSA key."""
+    private_key = import_private_key_from_settings()
+    assert isinstance(private_key, RSAKey)
+
+
+@override_settings(OIDC_RS_PRIVATE_KEY_STR=PRIVATE_KEY_STR_MOCKED)
+@override_settings(OIDC_RS_ENCRYPTION_KEY_TYPE="EC")
+@override_settings(OIDC_RS_ENCRYPTION_ALGO="ES256")
+def test_import_private_key_from_settings_success_ec_key():
+    """Should import private key string as an EC key."""
+    private_key = import_private_key_from_settings()
+    assert isinstance(private_key, ECKey)

src/backend/core/tests/resource_server/test_views.py

@@ -0,0 +1,70 @@
+"""
+Tests for the Resource Server (RS) Views.
+"""
+
+from unittest import mock
+
+from django.core.exceptions import ImproperlyConfigured
+from django.urls import reverse
+
+import pytest
+from joserfc.jwk import RSAKey
+from rest_framework.test import APIClient
+
+pytestmark = pytest.mark.django_db
+
+
+@mock.patch("core.resource_server.utils.import_private_key_from_settings")
+def test_view_jwks_valid_public_key(mock_import_private_key_from_settings):
+    """JWKs endpoint should return a set of valid Json Web Key"""
+
+    mocked_key = RSAKey.generate_key(2048)
+    mock_import_private_key_from_settings.return_value = mocked_key
+
+    url = reverse("resource_server_jwks")
+    response = APIClient().get(url)
+
+    mock_import_private_key_from_settings.assert_called_once()
+
+    assert response.status_code == 200
+    assert response["Content-Type"] == "application/json"
+
+    jwks = response.json()
+    assert jwks == {"keys": [mocked_key.as_dict(private=False)]}
+
+    # Security checks to make sure no details from the private key are exposed
+    private_details = ["d", "p", "q", "dp", "dq", "qi", "oth", "r", "t"]
+    assert all(
+        private_detail not in jwks["keys"][0].keys()
+        for private_detail in private_details
+    )
+
+
+@mock.patch("core.resource_server.utils.import_private_key_from_settings")
+def test_view_jwks_invalid_private_key(mock_import_private_key_from_settings):
+    """JWKS endpoint should return a proper exception when loading keys fails."""
+
+    mock_import_private_key_from_settings.return_value = "wrong_key"
+
+    url = reverse("resource_server_jwks")
+    response = APIClient().get(url)
+
+    mock_import_private_key_from_settings.assert_called_once()
+
+    assert response.status_code == 500
+    assert response.json() == {"error": "Could not load key"}
+
+
+@mock.patch("core.resource_server.utils.import_private_key_from_settings")
+def test_view_jwks_missing_private_key(mock_import_private_key_from_settings):
+    """JWKS endpoint should return a proper exception when private key is missing."""
+
+    mock_import_private_key_from_settings.side_effect = ImproperlyConfigured("foo.")
+
+    url = reverse("resource_server_jwks")
+    response = APIClient().get(url)
+
+    mock_import_private_key_from_settings.assert_called_once()
+
+    assert response.status_code == 500
+    assert response.json() == {"error": "foo."}

src/backend/core/tests/swagger/__init__.py

@@ -0,0 +1 @@
+"""Core Swagger tests."""

src/backend/core/tests/swagger/test_openapi_schema.py

@@ -1,6 +1,7 @@
 """
 Test suite for generated openapi schema.
 """
+
 import json
 from io import StringIO
 
@@ -32,7 +33,7 @@ def test_openapi_client_schema():
     )
     assert output.getvalue() == ""
 
-    response = Client().get("/v1.0/swagger.json")
+    response = Client().get("/api/v1.0/swagger.json")
 
     assert response.status_code == 200
     with open(

src/backend/core/tests/team_accesses/test_api_team_accesses_create.py

@@ -0,0 +1,228 @@
+"""
+Test for team accesses API endpoints in People's core app : create
+"""
+
+import json
+import random
+import re
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_create_anonymous():
+    """Anonymous users should not be allowed to create team accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+
+    response = APIClient().post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(user.id),
+            "team": str(team.id),
+            "role": random.choice(models.RoleChoices.choices)[0],
+        },
+        format="json",
+    )
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+    assert models.TeamAccess.objects.exists() is False
+
+
+def test_api_team_accesses_create_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to create team accesses for a team to
+    which they are not related.
+    """
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+    team = factories.TeamFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "You are not allowed to manage accesses for this team."
+    }
+    assert not models.TeamAccess.objects.filter(user=other_user).exists()
+
+
+def test_api_team_accesses_create_authenticated_member():
+    """Members of a team should not be allowed to create team accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    other_user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    for role in [role[0] for role in models.RoleChoices.choices]:
+        response = client.post(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": role,
+            },
+            format="json",
+        )
+
+        assert response.status_code == 403
+        assert response.json() == {
+            "detail": "You are not allowed to manage accesses for this team."
+        }
+
+    assert not models.TeamAccess.objects.filter(user=other_user).exists()
+
+
+def test_api_team_accesses_create_authenticated_administrator():
+    """
+    Administrators of a team should be able to create team accesses except for the "owner" role.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    # It should not be allowed to create an owner access
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": "owner",
+        },
+        format="json",
+    )
+
+    assert response.status_code == 403
+    assert response.json() == {
+        "detail": "Only owners of a team can assign other users as owners."
+    }
+
+    # It should be allowed to create a lower access
+    role = random.choice(
+        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
+    )
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
+    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_team_access.get_abilities(user),
+        "id": str(new_team_access.id),
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+def test_api_team_accesses_create_authenticated_owner():
+    """
+    Owners of a team should be able to create team accesses whatever the role.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    other_user = factories.UserFactory()
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+        {
+            "user": str(other_user.id),
+            "role": role,
+        },
+        format="json",
+    )
+
+    assert response.status_code == 201
+    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
+    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
+    assert response.json() == {
+        "abilities": new_team_access.get_abilities(user),
+        "id": str(new_team_access.id),
+        "role": role,
+        "user": str(other_user.id),
+    }
+
+
+def test_api_team_accesses_create_webhook():
+    """
+    When the team has a webhook, creating a team access should fire a call.
+    """
+    user, other_user = factories.UserFactory.create_batch(2)
+
+    team = factories.TeamFactory(users=[(user, "owner")])
+    webhook = factories.TeamWebhookFactory(team=team)
+
+    role = random.choice([role[0] for role in models.RoleChoices.choices])
+
+    client = APIClient()
+    client.force_login(user)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        response = client.post(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+            {
+                "user": str(other_user.id),
+                "role": role,
+            },
+            format="json",
+        )
+        assert response.status_code == 201
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(other_user.id),
+                            "email": other_user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }

src/backend/core/tests/team_accesses/test_api_team_accesses_delete.py

@@ -0,0 +1,215 @@
+"""
+Test for team accesses API endpoints in People's core app : delete
+"""
+
+import json
+import random
+import re
+
+import pytest
+import responses
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_delete_anonymous():
+    """Anonymous users should not be allowed to destroy a team access."""
+    access = factories.TeamAccessFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_authenticated():
+    """
+    Authenticated users should not be allowed to delete a team access for a
+    team to which they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_member():
+    """
+    Authenticated users should not be allowed to delete a team access for a
+    team in which they are a simple member.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    access = factories.TeamAccessFactory(team=team)
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 2
+
+
+def test_api_team_accesses_delete_administrators():
+    """
+    Users who are administrators in a team should be allowed to delete an access
+    from the team provided it is not ownership.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_owners_except_owners():
+    """
+    Users should be able to delete the team access of another user
+    for a team of which they are owner provided it is not an owner access.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 204
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_owners_for_owners():
+    """
+    Users should not be allowed to delete the team access of another owner
+    even for a team in which they are direct owner.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(team=team, role="owner")
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 2
+
+
+def test_api_team_accesses_delete_owners_last_owner():
+    """
+    It should not be possible to delete the last owner access from a team
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
+    assert models.TeamAccess.objects.count() == 1
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 403
+    assert models.TeamAccess.objects.count() == 1
+
+
+def test_api_team_accesses_delete_webhook():
+    """
+    When the team has a webhook, deleting a team access should fire a call.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    webhook = factories.TeamWebhookFactory(team=team)
+    access = factories.TeamAccessFactory(
+        team=team, role=random.choice(["member", "administrator"])
+    )
+
+    assert models.TeamAccess.objects.count() == 2
+    assert models.TeamAccess.objects.filter(user=access.user).exists()
+
+    client = APIClient()
+    client.force_login(user)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        response = client.delete(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        )
+        assert response.status_code == 204
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "remove",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": access.user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    assert models.TeamAccess.objects.count() == 1
+    assert models.TeamAccess.objects.filter(user=access.user).exists() is False

src/backend/core/tests/team_accesses/test_api_team_accesses_list.py

@@ -0,0 +1,367 @@
+"""
+Test for team accesses API endpoints in People's core app : list
+"""
+
+import pytest
+from rest_framework.status import HTTP_200_OK
+from rest_framework.test import APIClient
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_list_anonymous():
+    """Anonymous users should not be allowed to list team accesses."""
+    team = factories.TeamFactory()
+    factories.TeamAccessFactory.create_batch(2, team=team)
+
+    response = APIClient().get(f"/api/v1.0/teams/{team.id!s}/accesses/")
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_accesses_list_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to list team accesses for a team
+    to which they are not related.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    factories.TeamAccessFactory.create_batch(3, team=team)
+
+    # Accesses for other teams to which the user is related should not be listed either
+    other_access = factories.TeamAccessFactory(user=user)
+    factories.TeamAccessFactory(team=other_access.team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+    )
+    assert response.status_code == 200
+    assert response.json() == {
+        "count": 0,
+        "next": None,
+        "previous": None,
+        "results": [],
+    }
+
+
+def test_api_team_accesses_list_authenticated_related():
+    """
+    Authenticated users should be able to list team accesses for a team
+    to which they are related, with a given role.
+    """
+    user, administrator, owner = factories.UserFactory.create_batch(3)
+    team = factories.TeamFactory()
+
+    access1 = factories.TeamAccessFactory.create(team=team, user=owner, role="owner")
+    access2 = factories.TeamAccessFactory.create(
+        team=team, user=administrator, role="administrator"
+    )
+
+    # Ensure this user's role is different from other team members to test abilities' computation
+    user_access = models.TeamAccess.objects.create(team=team, user=user, role="member")
+
+    # Grant other team accesses to the user, they should not be listed either
+    other_access = factories.TeamAccessFactory(user=user)
+    factories.TeamAccessFactory(team=other_access.team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/",
+    )
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 3
+    assert sorted(response.json()["results"], key=lambda x: x["id"]) == sorted(
+        [
+            {
+                "id": str(user_access.id),
+                "user": {
+                    "id": str(user_access.user.id),
+                    "email": str(user.email),
+                    "name": str(user.name),
+                },
+                "role": str(user_access.role),
+                "abilities": user_access.get_abilities(user),
+            },
+            {
+                "id": str(access1.id),
+                "user": {
+                    "id": str(access1.user.id),
+                    "email": str(owner.email),
+                    "name": str(owner.name),
+                },
+                "role": str(access1.role),
+                "abilities": access1.get_abilities(user),
+            },
+            {
+                "id": str(access2.id),
+                "user": {
+                    "id": str(access2.user.id),
+                    "email": str(administrator.email),
+                    "name": str(administrator.name),
+                },
+                "role": str(access2.role),
+                "abilities": access2.get_abilities(user),
+            },
+        ],
+        key=lambda x: x["id"],
+    )
+
+
+def test_api_team_accesses_list_find_members(django_assert_num_queries):
+    """
+    Authenticated users should be able to search users access with a case-insensitive and
+    partial query on the name.
+    """
+    dave = factories.UserFactory(name="dave bowman", email=None)
+    frank = factories.UserFactory(name="frank poole", email=None)
+    mary = factories.UserFactory(name="mary poole", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    factories.UserFactory(name="heywood floyd", email=None)
+    factories.UserFactory(name="Andrei Smyslov", email=None)
+    factories.TeamFactory.create_batch(10)
+
+    # Add Mary, Nicole and Dave in the same team
+    team = factories.TeamFactory(
+        name="Odyssey",
+        users=[
+            (mary, models.RoleChoices.OWNER),
+            (nicole, models.RoleChoices.ADMIN),
+            (dave, models.RoleChoices.MEMBER),
+        ],
+    )
+    factories.TeamFactory(users=[(frank, models.RoleChoices.MEMBER)])
+
+    # Search users in the team Odyssey
+    client = APIClient()
+    client.force_login(mary)
+
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: get all users, owner included (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 3
+
+    # We can find David Bowman
+    # 3 queries are needed here:
+    # - 1 query: user authenticated
+    # - 2 queries: search user query with match
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=bowman",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    dave_access = dave.accesses.get(team=team)
+    assert response.json()["results"][0]["id"] == str(dave_access.id)
+
+    # We can find Nicole
+    # 3 queries are needed here:
+    # - 1 query: user authenticated
+    # - 2 queries: search user query with match
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=nicol",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    nicole_access = nicole.accesses.get(team=team)
+    assert response.json()["results"][0]["id"] == str(nicole_access.id)
+
+    # We can find Nicole and Mary
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: search user query with match and the owner found (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=ool",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 2
+    user_access_ids = sorted([user["id"] for user in response.json()["results"]])
+    mary_access = mary.accesses.get(team=team)
+    assert sorted([str(mary_access.id), str(nicole_access.id)]) == user_access_ids
+
+    # We cannot find Andrei, because he isn't a member of the current team
+    # 2 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 1 query: search user query with no match
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=andrei",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 0
+
+    # We can find Mary
+    # 5 queries are needed here:
+    # - 1 query: select on user authenticated
+    # - 4 queries: search user query with match and an owner found (2 more queries)
+    with django_assert_num_queries(5):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/?q=mary",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert response.json()["results"][0]["id"] == str(mary_access.id)
+
+
+def test_api_team_accesses__list_find_members_by_email():
+    """
+    Authenticated users should be able to search users access with a case-insensitive and
+    partial query on the email.
+    """
+    user = factories.UserFactory(name=None, email="alicia@example.com")
+
+    # set all names to None to match only on emails
+    colleague1 = factories.UserFactory(name=None, email="prudence_crandall@edu.us")
+    colleague2 = factories.UserFactory(name=None, email="reinebrunehaut@gouv.fr")
+    colleague3 = factories.UserFactory(name=None, email="artemisia.gentileschi@arte.it")
+
+    # Add all colleague in the same team
+    team = factories.TeamFactory(
+        users=[
+            (user, models.RoleChoices.ADMIN),
+            (colleague1, models.RoleChoices.OWNER),
+            (colleague2, models.RoleChoices.ADMIN),
+            (colleague3, models.RoleChoices.MEMBER),
+        ],
+    )
+    factories.TeamAccessFactory.create_batch(4)
+
+    # Create another team with similar email
+    factories.TeamFactory(
+        users=[
+            (
+                factories.UserFactory(name=None, email="bruneau@gouv.fr"),
+                models.RoleChoices.ADMIN,
+            ),
+        ],
+    )
+
+    # Search users in the team Odyssey
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?q=BRUNE",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert response.json()["results"][0]["user"]["email"] == "reinebrunehaut@gouv.fr"
+
+
+def test_api_team_accesses_list_authenticated_constant_numqueries(
+    django_assert_num_queries,
+):
+    """
+    The number of queries should not depend on the amount of fetched accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)  # random role
+
+    client = APIClient()
+    client.force_login(user)
+    # Only 3 queries are needed to efficiently fetch team accesses,
+    # related users and identities :
+    # - query retrieving logged-in user for user_role annotation
+    # - count from pagination
+    # - distinct from viewset
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    # num queries should still be the same
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/teams/{team.id!s}/accesses/",
+        )
+
+    assert response.status_code == 200
+    assert response.json()["count"] == 21
+
+
+def test_api_team_accesses_list_authenticated_ordering():
+    """Team accesses can be ordered by "role"."""
+
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=role",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    results = [team_access["role"] for team_access in response.json()["results"]]
+    assert sorted(results) == results
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=-role",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    results = [team_access["role"] for team_access in response.json()["results"]]
+    assert sorted(results, reverse=True) == results
+
+
+@pytest.mark.parametrize("ordering_field", ["email", "name"])
+def test_api_team_accesses_list_authenticated_ordering_user(ordering_field):
+    """Team accesses can be ordered by user's fields."""
+
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    models.TeamAccess.objects.create(team=team, user=user)
+
+    # create 20 new team members
+    for _ in range(20):
+        extra_user = factories.UserFactory()
+        factories.TeamAccessFactory(team=team, user=extra_user)
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=user__{ordering_field}",
+    )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["count"] == 21
+
+    def normalize(x):
+        """Mimic Django order_by, which is case-insensitive and space-insensitive"""
+        return x.casefold().replace(" ", "")
+
+    results = [
+        team_access["user"][ordering_field]
+        for team_access in response.json()["results"]
+    ]
+    assert sorted(results, key=normalize) == results

src/backend/core/tests/team_accesses/test_api_team_accesses_retrieve.py

@@ -0,0 +1,83 @@
+"""
+Test for team accesses API endpoints in People's core app : retrieve
+"""
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_retrieve_anonymous():
+    """
+    Anonymous users should not be allowed to retrieve a team access.
+    """
+    access = factories.TeamAccessFactory()
+
+    response = APIClient().get(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 401
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_accesses_retrieve_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to retrieve a team access for
+    a team to which they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(team=factories.TeamFactory())
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+    )
+    assert response.status_code == 404
+    assert response.json() == {"detail": "No TeamAccess matches the given query."}
+
+    # Accesses related to another team should be excluded even if the user is related to it
+    for other_access in [
+        factories.TeamAccessFactory(),
+        factories.TeamAccessFactory(user=user),
+    ]:
+        response = client.get(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{other_access.id!s}/",
+        )
+
+        assert response.status_code == 404
+        assert response.json() == {"detail": "No TeamAccess matches the given query."}
+
+
+def test_api_team_accesses_retrieve_authenticated_related():
+    """
+    A user who is related to a team should be allowed to retrieve the
+    associated team user accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+    )
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "id": str(access.id),
+        "user": {
+            "id": str(access.user.id),
+            "email": str(user.email),
+            "name": str(user.name),
+        },
+        "role": str(access.role),
+        "abilities": access.get_abilities(user),
+    }

src/backend/core/tests/team_accesses/test_api_team_accesses_update.py

@@ -0,0 +1,325 @@
+"""
+Test for team accesses API endpoints in People's core app : update
+"""
+
+import random
+from uuid import uuid4
+
+import pytest
+from rest_framework.test import APIClient
+
+from core import factories, models
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_accesses_update_anonymous():
+    """Anonymous users should not be allowed to update a team access."""
+    access = factories.TeamAccessFactory()
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    for field, value in new_values.items():
+        response = APIClient().put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 401
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_authenticated_unrelated():
+    """
+    Authenticated users should not be allowed to update a team access for a team to which
+    they are not related.
+    """
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory()
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_authenticated_member():
+    """Members of a team should not be allowed to update its accesses."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    access = factories.TeamAccessFactory(team=team)
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
+            {**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+
+    access.refresh_from_db()
+    updated_values = serializers.TeamAccessSerializer(instance=access).data
+    assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_except_owner():
+    """
+    A user who is an administrator in a team should be allowed to update a user
+    access for this team, as long as they don't try to set the role to owner.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    access = factories.TeamAccessFactory(
+        team=team,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(["administrator", "member"]),
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_from_owner():
+    """
+    A user who is an administrator in a team, should not be allowed to update
+    the user access of an "owner" for this team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+    access = factories.TeamAccessFactory(team=team, user=other_user, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data={**old_values, field: value},
+            format="json",
+        )
+        assert response.status_code == 403
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_administrator_to_owner():
+    """
+    A user who is an administrator in a team, should not be allowed to update
+    the user access of another user to grant team ownership.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "administrator")])
+    other_user = factories.UserFactory()
+    access = factories.TeamAccessFactory(
+        team=team,
+        user=other_user,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": "owner",
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+        # We are not allowed or not really updating the role
+        if field == "role" or new_data["role"] == old_values["role"]:
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_except_owner():
+    """
+    A user who is an owner in a team should be allowed to update
+    a user access for this team except for existing "owner" accesses.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    factories.UserFactory()
+    access = factories.TeamAccessFactory(
+        team=team,
+        role=random.choice(["administrator", "member"]),
+    )
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        new_data = {**old_values, field: value}
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data=new_data,
+            format="json",
+        )
+
+        if (
+            new_data["role"] == old_values["role"]
+        ):  # we are not really updating the role
+            assert response.status_code == 403
+        else:
+            assert response.status_code == 200
+
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+
+        if field == "role":
+            assert updated_values == {**old_values, "role": new_values["role"]}
+        else:
+            assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_for_owners():
+    """
+    A user who is "owner" of a team should not be allowed to update
+    an existing owner access for this team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+    access = factories.TeamAccessFactory(team=team, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+
+    new_values = {
+        "id": uuid4(),
+        "user_id": factories.UserFactory().id,
+        "role": random.choice(models.RoleChoices.choices)[0],
+    }
+
+    client = APIClient()
+    client.force_login(user)
+    for field, value in new_values.items():
+        response = client.put(
+            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+            data={**old_values, field: value},
+            content_type="application/json",
+        )
+        assert response.status_code == 403
+        access.refresh_from_db()
+        updated_values = serializers.TeamAccessSerializer(instance=access).data
+        assert updated_values == old_values
+
+
+def test_api_team_accesses_update_owner_self():
+    """
+    A user who is owner of a team should be allowed to update
+    their own user access provided there are other owners in the team.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
+    old_values = serializers.TeamAccessSerializer(instance=access).data
+    new_role = random.choice(["administrator", "member"])
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.put(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 403
+    access.refresh_from_db()
+    assert access.role == "owner"
+
+    # Add another owner and it should now work
+    factories.TeamAccessFactory(team=team, role="owner")
+
+    response = client.put(
+        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
+        data={**old_values, "role": new_role},
+        format="json",
+    )
+
+    assert response.status_code == 200
+    access.refresh_from_db()
+    assert access.role == new_role

src/backend/core/tests/teams/test_core_api_teams_create.py

@@ -1,17 +1,16 @@
 """
 Tests for Teams API endpoint in People's core app: create
 """
+
 import pytest
 from rest_framework.status import (
     HTTP_201_CREATED,
-    HTTP_400_BAD_REQUEST,
     HTTP_401_UNAUTHORIZED,
 )
 from rest_framework.test import APIClient
 
-from core.factories import IdentityFactory, TeamFactory
+from core.factories import OrganizationFactory, UserFactory
 from core.models import Team
-from core.tests.utils import OIDCToken
 
 pytestmark = pytest.mark.django_db
 
@@ -34,90 +33,51 @@ def test_api_teams_create_authenticated():
     Authenticated users should be able to create teams and should automatically be declared
     as the owner of the newly created team.
     """
-    identity = IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    organization = OrganizationFactory(with_registration_id=True)
+    user = UserFactory(organization=organization)
 
-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
         "/api/v1.0/teams/",
         {
             "name": "my team",
         },
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_201_CREATED
     team = Team.objects.get()
     assert team.name == "my team"
+    assert team.organization == organization
     assert team.accesses.filter(role="owner", user=user).exists()
 
 
-def test_api_teams_create_authenticated_slugify_name():
+def test_api_teams_create_cannot_override_organization():
     """
-    Creating teams should automatically generate a slug.
+    Authenticated users should be able to create teams and not
+    be able to set the organization manually (for now).
     """
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    organization = OrganizationFactory(with_registration_id=True)
+    user = UserFactory(organization=organization)
 
-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
         "/api/v1.0/teams/",
-        {"name": "my team"},
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
+        {
+            "name": "my team",
+            "organization": OrganizationFactory(
+                with_registration_id=True
+            ).pk,  # ignored
+        },
+        format="json",
     )
 
     assert response.status_code == HTTP_201_CREATED
     team = Team.objects.get()
     assert team.name == "my team"
-    assert team.slug == "my-team"
-
-
-@pytest.mark.parametrize(
-    "param",
-    [
-        ("my team", "my-team"),
-        ("my     team", "my-team"),
-        ("MY TEAM TOO", "my-team-too"),
-        ("mon équipe", "mon-equipe"),
-        ("front devs & UX", "front-devs-ux"),
-    ],
-)
-def test_api_teams_create_authenticated_expected_slug(param):
-    """
-    Creating teams should automatically create unaccented, no unicode, lower-case slug.
-    """
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
-    response = APIClient().post(
-        "/api/v1.0/teams/",
-        {
-            "name": param[0],
-        },
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == HTTP_201_CREATED
-    team = Team.objects.get()
-    assert team.name == param[0]
-    assert team.slug == param[1]
-
-
-def test_api_teams_create_authenticated_unique_slugs():
-    """
-    Creating teams should raise an error if already existing slug.
-    """
-    TeamFactory(name="existing team")
-    identity = IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
-    response = APIClient().post(
-        "/api/v1.0/teams/",
-        {
-            "name": "èxisting team",
-        },
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == HTTP_400_BAD_REQUEST
-    assert response.json()["slug"] == ["Team with this Slug already exists."]
+    assert team.organization == organization
+    assert team.accesses.filter(role="owner", user=user).exists()

src/backend/core/tests/teams/test_core_api_teams_delete.py

@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: delete
 """
+
 import pytest
 from rest_framework.status import (
     HTTP_204_NO_CONTENT,
@@ -11,7 +12,6 @@ from rest_framework.status import (
 from rest_framework.test import APIClient
 
 from core import factories, models
-from core.tests.utils import OIDCToken
 
 pytestmark = pytest.mark.django_db
 
@@ -33,18 +33,19 @@ def test_api_teams_delete_authenticated_unrelated():
     Authenticated users should not be allowed to delete a team to which they are not
     related.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory()
 
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id!s}/",
     )
 
     assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}
     assert models.Team.objects.count() == 1
 
 
@@ -53,14 +54,15 @@ def test_api_teams_delete_authenticated_member():
     Authenticated users should not be allowed to delete a team for which they are
     only a member.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "member")])
 
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
     )
 
     assert response.status_code == HTTP_403_FORBIDDEN
@@ -75,14 +77,15 @@ def test_api_teams_delete_authenticated_administrator():
     Authenticated users should not be allowed to delete a team for which they are
     administrator.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "administrator")])
 
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
     )
 
     assert response.status_code == HTTP_403_FORBIDDEN
@@ -97,14 +100,15 @@ def test_api_teams_delete_authenticated_owner():
     Authenticated users should be able to delete a team for which they are directly
     owner.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "owner")])
 
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/",
     )
 
     assert response.status_code == HTTP_204_NO_CONTENT

src/backend/core/tests/teams/test_core_api_teams_list.py

@@ -1,6 +1,7 @@
 """
 Tests for Teams API endpoint in People's core app: list
 """
+
 from unittest import mock
 
 import pytest
@@ -8,10 +9,7 @@ from rest_framework.pagination import PageNumberPagination
 from rest_framework.status import HTTP_200_OK, HTTP_401_UNAUTHORIZED
 from rest_framework.test import APIClient
 
-from core import factories, models
-from core.api import serializers
-
-from ..utils import OIDCToken
+from core import factories
 
 pytestmark = pytest.mark.django_db
 
@@ -29,10 +27,14 @@ def test_api_teams_list_anonymous():
 
 
 def test_api_teams_list_authenticated():
-    """Authenticated users should be able to list teams they are an owner/administrator/member of."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    """
+    Authenticated users should be able to list teams
+    they are an owner/administrator/member of.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     expected_ids = {
         str(access.team.id)
@@ -40,79 +42,90 @@ def test_api_teams_list_authenticated():
     }
     factories.TeamFactory.create_batch(2)  # Other teams
 
-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/",
     )
 
     assert response.status_code == HTTP_200_OK
-    results = response.json()["results"]
+    results = response.json()
+
     assert len(results) == 5
     results_id = {result["id"] for result in results}
     assert expected_ids == results_id
 
 
-@mock.patch.object(PageNumberPagination, "get_page_size", return_value=2)
-def test_api_teams_list_pagination(
-    _mock_page_size,
-):
-    """Pagination should work as expected."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team_ids = [
-        str(access.team.id)
-        for access in factories.TeamAccessFactory.create_batch(3, user=user)
-    ]
-
-    # Get page 1
-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
-
-    assert response.status_code == HTTP_200_OK
-    content = response.json()
-
-    assert content["count"] == 3
-    assert content["next"] == "http://testserver/api/v1.0/teams/?page=2"
-    assert content["previous"] is None
-
-    assert len(content["results"]) == 2
-    for item in content["results"]:
-        team_ids.remove(item["id"])
-
-    # Get page 2
-    response = APIClient().get(
-        "/api/v1.0/teams/?page=2", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
-
-    assert response.status_code == HTTP_200_OK
-    content = response.json()
-
-    assert content["count"] == 3
-    assert content["next"] is None
-    assert content["previous"] == "http://testserver/api/v1.0/teams/"
-
-    assert len(content["results"]) == 1
-    team_ids.remove(content["results"][0]["id"])
-    assert team_ids == []
-
-
 def test_api_teams_list_authenticated_distinct():
     """A team with several related users should only be listed once."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     other_user = factories.UserFactory()
 
     team = factories.TeamFactory(users=[user, other_user])
 
-    response = APIClient().get(
-        "/api/v1.0/teams/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/teams/",
     )
 
     assert response.status_code == HTTP_200_OK
     content = response.json()
-    assert len(content["results"]) == 1
-    assert content["results"][0]["id"] == str(team.id)
+    assert len(content) == 1
+    assert content[0]["id"] == str(team.id)
+
+
+def test_api_teams_order():
+    """
+    Test that the endpoint GET teams is sorted in 'created_at' descending order by default.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    team_ids = [
+        str(team.id) for team in factories.TeamFactory.create_batch(5, users=[user])
+    ]
+
+    response = client.get(
+        "/api/v1.0/teams/",
+    )
+
+    assert response.status_code == 200
+
+    response_data = response.json()
+    response_team_ids = [team["id"] for team in response_data]
+
+    team_ids.reverse()
+    assert (
+        response_team_ids == team_ids
+    ), "created_at values are not sorted from newest to oldest"
+
+
+def test_api_teams_order_param():
+    """
+    Test that the 'created_at' field is sorted in ascending order
+    when the 'ordering' query parameter is set.
+    """
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    team_ids = [
+        str(team.id) for team in factories.TeamFactory.create_batch(5, users=[user])
+    ]
+
+    response = client.get(
+        "/api/v1.0/teams/?ordering=created_at",
+    )
+    assert response.status_code == 200
+
+    response_data = response.json()
+
+    response_team_ids = [team["id"] for team in response_data]
+
+    assert (
+        response_team_ids == team_ids
+    ), "created_at values are not sorted from oldest to newest"

src/backend/core/tests/teams/test_core_api_teams_retrieve.py

@@ -1,12 +1,12 @@
 """
 Tests for Teams API endpoint in People's core app: retrieve
 """
+
 import pytest
-from rest_framework.status import HTTP_200_OK, HTTP_401_UNAUTHORIZED, HTTP_404_NOT_FOUND
+from rest_framework import status
 from rest_framework.test import APIClient
 
 from core import factories
-from core.tests.utils import OIDCToken
 
 pytestmark = pytest.mark.django_db
 
@@ -16,7 +16,7 @@ def test_api_teams_retrieve_anonymous():
     team = factories.TeamFactory()
     response = APIClient().get(f"/api/v1.0/teams/{team.id}/")
 
-    assert response.status_code == HTTP_401_UNAUTHORIZED
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
     assert response.json() == {
         "detail": "Authentication credentials were not provided."
     }
@@ -27,17 +27,18 @@ def test_api_teams_retrieve_authenticated_unrelated():
     Authenticated users should not be allowed to retrieve a team to which they are
     not related.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory()
 
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/",
     )
-    assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.json() == {"detail": "No Team matches the given query."}
 
 
 def test_api_teams_retrieve_authenticated_related():
@@ -45,39 +46,30 @@ def test_api_teams_retrieve_authenticated_related():
     Authenticated users should be allowed to retrieve a team to which they
     are related whatever the role.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory()
     access1 = factories.TeamAccessFactory(team=team, user=user)
     access2 = factories.TeamAccessFactory(team=team)
 
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/teams/{team.id!s}/",
     )
-    assert response.status_code == HTTP_200_OK
-    content = response.json()
-    assert sorted(content.pop("accesses"), key=lambda x: x["user"]) == sorted(
+
+    assert response.status_code == status.HTTP_200_OK
+    assert sorted(response.json().pop("accesses")) == sorted(
         [
-            {
-                "id": str(access1.id),
-                "user": str(user.id),
-                "role": access1.role,
-                "abilities": access1.get_abilities(user),
-            },
-            {
-                "id": str(access2.id),
-                "user": str(access2.user.id),
-                "role": access2.role,
-                "abilities": access2.get_abilities(user),
-            },
-        ],
-        key=lambda x: x["user"],
+            str(access1.id),
+            str(access2.id),
+        ]
     )
     assert response.json() == {
         "id": str(team.id),
         "name": team.name,
-        "slug": team.slug,
         "abilities": team.get_abilities(user),
+        "created_at": team.created_at.isoformat().replace("+00:00", "Z"),
+        "updated_at": team.updated_at.isoformat().replace("+00:00", "Z"),
     }

src/backend/core/tests/teams/test_core_api_teams_update.py

@@ -1,12 +1,12 @@
 """
 Tests for Teams API endpoint in People's core app: update
 """
+
 import random
 
 import pytest
 from rest_framework.status import (
     HTTP_200_OK,
-    HTTP_400_BAD_REQUEST,
     HTTP_401_UNAUTHORIZED,
     HTTP_403_FORBIDDEN,
     HTTP_404_NOT_FOUND,
@@ -15,7 +15,6 @@ from rest_framework.test import APIClient
 
 from core import factories
 from core.api import serializers
-from core.tests.utils import OIDCToken
 
 pytestmark = pytest.mark.django_db
 
@@ -45,23 +44,23 @@ def test_api_teams_update_authenticated_unrelated():
     """
     Authenticated users should not be allowed to update a team to which they are not related.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory()
     old_team_values = serializers.TeamSerializer(instance=team).data
 
     new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/teams/{team.id!s}/",
         new_team_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}
 
     team.refresh_from_db()
     team_values = serializers.TeamSerializer(instance=team).data
@@ -73,19 +72,19 @@ def test_api_teams_update_authenticated_members():
     Users who are members of a team but not administrators should
     not be allowed to update it.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "member")])
     old_team_values = serializers.TeamSerializer(instance=team).data
 
     new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/teams/{team.id!s}/",
         new_team_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_403_FORBIDDEN
@@ -100,39 +99,42 @@ def test_api_teams_update_authenticated_members():
 
 def test_api_teams_update_authenticated_administrators():
     """Administrators of a team should be allowed to update it."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "administrator")])
     initial_values = serializers.TeamSerializer(instance=team).data
 
     # generate new random values
     new_values = serializers.TeamSerializer(instance=factories.TeamFactory.build()).data
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/teams/{team.id!s}/",
         new_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
     assert response.status_code == HTTP_200_OK
 
     team.refresh_from_db()
     final_values = serializers.TeamSerializer(instance=team).data
     for key, value in final_values.items():
-        if key in ["id", "accesses"]:  # pylint: disable=R1733
+        if key in ["id", "accesses", "created_at"]:
             assert value == initial_values[key]
+        elif key == "updated_at":
+            assert value > initial_values[key]
         else:
-            # name, slug and abilities successfully modified
+            # name and abilities successfully modified
             assert value == new_values[key]
 
 
 def test_api_teams_update_authenticated_owners():
     """Administrators of a team should be allowed to update it,
     apart from read-only fields."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     team = factories.TeamFactory(users=[(user, "owner")])
     old_team_values = serializers.TeamSerializer(instance=team).data
@@ -140,21 +142,22 @@ def test_api_teams_update_authenticated_owners():
     new_team_values = serializers.TeamSerializer(
         instance=factories.TeamFactory.build()
     ).data
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/teams/{team.id!s}/",
         new_team_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
     assert response.status_code == HTTP_200_OK
 
     team.refresh_from_db()
     team_values = serializers.TeamSerializer(instance=team).data
     for key, value in team_values.items():
-        if key in ["id", "accesses"]:
+        if key in ["id", "accesses", "created_at"]:
             assert value == old_team_values[key]
+        elif key == "updated_at":
+            assert value > old_team_values[key]
         else:
-            # name, slug and abilities successfully modified
+            # name and abilities successfully modified
             assert value == new_team_values[key]
 
 
@@ -163,53 +166,25 @@ def test_api_teams_update_administrator_or_owner_of_another():
     Being administrator or owner of a team should not grant authorization to update
     another team.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     factories.TeamFactory(users=[(user, random.choice(["administrator", "owner"]))])
     team = factories.TeamFactory(name="Old name")
     old_team_values = serializers.TeamSerializer(instance=team).data
 
     new_team_values = serializers.TeamSerializer(instance=factories.TeamFactory()).data
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/teams/{team.id!s}/",
         new_team_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "Not found."}
+    assert response.json() == {"detail": "No Team matches the given query."}
 
     team.refresh_from_db()
     team_values = serializers.TeamSerializer(instance=team).data
     assert team_values == old_team_values
-
-
-def test_api_teams_update_existing_slug_should_return_error():
-    """
-    Updating a team's name to an existing slug should return a bad request,
-    instead of creating a duplicate.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    factories.TeamFactory(name="Existing team", users=[(user, "administrator")])
-    my_team = factories.TeamFactory(name="New team", users=[(user, "administrator")])
-
-    updated_values = serializers.TeamSerializer(instance=my_team).data
-    # Update my team's name for existing team. Creates a duplicate slug
-    updated_values["name"] = "existing team"
-    response = APIClient().put(
-        f"/api/v1.0/teams/{my_team.id!s}/",
-        updated_values,
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-    assert response.status_code == HTTP_400_BAD_REQUEST
-    assert response.json()["slug"] == ["Team with this Slug already exists."]
-    # Both teams names and slugs should be unchanged
-    assert my_team.name == "New team"
-    assert my_team.slug == "new-team"

src/backend/core/tests/test_api_config.py

@@ -0,0 +1,41 @@
+"""
+Test users API endpoints in the People core app.
+"""
+
+import pytest
+from rest_framework.status import (
+    HTTP_200_OK,
+)
+from rest_framework.test import APIClient
+
+from core import factories
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_config_anonymous():
+    """Anonymous users should be allowed to get the configuration."""
+    client = APIClient()
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    assert response.json() == {
+        "LANGUAGES": [["en-us", "English"], ["fr-fr", "French"]],
+        "FEATURES": {"TEAMS": True},
+        "RELEASE": "NA",
+    }
+
+
+def test_api_config_authenticated():
+    """Authenticated users should be allowed to get the configuration."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/config/")
+    assert response.status_code == HTTP_200_OK
+    assert response.json() == {
+        "LANGUAGES": [["en-us", "English"], ["fr-fr", "French"]],
+        "FEATURES": {"TEAMS": True},
+        "RELEASE": "NA",
+    }

src/backend/core/tests/test_api_contacts.py

@@ -1,6 +1,7 @@
 """
 Test contacts API endpoints in People's core app.
 """
+
 from django.test.utils import override_settings
 
 import pytest
@@ -9,8 +10,6 @@ from rest_framework.test import APIClient
 from core import factories, models
 from core.api import serializers
 
-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db
 
 
@@ -70,16 +69,14 @@ def test_api_contacts_list_authenticated_no_query():
     Authenticated users should be able to list contacts without applying a query.
     Profile and base contacts should be excluded.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
+    user = factories.UserFactory()
     contact = factories.ContactFactory(owner=user)
     user.profile_contact = contact
     user.save()
-    jwt_token = OIDCToken.for_user(user)
 
     # Let's have 5 contacts in database:
     assert user.profile_contact is not None  # Excluded because profile contact
-    base_contact = factories.BaseContactFactory()  # Excluded because overriden
+    base_contact = factories.BaseContactFactory()  # Excluded because overridden
     factories.ContactFactory(
         base=base_contact
     )  # Excluded because belongs to other user
@@ -87,9 +84,10 @@ def test_api_contacts_list_authenticated_no_query():
         base=base_contact, owner=user, full_name="Bernard"
     )  # Included
 
-    response = APIClient().get(
-        "/api/v1.0/contacts/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/")
 
     assert response.status_code == 200
     assert response.json() == [
@@ -109,9 +107,7 @@ def test_api_contacts_list_authenticated_by_full_name():
     Authenticated users should be able to search users with a case insensitive and
     partial query on the full name.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     dave = factories.BaseContactFactory(full_name="David Bowman")
     nicole = factories.BaseContactFactory(full_name="Nicole Foole")
@@ -119,36 +115,31 @@ def test_api_contacts_list_authenticated_by_full_name():
     factories.BaseContactFactory(full_name="Heywood Floyd")
 
     # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=David%20Bowman", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/?q=David%20Bowman")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(dave.id)]
 
     # Partial query should work
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ank", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ank")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(frank.id)]
 
     # Result that matches a trigram twice ranks better than result that matches once
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ole", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ole")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     # "Nicole Foole" matches twice on "ole"
     assert contact_ids == [str(nicole.id), str(frank.id)]
 
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ool", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ool")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
@@ -157,25 +148,22 @@ def test_api_contacts_list_authenticated_by_full_name():
 
 def test_api_contacts_list_authenticated_uppercase_content():
     """Upper case content should be found by lower case query."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     dave = factories.BaseContactFactory(full_name="EEE", short_name="AAA")
 
     # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=eee", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/contacts/?q=eee")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(dave.id)]
 
     # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=aaa", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=aaa")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
@@ -184,25 +172,22 @@ def test_api_contacts_list_authenticated_uppercase_content():
 
 def test_api_contacts_list_authenticated_capital_query():
     """Upper case query should find lower case content."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     dave = factories.BaseContactFactory(full_name="eee", short_name="aaa")
 
+    client = APIClient()
+    client.force_login(user)
+
     # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=EEE", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=EEE")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(dave.id)]
 
     # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=AAA", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=AAA")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
@@ -211,25 +196,22 @@ def test_api_contacts_list_authenticated_capital_query():
 
 def test_api_contacts_list_authenticated_accented_content():
     """Accented content should be found by unaccented query."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     dave = factories.BaseContactFactory(full_name="ééé", short_name="ààà")
 
+    client = APIClient()
+    client.force_login(user)
+
     # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=eee", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=eee")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(dave.id)]
 
     # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=aaa", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=aaa")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
@@ -238,25 +220,22 @@ def test_api_contacts_list_authenticated_accented_content():
 
 def test_api_contacts_list_authenticated_accented_query():
     """Accented query should find unaccented content."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     dave = factories.BaseContactFactory(full_name="eee", short_name="aaa")
 
+    client = APIClient()
+    client.force_login(user)
+
     # Unaccented full name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ééé", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ééé")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
     assert contact_ids == [str(dave.id)]
 
     # Unaccented short name
-    response = APIClient().get(
-        "/api/v1.0/contacts/?q=ààà", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/contacts/?q=ààà")
 
     assert response.status_code == 200
     contact_ids = [contact["id"] for contact in response.json()]
@@ -279,15 +258,13 @@ def test_api_contacts_retrieve_authenticated_owned():
     """
     Authenticated users should be allowed to retrieve a contact they own.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
     contact = factories.ContactFactory(owner=user)
 
-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")
 
     assert response.status_code == 200
     assert response.json() == {
@@ -304,14 +281,13 @@ def test_api_contacts_retrieve_authenticated_public():
     """
     Authenticated users should be able to retrieve public contacts.
     """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
+    user = factories.UserFactory()
     contact = factories.BaseContactFactory()
 
-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")
     assert response.status_code == 200
     assert response.json() == {
         "id": str(contact.id),
@@ -327,14 +303,13 @@ def test_api_contacts_retrieve_authenticated_other():
     """
     Authenticated users should not be allowed to retrieve another user's contacts.
     """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
+    user = factories.UserFactory()
     contact = factories.ContactFactory()
 
-    response = APIClient().get(
-        f"/api/v1.0/contacts/{contact.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(f"/api/v1.0/contacts/{contact.id!s}/")
     assert response.status_code == 403
     assert response.json() == {
         "detail": "You do not have permission to perform this action."
@@ -356,18 +331,18 @@ def test_api_contacts_create_anonymous_forbidden():
 
 def test_api_contacts_create_authenticated_missing_base():
     """Anonymous users should be able to create users."""
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(profile_contact=None)
 
-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
         "/api/v1.0/contacts/",
         {
             "full_name": "David Bowman",
             "short_name": "Dave",
         },
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
     assert response.status_code == 400
     assert models.Contact.objects.exists() is False
@@ -377,16 +352,16 @@ def test_api_contacts_create_authenticated_missing_base():
 
 def test_api_contacts_create_authenticated_successful():
     """Authenticated users should be able to create contacts."""
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory(profile_contact=None)
     base_contact = factories.BaseContactFactory()
 
+    client = APIClient()
+    client.force_login(user)
+
     # Existing override for another user should not interfere
     factories.ContactFactory(base=base_contact)
 
-    response = APIClient().post(
+    response = client.post(
         "/api/v1.0/contacts/",
         {
             "base": str(base_contact.id),
@@ -395,7 +370,6 @@ def test_api_contacts_create_authenticated_successful():
             "data": CONTACT_DATA,
         },
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 201
@@ -421,17 +395,17 @@ def test_api_contacts_create_authenticated_successful():
 @override_settings(ALLOW_API_USER_CREATE=True)
 def test_api_contacts_create_authenticated_existing_override():
     """
-    Trying to create a contact for base contact that is already overriden by the user
+    Trying to create a contact for base contact that is already overridden by the user
     should receive a 400 error.
     """
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory(profile_contact=None)
     base_contact = factories.BaseContactFactory()
     factories.ContactFactory(base=base_contact, owner=user)
 
-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
         "/api/v1.0/contacts/",
         {
             "base": str(base_contact.id),
@@ -440,7 +414,6 @@ def test_api_contacts_create_authenticated_existing_override():
             "data": CONTACT_DATA,
         },
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 400
@@ -479,9 +452,10 @@ def test_api_contacts_update_authenticated_owned():
     """
     Authenticated users should be allowed to update their own contacts.
     """
-    identity = factories.IdentityFactory(user__profile_contact=None)
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(profile_contact=None)
+
+    client = APIClient()
+    client.force_login(user)
 
     contact = factories.ContactFactory(owner=user)  # Owned by the logged-in user
     old_contact_values = serializers.ContactSerializer(instance=contact).data
@@ -491,11 +465,10 @@ def test_api_contacts_update_authenticated_owned():
     ).data
     new_contact_values["base"] = str(factories.ContactFactory().id)
 
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/contacts/{contact.id!s}/",
         new_contact_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 200
@@ -511,11 +484,12 @@ def test_api_contacts_update_authenticated_owned():
 
 def test_api_contacts_update_authenticated_profile():
     """
-    Authenticated users should be allowed to update their prodile contact.
+    Authenticated users should be allowed to update their profile contact.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     contact = factories.ContactFactory(owner=user)
     user.profile_contact = contact
@@ -527,11 +501,10 @@ def test_api_contacts_update_authenticated_profile():
     ).data
     new_contact_values["base"] = str(factories.ContactFactory().id)
 
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/contacts/{contact.id!s}/",
         new_contact_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 200
@@ -548,9 +521,10 @@ def test_api_contacts_update_authenticated_other():
     """
     Authenticated users should not be allowed to update contacts owned by other users.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     contact = factories.ContactFactory()  # owned by another user
     old_contact_values = serializers.ContactSerializer(instance=contact).data
@@ -560,11 +534,10 @@ def test_api_contacts_update_authenticated_other():
     ).data
     new_contact_values["base"] = str(factories.ContactFactory().id)
 
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/contacts/{contact.id!s}/",
         new_contact_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 403
@@ -586,15 +559,14 @@ def test_api_contacts_delete_list_anonymous():
 
 def test_api_contacts_delete_list_authenticated():
     """Authenticated users should not be allowed to delete a list of contacts."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     factories.ContactFactory.create_batch(2)
 
-    response = APIClient().delete(
-        "/api/v1.0/contacts/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.delete("/api/v1.0/contacts/")
 
     assert response.status_code == 405
     assert models.Contact.objects.count() == 4
@@ -615,15 +587,15 @@ def test_api_contacts_delete_authenticated_public():
     """
     Authenticated users should not be allowed to delete a public contact.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     contact = factories.BaseContactFactory()
 
-    response = APIClient().delete(
+    response = client.delete(
         f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 403
@@ -634,15 +606,14 @@ def test_api_contacts_delete_authenticated_owner():
     """
     Authenticated users should be allowed to delete a contact they own.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
     contact = factories.ContactFactory(owner=user)
 
-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
         f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 204
@@ -654,17 +625,16 @@ def test_api_contacts_delete_authenticated_profile():
     """
     Authenticated users should be allowed to delete their profile contact.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
     contact = factories.ContactFactory(owner=user, base=None)
     user.profile_contact = contact
     user.save()
 
-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
         f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 204
@@ -675,15 +645,14 @@ def test_api_contacts_delete_authenticated_other():
     """
     Authenticated users should not be allowed to delete a contact they don't own.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
+    user = factories.UserFactory()
     contact = factories.ContactFactory()
 
-    response = APIClient().delete(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
         f"/api/v1.0/contacts/{contact.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == 403

src/backend/core/tests/test_api_team_accesses.py

@@ -1,843 +0,0 @@
-"""
-Test team accesses API endpoints for users in People's core app.
-"""
-import random
-from uuid import uuid4
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories, models
-from core.api import serializers
-
-from .utils import OIDCToken
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_team_accesses_list_anonymous():
-    """Anonymous users should not be allowed to list team accesses."""
-    team = factories.TeamFactory()
-    factories.TeamAccessFactory.create_batch(2, team=team)
-
-    response = APIClient().get(f"/api/v1.0/teams/{team.id!s}/accesses/")
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_team_accesses_list_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to list team accesses for a team
-    to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    factories.TeamAccessFactory.create_batch(3, team=team)
-
-    # Accesses for other teams to which the user is related should not be listed either
-    other_access = factories.TeamAccessFactory(user=user)
-    factories.TeamAccessFactory(team=other_access.team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-    assert response.status_code == 200
-    assert response.json() == {
-        "count": 0,
-        "next": None,
-        "previous": None,
-        "results": [],
-    }
-
-
-def test_api_team_accesses_list_authenticated_related():
-    """
-    Authenticated users should be able to list team accesses for a team
-    to which they are related, whatever their role in the team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    user_access = models.TeamAccess.objects.create(team=team, user=user)  # random role
-    access1, access2 = factories.TeamAccessFactory.create_batch(2, team=team)
-
-    # Accesses for other teams to which the user is related should not be listed either
-    other_access = factories.TeamAccessFactory(user=user)
-    factories.TeamAccessFactory(team=other_access.team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    content = response.json()
-    assert len(content["results"]) == 3
-    assert sorted(content["results"], key=lambda x: x["id"]) == sorted(
-        [
-            {
-                "id": str(user_access.id),
-                "user": str(user.id),
-                "role": user_access.role,
-                "abilities": user_access.get_abilities(user),
-            },
-            {
-                "id": str(access1.id),
-                "user": str(access1.user.id),
-                "role": access1.role,
-                "abilities": access1.get_abilities(user),
-            },
-            {
-                "id": str(access2.id),
-                "user": str(access2.user.id),
-                "role": access2.role,
-                "abilities": access2.get_abilities(user),
-            },
-        ],
-        key=lambda x: x["id"],
-    )
-
-
-def test_api_team_accesses_retrieve_anonymous():
-    """
-    Anonymous users should not be allowed to retrieve a team access.
-    """
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-    )
-
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_team_accesses_retrieve_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to retrieve a team access for
-    a team to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-
-    # Accesses related to another team should be excluded even if the user is related to it
-    for access in [
-        factories.TeamAccessFactory(),
-        factories.TeamAccessFactory(user=user),
-    ]:
-        response = APIClient().get(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        assert response.status_code == 404
-        assert response.json() == {"detail": "Not found."}
-
-
-def test_api_team_accesses_retrieve_authenticated_related():
-    """
-    A user who is related to a team should be allowed to retrieve the
-    associated team user accesses.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[user])
-    access = factories.TeamAccessFactory(team=team)
-
-    response = APIClient().get(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    assert response.json() == {
-        "id": str(access.id),
-        "user": str(access.user.id),
-        "role": access.role,
-        "abilities": access.get_abilities(user),
-    }
-
-
-def test_api_team_accesses_create_anonymous():
-    """Anonymous users should not be allowed to create team accesses."""
-    user = factories.UserFactory()
-    team = factories.TeamFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(user.id),
-            "team": str(team.id),
-            "role": random.choice(models.RoleChoices.choices)[0],
-        },
-        format="json",
-    )
-    assert response.status_code == 401
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-    assert models.TeamAccess.objects.exists() is False
-
-
-def test_api_team_accesses_create_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to create team accesses for a team to
-    which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    other_user = factories.UserFactory()
-    team = factories.TeamFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "You are not allowed to manage accesses for this team."
-    }
-    assert not models.TeamAccess.objects.filter(user=other_user).exists()
-
-
-def test_api_team_accesses_create_authenticated_member():
-    """Members of a team should not be allowed to create team accesses."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    other_user = factories.UserFactory()
-
-    api_client = APIClient()
-    for role in [role[0] for role in models.RoleChoices.choices]:
-        response = api_client.post(
-            f"/api/v1.0/teams/{team.id!s}/accesses/",
-            {
-                "user": str(other_user.id),
-                "role": role,
-            },
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        assert response.status_code == 403
-        assert response.json() == {
-            "detail": "You are not allowed to manage accesses for this team."
-        }
-
-    assert not models.TeamAccess.objects.filter(user=other_user).exists()
-
-
-def test_api_team_accesses_create_authenticated_administrator():
-    """
-    Administrators of a team should be able to create team accesses except for the "owner" role.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-
-    api_client = APIClient()
-
-    # It should not be allowed to create an owner access
-    response = api_client.post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": "owner",
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert response.json() == {
-        "detail": "Only owners of a team can assign other users as owners."
-    }
-
-    # It should be allowed to create a lower access
-    role = random.choice(
-        [role[0] for role in models.RoleChoices.choices if role[0] != "owner"]
-    )
-
-    response = api_client.post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 201
-    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
-    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "abilities": new_team_access.get_abilities(user),
-        "id": str(new_team_access.id),
-        "role": role,
-        "user": str(other_user.id),
-    }
-
-
-def test_api_team_accesses_create_authenticated_owner():
-    """
-    Owners of a team should be able to create team accesses whatever the role.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    other_user = factories.UserFactory()
-
-    role = random.choice([role[0] for role in models.RoleChoices.choices])
-
-    response = APIClient().post(
-        f"/api/v1.0/teams/{team.id!s}/accesses/",
-        {
-            "user": str(other_user.id),
-            "role": role,
-        },
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 201
-    assert models.TeamAccess.objects.filter(user=other_user).count() == 1
-    new_team_access = models.TeamAccess.objects.filter(user=other_user).get()
-    assert response.json() == {
-        "abilities": new_team_access.get_abilities(user),
-        "id": str(new_team_access.id),
-        "role": role,
-        "user": str(other_user.id),
-    }
-
-
-def test_api_team_accesses_update_anonymous():
-    """Anonymous users should not be allowed to update a team access."""
-    access = factories.TeamAccessFactory()
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-        )
-        assert response.status_code == 401
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to update a team access for a team to which
-    they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    access = factories.TeamAccessFactory()
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_authenticated_member():
-    """Members of a team should not be allowed to update its accesses."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    access = factories.TeamAccessFactory(team=team)
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-            {**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-
-    access.refresh_from_db()
-    updated_values = serializers.TeamAccessSerializer(instance=access).data
-    assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_except_owner():
-    """
-    A user who is an administrator in a team should be allowed to update a user
-    access for this team, as long as they don't try to set the role to owner.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    access = factories.TeamAccessFactory(
-        team=team,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(["administrator", "member"]),
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        if (
-            new_data["role"] == old_values["role"]
-        ):  # we are not really updating the role
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
-        else:
-            assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_from_owner():
-    """
-    A user who is an administrator in a team, should not be allowed to update
-    the user access of an "owner" for this team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-    access = factories.TeamAccessFactory(team=team, user=other_user, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data={**old_values, field: value},
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_administrator_to_owner():
-    """
-    A user who is an administrator in a team, should not be allowed to update
-    the user access of another user to grant team ownership.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    other_user = factories.UserFactory()
-    access = factories.TeamAccessFactory(
-        team=team,
-        user=other_user,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": "owner",
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        # We are not allowed or not really updating the role
-        if field == "role" or new_data["role"] == old_values["role"]:
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_except_owner():
-    """
-    A user who is an owner in a team should be allowed to update
-    a user access for this team except for existing "owner" accesses.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    factories.UserFactory()
-    access = factories.TeamAccessFactory(
-        team=team,
-        role=random.choice(["administrator", "member"]),
-    )
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        new_data = {**old_values, field: value}
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data=new_data,
-            format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-
-        if (
-            new_data["role"] == old_values["role"]
-        ):  # we are not really updating the role
-            assert response.status_code == 403
-        else:
-            assert response.status_code == 200
-
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-
-        if field == "role":
-            assert updated_values == {**old_values, "role": new_values["role"]}
-        else:
-            assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_for_owners():
-    """
-    A user who is "owner" of a team should not be allowed to update
-    an existing owner access for this team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(team=team, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-
-    new_values = {
-        "id": uuid4(),
-        "user_id": factories.UserFactory().id,
-        "role": random.choice(models.RoleChoices.choices)[0],
-    }
-
-    api_client = APIClient()
-    for field, value in new_values.items():
-        response = api_client.put(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-            data={**old_values, field: value},
-            content_type="application/json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-        )
-        assert response.status_code == 403
-        access.refresh_from_db()
-        updated_values = serializers.TeamAccessSerializer(instance=access).data
-        assert updated_values == old_values
-
-
-def test_api_team_accesses_update_owner_self():
-    """
-    A user who is owner of a team should be allowed to update
-    their own user access provided there are other owners in the team.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
-    old_values = serializers.TeamAccessSerializer(instance=access).data
-    new_role = random.choice(["administrator", "member"])
-
-    api_client = APIClient()
-    response = api_client.put(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        data={**old_values, "role": new_role},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    access.refresh_from_db()
-    assert access.role == "owner"
-
-    # Add another owner and it should now work
-    factories.TeamAccessFactory(team=team, role="owner")
-
-    response = api_client.put(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        data={**old_values, "role": new_role},
-        format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 200
-    access.refresh_from_db()
-    assert access.role == new_role
-
-
-# Delete
-
-
-def test_api_team_accesses_delete_anonymous():
-    """Anonymous users should not be allowed to destroy a team access."""
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-    )
-
-    assert response.status_code == 401
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_authenticated():
-    """
-    Authenticated users should not be allowed to delete a team access for a
-    team to which they are not related.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    access = factories.TeamAccessFactory()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{access.team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_member():
-    """
-    Authenticated users should not be allowed to delete a team access for a
-    team in which they are a simple member.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "member")])
-    access = factories.TeamAccessFactory(team=team)
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 2
-
-
-def test_api_team_accesses_delete_administrators():
-    """
-    Users who are administrators in a team should be allowed to delete an access
-    from the team provided it is not ownership.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    access = factories.TeamAccessFactory(
-        team=team, role=random.choice(["member", "administrator"])
-    )
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 204
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_owners_except_owners():
-    """
-    Users should be able to delete the team access of another user
-    for a team of which they are owner provided it is not an owner access.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(
-        team=team, role=random.choice(["member", "administrator"])
-    )
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 204
-    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_owners_for_owners():
-    """
-    Users should not be allowed to delete the team access of another owner
-    even for a team in which they are direct owner.
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    access = factories.TeamAccessFactory(team=team, role="owner")
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 2
-
-
-def test_api_team_accesses_delete_owners_last_owner():
-    """
-    It should not be possible to delete the last owner access from a team
-    """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
-
-    team = factories.TeamFactory()
-    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
-
-    assert models.TeamAccess.objects.count() == 1
-    response = APIClient().delete(
-        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == 403
-    assert models.TeamAccess.objects.count() == 1

src/backend/core/tests/test_api_team_invitations.py

@@ -0,0 +1,412 @@
+"""
+Unit tests for the Invitation model
+"""
+
+import time
+
+import pytest
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from core import factories
+from core.api import serializers
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_team_invitations__create__anonymous():
+    """Anonymous users should not be able to create invitations."""
+    team = factories.TeamFactory()
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    response = APIClient().post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+
+
+def test_api_team_invitations__create__authenticated_outsider():
+    """Users outside of team should not be permitted to invite to team."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.parametrize(
+    "role",
+    ["owner", "administrator"],
+)
+def test_api_team_invitations__create__privileged_members(role):
+    """Owners and administrators should be able to invite new members."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, role)])
+
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+
+
+def test_api_team_invitations__create__members():
+    """
+    Members should not be able to invite new members.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build()
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert response.json() == {
+        "detail": "You are not allowed to manage invitation for this team."
+    }
+
+
+def test_api_team_invitations__create__issuer_and_team_automatically_added():
+    """Team and issuer fields should auto-complete."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "owner")])
+
+    # Generate a random invitation
+    invitation = factories.InvitationFactory.build()
+    invitation_data = {"email": invitation.email, "role": invitation.role}
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_data,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    # team and issuer automatically set
+    assert response.json()["team"] == str(team.id)
+    assert response.json()["issuer"] == str(user.id)
+
+
+def test_api_team_invitations__create__cannot_duplicate_invitation():
+    """An email should not be invited multiple times to the same team."""
+    existing_invitation = factories.InvitationFactory()
+    team = existing_invitation.team
+
+    # Grant privileged role on the Team to the user
+    user = factories.UserFactory()
+    factories.TeamAccessFactory(team=team, user=user, role="administrator")
+
+    # Create a new invitation to the same team with the exact same email address
+    duplicated_invitation = serializers.InvitationSerializer(
+        factories.InvitationFactory.build(email=existing_invitation.email)
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        duplicated_invitation,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["__all__"] == [
+        "Team invitation with this Email address and Team already exists."
+    ]
+
+
+def test_api_team_invitations__create__cannot_invite_existing_users():
+    """
+    Should not be able to invite already existing users.
+    """
+    user, existing_user = factories.UserFactory.create_batch(2)
+    team = factories.TeamFactory(users=[(user, "administrator")])
+
+    # Build an invitation to the email of an exising identity in the db
+    invitation_values = serializers.InvitationSerializer(
+        factories.InvitationFactory.build(email=existing_user.email, team=team)
+    ).data
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+        invitation_values,
+        format="json",
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert response.json()["email"] == [
+        "This email is already associated to a registered user."
+    ]
+
+
+def test_api_team_invitations__list__anonymous_user():
+    """Anonymous users should not be able to list invitations."""
+    team = factories.TeamFactory()
+    response = APIClient().get(f"/api/v1.0/teams/{team.id}/invitations/")
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__list__authenticated():
+    """
+    Authenticated user should be able to list invitations
+    in teams they belong to, including from other issuers.
+    """
+    user, other_user = factories.UserFactory.create_batch(2)
+    team = factories.TeamFactory(users=[(user, "administrator"), (other_user, "owner")])
+    invitation = factories.InvitationFactory(
+        team=team, role="administrator", issuer=user
+    )
+    other_invitations = factories.InvitationFactory.create_batch(
+        2, team=team, role="member", issuer=other_user
+    )
+
+    # invitations from other teams should not be listed
+    other_team = factories.TeamFactory()
+    factories.InvitationFactory.create_batch(2, team=other_team, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+    )
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json()["count"] == 3
+    assert sorted(response.json()["results"], key=lambda x: x["created_at"]) == sorted(
+        [
+            {
+                "id": str(i.id),
+                "created_at": i.created_at.isoformat().replace("+00:00", "Z"),
+                "email": str(i.email),
+                "team": str(team.id),
+                "role": i.role,
+                "issuer": str(i.issuer.id),
+                "is_expired": False,
+            }
+            for i in [invitation, *other_invitations]
+        ],
+        key=lambda x: x["created_at"],
+    )
+
+
+def test_api_team_invitations__list__expired_invitations_still_listed(settings):
+    """
+    Expired invitations are still listed.
+    """
+    user = factories.UserFactory()
+    other_user = factories.UserFactory()
+
+    team = factories.TeamFactory(users=[(user, "administrator"), (other_user, "owner")])
+
+    # override settings to accelerate validation expiration
+    settings.INVITATION_VALIDITY_DURATION = 1  # second
+    expired_invitation = factories.InvitationFactory(
+        team=team,
+        role="member",
+        issuer=user,
+    )
+    time.sleep(1)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{team.id}/invitations/",
+    )
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json()["count"] == 1
+    assert sorted(response.json()["results"], key=lambda x: x["created_at"]) == sorted(
+        [
+            {
+                "id": str(expired_invitation.id),
+                "created_at": expired_invitation.created_at.isoformat().replace(
+                    "+00:00", "Z"
+                ),
+                "email": str(expired_invitation.email),
+                "team": str(team.id),
+                "role": expired_invitation.role,
+                "issuer": str(expired_invitation.issuer.id),
+                "is_expired": True,
+            },
+        ],
+        key=lambda x: x["created_at"],
+    )
+
+
+def test_api_team_invitations__retrieve__anonymous_user():
+    """
+    Anonymous user should not be able to retrieve invitations.
+    """
+
+    invitation = factories.InvitationFactory()
+    response = APIClient().get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__retrieve__unrelated_user():
+    """
+    Authenticated unrelated users should not be able to retrieve invitations.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_api_team_invitations__retrieve__team_member():
+    """
+    Authenticated team members should be able to retrieve invitations
+    whatever their role in the team.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+    factories.TeamAccessFactory(team=invitation.team, user=user, role="member")
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.get(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {
+        "id": str(invitation.id),
+        "created_at": invitation.created_at.isoformat().replace("+00:00", "Z"),
+        "email": invitation.email,
+        "team": str(invitation.team.id),
+        "role": str(invitation.role),
+        "issuer": str(invitation.issuer.id),
+        "is_expired": False,
+    }
+
+
+@pytest.mark.parametrize(
+    "method",
+    ["put", "patch"],
+)
+def test_api_team_invitations__update__forbidden(method):
+    """
+    Update of invitations is currently forbidden.
+    """
+    user = factories.UserFactory()
+    invitation = factories.InvitationFactory()
+    factories.TeamAccessFactory(team=invitation.team, user=user, role="owner")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = None
+    if method == "put":
+        response = client.put(
+            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+        )
+    if method == "patch":
+        response = client.patch(
+            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+        )
+    assert response is not None
+    assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
+    assert response.json()["detail"] == f'Method "{method.upper()}" not allowed.'
+
+
+def test_api_team_invitations__delete__anonymous():
+    """Anonymous user should not be able to delete invitations."""
+    invitation = factories.InvitationFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+def test_api_team_invitations__delete__authenticated_outsider():
+    """Members outside of team should not cancel invitations."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+@pytest.mark.parametrize("role", ["owner", "administrator"])
+def test_api_team_invitations__delete__privileged_members(role):
+    """Privileged member should be able to cancel invitation."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, role)])
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_204_NO_CONTENT
+
+
+def test_api_team_invitations__delete__members():
+    """Member should not be able to cancel invitation."""
+    user = factories.UserFactory()
+    team = factories.TeamFactory(users=[(user, "member")])
+    invitation = factories.InvitationFactory(team=team)
+
+    client = APIClient()
+    client.force_login(user)
+    response = client.delete(
+        f"/api/v1.0/teams/{team.id}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert (
+        response.json()["detail"]
+        == "You do not have permission to perform this action."
+    )

src/backend/core/tests/test_api_users.py

@@ -1,6 +1,7 @@
 """
 Test users API endpoints in the People core app.
 """
+
 from unittest import mock
 
 import pytest
@@ -16,8 +17,6 @@ from core import factories, models
 from core.api import serializers
 from core.api.viewsets import Pagination
 
-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db
 
 
@@ -36,12 +35,14 @@ def test_api_users_list_authenticated():
     """
     Authenticated users should be able to list all users.
     """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     factories.UserFactory.create_batch(2)
-    response = APIClient().get(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/",
     )
     assert response.status_code == HTTP_200_OK
     assert len(response.json()["results"]) == 3
@@ -52,189 +53,282 @@ def test_api_users_authenticated_list_by_email():
     Authenticated users should be able to search users with a case-insensitive and
     partial query on the email.
     """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(email="david.bowman@work.com", name=None)
+    nicole = factories.UserFactory(email="nicole_foole@work.com", name=None)
+    frank = factories.UserFactory(email="frank_poole@work.com", name=None)
+    factories.UserFactory(email="heywood_floyd@work.com", name=None)
 
-    dave = factories.IdentityFactory(email="david.bowman@work.com")
-    nicole = factories.IdentityFactory(email="nicole_foole@work.com")
-    frank = factories.IdentityFactory(email="frank_poole@work.com")
-    factories.IdentityFactory(email="heywood_floyd@work.com")
+    client = APIClient()
+    client.force_login(user)
 
     # Full query should work
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids[0] == str(dave.user.id)
+    assert user_ids[0] == str(dave.id)
 
     # Partial query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=fran", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/users/?q=fran")
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids[0] == str(frank.user.id)
+    assert user_ids[0] == str(frank.id)
 
-    # Result that matches a trigram twice ranks better than result that matches once
-    response = APIClient().get(
-        "/api/v1.0/users/?q=ole", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/users/?q=ole")
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    # "Nicole Foole" matches twice on "ole"
-    assert user_ids == [str(nicole.user.id), str(frank.user.id)]
+    assert user_ids == [str(frank.id), str(nicole.id)]
 
-    # Even with a low similarity threshold, query should match expected emails
-    response = APIClient().get(
-        "/api/v1.0/users/?q=ool", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    response = client.get("/api/v1.0/users/?q=ool")
 
     assert response.status_code == HTTP_200_OK
-    user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(nicole.user.id), str(frank.user.id)]
+    assert response.json()["results"] == [
+        {
+            "id": str(frank.id),
+            "email": frank.email,
+            "name": frank.name,
+            "is_device": frank.is_device,
+            "is_staff": frank.is_staff,
+            "language": frank.language,
+            "timezone": str(frank.timezone),
+        },
+        {
+            "id": str(nicole.id),
+            "email": nicole.email,
+            "name": nicole.name,
+            "is_device": nicole.is_device,
+            "is_staff": nicole.is_staff,
+            "language": nicole.language,
+            "timezone": str(nicole.timezone),
+        },
+    ]
 
 
-def test_api_users_authenticated_list_multiple_identities_single_user():
+def test_api_users_authenticated_list_by_name():
     """
-    User with multiple identities should appear only once in results.
+    Authenticated users should be able to search users with a case-insensitive and
+    partial query on the name.
     """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(name="Dave bowman", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    frank = factories.UserFactory(name="frank poolé", email=None)
+    factories.UserFactory(name="heywood floyd", email=None)
 
-    dave = factories.UserFactory()
-    factories.IdentityFactory(user=dave, email="david.bowman@work.com")
-    factories.IdentityFactory(user=dave, email="david.bowman@fun.fr")
+    client = APIClient()
+    client.force_login(user)
 
     # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
+    response = client.get(
+        "/api/v1.0/users/?q=dave",
     )
 
     assert response.status_code == HTTP_200_OK
-    # A single user is returned, despite similarity matching both emails
-    assert response.json()["count"] == 1
-    assert response.json()["results"][0]["id"] == str(dave.id)
-
-
-def test_api_users_authenticated_list_multiple_identities_multiple_users():
-    """
-    User with multiple identities should be ranked
-    on their best matching identity.
-    """
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
-
-    dave = factories.UserFactory()
-    davina = factories.UserFactory()
-    prudence = factories.UserFactory()
-    factories.IdentityFactory(user=dave, email="david.bowman@work.com")
-    factories.IdentityFactory(user=dave, email="babibou@ehehe.com")
-    factories.IdentityFactory(user=davina, email="davina.bowan@work.com")
-    factories.IdentityFactory(user=prudence, email="prudence.crandall@work.com")
-
-    # Full query should work
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
-    )
-
-    assert response.status_code == HTTP_200_OK
-    assert response.json()["count"] == 3
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.id), str(davina.id), str(prudence.id)]
+    assert user_ids[0] == str(dave.id)
+
+    # Partial query should work
+    response = client.get("/api/v1.0/users/?q=fran")
+
+    assert response.status_code == HTTP_200_OK
+    user_ids = [user["id"] for user in response.json()["results"]]
+    assert user_ids[0] == str(frank.id)
+
+    response = client.get("/api/v1.0/users/?q=ole")
+
+    assert response.status_code == HTTP_200_OK
+    user_ids = [user["id"] for user in response.json()["results"]]
+    assert user_ids == [str(frank.id), str(nicole.id)]
+
+    response = client.get("/api/v1.0/users/?q=oole")
+
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["results"] == [
+        {
+            "id": str(frank.id),
+            "email": frank.email,
+            "name": frank.name,
+            "is_device": frank.is_device,
+            "is_staff": frank.is_staff,
+            "language": frank.language,
+            "timezone": str(frank.timezone),
+        },
+        {
+            "id": str(nicole.id),
+            "email": nicole.email,
+            "name": nicole.name,
+            "is_device": nicole.is_device,
+            "is_staff": nicole.is_staff,
+            "language": nicole.language,
+            "timezone": str(nicole.timezone),
+        },
+    ]
+
+
+def test_api_users_authenticated_list_by_name_and_email():
+    """
+    Authenticated users should be able to search users with a case-insensitive and
+    partial query on the name and email.
+    """
+
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    nicole = factories.UserFactory(email="nicole_foole@work.com", name="nicole foole")
+    oleg = factories.UserFactory(email="oleg_poole@work.com", name=None)
+    david = factories.UserFactory(email=None, name="david role")
+
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get("/api/v1.0/users/?q=ole")
+
+    assert response.status_code == HTTP_200_OK
+    user_ids = [user["id"] for user in response.json()["results"]]
+
+    assert user_ids == [str(david.id), str(oleg.id), str(nicole.id)]
+
+
+def test_api_users_authenticated_list_exclude_users_already_in_team(
+    django_assert_num_queries,
+):
+    """
+    Authenticated users should be able to search users
+    but the result should exclude all users already in the given team.
+    """
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    dave = factories.UserFactory(name="dave bowman", email=None)
+    nicole = factories.UserFactory(name="nicole foole", email=None)
+    frank = factories.UserFactory(name="frank poole", email=None)
+    mary = factories.UserFactory(name="mary poole", email=None)
+    factories.UserFactory(name="heywood floyd", email=None)
+    factories.UserFactory(name="Andrei Smyslov", email=None)
+    factories.TeamFactory.create_batch(10)
+
+    client = APIClient()
+    client.force_login(user)
+
+    # Add Dave and Frank in the same team
+    team = factories.TeamFactory(
+        users=[
+            (dave, models.RoleChoices.MEMBER),
+            (frank, models.RoleChoices.MEMBER),
+        ]
+    )
+    factories.TeamFactory(users=[(nicole, models.RoleChoices.MEMBER)])
+
+    # Search user to add him/her to a team, we give a team id to the request
+    # to exclude all users already in the team
+
+    # We can't find David Bowman because he is already a member of the given team
+    # 2 queries are needed here:
+    # - user authenticated
+    # - search user query
+    with django_assert_num_queries(2):
+        response = client.get(
+            f"/api/v1.0/users/?q=bowman&team_id={team.id}",
+        )
+    assert response.status_code == HTTP_200_OK
+    assert response.json()["results"] == []
+
+    # We can only find Nicole and Mary because Frank is already a member of the given team
+    # 4 queries are needed here:
+    # - user authenticated
+    # - search user query
+    # - User
+    with django_assert_num_queries(3):
+        response = client.get(
+            f"/api/v1.0/users/?q=ool&team_id={team.id}",
+        )
+    assert response.status_code == HTTP_200_OK
+    user_ids = sorted([user["id"] for user in response.json()["results"]])
+    assert user_ids == sorted([str(mary.id), str(nicole.id)])
 
 
 def test_api_users_authenticated_list_uppercase_content():
     """Upper case content should be found by lower case query."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="eva karl")
+    dave = factories.UserFactory(
+        email="DAVID.BOWMAN@INTENSEWORK.COM", name="DAVID BOWMAN"
+    )
 
-    dave = factories.IdentityFactory(email="DAVID.BOWMAN@INTENSEWORK.COM")
+    client = APIClient()
+    client.force_login(user)
 
     # Unaccented full address
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/users/?q=david.bowman@intensework.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]
 
     # Partial query
-    response = APIClient().get(
-        "/api/v1.0/users/?q=david", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=david",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]
 
 
 def test_api_users_list_authenticated_capital_query():
     """Upper case query should find lower case content."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="eva karl")
+    dave = factories.UserFactory(email="david.bowman@work.com", name="david bowman")
 
-    dave = factories.IdentityFactory(email="david.bowman@work.com")
+    client = APIClient()
+    client.force_login(user)
 
     # Full uppercase query
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/users/?q=DAVID.BOWMAN@WORK.COM",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]
 
     # Partial uppercase email
-    response = APIClient().get(
-        "/api/v1.0/users/?q=DAVID", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=DAVID",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(dave.user.id)]
+    assert user_ids == [str(dave.id)]
 
 
 def test_api_contacts_list_authenticated_accented_query():
     """Accented content should be found by unaccented query."""
-    user = factories.UserFactory(email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.email)
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory(email="tester@ministry.fr", name="john doe")
+    helene = factories.UserFactory(email="helene.bowman@work.com", name="helene bowman")
 
-    helene = factories.IdentityFactory(email="helene.bowman@work.com")
+    client = APIClient()
+    client.force_login(user)
 
     # Accented full query
-    response = APIClient().get(
+    response = client.get(
         "/api/v1.0/users/?q=hélène.bowman@work.com",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(helene.user.id)]
+    assert user_ids == [str(helene.id)]
 
     # Unaccented partial email
-    response = APIClient().get(
-        "/api/v1.0/users/?q=hélène", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?q=hélène",
     )
 
     assert response.status_code == HTTP_200_OK
     user_ids = [user["id"] for user in response.json()["results"]]
-    assert user_ids == [str(helene.user.id)]
+    assert user_ids == [str(helene.id)]
 
 
 @mock.patch.object(Pagination, "get_page_size", return_value=3)
@@ -242,15 +336,16 @@ def test_api_users_list_pagination(
     _mock_page_size,
 ):
     """Pagination should work as expected."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     factories.UserFactory.create_batch(4)
 
     # Get page 1
-    response = APIClient().get(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/",
     )
 
     assert response.status_code == HTTP_200_OK
@@ -262,8 +357,8 @@ def test_api_users_list_pagination(
     assert content["previous"] is None
 
     # Get page 2
-    response = APIClient().get(
-        "/api/v1.0/users/?page=2", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/?page=2",
     )
 
     assert response.status_code == HTTP_200_OK
@@ -276,6 +371,56 @@ def test_api_users_list_pagination(
     assert len(content["results"]) == 2
 
 
+@pytest.mark.parametrize("page_size", [1, 10, 99, 100])
+def test_api_users_list_pagination_page_size(
+    page_size,
+):
+    """Page's size on pagination should work as expected."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(page_size):
+        factories.UserFactory.create(email=f"user-{i}@people.com")
+
+    response = client.get(
+        f"/api/v1.0/users/?page_size={page_size}",
+    )
+
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+
+    assert content["count"] == page_size + 1
+    assert len(content["results"]) == page_size
+
+
+@pytest.mark.parametrize("page_size", [101, 200])
+def test_api_users_list_pagination_wrong_page_size(
+    page_size,
+):
+    """Page's size on pagination should be limited to "max_page_size"."""
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
+
+    for i in range(page_size):
+        factories.UserFactory.create(email=f"user-{i}@people.com")
+
+    response = client.get(
+        f"/api/v1.0/users/?page_size={page_size}",
+    )
+
+    assert response.status_code == HTTP_200_OK
+    content = response.json()
+
+    assert content["count"] == page_size + 1
+
+    # Length should not exceed "max_page_size" default value
+    assert len(content["results"]) == 100
+
+
 def test_api_users_retrieve_me_anonymous():
     """Anonymous users should not be allowed to list users."""
     factories.UserFactory.create_batch(2)
@@ -289,9 +434,10 @@ def test_api_users_retrieve_me_anonymous():
 
 def test_api_users_retrieve_me_authenticated():
     """Authenticated users should be able to retrieve their own user via the "/users/me" path."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     # Define profile contact
     contact = factories.ContactFactory(owner=user)
@@ -299,19 +445,19 @@ def test_api_users_retrieve_me_authenticated():
     user.save()
 
     factories.UserFactory.create_batch(2)
-    response = APIClient().get(
-        "/api/v1.0/users/me/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        "/api/v1.0/users/me/",
     )
 
     assert response.status_code == HTTP_200_OK
     assert response.json() == {
         "id": str(user.id),
+        "name": str(user.name),
         "email": str(user.email),
         "language": user.language,
         "timezone": str(user.timezone),
         "is_device": False,
         "is_staff": False,
-        "data": user.profile_contact.data,
     }
 
 
@@ -332,12 +478,13 @@ def test_api_users_retrieve_authenticated_self():
     Authenticated users should be allowed to retrieve their own user.
     The returned object should not contain the password.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
-    response = APIClient().get(
-        f"/api/v1.0/users/{user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.get(
+        f"/api/v1.0/users/{user.id!s}/",
     )
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
     assert response.json() == {"detail": 'Method "GET" not allowed.'}
@@ -348,13 +495,13 @@ def test_api_users_retrieve_authenticated_other():
     Authenticated users should be able to retrieve another user's detail view with
     limited information.
     """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user, other_user = factories.UserFactory.create_batch(2)
 
-    other_user = factories.UserFactory()
+    client = APIClient()
+    client.force_login(user)
 
-    response = APIClient().get(
-        f"/api/v1.0/users/{other_user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+    response = client.get(
+        f"/api/v1.0/users/{other_user.id!s}/",
     )
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
     assert response.json() == {"detail": 'Method "GET" not allowed.'}
@@ -378,18 +525,18 @@ def test_api_users_create_anonymous():
 
 def test_api_users_create_authenticated():
     """Authenticated users should not be able to create users via the API."""
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
-    response = APIClient().post(
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.post(
         "/api/v1.0/users/",
         {
             "language": "fr-fr",
             "password": "mypassword",
         },
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
     assert response.json() == {"detail": 'Method "POST" not allowed.'}
@@ -425,20 +572,20 @@ def test_api_users_update_authenticated_self():
     Authenticated users should be able to update their own user but only "language"
     and "timezone" fields.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     old_user_values = dict(serializers.UserSerializer(instance=user).data)
     new_user_values = dict(
         serializers.UserSerializer(instance=factories.UserFactory()).data
     )
 
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/users/{user.id!s}/",
         new_user_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_200_OK
@@ -453,18 +600,19 @@ def test_api_users_update_authenticated_self():
 
 def test_api_users_update_authenticated_other():
     """Authenticated users should not be allowed to update other users."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     user = factories.UserFactory()
     old_user_values = dict(serializers.UserSerializer(instance=user).data)
     new_user_values = serializers.UserSerializer(instance=factories.UserFactory()).data
 
-    response = APIClient().put(
+    response = client.put(
         f"/api/v1.0/users/{user.id!s}/",
         new_user_values,
         format="json",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
     )
 
     assert response.status_code == HTTP_403_FORBIDDEN
@@ -505,9 +653,10 @@ def test_api_users_patch_authenticated_self():
     Authenticated users should be able to patch their own user but only "language"
     and "timezone" fields.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
+
+    client = APIClient()
+    client.force_login(user)
 
     old_user_values = dict(serializers.UserSerializer(instance=user).data)
     new_user_values = dict(
@@ -515,11 +664,10 @@ def test_api_users_patch_authenticated_self():
     )
 
     for key, new_value in new_user_values.items():
-        response = APIClient().patch(
+        response = client.patch(
             f"/api/v1.0/users/{user.id!s}/",
             {key: new_value},
             format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
         )
         assert response.status_code == HTTP_200_OK
 
@@ -534,26 +682,27 @@ def test_api_users_patch_authenticated_self():
 
 def test_api_users_patch_authenticated_other():
     """Authenticated users should not be allowed to patch other users."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-
     user = factories.UserFactory()
-    old_user_values = dict(serializers.UserSerializer(instance=user).data)
+
+    client = APIClient()
+    client.force_login(user)
+
+    other_user = factories.UserFactory()
+    old_user_values = dict(serializers.UserSerializer(instance=other_user).data)
     new_user_values = dict(
         serializers.UserSerializer(instance=factories.UserFactory()).data
     )
 
     for key, new_value in new_user_values.items():
-        response = APIClient().put(
-            f"/api/v1.0/users/{user.id!s}/",
+        response = client.put(
+            f"/api/v1.0/users/{other_user.id!s}/",
             {key: new_value},
             format="json",
-            HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
         )
         assert response.status_code == HTTP_403_FORBIDDEN
 
-    user.refresh_from_db()
-    user_values = dict(serializers.UserSerializer(instance=user).data)
+    other_user.refresh_from_db()
+    user_values = dict(serializers.UserSerializer(instance=other_user).data)
     for key, value in user_values.items():
         assert value == old_user_values[key]
 
@@ -571,13 +720,14 @@ def test_api_users_delete_list_anonymous():
 
 def test_api_users_delete_list_authenticated():
     """Authenticated users should not be allowed to delete a list of users."""
+    user = factories.UserFactory()
     factories.UserFactory.create_batch(2)
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
 
     client = APIClient()
+    client.force_login(user)
+
     response = client.delete(
-        "/api/v1.0/users/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
+        "/api/v1.0/users/",
     )
 
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
@@ -598,13 +748,12 @@ def test_api_users_delete_authenticated():
     """
     Authenticated users should not be allowed to delete a user other than themselves.
     """
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
-    other_user = factories.UserFactory()
+    user, other_user = factories.UserFactory.create_batch(2)
 
-    response = APIClient().delete(
-        f"/api/v1.0/users/{other_user.id!s}/", HTTP_AUTHORIZATION=f"Bearer {jwt_token}"
-    )
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(f"/api/v1.0/users/{other_user.id!s}/")
 
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED
     assert models.User.objects.count() == 2
@@ -612,12 +761,13 @@ def test_api_users_delete_authenticated():
 
 def test_api_users_delete_self():
     """Authenticated users should not be able to delete their own user."""
-    identity = factories.IdentityFactory()
-    jwt_token = OIDCToken.for_user(identity.user)
+    user = factories.UserFactory()
 
-    response = APIClient().delete(
-        f"/api/v1.0/users/{identity.user.id!s}/",
-        HTTP_AUTHORIZATION=f"Bearer {jwt_token}",
+    client = APIClient()
+    client.force_login(user)
+
+    response = client.delete(
+        f"/api/v1.0/users/{user.id!s}/",
     )
 
     assert response.status_code == HTTP_405_METHOD_NOT_ALLOWED

src/backend/core/tests/test_models_contacts.py

@@ -1,6 +1,7 @@
 """
 Unit tests for the Contact model
 """
+
 from django.core.exceptions import ValidationError
 
 import pytest
@@ -52,7 +53,7 @@ def test_models_contacts_base_to_base():
 
 
 def test_models_contacts_owner_base_unique():
-    """Their should be only one contact deriving from a given base contact for a given owner."""
+    """There should be only one contact deriving from a given base contact for a given owner."""
     contact = factories.ContactFactory()
 
     with pytest.raises(ValidationError) as excinfo:

src/backend/core/tests/test_models_identities.py

@@ -1,182 +0,0 @@
-"""
-Unit tests for the Identity model
-"""
-from django.core.exceptions import ValidationError
-
-import pytest
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_models_identities_str_main():
-    """The str representation should be the email address with indication that it is main."""
-    identity = factories.IdentityFactory(email="david@example.com")
-    assert str(identity) == "david@example.com[main]"
-
-
-def test_models_identities_str_secondary():
-    """The str representation of a secondary email should be the email address."""
-    main_identity = factories.IdentityFactory()
-    secondary_identity = factories.IdentityFactory(
-        user=main_identity.user, email="david@example.com"
-    )
-    assert str(secondary_identity) == "david@example.com"
-
-
-def test_models_identities_is_main_automatic():
-    """The first identity created for a user should automatically be set as main."""
-    user = factories.UserFactory()
-    identity = models.Identity.objects.create(
-        user=user, sub="123", email="david@example.com"
-    )
-    assert identity.is_main is True
-
-
-def test_models_identities_is_main_exists():
-    """A user should always keep one and only one of its identities as main."""
-    user = factories.UserFactory()
-    main_identity, _secondary_identity = factories.IdentityFactory.create_batch(
-        2, user=user
-    )
-
-    assert main_identity.is_main is True
-
-    main_identity.is_main = False
-    with pytest.raises(
-        ValidationError, match="A user should have one and only one main identity."
-    ):
-        main_identity.save()
-
-
-def test_models_identities_is_main_switch():
-    """Setting a secondary identity as main should reset the existing main identity."""
-    user = factories.UserFactory()
-    first_identity, second_identity = factories.IdentityFactory.create_batch(
-        2, user=user
-    )
-
-    assert first_identity.is_main is True
-
-    second_identity.is_main = True
-    second_identity.save()
-
-    second_identity.refresh_from_db()
-    assert second_identity.is_main is True
-
-    first_identity.refresh_from_db()
-    assert first_identity.is_main is False
-
-
-def test_models_identities_email_not_required():
-    """The "email" field can be blank."""
-    user = factories.UserFactory()
-    models.Identity.objects.create(user=user, sub="123", email=None)
-
-
-def test_models_identities_user_required():
-    """The "user" field is required."""
-    with pytest.raises(models.User.DoesNotExist, match="Identity has no user."):
-        models.Identity.objects.create(user=None, email="david@example.com")
-
-
-def test_models_identities_email_unique_same_user():
-    """The "email" field should be unique for a given user."""
-    email = factories.IdentityFactory()
-
-    with pytest.raises(
-        ValidationError,
-        match="Identity with this User and Email address already exists.",
-    ):
-        factories.IdentityFactory(user=email.user, email=email.email)
-
-
-def test_models_identities_email_unique_different_users():
-    """The "email" field should not be unique among users."""
-    email = factories.IdentityFactory()
-    factories.IdentityFactory(email=email.email)
-
-
-def test_models_identities_email_normalization():
-    """The email field should be automatically normalized upon saving."""
-    email = factories.IdentityFactory()
-    email.email = "Thomas.Jefferson@Example.com"
-    email.save()
-    assert email.email == "Thomas.Jefferson@example.com"
-
-
-def test_models_identities_ordering():
-    """Identitys should be returned ordered by main status then by their email address."""
-    user = factories.UserFactory()
-    factories.IdentityFactory.create_batch(5, user=user)
-
-    emails = models.Identity.objects.all()
-
-    assert emails[0].is_main is True
-    for i in range(3):
-        assert emails[i + 1].is_main is False
-        assert emails[i + 2].email >= emails[i + 1].email
-
-
-def test_models_identities_sub_null():
-    """The "sub" field should not be null."""
-    user = factories.UserFactory()
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        models.Identity.objects.create(user=user, sub=None)
-
-
-def test_models_identities_sub_blank():
-    """The "sub" field should not be blank."""
-    user = factories.UserFactory()
-    with pytest.raises(ValidationError, match="This field cannot be blank."):
-        models.Identity.objects.create(user=user, email="david@example.com", sub="")
-
-
-def test_models_identities_sub_unique():
-    """The "sub" field should be unique."""
-    user = factories.UserFactory()
-    identity = factories.IdentityFactory()
-    with pytest.raises(ValidationError, match="Identity with this Sub already exists."):
-        models.Identity.objects.create(user=user, sub=identity.sub)
-
-
-def test_models_identities_sub_max_length():
-    """The sub field should be 255 characters maximum."""
-    factories.IdentityFactory(sub="a" * 255)
-    with pytest.raises(ValidationError) as excinfo:
-        factories.IdentityFactory(sub="a" * 256)
-
-    assert (
-        str(excinfo.value)
-        == "{'sub': ['Ensure this value has at most 255 characters (it has 256).']}"
-    )
-
-
-def test_models_identities_sub_special_characters():
-    """The sub field should accept periods, dashes, +, @ and underscores."""
-    identity = factories.IdentityFactory(sub="dave.bowman-1+2@hal_9000")
-    assert identity.sub == "dave.bowman-1+2@hal_9000"
-
-
-def test_models_identities_sub_spaces():
-    """The sub field should not accept spaces."""
-    with pytest.raises(ValidationError) as excinfo:
-        factories.IdentityFactory(sub="a b")
-
-    assert str(excinfo.value) == (
-        "{'sub': ['Enter a valid sub. This value may contain only letters, numbers, "
-        "and @/./+/-/_ characters.']}"
-    )
-
-
-def test_models_identities_sub_upper_case():
-    """The sub field should accept upper case characters."""
-    identity = factories.IdentityFactory(sub="John")
-    assert identity.sub == "John"
-
-
-def test_models_identities_sub_ascii():
-    """The sub field should accept non ASCII letters."""
-    identity = factories.IdentityFactory(sub="rené")
-    assert identity.sub == "rené"

src/backend/core/tests/test_models_invitations.py

@@ -0,0 +1,300 @@
+"""
+Unit tests for the Invitation model
+"""
+
+import smtplib
+import time
+import uuid
+from logging import Logger
+from unittest import mock
+
+from django.contrib.auth.models import AnonymousUser
+from django.core import exceptions, mail
+
+import pytest
+from faker import Faker
+from freezegun import freeze_time
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+fake = Faker()
+
+
+def test_models_invitations_readonly_after_create():
+    """Existing invitations should be readonly."""
+    invitation = factories.InvitationFactory()
+    with pytest.raises(exceptions.PermissionDenied):
+        invitation.save()
+
+
+def test_models_invitations_email_no_empty_mail():
+    """The "email" field should not be empty."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be blank"):
+        factories.InvitationFactory(email="")
+
+
+def test_models_invitations_email_no_null_mail():
+    """The "email" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be null"):
+        factories.InvitationFactory(email=None)
+
+
+def test_models_invitations_team_required():
+    """The "team" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be null"):
+        factories.InvitationFactory(team=None)
+
+
+def test_models_invitations_team_should_be_team_instance():
+    """The "team" field should be a team instance."""
+    with pytest.raises(ValueError, match='Invitation.team" must be a "Team" instance'):
+        factories.InvitationFactory(team="ee")
+
+
+def test_models_invitations_role_required():
+    """The "role" field is required."""
+    with pytest.raises(exceptions.ValidationError, match="This field cannot be blank"):
+        factories.InvitationFactory(role="")
+
+
+def test_models_invitations_role_among_choices():
+    """The "role" field should be a valid choice."""
+    with pytest.raises(
+        exceptions.ValidationError, match="Value 'boss' is not a valid choice"
+    ):
+        factories.InvitationFactory(role="boss")
+
+
+def test_models_invitations__is_expired(settings):
+    """
+    The 'is_expired' property should return False until validity duration
+    is exceeded and True afterwards.
+    """
+    expired_invitation = factories.InvitationFactory()
+    assert expired_invitation.is_expired is False
+
+    settings.INVITATION_VALIDITY_DURATION = 1
+    time.sleep(1)
+
+    assert expired_invitation.is_expired is True
+
+
+def test_models_invitation__new_user__convert_invitations_to_accesses():
+    """
+    Upon creating a new user, invitations linked to that email
+    should be converted to accesses and then deleted.
+    """
+    # Two invitations to the same mail but to different teams
+    invitation_to_team1 = factories.InvitationFactory()
+    invitation_to_team2 = factories.InvitationFactory(email=invitation_to_team1.email)
+
+    other_invitation = factories.InvitationFactory(
+        team=invitation_to_team2.team
+    )  # another person invited to team2
+
+    new_user = factories.UserFactory(email=invitation_to_team1.email)
+
+    # The invitation regarding
+    assert models.TeamAccess.objects.filter(
+        team=invitation_to_team1.team, user=new_user
+    ).exists()
+    assert models.TeamAccess.objects.filter(
+        team=invitation_to_team2.team, user=new_user
+    ).exists()
+    assert not models.Invitation.objects.filter(
+        team=invitation_to_team1.team, email=invitation_to_team1.email
+    ).exists()  # invitation "consumed"
+    assert not models.Invitation.objects.filter(
+        team=invitation_to_team2.team, email=invitation_to_team2.email
+    ).exists()  # invitation "consumed"
+    assert models.Invitation.objects.filter(
+        team=invitation_to_team2.team, email=other_invitation.email
+    ).exists()  # the other invitation remains
+
+
+def test_models_invitation__new_user__filter_expired_invitations():
+    """
+    Upon creating a new user, valid invitations should be converted into accesses
+    and expired invitations should remain unchanged.
+    """
+    with freeze_time("2020-01-01"):
+        expired_invitation = factories.InvitationFactory()
+    user_email = expired_invitation.email
+    valid_invitation = factories.InvitationFactory(email=user_email)
+
+    new_user = factories.UserFactory(email=user_email)
+
+    # valid invitation should have granted access to the related team
+    assert models.TeamAccess.objects.filter(
+        team=valid_invitation.team, user=new_user
+    ).exists()
+    assert not models.Invitation.objects.filter(
+        team=valid_invitation.team, email=user_email
+    ).exists()
+
+    # expired invitation should not have been consumed
+    assert not models.TeamAccess.objects.filter(
+        team=expired_invitation.team, user=new_user
+    ).exists()
+    assert models.Invitation.objects.filter(
+        team=expired_invitation.team, email=user_email
+    ).exists()
+
+
+@pytest.mark.parametrize("num_invitations, num_queries", [(0, 4), (1, 7), (20, 7)])
+def test_models_invitation__new_user__user_creation_constant_num_queries(
+    django_assert_num_queries, num_invitations, num_queries
+):
+    """
+    The number of queries executed during user creation should not be proportional
+    to the number of invitations being processed.
+    """
+    user_email = fake.email()
+
+    if num_invitations != 0:
+        for _ in range(0, num_invitations):
+            factories.InvitationFactory(email=user_email, team=factories.TeamFactory())
+
+    factories.UserFactory()
+
+    # with no invitation, we skip an "if", resulting in 8 requests
+    # otherwise, we should have 11 queries with any number of invitations
+    with django_assert_num_queries(num_queries):
+        models.User.objects.create(
+            email=user_email,
+            password="!",
+            name="Prudence C.",
+            sub=uuid.uuid4(),
+        )
+
+
+# get_abilities
+
+
+def test_models_team_invitations_get_abilities_anonymous():
+    """Check abilities returned for an anonymous user."""
+    access = factories.InvitationFactory()
+    abilities = access.get_abilities(AnonymousUser())
+    assert abilities == {
+        "delete": False,
+        "get": False,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_get_abilities_authenticated():
+    """Check abilities returned for an authenticated user."""
+    access = factories.InvitationFactory()
+    user = factories.UserFactory()
+    abilities = access.get_abilities(user)
+    assert abilities == {
+        "delete": False,
+        "get": False,
+        "patch": False,
+        "put": False,
+    }
+
+
+@pytest.mark.parametrize("role", ["administrator", "owner"])
+def test_models_team_invitations_get_abilities_privileged_member(role):
+    """Check abilities for a team member with a privileged role."""
+
+    pivileged_access = factories.TeamAccessFactory(role=role)
+    team = pivileged_access.team
+
+    factories.TeamAccessFactory(team=team)  # another one
+
+    invitation = factories.InvitationFactory(team=team)
+    abilities = invitation.get_abilities(pivileged_access.user)
+
+    assert abilities == {
+        "delete": True,
+        "get": True,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_get_abilities_member():
+    """Check abilities for a team member with 'member' role."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    factories.TeamAccessFactory(team=team)  # another one
+
+    invitation = factories.InvitationFactory(team=team)
+    abilities = invitation.get_abilities(member_access.user)
+
+    assert abilities == {
+        "delete": False,
+        "get": True,
+        "patch": False,
+        "put": False,
+    }
+
+
+def test_models_team_invitations_email():
+    """Check email invitation during invitation creation."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    factories.TeamAccessFactory(team=team)
+    invitation = factories.InvitationFactory(team=team, email="john@people.com")
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 1
+
+    # pylint: disable-next=no-member
+    email = mail.outbox[0]
+
+    assert email.to == [invitation.email]
+    assert email.subject == "Invitation to join Desk!"
+
+    email_content = " ".join(email.body.split())
+    assert "Invitation to join Desk!" in email_content
+    assert "[//example.com]" in email_content
+
+
+@mock.patch(
+    "django.core.mail.send_mail",
+    side_effect=smtplib.SMTPException("Error SMTPException"),
+)
+@mock.patch.object(Logger, "error")
+def test_models_team_invitations_email_failed(mock_logger, _mock_send_mail):
+    """Check invitation behavior when an SMTP error occurs during invitation creation."""
+
+    member_access = factories.TeamAccessFactory(role="member")
+    team = member_access.team
+
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    factories.TeamAccessFactory(team=team)
+
+    # No error should be raised
+    invitation = factories.InvitationFactory(team=team, email="john@people.com")
+
+    # No email has been sent
+    # pylint: disable-next=no-member
+    assert len(mail.outbox) == 0
+
+    # Logger should be called
+    mock_logger.assert_called_once()
+
+    (
+        _,
+        email,
+        exception,
+    ) = mock_logger.call_args.args
+
+    assert email == invitation.email
+    assert isinstance(exception, smtplib.SMTPException)

src/backend/core/tests/test_models_oidc_user_getter.py

@@ -1,107 +0,0 @@
-"""Unit tests for the `oidc_user_getter` function."""
-import pytest
-from rest_framework_simplejwt.exceptions import InvalidToken
-from rest_framework_simplejwt.tokens import AccessToken
-
-from core import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_models_oidc_user_getter_existing_user_no_email(django_assert_num_queries):
-    """
-    When a valid token is passed, an existing user matching the token's sub should be returned.
-    """
-    identity = factories.IdentityFactory()
-    factories.IdentityFactory(user=identity.user)  # another identity for the user
-    token = AccessToken()
-    token["sub"] = str(identity.sub)
-
-    with django_assert_num_queries(1):
-        user = models.oidc_user_getter(token)
-
-    identity.refresh_from_db()
-    assert user == identity.user
-
-
-def test_models_oidc_user_getter_existing_user_with_email(django_assert_num_queries):
-    """
-    When the valid token passed contains an email and targets an existing user,
-    it should update the email on the identity but not on the user.
-    """
-    identity = factories.IdentityFactory()
-    factories.IdentityFactory(user=identity.user)  # another identity for the user
-    user_email = identity.user.email
-    assert models.User.objects.count() == 1
-
-    token = AccessToken()
-    token["sub"] = str(identity.sub)
-
-    # Only 1 query if the email has not changed
-    token["email"] = identity.email
-    with django_assert_num_queries(1):
-        user = models.oidc_user_getter(token)
-
-    # Additional update query if the email has changed
-    new_email = "people@example.com"
-    token["email"] = new_email
-    with django_assert_num_queries(2):
-        user = models.oidc_user_getter(token)
-
-    identity.refresh_from_db()
-    assert identity.email == new_email
-
-    assert models.User.objects.count() == 1
-    assert user == identity.user
-    assert user.email == user_email
-
-
-def test_models_oidc_user_getter_new_user_no_email():
-    """
-    When a valid token is passed, a user should be created if the sub
-    does not match any existing user.
-    """
-    token = AccessToken()
-    token["sub"] = "123"
-
-    user = models.oidc_user_getter(token)
-
-    identity = user.identities.get()
-    assert identity.sub == "123"
-    assert identity.email is None
-
-    assert user.email is None
-    assert user.password == "!"
-    assert models.User.objects.count() == 1
-
-
-def test_models_oidc_user_getter_new_user_with_email():
-    """
-    When the valid token passed contains an email and a new user is created,
-    the email should be set on the user and on the identity.
-    """
-    email = "people@example.com"
-    token = AccessToken()
-    token["sub"] = "123"
-    token["email"] = email
-
-    user = models.oidc_user_getter(token)
-
-    identity = user.identities.get()
-    assert identity.sub == "123"
-    assert identity.email == email
-
-    assert user.email == email
-    assert models.User.objects.count() == 1
-
-
-def test_models_oidc_user_getter_invalid_token(django_assert_num_queries):
-    """The token passed in argument should contain the configured user id claim."""
-    token = AccessToken()
-
-    with django_assert_num_queries(0), pytest.raises(
-        InvalidToken, match="Token contained no recognizable user identification"
-    ):
-        models.oidc_user_getter(token)
-
-    assert models.User.objects.exists() is False

src/backend/core/tests/test_models_organizations.py

@@ -0,0 +1,127 @@
+"""
+Unit tests for the Organization model
+"""
+
+from django.core.exceptions import ValidationError
+
+import pytest
+
+from core import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_models_organization_str():
+    """The str representation should be the organization's name."""
+    organization = factories.OrganizationFactory(
+        name="HAL 9000", registration_id_list=["12345678901234"]
+    )
+    assert str(organization) == f"HAL 9000 (# {organization.pk})"
+
+
+def test_models_organization_constraints():
+    """It should not be possible to create an organization."""
+    organization = factories.OrganizationFactory(
+        registration_id_list=["12345678901234"], domain_list=["hal9000.com"]
+    )
+
+    with pytest.raises(ValidationError):
+        models.Organization.objects.create(name="HAL 9000")
+
+    with pytest.raises(ValidationError):
+        models.Organization.objects.create(
+            name="HAL 9000",
+            registration_id_list=[
+                organization.registration_id_list[0],
+                "12345678901235",
+            ],
+        )
+
+    with pytest.raises(ValidationError):
+        models.Organization.objects.create(
+            name="HAL 9000", domain_list=[organization.domain_list[0], "hal9001.com"]
+        )
+
+
+def test_models_organization_get_or_create_from_user_claims_no_kwargs():
+    """It should fail."""
+    with pytest.raises(ValueError):
+        models.Organization.objects.get_or_create_from_user_claims()
+
+
+def test_models_organization_get_or_create_from_user_claims_with_registration_id():
+    """It should create an organization with a registration ID number."""
+    organization, created = models.Organization.objects.get_or_create_from_user_claims(
+        registration_id="12345678901234"
+    )
+    assert created is True
+    assert organization.registration_id_list == ["12345678901234"]
+    assert organization.domain_list == []
+
+    same_organization, created = (
+        models.Organization.objects.get_or_create_from_user_claims(
+            registration_id="12345678901234"
+        )
+    )
+    assert created is False
+    assert organization == same_organization
+    assert same_organization.registration_id_list == ["12345678901234"]
+    assert same_organization.domain_list == []
+
+
+def test_models_organization_get_or_create_from_user_claims_with_domain():
+    """It should create an organization with a domain."""
+    organization, created = models.Organization.objects.get_or_create_from_user_claims(
+        domain="hal9000.com"
+    )
+    assert created is True
+    assert organization.registration_id_list == []
+    assert organization.domain_list == ["hal9000.com"]
+
+    same_organization, created = (
+        models.Organization.objects.get_or_create_from_user_claims(domain="hal9000.com")
+    )
+    assert created is False
+    assert organization == same_organization
+    assert same_organization.registration_id_list == []
+    assert same_organization.domain_list == ["hal9000.com"]
+
+
+def test_models_organization_get_or_create_from_user_claims_with_registration_id_and_domain():
+    """It should create an organization with a registration ID number."""
+    organization, created = models.Organization.objects.get_or_create_from_user_claims(
+        registration_id="12345678901234", domain="hal9000.com"
+    )
+    assert created is True
+    assert organization.registration_id_list == ["12345678901234"]
+    assert organization.domain_list == []
+
+    same_organization, created = (
+        models.Organization.objects.get_or_create_from_user_claims(
+            registration_id="12345678901234", domain="hal9000.com"
+        )
+    )
+    assert created is False
+    assert organization == same_organization
+    assert same_organization.registration_id_list == ["12345678901234"]
+    assert same_organization.domain_list == []
+
+
+def test_models_organization_registration_id_validators():
+    """
+    Test the registration ID validators.
+
+    This cannot be tested dynamically because the validators are set at model loading
+    and this is not possible to reload the models on the fly. We therefore enforce the
+    setting in Test environment.
+    """
+    models.Organization.objects.create(
+        name="hu",
+        registration_id_list=["12345678901234"],
+    )
+
+    with pytest.raises(ValidationError):
+        models.Organization.objects.create(
+            name="hi",
+            registration_id_list=["a12345678912345"],
+        )

src/backend/core/tests/test_models_team_accesses.py

@@ -1,12 +1,17 @@
 """
 Unit tests for the TeamAccess model
 """
+
+import json
+import re
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError
 
 import pytest
+import responses
 
-from core import factories
+from core import factories, models
 
 pytestmark = pytest.mark.django_db
 
@@ -15,16 +20,13 @@ def test_models_team_accesses_str():
     """
     The str representation should include user name, team full name and role.
     """
-    contact = factories.ContactFactory(full_name="David Bowman")
-    user = contact.owner
-    user.profile_contact = contact
-    user.save()
+    user = factories.UserFactory()
     access = factories.TeamAccessFactory(
         role="member",
         user=user,
         team__name="admins",
     )
-    assert str(access) == "David Bowman is member in team admins"
+    assert str(access) == f"{user} is {access.role} in team {access.team}"
 
 
 def test_models_team_accesses_unique():
@@ -38,6 +40,94 @@ def test_models_team_accesses_unique():
         factories.TeamAccessFactory(user=access.user, team=access.team)
 
 
+def test_models_team_accesses_create_webhook():
+    """
+    When the team has a webhook, creating a team access should fire a call.
+    """
+    user = factories.UserFactory()
+    team = factories.TeamFactory()
+    webhook = factories.TeamWebhookFactory(team=team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        models.TeamAccess.objects.create(user=user, team=team)
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(user.id),
+                            "email": user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+
+def test_models_team_accesses_delete_webhook():
+    """
+    When the team has a webhook, deleting a team access should fire a call.
+    """
+    team = factories.TeamFactory()
+    webhook = factories.TeamWebhookFactory(team=team)
+    access = factories.TeamAccessFactory(team=team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        access.delete()
+
+        assert rsp.call_count == 1
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Payload sent to scim provider
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "remove",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": access.user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    assert models.TeamAccess.objects.exists() is False
+
+
 # get_abilities
 
 

src/backend/core/tests/test_models_teams.py

@@ -1,6 +1,7 @@
 """
 Unit tests for the Team model
 """
+
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError
 
@@ -46,12 +47,6 @@ def test_models_teams_name_max_length():
         factories.TeamFactory(name="a " * 51)
 
 
-def test_models_teams_slug_empty():
-    """Slug field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank."):
-        models.Team.objects.create(slug="")
-
-
 # get_abilities
 
 
@@ -61,7 +56,7 @@ def test_models_teams_get_abilities_anonymous():
     abilities = team.get_abilities(AnonymousUser())
     assert abilities == {
         "delete": False,
-        "get": True,
+        "get": False,
         "patch": False,
         "put": False,
         "manage_accesses": False,
@@ -74,7 +69,7 @@ def test_models_teams_get_abilities_authenticated():
     abilities = team.get_abilities(factories.UserFactory())
     assert abilities == {
         "delete": False,
-        "get": True,
+        "get": False,
         "patch": False,
         "put": False,
         "manage_accesses": False,

src/backend/core/tests/test_models_users.py

@@ -1,6 +1,7 @@
 """
 Unit tests for the User model
 """
+
 from unittest import mock
 
 from django.core.exceptions import ValidationError
@@ -13,13 +14,18 @@ pytestmark = pytest.mark.django_db
 
 
 def test_models_users_str():
-    """The str representation should be the full name."""
+    """
+    user str representation should return name or email when avalaible.
+    Otherwise, it should return the sub.
+    """
     user = factories.UserFactory()
-    contact = factories.ContactFactory(full_name="david bowman", owner=user)
-    user.profile_contact = contact
-    user.save()
+    assert str(user) == user.name
 
-    assert str(user) == "david bowman"
+    no_name_user = factories.UserFactory(name=None)
+    assert str(no_name_user) == no_name_user.email
+
+    no_name_no_email_user = factories.UserFactory(name=None, email=None)
+    assert str(no_name_no_email_user) == f"User {no_name_no_email_user.sub}"
 
 
 def test_models_users_id_unique():
@@ -29,23 +35,101 @@ def test_models_users_id_unique():
         factories.UserFactory(id=user.id)
 
 
-def test_models_users_email_unique():
-    """The "email" field should be unique except for the null value."""
+def test_models_users_sub_null():
+    """The 'sub' field should not be null."""
+    with pytest.raises(ValidationError, match="This field cannot be null.") as excinfo:
+        models.User.objects.create(sub=None, password="password")
+
+    assert str(excinfo.value) == "{'sub': ['This field cannot be null.']}"
+
+
+def test_models_users_sub_blank():
+    """The 'sub' field should not be blank."""
+    with pytest.raises(ValidationError, match="This field cannot be blank.") as excinfo:
+        models.User.objects.create(sub="", password="password")
+
+    assert str(excinfo.value) == "{'sub': ['This field cannot be blank.']}"
+
+
+def test_models_users_sub_unique():
+    """The 'sub' field should be unique."""
     user = factories.UserFactory()
-    with pytest.raises(
-        ValidationError, match="User with this Email address already exists."
-    ):
-        factories.UserFactory(email=user.email)
+    with pytest.raises(ValidationError, match="User with this Sub already exists."):
+        models.User.objects.create(sub=user.sub, password="password")
+
+
+def test_models_users_sub_max_length():
+    """The 'sub' field should be 255 characters maximum."""
+    factories.UserFactory(sub="a" * 255)
+    with pytest.raises(ValidationError) as excinfo:
+        factories.UserFactory(sub="a" * 256)
+
+    assert (
+        str(excinfo.value)
+        == "{'sub': ['Ensure this value has at most 255 characters (it has 256).']}"
+    )
+
+
+def test_models_users_sub_special_characters():
+    """The 'sub' field should accept periods, dashes, +, @ and underscores."""
+    user = factories.UserFactory(sub="dave.bowman-1+2@hal_9000")
+    assert user.sub == "dave.bowman-1+2@hal_9000"
+
+
+def test_models_users_sub_spaces():
+    """The 'sub' field should not accept spaces."""
+    with pytest.raises(ValidationError) as excinfo:
+        factories.UserFactory(sub="a b")
+
+    assert str(excinfo.value) == (
+        "{'sub': ['Enter a valid sub. This value may contain only letters, numbers, "
+        "and @/./+/-/_ characters.']}"
+    )
+
+
+def test_models_users_sub_upper_case():
+    """The 'sub' field should accept upper case characters."""
+    user = factories.UserFactory(sub="John")
+    assert user.sub == "John"
+
+
+def test_models_users_sub_ascii():
+    """The 'sub' field should accept non ASCII letters."""
+    user = factories.UserFactory(sub="rené")
+    assert user.sub == "rené"
+
+
+def test_models_users_email_not_required():
+    """The 'email' field can be blank."""
+    user = factories.UserFactory(email=None)
+    assert user.email is None
+
+
+def test_models_users_email_normalization():
+    """The 'email' field should be automatically normalized upon saving."""
+    user = factories.UserFactory()
+    user.email = "Thomas.Jefferson@Example.com"
+    user.save()
+
+    assert user.email == "Thomas.Jefferson@example.com"
 
 
 def test_models_users_email_several_null():
     """Several users with a null value for the "email" field can co-exist."""
     factories.UserFactory(email=None)
-    factories.UserFactory(email=None)
+    models.User.objects.create(email=None, sub="123", password="foo.")
 
     assert models.User.objects.filter(email__isnull=True).count() == 2
 
 
+def test_models_users_email_not_unique():
+    """The 'email' field should not necessarily be unique among users."""
+    user = factories.UserFactory()
+    other_user = factories.UserFactory(email=user.email)
+
+    assert user.email == other_user.email
+
+
 def test_models_users_profile_not_owned():
     """A user cannot declare as profile a contact that not is owned."""
     user = factories.UserFactory()
@@ -77,10 +161,9 @@ def test_models_users_profile_owned_by_other():
 
 
 def test_models_users_send_mail_main_existing():
-    """The "email_user' method should send mail to the user's main email address."""
-    main_email = factories.IdentityFactory(email="dave@example.com")
-    user = main_email.user
-    factories.IdentityFactory.create_batch(2, user=user)
+    """The 'email_user' method should send mail to the user's email address."""
+    user = factories.UserFactory(email="dave@example.com")
+    factories.UserFactory.create_batch(2)
 
     with mock.patch("django.core.mail.send_mail") as mock_send:
         user.email_user("my subject", "my message")
@@ -90,11 +173,23 @@ def test_models_users_send_mail_main_existing():
     )
 
 
-def test_models_users_send_mail_main_missing():
-    """The "email_user' method should fail if the user has no email address."""
+def test_models_users_send_mail_main_admin():
+    """
+    The 'email_user' method should send mail to the user's email address.
+    """
     user = factories.UserFactory()
 
-    with pytest.raises(models.Identity.DoesNotExist) as excinfo:
+    with mock.patch("django.core.mail.send_mail") as mock_send:
         user.email_user("my subject", "my message")
 
-    assert str(excinfo.value) == "Identity matching query does not exist."
+    mock_send.assert_called_once_with("my subject", "my message", None, [user.email])
+
+
+def test_models_users_send_mail_main_missing():
+    """The 'email_user' method should fail if the user has no email address."""
+    user = factories.UserFactory(email=None)
+
+    with pytest.raises(ValueError) as excinfo:
+        user.email_user("my subject", "my message")
+
+    assert str(excinfo.value) == "You must first set an email for the user."

src/backend/core/tests/test_throttle.py

@@ -1,6 +1,7 @@
 """
 Test Throttle in People's app.
 """
+
 import pytest
 from rest_framework.test import APIClient
 
@@ -8,8 +9,6 @@ from core import factories
 
 from people.settings import REST_FRAMEWORK  # pylint: disable=E0611
 
-from .utils import OIDCToken
-
 pytestmark = pytest.mark.django_db
 
 
@@ -17,11 +16,10 @@ def test_throttle():
     """
     Throttle protection should block requests if too many.
     """
-    identity = factories.IdentityFactory()
-    user = identity.user
-    jwt_token = OIDCToken.for_user(user)
+    user = factories.UserFactory()
 
     client = APIClient()
+    client.force_login(user)
     endpoint = "/api/v1.0/users/"
 
     # loop to activate throttle protection
@@ -29,8 +27,8 @@ def test_throttle():
         REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"]["burst"].replace("/minute", "")
     )
     for _ in range(0, throttle_limit):
-        client.get(endpoint, HTTP_AUTHORIZATION=f"Bearer {jwt_token}")
+        client.get(endpoint)
 
     # this call should err
-    response = client.get(endpoint, HTTP_AUTHORIZATION=f"Bearer {jwt_token}")
+    response = client.get(endpoint)
     assert response.status_code == 429  # too many requests

src/backend/core/tests/test_utils_webhooks_scim_client.py

@@ -0,0 +1,341 @@
+"""Test Team synchronization webhooks."""
+
+import json
+import random
+import re
+from logging import Logger
+from unittest import mock
+
+import pytest
+import responses
+
+from core import factories
+from core.utils.webhooks import scim_synchronizer
+
+pytestmark = pytest.mark.django_db
+
+
+def test_utils_webhooks_add_user_to_group_no_webhooks():
+    """If no webhook is declared on the team, the function should not make any request."""
+    access = factories.TeamAccessFactory()
+
+    with responses.RequestsMock():
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+    assert len(responses.calls) == 0
+
+
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_success(mock_info):
+    """The user passed to the function should get added."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+            # Check headers
+            headers = rsps.calls[i].request.headers
+            assert "Authorization" not in headers
+            assert headers["Content-Type"] == "application/json"
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert mock_info.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_info.call_args_list[i][0] == (
+            "%s synchronization succeeded with %s",
+            "add_user_to_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_remove_user_from_group_success(mock_info):
+    """The user passed to the function should get removed."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.remove_user_from_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "remove",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert mock_info.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_info.call_args_list[i][0] == (
+            "%s synchronization succeeded with %s",
+            "remove_user_from_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_failure(mock_info, mock_error):
+    """The logger should be called on webhook call failure."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Simulate webhook failure using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=random.choice([404, 301, 302]),
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i, webhook in enumerate(webhooks):
+            assert rsps.calls[i].request.url == webhook.url
+
+        # Payload sent to scim provider
+        for call in rsps.calls:
+            payload = json.loads(call.request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert not mock_info.called
+    assert mock_error.call_count == 2
+    for i, webhook in enumerate(webhooks):
+        assert mock_error.call_args_list[i][0] == (
+            "%s synchronization failed with %s",
+            "add_user_to_group",
+            webhook.url,
+        )
+
+    # Status
+    for webhook in webhooks:
+        webhook.refresh_from_db()
+        assert webhook.status == "failure"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_webhooks_add_user_to_group_retries(mock_info, mock_error):
+    """webhooks synchronization supports retries."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team)
+
+    url = re.compile(r".*/Groups/.*")
+    with responses.RequestsMock() as rsps:
+        # Make webhook fail 3 times before succeeding using "responses"
+        all_rsps = [
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
+            rsps.add(rsps.PATCH, url, status=200, content_type="application/json"),
+        ]
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        for i in range(4):
+            assert all_rsps[i].call_count == 1
+            assert rsps.calls[i].request.url == webhook.url
+            payload = json.loads(rsps.calls[i].request.body)
+            assert payload == {
+                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+                "Operations": [
+                    {
+                        "op": "add",
+                        "path": "members",
+                        "value": [
+                            {
+                                "value": str(access.user.id),
+                                "email": user.email,
+                                "type": "User",
+                            }
+                        ],
+                    }
+                ],
+            }
+
+    # Logger
+    assert not mock_error.called
+    assert mock_info.call_count == 1
+    assert mock_info.call_args_list[0][0] == (
+        "%s synchronization succeeded with %s",
+        "add_user_to_group",
+        webhook.url,
+    )
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "success"
+
+
+@mock.patch.object(Logger, "error")
+@mock.patch.object(Logger, "info")
+def test_utils_synchronize_course_runs_max_retries_exceeded(mock_info, mock_error):
+    """Webhooks synchronization has exceeded max retries and should get logged."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team)
+
+    with responses.RequestsMock() as rsps:
+        # Simulate webhook temporary failure using "responses":
+        rsp = rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=random.choice([500, 502]),
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+
+        assert rsp.call_count == 5
+        assert rsps.calls[0].request.url == webhook.url
+        payload = json.loads(rsps.calls[0].request.body)
+        assert payload == {
+            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+            "Operations": [
+                {
+                    "op": "add",
+                    "path": "members",
+                    "value": [
+                        {
+                            "value": str(access.user.id),
+                            "email": user.email,
+                            "type": "User",
+                        }
+                    ],
+                }
+            ],
+        }
+
+    # Logger
+    assert not mock_info.called
+    assert mock_error.call_count == 1
+    assert mock_error.call_args_list[0][0] == (
+        "%s synchronization failed due to max retries exceeded with url %s",
+        "add_user_to_group",
+        webhook.url,
+    )
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "failure"
+
+
+def test_utils_webhooks_add_user_to_group_authorization():
+    """Secret token should be passed in authorization header when set."""
+    user = factories.UserFactory()
+    access = factories.TeamAccessFactory(user=user)
+    webhook = factories.TeamWebhookFactory(team=access.team, secret="123")
+
+    with responses.RequestsMock() as rsps:
+        # Ensure successful response by scim provider using "responses":
+        rsps.add(
+            rsps.PATCH,
+            re.compile(r".*/Groups/.*"),
+            body="{}",
+            status=200,
+            content_type="application/json",
+        )
+
+        scim_synchronizer.add_user_to_group(access.team, access.user)
+        assert rsps.calls[0].request.url == webhook.url
+
+        # Check headers
+        headers = rsps.calls[0].request.headers
+        assert headers["Authorization"] == "Bearer 123"
+        assert headers["Content-Type"] == "application/json"
+
+    # Status
+    webhook.refresh_from_db()
+    assert webhook.status == "success"

src/backend/core/tests/test_validators.py

@@ -0,0 +1,58 @@
+"""
+Test cases for core.validators module.
+"""
+
+from django.core.exceptions import ImproperlyConfigured
+from django.core.validators import EmailValidator, RegexValidator
+
+import pytest
+
+from core.validators import get_field_validators_from_setting
+
+
+def test_get_field_validators_from_setting_without_option(settings):
+    """Test get_field_validators_from_setting without options."""
+    settings.VALIDATOR_NO_OPTION = [
+        {
+            "NAME": "django.core.validators.EmailValidator",
+        },
+    ]
+
+    validators = get_field_validators_from_setting("VALIDATOR_NO_OPTION")
+    assert len(validators) == 1
+    assert isinstance(validators[0], EmailValidator)
+
+
+def test_get_field_validators_from_setting_with_option(settings):
+    """Test get_field_validators_from_setting with options."""
+    settings.REGEX_WITH_OPTIONS = [
+        {
+            "NAME": "django.core.validators.RegexValidator",
+            "OPTIONS": {
+                "regex": "[a-z][0-9]{14}",
+            },
+        },
+    ]
+
+    validators = get_field_validators_from_setting("REGEX_WITH_OPTIONS")
+    assert len(validators) == 1
+    assert isinstance(validators[0], RegexValidator)
+    assert validators[0].regex.pattern == "[a-z][0-9]{14}"
+
+
+def test_get_field_validators_from_setting_invalid_class_name(settings):
+    """Test get_field_validators_from_setting with an invalid class name."""
+    settings.INVALID_VALIDATORS = [
+        {
+            "NAME": "non.existent.Validator",
+        },
+    ]
+    with pytest.raises(ImproperlyConfigured):
+        get_field_validators_from_setting("INVALID_VALIDATORS")
+
+
+def test_get_field_validators_from_setting_empty_setting(settings):
+    """Test get_field_validators_from_setting with an empty setting."""
+    settings.EMPTY_VALIDATORS = []
+    validators = get_field_validators_from_setting("EMPTY_VALIDATORS")
+    assert not validators