🔧(backend) udpate email invitation sender

Replace the placeholder setting by a randomly picked 'do not reply' email adress. Might be improved later on.
📱(frontend) handle extremely long name
2024-04-02 23:26:38 +02:00 · 2024-04-02 23:21:44 +02:00 · 2024-04-02 22:53:43 +02:00
211 changed files with 5702 additions and 8553 deletions
@@ -1,51 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    tags:
-      - 'preprod'
-
-
-jobs:
-  notify-argocd:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "people,secrets"
-      -
-        name: Checkout repository
-        uses: actions/checkout@v2
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
-      -
-        name: Load sops secrets
-        uses: rouja/actions-sops@main
-        with:
-          secret-file: secrets/numerique-gouv/people/secrets.enc.env
-          age-key: ${{ secrets.SOPS_PRIVATE }}
-      -
-        name: Call argocd github webhook
-        run: |
-          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
-
-  start-test-on-preprod:
-    needs:
-      - notify-argocd
-    runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags/preprod')
-    steps:
-      -
-        name: Debug
-        run: |
-          echo "Start test when preprod is ready"
@@ -5,7 +5,6 @@ on:
  push:
    branches:
      - 'main'
-      - 'fix/warning-backend'
    tags:
      - 'v*'
  pull_request:
@@ -20,19 +19,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "people,secrets"
-      -
-        name: Checkout repository
-        uses: actions/checkout@v2
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
+        name: Checkout
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -43,7 +31,7 @@ jobs:
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          secret-file: .github/workflows/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Login to DockerHub
@@ -64,19 +52,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "people,secrets"
-      -
-        name: Checkout repository
-        uses: actions/checkout@v2
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
+        name: Checkout
+        uses: actions/checkout@v4
      -
        name: Docker meta
        id: meta
@@ -87,7 +64,7 @@ jobs:
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          secret-file: .github/workflows/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Login to DockerHub
@@ -109,27 +86,15 @@ jobs:
      - build-and-push-frontend
      - build-and-push-backend
    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
    steps:
      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "people,secrets"
-      -
-        name: Checkout repository
-        uses: actions/checkout@v2
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
+        name: Checkout
+        uses: actions/checkout@v4
      -
        name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          secret-file: .github/workflows/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      -
        name: Call argocd github webhook
@@ -4,6 +4,8 @@ on:
  push:
    branches:
      - main
+    tags:
+      - 'v*'
  pull_request:
    branches:
      - '*'
@@ -14,7 +16,7 @@ jobs:
    if: github.event_name == 'pull_request' # Makes sense only for pull requests
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
        with:
            fetch-depth: 0
      - name: show
@@ -37,7 +39,7 @@ jobs:
      github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
        with:
            fetch-depth: 0
      - name: Check that the CHANGELOG has been modified in the current branch
@@ -47,7 +49,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
      - name: Check CHANGELOG max line length
        run: |
          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -198,7 +200,7 @@ jobs:
      - name: Run e2e tests
        run: cd src/frontend/ && yarn e2e:test

-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v3
        if: always()
        with:
          name: playwright-report
@@ -212,7 +214,7 @@ jobs:
        working-directory: src/mail
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
@@ -236,9 +238,9 @@ jobs:
        working-directory: src/backend
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v3
        with:
          python-version: '3.10'
      - name: Install development dependencies
@@ -282,7 +284,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
      - name: Create writable /data
        run: |
          sudo mkdir -p /data/media && \
@@ -293,7 +295,7 @@ jobs:
          name: mails-templates
          path: src/backend/core/templates/mail
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v3
        with:
          python-version: '3.10'
      - name: Install development dependencies
@@ -310,27 +312,16 @@ jobs:
  i18n-crowdin:
    runs-on: ubuntu-latest
    steps:
-      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "people,secrets"
-      -
-        name: Checkout repository
+      - name: Checkout repository
        uses: actions/checkout@v2
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
+        
      - name: Install gettext (required to make messages)
        run: |
          sudo apt-get update
          sudo apt-get install -y gettext
      
      - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v3
        with:
          python-version: '3.10'

@@ -341,11 +332,10 @@ jobs:
      - name: Generate the translation base file
        run: ~/.local/bin/django-admin makemessages --keep-pot --all
        
-      -
-        name: Load sops secrets
+      - name: Load sops secrets
        uses: rouja/actions-sops@main
        with:
-          secret-file: secrets/numerique-gouv/people/secrets.enc.env
+          secret-file: .github/workflows/secrets.enc.env
          age-key: ${{ secrets.SOPS_PRIVATE }}
      
      - name: Setup Node.js
@@ -0,0 +1,24 @@
+SOPS_PRIVATE=ENC[AES256_GCM,data:FAgeMw3bbPVNZEuyuJ4rMeknOH4UZ1vC7k3S0qe6aaeGG3HHfEIpWHckCjHLDTz6hNDUxWSr/WPytntbGjqcvzKwYZBeehGx9hY=,iv:O64EPSvyYSxjHOIIrdjMQYIJR9HW2CxE+6Ay0e0dvoc=,tag:64G0A4kIJ8AzNx3+CluW5Q==,type:str]
+CROWDIN_API_TOKEN=ENC[AES256_GCM,data:IlmqbPlM6s9paCAxn40v4LNEGbzYlm9SVplXfP8PI8Ei/K5oGtLPquoDokK33ySEfEh5b5xLAZjlmDyICdv89ETdd7RLB/63f2LduMn8n0A=,iv:gdcCrv58wkLC6wufFvHGrHB/A6aLXAApJ036BYjlN8g=,tag:wReGIj4izqzBHY7X0rqOAg==,type:str]
+CROWDIN_BASE_PATH=ENC[AES256_GCM,data:bepqdi4eaMM=,iv:nF7FSUiuRu4kTYeEQB3cN/Fwrpt0fB0dC/dm4poec7w=,tag:kbxhwe1SQYkaddKyY1UQDg==,type:str]
+CROWDIN_PROJECT_ID=ENC[AES256_GCM,data:z8ZkbbR9,iv:Uc2aGQ9dAkiUcTpBqcIqD2fXt4+/ObJJz/3D8BhN9/A=,tag:ZDqDpsD7IN7iyFvKmxoI2w==,type:str]
+DOCKER_HUB_PASSWORD=ENC[AES256_GCM,data:3E/4G2zOBNZqkGc=,iv:zbQzrgLYgNp99zRUZ3ICG47OkLPV1HnhcNoIu3cSmpc=,tag:CEvKG2HVd2ijjGfzkM005Q==,type:str]
+DOCKER_HUB_USER=ENC[AES256_GCM,data:Qc/HR/O8nw==,iv:nvXUmLHgNFQwm6aIpBcPvOdITOkw1YT7hIyk4ptuOOw=,tag:qoqSA9NlGCbor+7OyGArfw==,type:str]
+ARGOCD_WEBHOOK_URL=ENC[AES256_GCM,data:WhW6TQQV/IQteW/jQukjlTaTLeNUzEzadp+HJEC7bqrWR88ZBUlk8sfF5KV7PAAAZtvMhe4mi/yl,iv:CInpRuJpKFpxozdzHQkfDxbhQYyy+VByzrDr2ZSmJ7E=,tag:RNmIoYtA5DSi1W7TDsJHxw==,type:str]
+ARGOCD_WEBHOOK_SECRET=ENC[AES256_GCM,data:KTT5ubYdm5oVzXL0sM9HdNObVKhSD1spB3KYgM6CskEpQutb3R4Lu5mImft9C9tRKIkZetxV9YyLawCPaZm5P1U=,iv:Xp+xE43a6/GODhhujnSrTfcQJ2P9u4YrRakmxLwEtEc=,tag:jYAk+4X7x44edb0vcbnKWA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHaHpGT0lLR21qRi8wZCt2\nc0t5NGlDR29lK2JscE4rc3VZOU5ic3FBdkhnCnJYdDdvMlBROWhPc2pjbDJTbmo0\ncENxV0hDYzZKSFh5RTNnUTRyaUdGLzgKLS0tIENIeDQyQ1NzMkF6cTZVRmU1VC9D\nNy9BTElMQlBEUWhCQWxpdVI1enJNblEKbGEkN7JPlj+OqBHYhZhZwfjpdxGlkjti\nBPsDHIklHYufk9+TjnxBYL1Oe6zLn4zlG0r/w8AHrTo6oke5dUjvKg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArOG1XL1NFc29xVWFFdW9Q\nM0FrY3BEazJRRXNHMjVpS2hCVVBNSllUU1dJCkRIT00xSVAzeEozZndwTzlmY1Bn\nc3VJYmQrVzRXZTF1TjR4QXQrYXpIaG8KLS0tIEtXNTkvb2tRcjR0YWdneTI2dlBu\nY2tkYVU4UGtZdEIxQWMxQ1h6aHQ1RjQKpPQRQZtMDMkmSUhm7PQXpBHYK45Fm7Gx\nNL4gpLq1bJ6tNlnvP2zj2OOJ7NsiSeH8Vey6NON6E5wDKckBkpZUdg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUEM5ZzNST2RHTzRKUUxH\nbGxsOVoxTkVQWnFBa3lweExjSG5tZW02ZTBVCmhmLzRkbEVUUFNOZXdZRG5QUUJL\nL0lvMDArRHBGbmsrR1Y0NE9DcmtwbWcKLS0tIDljdmdGaTVVdnBxdjlYM0IrWTZ1\nYU03M1dHZm5nMDY0ZE9TSzl2Mk9YcG8KZ6vkG1KUIpS3BnIWcluA0nc5YX5AB3RH\nPJqFTdNwUfeB8omOyifF4jxU3Jqm53d3kVmiSPXTlaOYwqrhbT1oAw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
+sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0c2x0YVB4cW1jVFRZVlBP\nNFJiSHIrWk9HWGgreVRSZWhkd3cveDBDZ1RZCkQzYnFxMEhUb2s2U3drZzQwTW5D\nbU9iL0RoN2Ztb0M2UEluOUQ5M3RtMEEKLS0tIEhJRnZGekxWR3dRejV1SkNDQkda\nQkY5MGZyZW1QNzdveXFTbGd0WjRZaTAKbv+2BPThEjNn7yjK4aX4C7kvnXQgf1Qb\n6J72BKD8AtHOJVdp/d1+I41ejwXdfBbSKN5O6rnPozH60GDWFlQRwA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_3__map_recipient=age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bzBsVUdlV1dzNVZoWGs2\nR3k0ZGh4cTlNTWdqNXlzc29KeTNTcmd6MHlZCi9wa29CNzcwWmtyT2U2bVArQXlU\nOGJXY3VaT2J5SEd1clY2WFVLa0s2a0EKLS0tIGlYZzRFT29ld2t6SU5tUUhIeUpG\nRnQwcTN0OFZJNGJicUNmeVE0eVcrU3MK96xiB4AkQSXLnP5XvVlQhvjQEQKhTZuO\nYbO1uP0EGSQ+f6uP3ENw4BFAgdB3y0YFcVm5VtTxN4Tpw3ZUVWtqew==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_4__map_recipient=age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
+sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkEzQlRLNVd3U3hrU2dh\nY0l1OGVlYjJNZEIzK1R5NWFCK1lnK2pMVnlBCksrR1JKZTFmdzJCekZkQStvejBL\nd05wejByZjdnN2xweVhBemNiSDUwUEUKLS0tIEJIVGYzbWNBN2hrNEtoY2xMSk9v\naWw1THRBbmpDbGc2eE1WV0VSVUtoNm8KyCP6BtJRNUfvlAiuzQ1xhpjm6YFUA66G\n/qk9WLm07qHfFD5r2dGQBksN61Nk+akF0BGa56qnAEJp63lP8u1xbg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_5__map_recipient=age1qy04neuzwpasmvljqrcvhwnf0kz5cpyteze38c8avp0czewskasszv9pyw
+sops_lastmodified=2024-03-26T10:02:48Z
+sops_mac=ENC[AES256_GCM,data:p7Br4MRgpr26vSS79QBwYRXQWdb20lbrSxOdcrj385EhDVaqZM9aaycf09FItuBrQDuNO3NVSoGnJvWhekwRXXJlxXDENmjP9YBnNt25WXCa2+PLQGzvGbZjo/KHky5zqwVV5XaJ++UuO7VJZgB6m5m7RPZEBCo4cwy7rvNeyEs=,iv:XaavC9VEDckO1QpsPjUwf5BpJzFcEdxycSZvuFX8D7A=,tag:S82ex6+X4MUkkR8m9UAgqA==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1
@@ -1,3 +0,0 @@
-[submodule "secrets"]
-	path = secrets
-	url = ../secrets
@@ -0,0 +1,15 @@
+creation_rules:
+  # Here we have
+  # - Jacques key-id: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+  # - github-repo key-id: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+  # - Anthony Le-Courric key-id: age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv
+  # - Antoine Lebaud key-id: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+  # - Marie Pupo Jeammet key-id: age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa
+  # - argocd key-id: age1qy04neuzwpasmvljqrcvhwnf0kz5cpyteze38c8avp0czewskasszv9pyw
+  - age:
+      age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x,
+      age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7,
+      age1g5keveae6zhn059e7cxkjqdz4v3u47ypejv9ujld65nwh6d5pd9qfm0ecv,
+      age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3,
+      age1tl80n23wq6zxegupwn70ew0yp225ua5v4dk800x7g2w6pvlxz46qk592pa,
+      age1qy04neuzwpasmvljqrcvhwnf0kz5cpyteze38c8avp0czewskasszv9pyw
@@ -24,8 +24,8 @@ COPY ./src/frontend/packages/eslint-config-people/package.json ./packages/eslint

 RUN yarn --frozen-lockfile

-### ---- Front-end builder dev image ----
-FROM node:20 as frontend-builder-dev
+### ---- Front-end builder image ----
+FROM node:20 as frontend-builder

 WORKDIR /builder

@@ -34,11 +34,9 @@ COPY ./src/frontend .

 WORKDIR ./apps/desk

-### ---- Front-end builder image ----
-FROM frontend-builder-dev as frontend-builder
-
 RUN yarn build

+
 # ---- Front-end image ----
 FROM nginxinc/nginx-unprivileged:1.25 as frontend-production

@@ -166,30 +166,24 @@ test-back-parallel: ## run all back-end tests in parallel
 	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel

+
 makemigrations:  ## run django makemigrations for the people project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) makemigrations $(ARGS)
+	@$(MANAGE) makemigrations
 .PHONY: makemigrations

 migrate:  ## run django migrations for the people project.
 	@echo "$(BOLD)Running migrations$(RESET)"
 	@$(COMPOSE) up -d postgresql
 	@$(WAIT_DB)
-	@$(MANAGE) migrate $(ARGS)
+	@$(MANAGE) migrate
 .PHONY: migrate

-showmigrations:  ## run django showmigrations for the people project.
-	@echo "$(BOLD)Running showmigrations$(RESET)"
-	@$(COMPOSE) up -d postgresql
-	@$(WAIT_DB)
-	@$(MANAGE) showmigrations $(ARGS)
-.PHONY: showmigrations
-
 superuser: ## Create an admin superuser with password "admin"
 	@echo "$(BOLD)Creating a Django superuser$(RESET)"
-	@$(MANAGE) createsuperuser --admin_email admin@example.com --password admin
+	@$(MANAGE) createsuperuser --email admin@example.com --password admin
 .PHONY: superuser

 back-i18n-compile: ## compile the gettext files
@@ -329,12 +323,3 @@ frontend-i18n-generate: \
 frontend-i18n-compile: ## Format the crowin json files used deploy to the apps
 	cd $(PATH_FRONT) && yarn i18n:deploy
 .PHONY: frontend-i18n-compile
-
-# -- K8S
-start-kind: ## Create the kubernetes cluster
-	./bin/start-kind.sh
-.PHONY: start-kind
-
-tilt-up: ## start tilt - k8s local development
-	tilt up -f ./bin/Tiltfile
-.PHONY: tilt-up
@@ -69,8 +69,6 @@ You first need to create a superuser account:
 $ make superuser
 ```

-You can then login with credentials `admin@example` / `admin`.
-
 ### Run frontend

 Run the front with:
@@ -1,58 +0,0 @@
-load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
-load('ext://namespace', 'namespace_create', 'namespace_inject')
-namespace_create('desk')
-
-docker_build(
-    'localhost:5001/people-backend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    only=['./src/backend', './src/mail', './docker'],
-    target = 'backend-production',
-    live_update=[
-        sync('../src/backend', '/app'),
-        run(
-            'pip install -r /app/requirements.txt',
-            trigger=['./api/requirements.txt']
-        )
-    ]
-)
-
-docker_build(
-    'localhost:5001/people-frontend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    build_args={'ENV': 'dev'},
-    only=['./src/frontend', './src/mail', './docker'],
-    target = 'frontend-builder-dev',
-    live_update=[
-        sync('../src/frontend', '/builder'),
-    ]
-)
-
-k8s_yaml(local('cd ../src/helm && helmfile -n desk -e dev template .'))
-
-migration = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py makemigrations
-'''
-cmd_button('Make migration',
-           argv=['sh', '-c', migration],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run makemigration',
-)
-
-pod_migrate = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py migrate --no-input
-'''
-cmd_button('Migrate db',
-           argv=['sh', '-c', pod_migrate],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run database migration',
-)
@@ -1,102 +0,0 @@
-#!/bin/sh
-set -o errexit
-
-CURRENT_DIR=$(pwd)
-
-# 0. Create ca
-echo "0. Create ca"
-mkcert -install
-cd /tmp
-mkcert "127.0.0.1.nip.io" "*.127.0.0.1.nip.io"
-cd $CURRENT_DIR
-
-# 1. Create registry container unless it already exists
-echo "1. Create registry container unless it already exists"
-reg_name='kind-registry'
-reg_port='5001'
-if [ "$(docker inspect -f '{{.State.Running}}' "${reg_name}" 2>/dev/null || true)" != 'true' ]; then
-	docker run \
-		-d --restart=always -p "127.0.0.1:${reg_port}:5000" --network bridge --name "${reg_name}" \
-		registry:2
-fi
-
-# 2. Create kind cluster with containerd registry config dir enabled
-echo "2. Create kind cluster with containerd registry config dir enabled"
-# TODO: kind will eventually enable this by default and this patch will
-# be unnecessary.
-#
-# See:
-# https://github.com/kubernetes-sigs/kind/issues/2875
-# https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
-# See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
-cat <<EOF | kind create cluster --config=-
-kind: Cluster
-apiVersion: kind.x-k8s.io/v1alpha4
-containerdConfigPatches:
- |-
-  [plugins."io.containerd.grpc.v1.cri".registry]
-    config_path = "/etc/containerd/certs.d"
-nodes:
- role: control-plane
-  image: kindest/node:v1.27.3
-  kubeadmConfigPatches:
-  - |
-    kind: InitConfiguration
-    nodeRegistration:
-      kubeletExtraArgs:
-        node-labels: "ingress-ready=true"
-  extraPortMappings:
-  - containerPort: 80
-    hostPort: 80
-    protocol: TCP
-  - containerPort: 443
-    hostPort: 443
-    protocol: TCP
- role: worker
-  image: kindest/node:v1.27.3
- role: worker
-  image: kindest/node:v1.27.3
-EOF
-
-# 3. Add the registry config to the nodes
-echo "3. Add the registry config to the nodes"
-#
-# This is necessary because localhost resolves to loopback addresses that are
-# network-namespace local.
-# In other words: localhost in the container is not localhost on the host.
-#
-# We want a consistent name that works from both ends, so we tell containerd to
-# alias localhost:${reg_port} to the registry container when pulling images
-REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
-for node in $(kind get nodes); do
-	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
-	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
-[host."http://${reg_name}:5000"]
-EOF
-done
-
-# 4. Connect the registry to the cluster network if not already connected
-echo "4. Connect the registry to the cluster network if not already connected"
-# This allows kind to bootstrap the network but ensures they're on the same network
-if [ "$(docker inspect -f='{{json .NetworkSettings.Networks.kind}}' "${reg_name}")" = 'null' ]; then
-	docker network connect "kind" "${reg_name}"
-fi
-
-# 5. Document the local registry
-echo "5. Document the local registry"
-# https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/generic/1755-communicating-a-local-registry
-cat <<EOF | kubectl apply -f -
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: local-registry-hosting
-  namespace: kube-public
-data:
-  localRegistryHosting.v1: |
-    host: "localhost:${reg_port}"
-    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
-EOF
-
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
-kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
-kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'
@@ -136,6 +136,7 @@ services:

  kc_postgresql:
      image: postgres:14.3
+      platform: linux/amd64
      ports:
        - "5433:5432"
      env_file:
@@ -13,7 +13,7 @@
      "enabled": false,
      "groupName": "ignored js dependencies",
      "matchManagers": ["npm"],
-      "matchPackageNames": ["node", "node-fetch", "i18next-parser", "eslint"]
+      "matchPackageNames": ["node", "node-fetch", "i18next-parser"]
    }
  ]
 }
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-git submodule update --init --recursive
-git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -53,15 +53,6 @@ class TeamAccessInline(admin.TabularInline):
    readonly_fields = ("created_at", "updated_at")


-class TeamWebhookInline(admin.TabularInline):
-    """Inline admin class for team webhooks."""
-
-    extra = 0
-    autocomplete_fields = ["team"]
-    model = models.TeamWebhook
-    readonly_fields = ("created_at", "updated_at")
-
-
@admin.register(models.User)
 class UserAdmin(auth_admin.UserAdmin):
    """Admin class for the User model"""
@@ -76,7 +67,7 @@ class UserAdmin(auth_admin.UserAdmin):
                )
            },
        ),
-        (_("Personal info"), {"fields": ("admin_email", "language", "timezone")}),
+        (_("Personal info"), {"fields": ("email", "language", "timezone")}),
        (
            _("Permissions"),
            {
@@ -97,13 +88,13 @@ class UserAdmin(auth_admin.UserAdmin):
            None,
            {
                "classes": ("wide",),
-                "fields": ("admin_email", "password1", "password2"),
+                "fields": ("email", "password1", "password2"),
            },
        ),
    )
    inlines = (IdentityInline, TeamAccessInline)
    list_display = (
-        "admin_email",
+        "email",
        "created_at",
        "updated_at",
        "is_active",
@@ -114,14 +105,14 @@ class UserAdmin(auth_admin.UserAdmin):
    list_filter = ("is_staff", "is_superuser", "is_device", "is_active")
    ordering = ("is_active", "-is_superuser", "-is_staff", "-is_device", "-updated_at")
    readonly_fields = ("id", "created_at", "updated_at")
-    search_fields = ("id", "admin_email", "identities__sub", "identities__email")
+    search_fields = ("id", "email", "identities__sub", "identities__email")


@admin.register(models.Team)
 class TeamAdmin(admin.ModelAdmin):
    """Team admin interface declaration."""

-    inlines = (TeamAccessInline, TeamWebhookInline)
+    inlines = (TeamAccessInline,)
    list_display = (
        "name",
        "slug",
@@ -23,8 +23,6 @@ def exception_handler(exc, context):
            detail = exc.message
        elif hasattr(exc, "messages"):
            detail = exc.messages
-        else:
-            detail = ""

        exc = drf_exceptions.ValidationError(detail=detail)

@@ -52,22 +52,42 @@ class UserSerializer(DynamicFieldsModelSerializer):
    """Serialize users."""

    timezone = TimeZoneSerializerField(use_pytz=False, required=True)
-    email = serializers.ReadOnlyField()
-    name = serializers.ReadOnlyField()
+    name = serializers.SerializerMethodField(read_only=True)
+    email = serializers.SerializerMethodField(read_only=True)

    class Meta:
        model = models.User
        fields = [
            "id",
+            "name",
            "email",
            "language",
-            "name",
            "timezone",
            "is_device",
            "is_staff",
        ]
        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]

+    def _get_main_identity_attr(self, obj, attribute_name):
+        """Return the specified attribute of the main identity."""
+        try:
+            return getattr(obj.main_identity[0], attribute_name)
+        except TypeError:
+            return getattr(obj.main_identity, attribute_name)
+        except IndexError:
+            main_identity = obj.identities.filter(is_main=True).first()
+            return getattr(obj.main_identity, attribute_name) if main_identity else None
+        except AttributeError:
+            return None
+
+    def get_name(self, obj):
+        """Return main identity's name."""
+        return self._get_main_identity_attr(obj, "name")
+
+    def get_email(self, obj):
+        """Return main identity's email."""
+        return self._get_main_identity_attr(obj, "email")
+

 class TeamAccessSerializer(serializers.ModelSerializer):
    """Serialize team accesses."""
@@ -202,7 +202,7 @@ class UserViewSet(
                Prefetch(
                    "identities",
                    queryset=models.Identity.objects.filter(is_main=True),
-                    to_attr="_identities_main",
+                    to_attr="main_identity",
                )
            )

@@ -245,6 +245,9 @@ class UserViewSet(
        Return information on currently logged user
        """
        user = request.user
+        user.main_identity = models.Identity.objects.filter(
+            user=user, is_main=True
+        ).first()
        return response.Response(
            self.serializer_class(user, context={"request": request}).data
        )
@@ -375,7 +378,7 @@ class TeamAccessViewSet(
                    Prefetch(
                        "user__identities",
                        queryset=models.Identity.objects.filter(is_main=True),
-                        to_attr="_identities_main",
+                        to_attr="main_identity",
                    )
                )
                # Abilities are computed based on logged-in user's role and
@@ -1,4 +1,4 @@
-"""Authentication Backends for the People core app."""
+"""Authentication for the People core app."""

 from django.conf import settings
 from django.core.exceptions import SuspiciousOperation
@@ -10,7 +10,7 @@ from mozilla_django_oidc.auth import (
    OIDCAuthenticationBackend as MozillaOIDCAuthenticationBackend,
 )

-from core.models import Identity
+from .models import Identity


 class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend):
@@ -1,18 +0,0 @@
-"""Authentication URLs for the People core app."""
-
-from django.urls import path
-
-from mozilla_django_oidc.urls import urlpatterns as mozzila_oidc_urls
-
-from .views import OIDCLogoutCallbackView, OIDCLogoutView
-
-urlpatterns = [
-    # Override the default 'logout/' path from Mozilla Django OIDC with our custom view.
-    path("logout/", OIDCLogoutView.as_view(), name="oidc_logout_custom"),
-    path(
-        "logout-callback/",
-        OIDCLogoutCallbackView.as_view(),
-        name="oidc_logout_callback",
-    ),
-    *mozzila_oidc_urls,
-]
@@ -1,137 +0,0 @@
-"""Authentication Views for the People core app."""
-
-from urllib.parse import urlencode
-
-from django.contrib import auth
-from django.core.exceptions import SuspiciousOperation
-from django.http import HttpResponseRedirect
-from django.urls import reverse
-from django.utils import crypto
-
-from mozilla_django_oidc.utils import (
-    absolutify,
-)
-from mozilla_django_oidc.views import (
-    OIDCLogoutView as MozillaOIDCOIDCLogoutView,
-)
-
-
-class OIDCLogoutView(MozillaOIDCOIDCLogoutView):
-    """Custom logout view for handling OpenID Connect (OIDC) logout flow.
-
-    Adds support for handling logout callbacks from the identity provider (OP)
-    by initiating the logout flow if the user has an active session.
-
-    The Django session is retained during the logout process to persist the 'state' OIDC parameter.
-    This parameter is crucial for maintaining the integrity of the logout flow between this call
-    and the subsequent callback.
-    """
-
-    @staticmethod
-    def persist_state(request, state):
-        """Persist the given 'state' parameter in the session's 'oidc_states' dictionary
-
-        This method is used to store the OIDC state parameter in the session, according to the
-        structure expected by Mozilla Django OIDC's 'add_state_and_verifier_and_nonce_to_session'
-        utility function.
-        """
-
-        if "oidc_states" not in request.session or not isinstance(
-            request.session["oidc_states"], dict
-        ):
-            request.session["oidc_states"] = {}
-
-        request.session["oidc_states"][state] = {}
-        request.session.save()
-
-    def construct_oidc_logout_url(self, request):
-        """Create the redirect URL for interfacing with the OIDC provider.
-
-        Retrieves the necessary parameters from the session and constructs the URL
-        required to initiate logout with the OpenID Connect provider.
-
-        If no ID token is found in the session, the logout flow will not be initiated,
-        and the method will return the default redirect URL.
-
-        The 'state' parameter is generated randomly and persisted in the session to ensure
-        its integrity during the subsequent callback.
-        """
-
-        oidc_logout_endpoint = self.get_settings("OIDC_OP_LOGOUT_ENDPOINT")
-
-        if not oidc_logout_endpoint:
-            return self.redirect_url
-
-        reverse_url = reverse("oidc_logout_callback")
-        id_token = request.session.get("oidc_id_token", None)
-
-        if not id_token:
-            return self.redirect_url
-
-        query = {
-            "id_token_hint": id_token,
-            "state": crypto.get_random_string(self.get_settings("OIDC_STATE_SIZE", 32)),
-            "post_logout_redirect_uri": absolutify(request, reverse_url),
-        }
-
-        self.persist_state(request, query["state"])
-
-        return f"{oidc_logout_endpoint}?{urlencode(query)}"
-
-    def post(self, request):
-        """Handle user logout.
-
-        If the user is not authenticated, redirects to the default logout URL.
-        Otherwise, constructs the OIDC logout URL and redirects the user to start
-        the logout process.
-
-        If the user is redirected to the default logout URL, ensure her Django session
-        is terminated.
-        """
-
-        logout_url = self.redirect_url
-
-        if request.user.is_authenticated:
-            logout_url = self.construct_oidc_logout_url(request)
-
-        # If the user is not redirected to the OIDC provider, ensure logout
-        if logout_url == self.redirect_url:
-            auth.logout(request)
-
-        return HttpResponseRedirect(logout_url)
-
-
-class OIDCLogoutCallbackView(MozillaOIDCOIDCLogoutView):
-    """Custom view for handling the logout callback from the OpenID Connect (OIDC) provider.
-
-    Handles the callback after logout from the identity provider (OP).
-    Verifies the state parameter and performs necessary logout actions.
-
-    The Django session is maintained during the logout process to ensure the integrity
-    of the logout flow initiated in the previous step.
-    """
-
-    http_method_names = ["get"]
-
-    def get(self, request):
-        """Handle the logout callback.
-
-        If the user is not authenticated, redirects to the default logout URL.
-        Otherwise, verifies the state parameter and performs necessary logout actions.
-        """
-
-        if not request.user.is_authenticated:
-            return HttpResponseRedirect(self.redirect_url)
-
-        state = request.GET.get("state")
-
-        if state not in request.session.get("oidc_states", {}):
-            msg = "OIDC callback state not found in session `oidc_states`!"
-            raise SuspiciousOperation(msg)
-
-        del request.session["oidc_states"][state]
-        request.session.save()
-
-        auth.logout(request)
-
-        return HttpResponseRedirect(self.redirect_url)
@@ -3,7 +3,6 @@ Core application enums declaration
 """

 from django.conf import global_settings, settings
-from django.db import models
 from django.utils.translation import gettext_lazy as _

 # Django sets `LANGUAGES` by default with all supported languages. We can use it for
@@ -15,11 +14,3 @@ ALL_LANGUAGES = getattr(
    "ALL_LANGUAGES",
    [(language, _(name)) for language, name in global_settings.LANGUAGES],
 )
-
-
-class WebhookStatusChoices(models.TextChoices):
-    """Defines the possible statuses in which a webhook can be."""
-
-    FAILURE = "failure", _("Failure")
-    PENDING = "pending", _("Pending")
-    SUCCESS = "success", _("Success")
@@ -120,13 +120,13 @@ class ContactFactory(BaseContactFactory):


 class UserFactory(factory.django.DjangoModelFactory):
-    """A factory to create random users for testing purposes."""
+    """A factory to random users for testing purposes."""

    class Meta:
        model = models.User
-        django_get_or_create = ("admin_email",)
+        django_get_or_create = ("email",)

-    admin_email = factory.Faker("email")
+    email = factory.Faker("email")
    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
    password = make_password("password")

@@ -177,16 +177,6 @@ class TeamAccessFactory(factory.django.DjangoModelFactory):
    role = factory.fuzzy.FuzzyChoice([r[0] for r in models.RoleChoices.choices])


-class TeamWebhookFactory(factory.django.DjangoModelFactory):
-    """Create fake team webhooks for testing."""
-
-    class Meta:
-        model = models.TeamWebhook
-
-    team = factory.SubFactory(TeamFactory)
-    url = factory.Sequence(lambda n: f"https://example.com/Groups/{n!s}")
-
-
 class InvitationFactory(factory.django.DjangoModelFactory):
    """A factory to create invitations for a user"""

@@ -1,4 +1,4 @@
-# Generated by Django 5.0.3 on 2024-03-25 22:58
+# Generated by Django 5.0.2 on 2024-03-05 17:09

 import django.contrib.auth.models
 import django.core.validators
@@ -45,7 +45,7 @@ class Migration(migrations.Migration):
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('admin_email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='admin email address')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, unique=True, verbose_name='email address')),
                ('language', models.CharField(choices="(('en-us', 'English'), ('fr-fr', 'French'))", default='en-us', help_text='The language in which the user wants to see the interface.', max_length=10, verbose_name='language')),
                ('timezone', timezone_field.fields.TimeZoneField(choices_display='WITH_GMT_OFFSET', default='UTC', help_text='The timezone in which the user wants to see times.', use_pytz=False)),
                ('is_device', models.BooleanField(default=False, help_text='Whether the user is a device or a real user.', verbose_name='device')),
@@ -144,23 +144,6 @@ class Migration(migrations.Migration):
            name='users',
            field=models.ManyToManyField(related_name='teams', through='core.TeamAccess', to=settings.AUTH_USER_MODEL),
        ),
-        migrations.CreateModel(
-            name='TeamWebhook',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('url', models.URLField(verbose_name='url')),
-                ('secret', models.CharField(blank=True, max_length=255, null=True, verbose_name='secret')),
-                ('status', models.CharField(choices=[('failure', 'Failure'), ('pending', 'Pending'), ('success', 'Success')], default='pending', max_length=10)),
-                ('team', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webhooks', to='core.team')),
-            ],
-            options={
-                'verbose_name': 'Team webhook',
-                'verbose_name_plural': 'Team webhooks',
-                'db_table': 'people_team_webhook',
-            },
-        ),
        migrations.AddConstraint(
            model_name='contact',
            constraint=models.CheckConstraint(check=models.Q(('base__isnull', False), ('owner__isnull', True), _negated=True), name='base_owner_constraint', violation_error_message='A contact overriding a base contact must be owned.'),
@@ -12,9 +12,8 @@ from logging import getLogger
 from django.conf import settings
 from django.contrib.auth import models as auth_models
 from django.contrib.auth.base_user import AbstractBaseUser
-from django.contrib.sites.models import Site
 from django.core import exceptions, mail, validators
-from django.db import models, transaction
+from django.db import models
 from django.template.loader import render_to_string
 from django.utils import timezone
 from django.utils.functional import lazy
@@ -25,9 +24,6 @@ from django.utils.translation import override
 import jsonschema
 from timezone_field import TimeZoneField

-from core.enums import WebhookStatusChoices
-from core.utils.webhooks import scim_synchronizer
-
 logger = getLogger(__name__)

 current_dir = os.path.dirname(os.path.abspath(__file__))
@@ -78,7 +74,7 @@ class BaseModel(models.Model):
    def save(self, *args, **kwargs):
        """Call `full_clean` before saving."""
        self.full_clean()
-        return super().save(*args, **kwargs)
+        super().save(*args, **kwargs)


 class Contact(BaseModel):
@@ -161,9 +157,7 @@ class Contact(BaseModel):
 class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
    """User model to work with OIDC only authentication."""

-    admin_email = models.EmailField(
-        _("admin email address"), unique=True, null=True, blank=True
-    )
+    email = models.EmailField(_("email address"), unique=True, null=True, blank=True)
    profile_contact = models.OneToOneField(
        Contact,
        on_delete=models.SET_NULL,
@@ -205,7 +199,7 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):

    objects = auth_models.UserManager()

-    USERNAME_FIELD = "admin_email"
+    USERNAME_FIELD = "email"
    REQUIRED_FIELDS = []

    class Meta:
@@ -217,32 +211,9 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):
        return (
            str(self.profile_contact)
            if self.profile_contact
-            else self.admin_email or str(self.id)
+            else self.email or str(self.id)
        )

-    def _get_identities_main(self):
-        """Return a list with the main identity or an empty list."""
-        try:
-            return self._identities_main
-        except AttributeError:
-            return self.identities.filter(is_main=True)
-
-    @property
-    def name(self):
-        """Return main identity's name."""
-        try:
-            return self._get_identities_main()[0].name
-        except IndexError:
-            return None
-
-    @property
-    def email(self):
-        """Return main identity's email."""
-        try:
-            return self._get_identities_main()[0].email
-        except IndexError:
-            return None
-
    def clean(self):
        """Validate fields."""
        super().clean()
@@ -254,10 +225,8 @@ class User(AbstractBaseUser, BaseModel, auth_models.PermissionsMixin):

    def email_user(self, subject, message, from_email=None, **kwargs):
        """Email this user."""
-        email = self.email or self.admin_email
-        if not email:
-            raise ValueError("You must first set an email for the user.")
-        mail.send_mail(subject, message, from_email, [email], **kwargs)
+        main_identity = self.identities.get(is_main=True)
+        mail.send_mail(subject, message, from_email, [main_identity.email], **kwargs)

    @classmethod
    def get_email_field_name(cls):
@@ -399,7 +368,7 @@ class Team(BaseModel):
        return self.name

    def save(self, *args, **kwargs):
-        """Override save function to compute the slug."""
+        """Overriding save function to compute the slug."""
        self.slug = self.get_slug()
        return super().save(*args, **kwargs)

@@ -466,34 +435,6 @@ class TeamAccess(BaseModel):
    def __str__(self):
        return f"{self.user!s} is {self.role:s} in team {self.team!s}"

-    def save(self, *args, **kwargs):
-        """
-        Override save function to fire webhooks on any addition or update
-        to a team access.
-        """
-
-        if self._state.adding:
-            self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
-            with transaction.atomic():
-                instance = super().save(*args, **kwargs)
-                scim_synchronizer.add_user_to_group(self.team, self.user)
-        else:
-            instance = super().save(*args, **kwargs)
-
-        return instance
-
-    def delete(self, *args, **kwargs):
-        """
-        Override delete method to fire webhooks on  to team accesses.
-        Don't allow deleting a team access until it is successfully synchronized with all
-        its webhooks.
-        """
-        self.team.webhooks.update(status=WebhookStatusChoices.PENDING)
-        with transaction.atomic():
-            arguments = self.team, self.user
-            super().delete(*args, **kwargs)
-            scim_synchronizer.remove_user_from_group(*arguments)
-
    def get_abilities(self, user):
        """
        Compute and return abilities for a given user taking into account
@@ -544,34 +485,6 @@ class TeamAccess(BaseModel):
        }


-class TeamWebhook(BaseModel):
-    """Webhooks fired on changes in teams."""
-
-    team = models.ForeignKey(Team, related_name="webhooks", on_delete=models.CASCADE)
-    url = models.URLField(_("url"))
-    secret = models.CharField(_("secret"), max_length=255, null=True, blank=True)
-    status = models.CharField(
-        max_length=10,
-        default=WebhookStatusChoices.PENDING,
-        choices=WebhookStatusChoices.choices,
-    )
-
-    class Meta:
-        db_table = "people_team_webhook"
-        verbose_name = _("Team webhook")
-        verbose_name_plural = _("Team webhooks")
-
-    def __str__(self):
-        return f"Webhook to {self.url} for {self.team}"
-
-    def get_headers(self):
-        """Build header dict from webhook object."""
-        headers = {"Content-Type": "application/json"}
-        if self.secret:
-            headers["Authorization"] = f"Bearer {self.secret:s}"
-        return headers
-
-
 class Invitation(BaseModel):
    """User invitation to teams."""

@@ -661,7 +574,6 @@ class Invitation(BaseModel):
            with override(self.issuer.language):
                template_vars = {
                    "title": _("Invitation to join Desk!"),
-                    "site": Site.objects.get_current(),
                }
                msg_html = render_to_string("mail/html/invitation.html", template_vars)
                msg_plain = render_to_string("mail/text/invitation.txt", template_vars)
@@ -1,10 +0,0 @@
-"""Unit tests for the Authentication URLs."""
-
-from core.authentication.urls import urlpatterns
-
-
-def test_urls_override_default_mozilla_django_oidc():
-    """Custom URL patterns should override default ones from Mozilla Django OIDC."""
-
-    url_names = [u.name for u in urlpatterns]
-    assert url_names.index("oidc_logout_custom") < url_names.index("oidc_logout")
@@ -1,238 +0,0 @@
-"""Unit tests for the Authentication Views."""
-
-from unittest import mock
-from urllib.parse import parse_qs, urlparse
-
-from django.contrib.auth.models import AnonymousUser
-from django.contrib.sessions.middleware import SessionMiddleware
-from django.core.exceptions import SuspiciousOperation
-from django.test import RequestFactory
-from django.test.utils import override_settings
-from django.urls import reverse
-from django.utils import crypto
-
-import pytest
-from rest_framework.test import APIClient
-
-from core import factories
-from core.authentication.views import OIDCLogoutCallbackView, OIDCLogoutView
-
-pytestmark = pytest.mark.django_db
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_anonymous():
-    """Anonymous users calling the logout url,
-    should be redirected to the specified LOGOUT_REDIRECT_URL."""
-
-    url = reverse("oidc_logout_custom")
-    response = APIClient().get(url)
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@mock.patch.object(
-    OIDCLogoutView, "construct_oidc_logout_url", return_value="/example-logout"
-)
-def test_view_logout(mocked_oidc_logout_url):
-    """Authenticated users should be redirected to OIDC provider for logout."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    client = APIClient()
-    client.force_login(user)
-
-    url = reverse("oidc_logout_custom")
-    response = client.get(url)
-
-    mocked_oidc_logout_url.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/default-redirect-logout")
-@mock.patch.object(
-    OIDCLogoutView, "construct_oidc_logout_url", return_value="/default-redirect-logout"
-)
-def test_view_logout_no_oidc_provider(mocked_oidc_logout_url):
-    """Authenticated users should be logged out when no OIDC provider is available."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    client = APIClient()
-    client.force_login(user)
-
-    url = reverse("oidc_logout_custom")
-
-    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
-        response = client.get(url)
-        mocked_oidc_logout_url.assert_called_once()
-        mock_logout.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/default-redirect-logout"
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_callback_anonymous():
-    """Anonymous users calling the logout callback url,
-    should be redirected to the specified LOGOUT_REDIRECT_URL."""
-
-    url = reverse("oidc_logout_callback")
-    response = APIClient().get(url)
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
-
-
-@pytest.mark.parametrize(
-    "initial_oidc_states",
-    [{}, {"other_state": "foo"}],
-)
-def test_view_logout_persist_state(initial_oidc_states):
-    """State value should be persisted in session's data."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    if initial_oidc_states:
-        request.session["oidc_states"] = initial_oidc_states
-        request.session.save()
-
-    mocked_state = "mock_state"
-
-    OIDCLogoutView().persist_state(request, mocked_state)
-
-    assert "oidc_states" in request.session
-    assert request.session["oidc_states"] == {
-        "mock_state": {},
-        **initial_oidc_states,
-    }
-
-
-@override_settings(OIDC_OP_LOGOUT_ENDPOINT="/example-logout")
-@mock.patch.object(OIDCLogoutView, "persist_state")
-@mock.patch.object(crypto, "get_random_string", return_value="mocked_state")
-def test_view_logout_construct_oidc_logout_url(
-    mocked_get_random_string, mocked_persist_state
-):
-    """Should construct the logout URL to initiate the logout flow with the OIDC provider."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    request.session["oidc_id_token"] = "mocked_oidc_id_token"
-    request.session.save()
-
-    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
-
-    mocked_persist_state.assert_called_once()
-    mocked_get_random_string.assert_called_once()
-
-    params = parse_qs(urlparse(redirect_url).query)
-
-    assert params["id_token_hint"][0] == "mocked_oidc_id_token"
-    assert params["state"][0] == "mocked_state"
-
-    url = reverse("oidc_logout_callback")
-    assert url in params["post_logout_redirect_uri"][0]
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/")
-def test_view_logout_construct_oidc_logout_url_none_id_token():
-    """If no ID token is available in the session,
-    the user should be redirected to the final URL."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    redirect_url = OIDCLogoutView().construct_oidc_logout_url(request)
-
-    assert redirect_url == "/"
-
-
-@pytest.mark.parametrize(
-    "initial_state",
-    [None, {"other_state": "foo"}],
-)
-def test_view_logout_callback_wrong_state(initial_state):
-    """Should raise an error if OIDC state doesn't match session data."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    request = RequestFactory().request()
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    if initial_state:
-        request.session["oidc_states"] = initial_state
-        request.session.save()
-
-    callback_view = OIDCLogoutCallbackView.as_view()
-
-    with pytest.raises(SuspiciousOperation) as excinfo:
-        callback_view(request)
-
-    assert (
-        str(excinfo.value) == "OIDC callback state not found in session `oidc_states`!"
-    )
-
-
-@override_settings(LOGOUT_REDIRECT_URL="/example-logout")
-def test_view_logout_callback():
-    """If state matches, callback should clear OIDC state and redirects."""
-
-    identity = factories.IdentityFactory()
-    user = identity.user
-
-    request = RequestFactory().get("/logout-callback/", data={"state": "mocked_state"})
-    request.user = user
-
-    middleware = SessionMiddleware(get_response=lambda x: x)
-    middleware.process_request(request)
-
-    mocked_state = "mocked_state"
-
-    request.session["oidc_states"] = {mocked_state: {}}
-    request.session.save()
-
-    callback_view = OIDCLogoutCallbackView.as_view()
-
-    with mock.patch("mozilla_django_oidc.views.auth.logout") as mock_logout:
-
-        def clear_user(request):
-            # Assert state is cleared prior to logout
-            assert request.session["oidc_states"] == {}
-            request.user = AnonymousUser()
-
-        mock_logout.side_effect = clear_user
-        response = callback_view(request)
-        mock_logout.assert_called_once()
-
-    assert response.status_code == 302
-    assert response.url == "/example-logout"
@@ -2,12 +2,9 @@
 Test for team accesses API endpoints in People's core app : create
 """

-import json
 import random
-import re

 import pytest
-import responses
 from rest_framework.test import APIClient

 from core import factories, models
@@ -177,60 +174,3 @@ def test_api_team_accesses_create_authenticated_owner():
        "role": role,
        "user": str(other_user.id),
    }
-
-
-def test_api_team_accesses_create_webhook():
-    """
-    When the team has a webhook, creating a team access should fire a call.
-    """
-    user, other_user = factories.UserFactory.create_batch(2)
-
-    team = factories.TeamFactory(users=[(user, "owner")])
-    webhook = factories.TeamWebhookFactory(team=team)
-
-    role = random.choice([role[0] for role in models.RoleChoices.choices])
-
-    client = APIClient()
-    client.force_login(user)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsp = rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        response = client.post(
-            f"/api/v1.0/teams/{team.id!s}/accesses/",
-            {
-                "user": str(other_user.id),
-                "role": role,
-            },
-            format="json",
-        )
-        assert response.status_code == 201
-
-        assert rsp.call_count == 1
-        assert rsps.calls[0].request.url == webhook.url
-
-        # Payload sent to scim provider
-        payload = json.loads(rsps.calls[0].request.body)
-        assert payload == {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "add",
-                    "path": "members",
-                    "value": [
-                        {
-                            "value": str(other_user.id),
-                            "email": None,
-                            "type": "User",
-                        }
-                    ],
-                }
-            ],
-        }
@@ -2,12 +2,9 @@
 Test for team accesses API endpoints in People's core app : delete
 """

-import json
 import random
-import re

 import pytest
-import responses
 from rest_framework.test import APIClient

 from core import factories, models
@@ -151,77 +148,18 @@ def test_api_team_accesses_delete_owners_last_owner():
    """
    It should not be possible to delete the last owner access from a team
    """
-    user = factories.UserFactory()
+    identity = factories.IdentityFactory()
+    user = identity.user

    team = factories.TeamFactory()
    access = factories.TeamAccessFactory(team=team, user=user, role="owner")
-    assert models.TeamAccess.objects.count() == 1

+    assert models.TeamAccess.objects.count() == 1
    client = APIClient()
    client.force_login(user)
-
    response = client.delete(
        f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
    )

    assert response.status_code == 403
    assert models.TeamAccess.objects.count() == 1
-
-
-def test_api_team_accesses_delete_webhook():
-    """
-    When the team has a webhook, deleting a team access should fire a call.
-    """
-    user = factories.UserFactory()
-
-    team = factories.TeamFactory(users=[(user, "administrator")])
-    webhook = factories.TeamWebhookFactory(team=team)
-    access = factories.TeamAccessFactory(
-        team=team, role=random.choice(["member", "administrator"])
-    )
-
-    assert models.TeamAccess.objects.count() == 2
-    assert models.TeamAccess.objects.filter(user=access.user).exists()
-
-    client = APIClient()
-    client.force_login(user)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsp = rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        response = client.delete(
-            f"/api/v1.0/teams/{team.id!s}/accesses/{access.id!s}/",
-        )
-        assert response.status_code == 204
-
-        assert rsp.call_count == 1
-        assert rsps.calls[0].request.url == webhook.url
-
-        # Payload sent to scim provider
-        payload = json.loads(rsps.calls[0].request.body)
-        assert payload == {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "remove",
-                    "path": "members",
-                    "value": [
-                        {
-                            "value": str(access.user.id),
-                            "email": None,
-                            "type": "User",
-                        }
-                    ],
-                }
-            ],
-        }
-
-    assert models.TeamAccess.objects.count() == 1
-    assert models.TeamAccess.objects.filter(user=access.user).exists() is False
@@ -266,15 +266,11 @@ def test_api_team_accesses_list_authenticated_ordering_user(ordering_fields):
    assert response.status_code == HTTP_200_OK
    assert response.json()["count"] == 21

-    def normalize(x):
-        """Mimic Django order_by, which is case-insensitive and space-insensitive"""
-        return x.casefold().replace(" ", "")
-
    results = [
        team_access["user"][ordering_fields]
        for team_access in response.json()["results"]
    ]
-    assert sorted(results, key=normalize) == results
+    assert sorted(results) == results

    response = client.get(
        f"/api/v1.0/teams/{team.id!s}/accesses/?ordering=-{ordering_fields}",
@@ -286,4 +282,4 @@ def test_api_team_accesses_list_authenticated_ordering_user(ordering_fields):
        team_access["user"][ordering_fields]
        for team_access in response.json()["results"]
    ]
-    assert sorted(results, reverse=True, key=normalize) == results
+    assert sorted(results, reverse=True) == results
@@ -3,7 +3,7 @@ Tests for Teams API endpoint in People's core app: retrieve
 """

 import pytest
-from rest_framework import status
+from rest_framework.status import HTTP_200_OK, HTTP_401_UNAUTHORIZED, HTTP_404_NOT_FOUND
 from rest_framework.test import APIClient

 from core import factories
@@ -16,7 +16,7 @@ def test_api_teams_retrieve_anonymous():
    team = factories.TeamFactory()
    response = APIClient().get(f"/api/v1.0/teams/{team.id}/")

-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert response.status_code == HTTP_401_UNAUTHORIZED
    assert response.json() == {
        "detail": "Authentication credentials were not provided."
    }
@@ -37,7 +37,7 @@ def test_api_teams_retrieve_authenticated_unrelated():
    response = client.get(
        f"/api/v1.0/teams/{team.id!s}/",
    )
-    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert response.status_code == HTTP_404_NOT_FOUND
    assert response.json() == {"detail": "No Team matches the given query."}


@@ -60,7 +60,7 @@ def test_api_teams_retrieve_authenticated_related():
        f"/api/v1.0/teams/{team.id!s}/",
    )

-    assert response.status_code == status.HTTP_200_OK
+    assert response.status_code == HTTP_200_OK
    assert sorted(response.json().pop("accesses")) == sorted(
        [
            str(access1.id),
@@ -349,8 +349,6 @@ def test_api_team_invitations__update__forbidden(method):

    client = APIClient()
    client.force_login(user)
-
-    response = None
    if method == "put":
        response = client.put(
            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
@@ -359,7 +357,6 @@ def test_api_team_invitations__update__forbidden(method):
        response = client.patch(
            f"/api/v1.0/teams/{invitation.team.id}/invitations/{invitation.id}/",
        )
-    assert response is not None
    assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
    assert response.json()["detail"] == f'Method "{method.upper()}" not allowed.'

@@ -53,8 +53,8 @@ def test_api_users_authenticated_list_by_email():
    Authenticated users should be able to search users with a case-insensitive and
    partial query on the email.
    """
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="john doe")

    client = APIClient()
    client.force_login(user)
@@ -125,8 +125,8 @@ def test_api_users_authenticated_list_by_name():
    Authenticated users should be able to search users with a case-insensitive and
    partial query on the name.
    """
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="john doe")

    client = APIClient()
    client.force_login(user)
@@ -192,8 +192,8 @@ def test_api_users_authenticated_list_by_name_and_email():
    partial query on the name and email.
    """

-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="john doe")

    client = APIClient()
    client.force_login(user)
@@ -225,7 +225,7 @@ def test_api_users_authenticated_list_exclude_users_already_in_team(
    Authenticated users should be able to search users
    but the result should exclude all users already in the given team.
    """
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
+    user = factories.UserFactory(email="tester@ministry.fr")
    factories.IdentityFactory(user=user, email=user.email, name="john doe")
    client = APIClient()
    client.force_login(user)
@@ -280,8 +280,8 @@ def test_api_users_authenticated_list_multiple_identities_single_user():
    """
    User with multiple identities should appear only once in results.
    """
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="eva karl")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="eva karl")

    client = APIClient()
    client.force_login(user)
@@ -308,8 +308,8 @@ def test_api_users_authenticated_list_multiple_identities_multiple_users():
    User with multiple identities should be ranked
    on their best matching identity.
    """
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="john doe")

    client = APIClient()
    client.force_login(user)
@@ -368,8 +368,8 @@ def test_api_users_authenticated_list_multiple_identities_multiple_users():

 def test_api_users_authenticated_list_uppercase_content():
    """Upper case content should be found by lower case query."""
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="eva karl")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="eva karl")

    client = APIClient()
    client.force_login(user)
@@ -399,8 +399,8 @@ def test_api_users_authenticated_list_uppercase_content():

 def test_api_users_list_authenticated_capital_query():
    """Upper case query should find lower case content."""
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="eva karl")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="eva karl")

    client = APIClient()
    client.force_login(user)
@@ -428,8 +428,8 @@ def test_api_users_list_authenticated_capital_query():

 def test_api_contacts_list_authenticated_accented_query():
    """Accented content should be found by unaccented query."""
-    user = factories.UserFactory(admin_email="tester@ministry.fr")
-    factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
+    user = factories.UserFactory(email="tester@ministry.fr")
+    factories.IdentityFactory(user=user, email=user.email, name="john doe")

    client = APIClient()
    client.force_login(user)
@@ -510,7 +510,7 @@ def test_api_users_list_pagination_page_size(
    client.force_login(user)

    for i in range(page_size):
-        factories.UserFactory.create(admin_email=f"user-{i}@people.com")
+        factories.UserFactory.create(email=f"user-{i}@people.com")

    response = client.get(
        f"/api/v1.0/users/?page_size={page_size}",
@@ -535,7 +535,7 @@ def test_api_users_list_pagination_wrong_page_size(
    client.force_login(user)

    for i in range(page_size):
-        factories.UserFactory.create(admin_email=f"user-{i}@people.com")
+        factories.UserFactory.create(email=f"user-{i}@people.com")

    response = client.get(
        f"/api/v1.0/users/?page_size={page_size}",
@@ -1,11 +1,11 @@
-"""Unit tests for the Authentication Backends."""
+"""Unit tests for the `get_or_create_user` function."""

 from django.core.exceptions import SuspiciousOperation

 import pytest

 from core import models
-from core.authentication.backends import OIDCAuthenticationBackend
+from core.authentication import OIDCAuthenticationBackend
 from core.factories import IdentityFactory

 pytestmark = pytest.mark.django_db
@@ -95,7 +95,7 @@ def test_authentication_getter_existing_user_change_fields(
    klass = OIDCAuthenticationBackend()

    identity = IdentityFactory(name="John Doe", email="john.doe@example.com")
-    user_email = identity.user.admin_email
+    user_email = identity.user.email

    # Create multiple identities for a user
    for _ in range(5):
@@ -125,7 +125,7 @@ def test_authentication_getter_existing_user_change_fields(

    assert models.User.objects.count() == 1
    assert user == identity.user
-    assert user.admin_email == user_email
+    assert user.email == user_email


 def test_authentication_getter_new_user_no_email(monkeypatch):
@@ -148,7 +148,7 @@ def test_authentication_getter_new_user_no_email(monkeypatch):
    assert identity.sub == "123"
    assert identity.email is None

-    assert user.admin_email is None
+    assert user.email is None
    assert user.password == "!"
    assert models.User.objects.count() == 1

@@ -177,7 +177,7 @@ def test_authentication_getter_new_user_with_email(monkeypatch):
    assert identity.email == email
    assert identity.name == "John Doe"

-    assert user.admin_email is None
+    assert user.email is None
    assert models.User.objects.count() == 1


@@ -257,14 +257,13 @@ def test_models_team_invitations_email():
    assert len(mail.outbox) == 1

    # pylint: disable-next=no-member
-    email = mail.outbox[0]
+    (email,) = mail.outbox

    assert email.to == [invitation.email]
    assert email.subject == "Invitation to join Desk!"

    email_content = " ".join(email.body.split())
    assert "Invitation to join Desk!" in email_content
-    assert "[//example.com]" in email_content


@mock.patch(
@@ -2,16 +2,12 @@
 Unit tests for the TeamAccess model
 """

-import json
-import re
-
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ValidationError

 import pytest
-import responses

-from core import factories, models
+from core import factories

 pytestmark = pytest.mark.django_db

@@ -43,94 +39,6 @@ def test_models_team_accesses_unique():
        factories.TeamAccessFactory(user=access.user, team=access.team)


-def test_models_team_accesses_create_webhook():
-    """
-    When the team has a webhook, creating a team access should fire a call.
-    """
-    user = factories.UserFactory()
-    team = factories.TeamFactory()
-    webhook = factories.TeamWebhookFactory(team=team)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsp = rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        models.TeamAccess.objects.create(user=user, team=team)
-
-        assert rsp.call_count == 1
-        assert rsps.calls[0].request.url == webhook.url
-
-        # Payload sent to scim provider
-        payload = json.loads(rsps.calls[0].request.body)
-        assert payload == {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "add",
-                    "path": "members",
-                    "value": [
-                        {
-                            "value": str(user.id),
-                            "email": None,
-                            "type": "User",
-                        }
-                    ],
-                }
-            ],
-        }
-
-
-def test_models_team_accesses_delete_webhook():
-    """
-    When the team has a webhook, deleting a team access should fire a call.
-    """
-    team = factories.TeamFactory()
-    webhook = factories.TeamWebhookFactory(team=team)
-    access = factories.TeamAccessFactory(team=team)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsp = rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        access.delete()
-
-        assert rsp.call_count == 1
-        assert rsps.calls[0].request.url == webhook.url
-
-        # Payload sent to scim provider
-        payload = json.loads(rsps.calls[0].request.body)
-        assert payload == {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "remove",
-                    "path": "members",
-                    "value": [
-                        {
-                            "value": str(access.user.id),
-                            "email": None,
-                            "type": "User",
-                        }
-                    ],
-                }
-            ],
-        }
-
-    assert models.TeamAccess.objects.exists() is False
-
-
 # get_abilities


@@ -31,20 +31,20 @@ def test_models_users_id_unique():


 def test_models_users_email_unique():
-    """The "admin_email" field should be unique except for the null value."""
+    """The "email" field should be unique except for the null value."""
    user = factories.UserFactory()
    with pytest.raises(
-        ValidationError, match="User with this Admin email address already exists."
+        ValidationError, match="User with this Email address already exists."
    ):
-        models.User.objects.create(admin_email=user.admin_email, password="password")
+        models.User.objects.create(email=user.email)


 def test_models_users_email_several_null():
    """Several users with a null value for the "email" field can co-exist."""
-    factories.UserFactory(admin_email=None)
-    models.User.objects.create(admin_email=None, password="foo.")
+    factories.UserFactory(email=None)
+    models.User.objects.create(email=None, password="foo.")

-    assert models.User.objects.filter(admin_email__isnull=True).count() == 2
+    assert models.User.objects.filter(email__isnull=True).count() == 2


 def test_models_users_profile_not_owned():
@@ -91,26 +91,11 @@ def test_models_users_send_mail_main_existing():
    )


-def test_models_users_send_mail_main_admin():
-    """
-    The 'email_user' method should send mail to the user's admin email address if the
-    user has no related identities.
-    """
-    user = factories.UserFactory()
-
-    with mock.patch("django.core.mail.send_mail") as mock_send:
-        user.email_user("my subject", "my message")
-
-    mock_send.assert_called_once_with(
-        "my subject", "my message", None, [user.admin_email]
-    )
-
-
 def test_models_users_send_mail_main_missing():
    """The 'email_user' method should fail if the user has no email address."""
-    user = factories.UserFactory(admin_email=None)
+    user = factories.UserFactory()

-    with pytest.raises(ValueError) as excinfo:
+    with pytest.raises(models.Identity.DoesNotExist) as excinfo:
        user.email_user("my subject", "my message")

-    assert str(excinfo.value) == "You must first set an email for the user."
+    assert str(excinfo.value) == "Identity matching query does not exist."
@@ -1,341 +0,0 @@
-"""Test Team synchronization webhooks."""
-
-import json
-import random
-import re
-from logging import Logger
-from unittest import mock
-
-import pytest
-import responses
-
-from core import factories
-from core.utils.webhooks import scim_synchronizer
-
-pytestmark = pytest.mark.django_db
-
-
-def test_utils_webhooks_add_user_to_group_no_webhooks():
-    """If no webhook is declared on the team, the function should not make any request."""
-    access = factories.TeamAccessFactory()
-
-    with responses.RequestsMock():
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-
-    assert len(responses.calls) == 0
-
-
-@mock.patch.object(Logger, "info")
-def test_utils_webhooks_add_user_to_group_success(mock_info):
-    """The user passed to the function should get added."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-
-        for i, webhook in enumerate(webhooks):
-            assert rsps.calls[i].request.url == webhook.url
-
-            # Check headers
-            headers = rsps.calls[i].request.headers
-            assert "Authorization" not in headers
-            assert headers["Content-Type"] == "application/json"
-
-        # Payload sent to scim provider
-        for call in rsps.calls:
-            payload = json.loads(call.request.body)
-            assert payload == {
-                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-                "Operations": [
-                    {
-                        "op": "add",
-                        "path": "members",
-                        "value": [
-                            {
-                                "value": str(access.user.id),
-                                "email": identity.email,
-                                "type": "User",
-                            }
-                        ],
-                    }
-                ],
-            }
-
-    # Logger
-    assert mock_info.call_count == 2
-    for i, webhook in enumerate(webhooks):
-        assert mock_info.call_args_list[i][0] == (
-            "%s synchronization succeeded with %s",
-            "add_user_to_group",
-            webhook.url,
-        )
-
-    # Status
-    for webhook in webhooks:
-        webhook.refresh_from_db()
-        assert webhook.status == "success"
-
-
-@mock.patch.object(Logger, "info")
-def test_utils_webhooks_remove_user_from_group_success(mock_info):
-    """The user passed to the function should get removed."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        scim_synchronizer.remove_user_from_group(access.team, access.user)
-
-        for i, webhook in enumerate(webhooks):
-            assert rsps.calls[i].request.url == webhook.url
-
-        # Payload sent to scim provider
-        for call in rsps.calls:
-            payload = json.loads(call.request.body)
-            assert payload == {
-                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-                "Operations": [
-                    {
-                        "op": "remove",
-                        "path": "members",
-                        "value": [
-                            {
-                                "value": str(access.user.id),
-                                "email": identity.email,
-                                "type": "User",
-                            }
-                        ],
-                    }
-                ],
-            }
-
-    # Logger
-    assert mock_info.call_count == 2
-    for i, webhook in enumerate(webhooks):
-        assert mock_info.call_args_list[i][0] == (
-            "%s synchronization succeeded with %s",
-            "remove_user_from_group",
-            webhook.url,
-        )
-
-    # Status
-    for webhook in webhooks:
-        webhook.refresh_from_db()
-        assert webhook.status == "success"
-
-
-@mock.patch.object(Logger, "error")
-@mock.patch.object(Logger, "info")
-def test_utils_webhooks_add_user_to_group_failure(mock_info, mock_error):
-    """The logger should be called on webhook call failure."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhooks = factories.TeamWebhookFactory.create_batch(2, team=access.team)
-
-    with responses.RequestsMock() as rsps:
-        # Simulate webhook failure using "responses":
-        rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=random.choice([404, 301, 302]),
-            content_type="application/json",
-        )
-
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-
-        for i, webhook in enumerate(webhooks):
-            assert rsps.calls[i].request.url == webhook.url
-
-        # Payload sent to scim provider
-        for call in rsps.calls:
-            payload = json.loads(call.request.body)
-            assert payload == {
-                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-                "Operations": [
-                    {
-                        "op": "add",
-                        "path": "members",
-                        "value": [
-                            {
-                                "value": str(access.user.id),
-                                "email": identity.email,
-                                "type": "User",
-                            }
-                        ],
-                    }
-                ],
-            }
-
-    # Logger
-    assert not mock_info.called
-    assert mock_error.call_count == 2
-    for i, webhook in enumerate(webhooks):
-        assert mock_error.call_args_list[i][0] == (
-            "%s synchronization failed with %s",
-            "add_user_to_group",
-            webhook.url,
-        )
-
-    # Status
-    for webhook in webhooks:
-        webhook.refresh_from_db()
-        assert webhook.status == "failure"
-
-
-@mock.patch.object(Logger, "error")
-@mock.patch.object(Logger, "info")
-def test_utils_webhooks_add_user_to_group_retries(mock_info, mock_error):
-    """webhooks synchronization supports retries."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhook = factories.TeamWebhookFactory(team=access.team)
-
-    url = re.compile(r".*/Groups/.*")
-    with responses.RequestsMock() as rsps:
-        # Make webhook fail 3 times before succeeding using "responses"
-        all_rsps = [
-            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
-            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
-            rsps.add(rsps.PATCH, url, status=500, content_type="application/json"),
-            rsps.add(rsps.PATCH, url, status=200, content_type="application/json"),
-        ]
-
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-
-        for i in range(4):
-            assert all_rsps[i].call_count == 1
-            assert rsps.calls[i].request.url == webhook.url
-            payload = json.loads(rsps.calls[i].request.body)
-            assert payload == {
-                "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-                "Operations": [
-                    {
-                        "op": "add",
-                        "path": "members",
-                        "value": [
-                            {
-                                "value": str(access.user.id),
-                                "email": identity.email,
-                                "type": "User",
-                            }
-                        ],
-                    }
-                ],
-            }
-
-    # Logger
-    assert not mock_error.called
-    assert mock_info.call_count == 1
-    assert mock_info.call_args_list[0][0] == (
-        "%s synchronization succeeded with %s",
-        "add_user_to_group",
-        webhook.url,
-    )
-
-    # Status
-    webhook.refresh_from_db()
-    assert webhook.status == "success"
-
-
-@mock.patch.object(Logger, "error")
-@mock.patch.object(Logger, "info")
-def test_utils_synchronize_course_runs_max_retries_exceeded(mock_info, mock_error):
-    """Webhooks synchronization has exceeded max retries and should get logged."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhook = factories.TeamWebhookFactory(team=access.team)
-
-    with responses.RequestsMock() as rsps:
-        # Simulate webhook temporary failure using "responses":
-        rsp = rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=random.choice([500, 502]),
-            content_type="application/json",
-        )
-
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-
-        assert rsp.call_count == 5
-        assert rsps.calls[0].request.url == webhook.url
-        payload = json.loads(rsps.calls[0].request.body)
-        assert payload == {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "add",
-                    "path": "members",
-                    "value": [
-                        {
-                            "value": str(access.user.id),
-                            "email": identity.email,
-                            "type": "User",
-                        }
-                    ],
-                }
-            ],
-        }
-
-    # Logger
-    assert not mock_info.called
-    assert mock_error.call_count == 1
-    assert mock_error.call_args_list[0][0] == (
-        "%s synchronization failed due to max retries exceeded with url %s",
-        "add_user_to_group",
-        webhook.url,
-    )
-
-    # Status
-    webhook.refresh_from_db()
-    assert webhook.status == "failure"
-
-
-def test_utils_webhooks_add_user_to_group_authorization():
-    """Secret token should be passed in authorization header when set."""
-    identity = factories.IdentityFactory()
-    access = factories.TeamAccessFactory(user=identity.user)
-    webhook = factories.TeamWebhookFactory(team=access.team, secret="123")
-
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response by scim provider using "responses":
-        rsps.add(
-            rsps.PATCH,
-            re.compile(r".*/Groups/.*"),
-            body="{}",
-            status=200,
-            content_type="application/json",
-        )
-
-        scim_synchronizer.add_user_to_group(access.team, access.user)
-        assert rsps.calls[0].request.url == webhook.url
-
-        # Check headers
-        headers = rsps.calls[0].request.headers
-        assert headers["Authorization"] == "Bearer 123"
-        assert headers["Content-Type"] == "application/json"
-
-    # Status
-    webhook.refresh_from_db()
-    assert webhook.status == "success"
@@ -1,70 +0,0 @@
-"""A minimalist SCIM client to synchronize with remote service providers."""
-
-import logging
-
-import requests
-from urllib3.util import Retry
-
-logger = logging.getLogger(__name__)
-
-adapter = requests.adapters.HTTPAdapter(
-    max_retries=Retry(
-        total=4,
-        backoff_factor=0.1,
-        status_forcelist=[500, 502],
-        allowed_methods=["PATCH"],
-    )
-)
-
-session = requests.Session()
-session.mount("http://", adapter)
-session.mount("https://", adapter)
-
-
-class SCIMClient:
-    """A minimalist SCIM client for our needs."""
-
-    def add_user_to_group(self, webhook, user):
-        """Add a user to a group from its ID or email."""
-        payload = {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "add",
-                    "path": "members",
-                    "value": [
-                        {"value": str(user.id), "email": user.email, "type": "User"}
-                    ],
-                }
-            ],
-        }
-
-        return session.patch(
-            webhook.url,
-            json=payload,
-            headers=webhook.get_headers(),
-            verify=False,
-            timeout=3,
-        )
-
-    def remove_user_from_group(self, webhook, user):
-        """Remove a user from a group by its ID or email."""
-        payload = {
-            "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
-            "Operations": [
-                {
-                    "op": "remove",
-                    "path": "members",
-                    "value": [
-                        {"value": str(user.id), "email": user.email, "type": "User"}
-                    ],
-                }
-            ],
-        }
-        return session.patch(
-            webhook.url,
-            json=payload,
-            headers=webhook.get_headers(),
-            verify=False,
-            timeout=3,
-        )
@@ -1,75 +0,0 @@
-"""Fire webhooks with synchronous retries"""
-
-import logging
-
-import requests
-
-from core.enums import WebhookStatusChoices
-
-from .scim import SCIMClient
-
-logger = logging.getLogger(__name__)
-
-
-class WebhookSCIMClient:
-    """Wraps the SCIM client to record call results on webhooks."""
-
-    def __getattr__(self, name):
-        """Handle calls from webhooks to synchronize a team access with a distant application."""
-
-        def wrapper(team, user):
-            """
-            Wrap SCIMClient calls to handle retries, error handling and storing result in the
-            calling Webhook instance.
-            """
-            for webhook in team.webhooks.all():
-                if not webhook.url:
-                    continue
-
-                client = SCIMClient()
-                status = WebhookStatusChoices.FAILURE
-                try:
-                    response = getattr(client, name)(webhook, user)
-
-                except requests.exceptions.RetryError as exc:
-                    logger.error(
-                        "%s synchronization failed due to max retries exceeded with url %s",
-                        name,
-                        webhook.url,
-                        exc_info=exc,
-                    )
-                except requests.exceptions.RequestException as exc:
-                    logger.error(
-                        "%s synchronization failed with %s.",
-                        name,
-                        webhook.url,
-                        exc_info=exc,
-                    )
-                else:
-                    extra = {
-                        "response": response.content,
-                    }
-                    # pylint: disable=no-member
-                    if response.status_code == requests.codes.ok:
-                        logger.info(
-                            "%s synchronization succeeded with %s",
-                            name,
-                            webhook.url,
-                            extra=extra,
-                        )
-
-                        status = WebhookStatusChoices.SUCCESS
-                    else:
-                        logger.error(
-                            "%s synchronization failed with %s",
-                            name,
-                            webhook.url,
-                            extra=extra,
-                        )
-
-                webhook._meta.model.objects.filter(id=webhook.id).update(status=status)  # noqa
-
-        return wrapper
-
-
-scim_synchronizer = WebhookSCIMClient()
@@ -115,7 +115,7 @@ def create_demo(stdout):
        for i in range(defaults.NB_OBJECTS["users"]):
            queue.push(
                models.User(
-                    admin_email=f"user{i:d}@example.com",
+                    email=f"user{i:d}@example.com",
                    password="!",
                    is_superuser=False,
                    is_active=True,
@@ -126,12 +126,12 @@ def create_demo(stdout):
        queue.flush()

    with Timeit(stdout, "Creating identities"):
-        users_values = list(models.User.objects.values("id", "admin_email"))
+        users_values = list(models.User.objects.values("id", "email"))
        for user_dict in users_values:
            for i in range(
                random.choices(range(5), weights=[5, 50, 30, 10, 5], k=1)[0]
            ):
-                user_email = user_dict["admin_email"]
+                user_email = user_dict["email"]
                queue.push(
                    models.Identity(
                        user_id=user_dict["id"],
@@ -17,7 +17,7 @@ class Command(BaseCommand):
    def add_arguments(self, parser):
        """Define required arguments "email" and "password"."""
        parser.add_argument(
-            "--admin_email",
+            "--email",
            help=("Email for the user."),
        )
        parser.add_argument(
@@ -30,11 +30,11 @@ class Command(BaseCommand):
        Given an email and a password, create a superuser or upgrade the existing
        user to superuser status.
        """
-        email = options.get("admin_email")
+        email = options.get("email")
        try:
-            user = User.objects.get(admin_email=email)
+            user = User.objects.get(email=email)
        except User.DoesNotExist:
-            user = User(admin_email=email)
+            user = User(email=email)
            message = "Superuser created successfully."
        else:
            if user.is_superuser and user.is_staff:
@@ -31,14 +31,3 @@ def test_commands_create_demo():
    assert models.Identity.objects.exists()
    assert models.Team.objects.count() == 3
    assert models.TeamAccess.objects.count() >= 3
-
-
-def test_commands_createsuperuser():
-    """
-    The createsuperuser management command should create a user
-    with superuser permissions.
-    """
-
-    call_command("createsuperuser")
-
-    assert models.User.objects.count() == 1
@@ -1,33 +0,0 @@
-"""Admin classes and registrations for People's mailbox manager app."""
-
-from django.contrib import admin
-from django.utils.translation import gettext_lazy as _
-
-from mailbox_manager import models
-
-
-@admin.register(models.MailDomain)
-class MailDomainAdmin(admin.ModelAdmin):
-    """Mail domain admin interface declaration."""
-
-    list_display = (
-        "name",
-        "created_at",
-        "updated_at",
-    )
-    search_fields = ("name",)
-    readonly_fields = ["created_at"]
-
-
-@admin.register(models.MailDomainAccess)
-class MailDomainAccessAdmin(admin.ModelAdmin):
-    """Admin for mail domain accesses model."""
-
-    list_display = ("user", "domain")
-
-
-@admin.register(models.Mailbox)
-class MailboxAdmin(admin.ModelAdmin):
-    """Admin for mailbox model."""
-
-    list_display = ("__str__", "domain")
@@ -1,12 +0,0 @@
-"""Permission handlers for the People mailbox manager app."""
-
-from core.api import permissions as core_permissions
-
-
-class AccessPermission(core_permissions.IsAuthenticated):
-    """Permission class for access objects."""
-
-    def has_object_permission(self, request, view, obj):
-        """Check permission for a given object."""
-        abilities = obj.get_abilities(request.user)
-        return abilities.get(request.method.lower(), False)
@@ -1,42 +0,0 @@
-"""Client serializers for People's mailbox manager app."""
-
-from rest_framework import serializers
-
-from mailbox_manager import models
-
-
-class MailboxSerializer(serializers.ModelSerializer):
-    """Serialize mailbox."""
-
-    class Meta:
-        model = models.Mailbox
-        fields = ["id", "local_part", "secondary_email"]
-
-
-class MailDomainSerializer(serializers.ModelSerializer):
-    """Serialize mail domain."""
-
-    class Meta:
-        model = models.MailDomain
-        lookup_field = "slug"
-        fields = [
-            "id",
-            "name",
-            "created_at",
-            "updated_at",
-        ]
-
-
-class MailDomainAccessSerializer(serializers.ModelSerializer):
-    """Serialize mail domain accesses."""
-
-    class Meta:
-        model = models.MailDomainAccess
-        fields = [
-            "id",
-            "user",
-            "role",
-            "created_at",
-            "updated_at",
-        ]
-        read_only_fields = ["id"]
@@ -1,101 +0,0 @@
-"""API endpoints"""
-
-from rest_framework import filters, mixins, viewsets
-from rest_framework import permissions as drf_permissions
-
-from core import models as core_models
-
-from mailbox_manager import models
-from mailbox_manager.api import permissions, serializers
-
-
-# pylint: disable=too-many-ancestors
-class MailDomainViewSet(
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    MailDomain viewset.
-
-    GET /api/<version>/mail-domains/
-        Return a list of mail domains user has access to.
-
-    GET /api/<version>/mail-domains/<domain-slug>/
-        Return details for a mail domain user has access to.
-
-    POST /api/<version>/mail-domains/ with expected data:
-        - name: str
-        Return newly created domain
-
-    DELETE /api/<version>/mail-domains/<domain-slug>/
-        Delete targeted team access
-    """
-
-    permission_classes = [permissions.AccessPermission]
-    serializer_class = serializers.MailDomainSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at", "name"]
-    ordering = ["-created_at"]
-    lookup_field = "slug"
-    queryset = models.MailDomain.objects.all()
-
-    def get_queryset(self):
-        return self.queryset.filter(accesses__user=self.request.user)
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created mail domain."""
-
-        domain = serializer.save()
-        models.MailDomainAccess.objects.create(
-            user=self.request.user,
-            domain=domain,
-            role=core_models.RoleChoices.OWNER,
-        )
-
-
-# pylint: disable=too-many-ancestors
-class MailDomainAccessViewSet(
-    mixins.ListModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    MailDomainAccess viewset.
-    """
-
-    permission_classes = [drf_permissions.IsAuthenticated]
-    serializer_class = serializers.MailDomainAccessSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at", "user", "domain", "role"]
-    ordering = ["-created_at"]
-    queryset = models.MailDomainAccess.objects.all()
-
-
-class MailBoxViewSet(
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    viewsets.GenericViewSet,
-):
-    """MailBox ViewSet"""
-
-    permission_classes = [drf_permissions.IsAuthenticated]
-    serializer_class = serializers.MailboxSerializer
-    queryset = models.Mailbox.objects.all()
-
-    def get_queryset(self):
-        """Custom queryset to get mailboxes related to a mail domain."""
-        domain_slug = self.kwargs.get("domain_slug", "")
-        if domain_slug:
-            return self.queryset.filter(domain__slug=domain_slug)
-        return self.queryset
-
-    def perform_create(self, serializer):
-        """Create new mailbox."""
-        domain_slug = self.kwargs.get("domain_slug", "")
-        if domain_slug:
-            serializer.validated_data["domain"] = models.MailDomain.objects.get(
-                slug=domain_slug
-            )
-        super().perform_create(serializer)
@@ -1 +0,0 @@
-"""People additionnal application, to manage email adresses."""
@@ -1,67 +0,0 @@
-"""
-Mailbox manager application factories
-"""
-
-from django.utils.text import slugify
-
-import factory.fuzzy
-from faker import Faker
-
-from core import factories as core_factories
-from core import models as core_models
-
-from mailbox_manager import models
-
-fake = Faker()
-
-
-class MailDomainFactory(factory.django.DjangoModelFactory):
-    """A factory to create mail domain."""
-
-    class Meta:
-        model = models.MailDomain
-        django_get_or_create = ("name",)
-        skip_postgeneration_save = True
-
-    name = factory.Faker("domain_name")
-    slug = factory.LazyAttribute(lambda o: slugify(o.name))
-
-    @factory.post_generation
-    def users(self, create, extracted, **kwargs):
-        """Add users to domain from a given list of users with or without roles."""
-        if not create or not extracted:
-            return
-        for user_entry in extracted:
-            if isinstance(user_entry, core_models.User):
-                MailDomainAccessFactory(domain=self, user=user_entry)
-            else:
-                MailDomainAccessFactory(
-                    domain=self, user=user_entry[0], role=user_entry[1]
-                )
-
-
-class MailDomainAccessFactory(factory.django.DjangoModelFactory):
-    """A factory to create mail domain accesses."""
-
-    class Meta:
-        model = models.MailDomainAccess
-
-    user = factory.SubFactory(core_factories.UserFactory)
-    domain = factory.SubFactory(MailDomainFactory)
-    role = factory.fuzzy.FuzzyChoice([r[0] for r in core_models.RoleChoices.choices])
-
-
-class MailboxFactory(factory.django.DjangoModelFactory):
-    """A factory to create mailboxes for mail domain members."""
-
-    class Meta:
-        model = models.Mailbox
-
-    class Params:
-        """Parameters for fields."""
-
-        full_name = factory.Faker("name")
-
-    local_part = factory.LazyAttribute(lambda a: a.full_name.lower().replace(" ", "."))
-    domain = factory.SubFactory(MailDomainFactory)
-    secondary_email = factory.Faker("email")
@@ -1,67 +0,0 @@
-# Generated by Django 5.0.3 on 2024-04-16 12:51
-
-import django.core.validators
-import django.db.models.deletion
-import uuid
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    initial = True
-
-    dependencies = [
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name='MailDomain',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('name', models.CharField(max_length=150, unique=True, verbose_name='name')),
-            ],
-            options={
-                'verbose_name': 'Mail domain',
-                'verbose_name_plural': 'Mail domains',
-                'db_table': 'people_mail_domain',
-            },
-        ),
-        migrations.CreateModel(
-            name='Mailbox',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('local_part', models.CharField(max_length=150, validators=[django.core.validators.RegexValidator(regex='^[a-zA-Z0-9_.+-]+$')], verbose_name='local_part')),
-                ('secondary_email', models.EmailField(max_length=254, verbose_name='secondary email address')),
-                ('domain', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain', to='mailbox_manager.maildomain')),
-            ],
-            options={
-                'verbose_name': 'Mailbox',
-                'verbose_name_plural': 'Mailboxes',
-                'db_table': 'people_mail_box',
-                'unique_together': {('local_part', 'domain')},
-            },
-        ),
-        migrations.CreateModel(
-            name='MailDomainAccess',
-            fields=[
-                ('id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='primary key for the record as UUID', primary_key=True, serialize=False, verbose_name='id')),
-                ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
-                ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
-                ('role', models.CharField(choices=[('member', 'Member'), ('administrator', 'Administrator'), ('owner', 'Owner')], default='member', max_length=20)),
-                ('domain', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain_accesses', to='mailbox_manager.maildomain')),
-                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='mail_domain_accesses', to=settings.AUTH_USER_MODEL)),
-            ],
-            options={
-                'verbose_name': 'User/mail domain relation',
-                'verbose_name_plural': 'User/mail domain relations',
-                'db_table': 'people_mail_domain_accesses',
-                'unique_together': {('user', 'domain')},
-            },
-        ),
-    ]
@@ -1,19 +0,0 @@
-# Generated by Django 5.0.3 on 2024-04-17 11:58
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('mailbox_manager', '0001_initial'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='maildomainaccess',
-            name='domain',
-            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='accesses', to='mailbox_manager.maildomain'),
-        ),
-    ]
@@ -1,18 +0,0 @@
-# Generated by Django 5.0.6 on 2024-06-03 14:14
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('mailbox_manager', '0002_alter_maildomainaccess_domain'),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name='maildomain',
-            name='slug',
-            field=models.SlugField(blank=True, max_length=80),
-        ),
-    ]
@@ -1,23 +0,0 @@
-# Generated by Django 5.0.6 on 2024-06-03 14:14
-
-from django.db import migrations, models
-from django.utils.text import slugify
-
-
-def populate_slug(apps, schema_editor):
-    MailDomain = apps.get_model('mailbox_manager', 'MailDomain')
-    for mail_domain in MailDomain.objects.filter(slug=''):
-        mail_domain.slug = slugify(mail_domain.name)
-        mail_domain.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('mailbox_manager', '0003_maildomain_slug'),
-    ]
-
-    operations = [
-        migrations.RunPython(populate_slug, reverse_code=migrations.RunPython.noop),
-
-    ]
@@ -1,18 +0,0 @@
-# Generated by Django 5.0.6 on 2024-06-03 14:20
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('mailbox_manager', '0004_maildomain_fill_slug'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='maildomain',
-            name='slug',
-            field=models.SlugField(max_length=80, unique=True),
-        ),
-    ]
@@ -1,118 +0,0 @@
-"""
-Declare and configure the models for the People additional application : mailbox_manager
-"""
-
-from django.conf import settings
-from django.core import validators
-from django.db import models
-from django.utils.text import slugify
-from django.utils.translation import gettext_lazy as _
-
-from core.models import BaseModel, RoleChoices
-
-
-class MailDomain(BaseModel):
-    """Domain names from which we will create email addresses (mailboxes)."""
-
-    name = models.CharField(
-        _("name"), max_length=150, null=False, blank=False, unique=True
-    )
-    slug = models.SlugField(null=False, blank=False, unique=True, max_length=80)
-
-    class Meta:
-        db_table = "people_mail_domain"
-        verbose_name = _("Mail domain")
-        verbose_name_plural = _("Mail domains")
-
-    def __str__(self):
-        return self.name
-
-    def save(self, *args, **kwargs):
-        if not self.slug:
-            self.slug = slugify(self.name)
-        return super().save(*args, **kwargs)
-
-    def get_abilities(self, user):
-        """
-        Compute and return abilities for a given user on the domain.
-        """
-        is_owner_or_admin = False
-        role = None
-
-        if user.is_authenticated:
-            try:
-                role = self.accesses.filter(user=user).values("role")[0]["role"]
-            except (MailDomainAccess.DoesNotExist, IndexError):
-                role = None
-
-        is_owner_or_admin = role in [RoleChoices.OWNER, RoleChoices.ADMIN]
-
-        return {
-            "get": bool(role),
-            "patch": is_owner_or_admin,
-            "put": is_owner_or_admin,
-            "delete": role == RoleChoices.OWNER,
-            "manage_accesses": is_owner_or_admin,
-        }
-
-
-class MailDomainAccess(BaseModel):
-    """Allow to manage users' accesses to mail domains."""
-
-    user = models.ForeignKey(
-        settings.AUTH_USER_MODEL,
-        on_delete=models.CASCADE,
-        related_name="mail_domain_accesses",
-        null=False,
-        blank=False,
-    )
-    domain = models.ForeignKey(
-        MailDomain,
-        on_delete=models.CASCADE,
-        related_name="accesses",
-        null=False,
-        blank=False,
-    )
-    role = models.CharField(
-        max_length=20, choices=RoleChoices.choices, default=RoleChoices.MEMBER
-    )
-
-    class Meta:
-        db_table = "people_mail_domain_accesses"
-        verbose_name = _("User/mail domain relation")
-        verbose_name_plural = _("User/mail domain relations")
-        unique_together = ("user", "domain")
-
-    def __str__(self):
-        return f"Access of user {self.user} on domain {self.domain}."
-
-
-class Mailbox(BaseModel):
-    """Mailboxes for users from mail domain."""
-
-    local_part = models.CharField(
-        _("local_part"),
-        max_length=150,
-        null=False,
-        blank=False,
-        validators=[validators.RegexValidator(regex="^[a-zA-Z0-9_.+-]+$")],
-    )
-    domain = models.ForeignKey(
-        MailDomain,
-        on_delete=models.CASCADE,
-        related_name="mail_domain",
-        null=False,
-        blank=False,
-    )
-    secondary_email = models.EmailField(
-        _("secondary email address"), null=False, blank=False
-    )
-
-    class Meta:
-        db_table = "people_mail_box"
-        verbose_name = _("Mailbox")
-        verbose_name_plural = _("Mailboxes")
-        unique_together = ("local_part", "domain")
-
-    def __str__(self):
-        return f"{self.local_part!s}@{self.domain.name:s}"
@@ -1,73 +0,0 @@
-"""
-Tests for MailDomains API endpoint in People's app mailbox_manager. Focus on "create" action.
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mail_domains__create_anonymous():
-    """Anonymous users should not be allowed to create mail domains."""
-
-    response = APIClient().post(
-        "/api/v1.0/mail-domains/",
-        {
-            "name": "mydomain.com",
-        },
-    )
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert not models.MailDomain.objects.exists()
-
-
-def test_api_mail_domains__create_name_unique():
-    """
-    Creating domain should raise an error if already existing name.
-    """
-    factories.MailDomainFactory(name="existing_domain.com")
-    identity = core_factories.IdentityFactory()
-
-    client = APIClient()
-    client.force_login(identity.user)
-
-    response = client.post(
-        "/api/v1.0/mail-domains/",
-        {
-            "name": "existing_domain.com",
-        },
-    )
-
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert response.json()["name"] == ["Mail domain with this name already exists."]
-
-
-def test_api_mail_domains__create_authenticated():
-    """
-    Authenticated users should be able to create mail domains
-    and should automatically be added as owner of the newly created domain.
-    """
-
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-
-    client = APIClient()
-    client.force_login(identity.user)
-
-    response = client.post(
-        "/api/v1.0/mail-domains/",
-        {
-            "name": "mydomain.com",
-        },
-        format="json",
-    )
-
-    assert response.status_code == status.HTTP_201_CREATED
-    domain = models.MailDomain.objects.get()
-    assert domain.name == "mydomain.com"
-    assert domain.accesses.filter(role="owner", user=user).exists()
@@ -1,107 +0,0 @@
-"""
-Tests for MailDomains API endpoint, in People's mailbox manager app. Focus on "delete" action.
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mail_domains__delete_anonymous():
-    """Anonymous users should not be allowed to destroy a team."""
-    domain = factories.MailDomainFactory()
-
-    response = APIClient().delete(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert models.MailDomain.objects.count() == 1
-
-
-def test_api_mail_domains__delete_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to delete a domain to which they are not
-    related.
-    """
-    identity = core_factories.IdentityFactory()
-    domain = factories.MailDomainFactory()
-
-    client = APIClient()
-    client.force_login(identity.user)
-    response = client.delete(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "No MailDomain matches the given query."}
-    assert models.MailDomain.objects.count() == 1
-
-
-def test_api_mail_domains__delete_authenticated_member():
-    """
-    Authenticated users should not be allowed to delete a domain
-    to which they are only a member.
-    """
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-    domain = factories.MailDomainFactory(users=[(user, "member")])
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-    assert models.MailDomain.objects.count() == 1
-
-
-def test_api_mail_domains__delete_authenticated_administrator():
-    """
-    Authenticated users should not be allowed to delete a domain
-    for which they are administrator.
-    """
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-    domain = factories.MailDomainFactory(users=[(user, "administrator")])
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_403_FORBIDDEN
-    assert response.json() == {
-        "detail": "You do not have permission to perform this action."
-    }
-    assert models.MailDomain.objects.count() == 1
-
-
-def test_api_mail_domains__delete_authenticated_owner():
-    """
-    Authenticated users should be able to delete a domain
-    for which they are directly owner.
-    """
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-    domain = factories.MailDomainFactory(users=[(user, "owner")])
-
-    client = APIClient()
-    client.force_login(user)
-    response = client.delete(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_204_NO_CONTENT
-    assert models.MailDomain.objects.exists() is False
@@ -1,56 +0,0 @@
-"""
-Tests for MailDomains API endpoint in People's mailbox manager app. Focus on "list" action.
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mail_domains__list_anonymous():
-    """Anonymous users should not be allowed to list mail domains."""
-
-    factories.MailDomainFactory.create_batch(3)
-
-    response = APIClient().get("/api/v1.0/mail-domains/")
-
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_mail_domains__list_authenticated():
-    """
-    Authenticated users should be able to list domains
-    to which they have access.
-    """
-
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-
-    client = APIClient()
-    client.force_login(user)
-
-    expected_ids = {
-        str(access.domain.id)
-        for access in factories.MailDomainAccessFactory.create_batch(5, user=user)
-    }
-    factories.MailDomainFactory.create_batch(2)  # Other teams
-    factories.MailDomainAccessFactory.create_batch(2)  # Other teams and accesses
-
-    response = client.get(
-        "/api/v1.0/mail-domains/",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    results = response.json()["results"]
-    assert len(results) == 5
-    results_id = {result["id"] for result in results}
-    assert expected_ids == results_id
@@ -1,71 +0,0 @@
-"""
-Tests for MailDomains API endpoint in People's mailbox manager app. Focus on "retrieve" action.
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mail_domains__retrieve_anonymous():
-    """Anonymous users should not be allowed to retrieve a domain."""
-
-    domain = factories.MailDomainFactory()
-    response = APIClient().get(f"/api/v1.0/mail-domains/{domain.slug}/")
-
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_mail_domains__retrieve_authenticated_unrelated():
-    """
-    Authenticated users should not be allowed to retrieve a domain
-    to which they have access.
-    """
-    identity = core_factories.IdentityFactory()
-
-    client = APIClient()
-    client.force_login(identity.user)
-
-    domain = factories.MailDomainFactory()
-
-    response = client.get(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-    assert response.status_code == status.HTTP_404_NOT_FOUND
-    assert response.json() == {"detail": "No MailDomain matches the given query."}
-
-
-def test_api_mail_domains__retrieve_authenticated_related():
-    """
-    Authenticated users should be allowed to retrieve a domain
-    to which they have access.
-    """
-    identity = core_factories.IdentityFactory()
-    user = identity.user
-
-    client = APIClient()
-    client.force_login(user)
-
-    domain = factories.MailDomainFactory()
-    factories.MailDomainAccessFactory(domain=domain, user=user)
-
-    response = client.get(
-        f"/api/v1.0/mail-domains/{domain.slug}/",
-    )
-
-    assert response.status_code == status.HTTP_200_OK
-    assert response.json() == {
-        "id": str(domain.id),
-        "name": domain.name,
-        "created_at": domain.created_at.isoformat().replace("+00:00", "Z"),
-        "updated_at": domain.updated_at.isoformat().replace("+00:00", "Z"),
-    }
@@ -1,103 +0,0 @@
-"""
-Unit tests for the mailbox API
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories, models
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mailboxes__create_anonymous_forbidden():
-    """Anonymous users should not be able to create a new mailbox via the API."""
-    mail_domain = factories.MailDomainFactory()
-
-    response = APIClient().post(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/",
-        {
-            "first_name": "jean",
-            "last_name": "doe",
-            "local_part": "jean.doe",
-            "secondary_email": "jean.doe@gmail.com",
-            "phone_number": "+33150142700",
-        },
-    )
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert not models.Mailbox.objects.exists()
-
-
-def test_api_mailboxes__create_authenticated_missing_fields():
-    """
-    Authenticated users should not be able to create mailboxes
-    without local part or secondary mail.
-    """
-    user = core_factories.UserFactory(admin_email="tester@ministry.fr")
-    core_factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
-
-    client = APIClient()
-    client.force_login(user)
-
-    mail_domain = factories.MailDomainFactory()
-    response = client.post(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/",
-        {
-            "first_name": "jean",
-            "last_name": "doe",
-            "secondary_email": "jean.doe@gmail.com",
-            "phone_number": "+33150142700",
-        },
-        format="json",
-    )
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert models.Mailbox.objects.exists() is False
-    assert response.json() == {"local_part": ["This field is required."]}
-
-    response = client.post(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/",
-        {
-            "first_name": "jean",
-            "last_name": "doe",
-            "local_part": "jean.doe",
-            "phone_number": "+33150142700",
-        },
-        format="json",
-    )
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert models.Mailbox.objects.exists() is False
-    assert response.json() == {"secondary_email": ["This field is required."]}
-
-
-def test_api_mailboxes__create_authenticated_successful():
-    """Authenticated users should be able to create mailbox."""
-    user = core_factories.UserFactory(admin_email="tester@ministry.fr")
-    core_factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
-
-    client = APIClient()
-    client.force_login(user)
-
-    mail_domain = factories.MailDomainFactory(name="saint-jean.collectivite.fr")
-    response = client.post(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/",
-        {
-            "first_name": "jean",
-            "last_name": "doe",
-            "local_part": "jean.doe",
-            "secondary_email": "jean.doe@gmail.com",
-            "phone_number": "+33150142700",
-        },
-        format="json",
-    )
-    assert response.status_code == status.HTTP_201_CREATED
-    mailbox = models.Mailbox.objects.get()
-    assert mailbox.local_part == "jean.doe"
-    assert mailbox.secondary_email == "jean.doe@gmail.com"
-    assert response.json() == {
-        "id": str(mailbox.id),
-        "local_part": str(mailbox.local_part),
-        "secondary_email": str(mailbox.secondary_email),
-    }
@@ -1,53 +0,0 @@
-"""
-Unit tests for the mailbox API
-"""
-
-import pytest
-from rest_framework import status
-from rest_framework.test import APIClient
-
-from core import factories as core_factories
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-
-def test_api_mailboxes__list_anonymous():
-    """Anonymous users should not be allowed to list mailboxes."""
-    mail_domain = factories.MailDomainFactory()
-    factories.MailboxFactory.create_batch(2, domain=mail_domain)
-
-    response = APIClient().get(f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/")
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-    assert response.json() == {
-        "detail": "Authentication credentials were not provided."
-    }
-
-
-def test_api_mailboxes__list_authenticated_no_query():
-    """Authenticated users should be able to list mailboxes without applying a query."""
-    user = core_factories.UserFactory(admin_email="tester@ministry.fr")
-    core_factories.IdentityFactory(user=user, email=user.admin_email, name="john doe")
-
-    client = APIClient()
-    client.force_login(user)
-
-    mail_domain = factories.MailDomainFactory()
-    mailbox1 = factories.MailboxFactory(domain=mail_domain)
-    mailbox2 = factories.MailboxFactory(domain=mail_domain)
-
-    response = client.get(f"/api/v1.0/mail-domains/{mail_domain.slug}/mailboxes/")
-    assert response.status_code == status.HTTP_200_OK
-    assert response.json()["results"] == [
-        {
-            "id": str(mailbox1.id),
-            "local_part": str(mailbox1.local_part),
-            "secondary_email": str(mailbox1.secondary_email),
-        },
-        {
-            "id": str(mailbox2.id),
-            "local_part": str(mailbox2.local_part),
-            "secondary_email": str(mailbox2.secondary_email),
-        },
-    ]
@@ -1,91 +0,0 @@
-"""
-Unit tests for the mailbox model
-"""
-
-from django.core.exceptions import ValidationError
-
-import pytest
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-
-# LOCAL PART FIELD
-
-
-def test_models_mailboxes__local_part_cannot_be_empty():
-    """The "local_part" field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank"):
-        factories.MailboxFactory(local_part="")
-
-
-def test_models_mailboxes__local_part_cannot_be_null():
-    """The "local_part" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null"):
-        factories.MailboxFactory(local_part=None)
-
-
-def test_models_mailboxes__local_part_matches_expected_format():
-    """
-    The local part should contain alpha-numeric caracters
-    and a limited set of special caracters ("+", "-", ".", "_").
-    """
-    factories.MailboxFactory(local_part="Marie-Jose.Perec+JO_2024")
-
-    with pytest.raises(ValidationError, match="Enter a valid value"):
-        factories.MailboxFactory(local_part="mariejo@unnecessarydomain.com")
-
-    with pytest.raises(ValidationError, match="Enter a valid value"):
-        factories.MailboxFactory(local_part="!")
-
-
-def test_models_mailboxes__local_part_unique_per_domain():
-    """Local parts should be unique per domain."""
-
-    existing_mailbox = factories.MailboxFactory()
-
-    # same local part on another domain should not be a problem
-    factories.MailboxFactory(local_part=existing_mailbox.local_part)
-
-    # same local part on the same domain should not be possible
-    with pytest.raises(
-        ValidationError, match="Mailbox with this Local_part and Domain already exists."
-    ):
-        factories.MailboxFactory(
-            local_part=existing_mailbox.local_part, domain=existing_mailbox.domain
-        )
-
-
-# DOMAIN FIELD
-
-
-def test_models_mailboxes__domain_must_be_a_maildomain_instance():
-    """The "domain" field should be an instance of MailDomain."""
-    expected_error = '"Mailbox.domain" must be a "MailDomain" instance.'
-    with pytest.raises(ValueError, match=expected_error):
-        factories.MailboxFactory(domain="")
-
-    with pytest.raises(ValueError, match=expected_error):
-        factories.MailboxFactory(domain="domain-as-string.com")
-
-
-def test_models_mailboxes__domain_cannot_be_null():
-    """The "domain" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null"):
-        factories.MailboxFactory(domain=None)
-
-
-# SECONDARY_EMAIL FIELD
-
-
-def test_models_mailboxes__secondary_email_cannot_be_empty():
-    """The "secondary_email" field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank"):
-        factories.MailboxFactory(secondary_email="")
-
-
-def test_models_mailboxes__secondary_email_cannot_be_null():
-    """The "secondary_email" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null"):
-        factories.MailboxFactory(secondary_email=None)
@@ -1,26 +0,0 @@
-"""
-Unit tests for the MailDomain model
-"""
-
-from django.core.exceptions import ValidationError
-
-import pytest
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-
-# NAME FIELD
-
-
-def test_models_mail_domain__domain_name_should_not_be_empty():
-    """The domain name field should not be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank"):
-        factories.MailDomainFactory(name="")
-
-
-def test_models_mail_domain__domain_name_should_not_be_null():
-    """The domain name field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        factories.MailDomainFactory(name=None)
@@ -1,60 +0,0 @@
-"""
-Unit tests for the MailDomainAccess model
-"""
-
-from django.core.exceptions import ValidationError
-
-import pytest
-
-from mailbox_manager import factories
-
-pytestmark = pytest.mark.django_db
-
-# USER FIELD
-
-
-def test_models_maildomainaccess__user_be_a_user_instance():
-    """The "user" field should be a user instance."""
-    expected_error = '"MailDomainAccess.user" must be a "User" instance.'
-    with pytest.raises(ValueError, match=expected_error):
-        factories.MailDomainAccessFactory(user="")
-
-
-def test_models_maildomainaccess__user_should_not_be_null():
-    """The user field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null."):
-        factories.MailDomainAccessFactory(user=None)
-
-
-# DOMAIN FIELD
-
-
-def test_models_maildomainaccesses__domain_must_be_a_maildomain_instance():
-    """The "domain" field should be an instance of MailDomain."""
-    expected_error = '"MailDomainAccess.domain" must be a "MailDomain" instance.'
-    with pytest.raises(ValueError, match=expected_error):
-        factories.MailDomainAccessFactory(domain="")
-
-    with pytest.raises(ValueError, match=expected_error):
-        factories.MailDomainAccessFactory(domain="domain-as-string.com")
-
-
-def test_models_maildomainaccesses__domain_cannot_be_null():
-    """The "domain" field should not be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null"):
-        factories.MailDomainAccessFactory(domain=None)
-
-
-# ROLE FIELD
-
-
-def test_models_maildomainaccesses__role_cannot_be_empty():
-    """The "role" field cannot be empty."""
-    with pytest.raises(ValidationError, match="This field cannot be blank"):
-        factories.MailDomainAccessFactory(role="")
-
-
-def test_models_maildomainaccesses__role_cannot_be_null():
-    """The "role" field cannot be null."""
-    with pytest.raises(ValidationError, match="This field cannot be null"):
-        factories.MailDomainAccessFactory(role=None)
@@ -1,41 +0,0 @@
-"""API URL Configuration"""
-
-from django.urls import include, path, re_path
-
-from rest_framework.routers import DefaultRouter
-
-from mailbox_manager.api import viewsets
-
-maildomain_router = DefaultRouter()
-maildomain_router.register(
-    "mail-domains", viewsets.MailDomainViewSet, basename="mail-domains"
-)
-
-# - Routes nested under a mail domain
-maildomain_related_router = DefaultRouter()
-maildomain_related_router.register(
-    "accesses",
-    viewsets.MailDomainAccessViewSet,
-    basename="accesses",
-)
-maildomain_related_router.register(
-    "mailboxes",
-    viewsets.MailBoxViewSet,
-    basename="mailboxes",
-)
-
-
-urlpatterns = [
-    path(
-        "",
-        include(
-            [
-                *maildomain_router.urls,
-                re_path(
-                    r"^mail-domains/(?P<domain_slug>[\w-]+)/",
-                    include(maildomain_related_router.urls),
-                ),
-            ]
-        ),
-    ),
-]
@@ -3,10 +3,10 @@
 from django.conf import settings
 from django.urls import include, path, re_path

+from mozilla_django_oidc.urls import urlpatterns as oidc_urls
 from rest_framework.routers import DefaultRouter

 from core.api import viewsets
-from core.authentication.urls import urlpatterns as oidc_urls

 # - Main endpoints
 router = DefaultRouter()
@@ -28,7 +28,6 @@ team_related_router.register(
    basename="invitations",
 )

-
 urlpatterns = [
    path(
        f"api/{settings.API_VERSION}/",
@@ -42,6 +41,5 @@ urlpatterns = [
                ),
            ]
        ),
-    ),
-    path(f"api/{settings.API_VERSION}/", include("mailbox_manager.urls")),
+    )
 ]
@@ -182,7 +182,7 @@ class Base(Configuration):

    AUTHENTICATION_BACKENDS = [
        "django.contrib.auth.backends.ModelBackend",
-        "core.authentication.backends.OIDCAuthenticationBackend",
+        "core.authentication.OIDCAuthenticationBackend",
    ]

    # Django's applications from the highest priority to the lowest
@@ -190,7 +190,6 @@ class Base(Configuration):
        # People
        "core",
        "demo",
-        "mailbox_manager",
        "drf_spectacular",
        # Third party apps
        "corsheaders",
@@ -269,7 +268,7 @@ class Base(Configuration):
    EMAIL_PORT = values.PositiveIntegerValue(None)
    EMAIL_USE_TLS = values.BooleanValue(False)
    EMAIL_USE_SSL = values.BooleanValue(False)
-    EMAIL_FROM = values.Value("from@example.com")
+    EMAIL_FROM = values.Value("do-not-reply@desk.beta.numerique.gouv.fr")

    AUTH_USER_MODEL = "core.User"
    INVITATION_VALIDITY_DURATION = 604800  # 7 days, in seconds
@@ -324,9 +323,6 @@ class Base(Configuration):
    OIDC_OP_USER_ENDPOINT = values.Value(
        None, environ_name="OIDC_OP_USER_ENDPOINT", environ_prefix=None
    )
-    OIDC_OP_LOGOUT_ENDPOINT = values.Value(
-        None, environ_name="OIDC_OP_LOGOUT_ENDPOINT", environ_prefix=None
-    )
    OIDC_AUTH_REQUEST_EXTRA_PARAMS = values.DictValue(
        {}, environ_name="OIDC_AUTH_REQUEST_EXTRA_PARAMS", environ_prefix=None
    )
@@ -351,12 +347,6 @@ class Base(Configuration):
    OIDC_REDIRECT_ALLOWED_HOSTS = values.ListValue(
        default=[], environ_name="OIDC_REDIRECT_ALLOWED_HOSTS", environ_prefix=None
    )
-    OIDC_STORE_ID_TOKEN = values.BooleanValue(
-        default=True, environ_name="OIDC_STORE_ID_TOKEN", environ_prefix=None
-    )
-    ALLOW_LOGOUT_GET_METHOD = values.BooleanValue(
-        default=True, environ_name="ALLOW_LOGOUT_GET_METHOD", environ_prefix=None
-    )

    USER_OIDC_FIELDS_TO_NAME = values.ListValue(
        default=["first_name", "last_name"],
@@ -515,12 +505,6 @@ class Production(Base):
    CSRF_TRUSTED_ORIGINS = values.ListValue([])
    SECURE_BROWSER_XSS_FILTER = True
    SECURE_CONTENT_TYPE_NOSNIFF = True
-    SECURE_HSTS_SECONDS = values.IntegerValue(
-        default=31536000, environ_name="SECURE_HSTS_SECONDS"
-    )
-    SECURE_SSL_REDIRECT = values.BooleanValue(
-        default=True, environ_name="SECURE_SSL_REDIRECT"
-    )

    # SECURE_PROXY_SSL_HEADER allows to fix the scheme in Django's HttpRequest
    # object when your application is behind a reverse proxy.
@@ -531,7 +515,7 @@ class Production(Base):
    # - Your proxy sets the X-Forwarded-Proto header and sends it to Django
    #
    # In other cases, you should comment the following line to avoid security issues.
-    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+    # SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

    # Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
    CSRF_COOKIE_SECURE = True
@@ -25,30 +25,30 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "boto3==1.34.127",
+    "boto3==1.34.75",
    "Brotli==1.1.0",
-    "celery[redis]==5.4.0",
+    "celery[redis]==5.3.6",
    "django-configurations==2.5.1",
    "django-cors-headers==4.3.1",
    "django-countries==7.6.1",
    "django-parler==2.3",
-    "redis==5.0.6",
+    "redis==5.0.3",
    "django-redis==5.4.0",
-    "django-storages==1.14.3",
+    "django-storages==1.14.2",
    "django-timezone-field>=5.1",
-    "django==5.0.6",
+    "django==5.0.3",
    "djangorestframework==3.15.1",
    "drf_spectacular==0.27.2",
-    "dockerflow==2024.4.2",
+    "dockerflow==2024.3.0",
    "easy_thumbnails==2.8.5",
    "factory_boy==3.3.0",
-    "gunicorn==22.0.0",
-    "jsonschema==4.22.0",
+    "gunicorn==21.2.0",
+    "jsonschema==4.21.1",
    "nested-multipart-parser==1.5.0",
-    "psycopg[binary]==3.1.19",
+    "psycopg[binary]==3.1.18",
    "PyJWT==2.8.0",
    "requests==2.31.0",
-    "sentry-sdk==2.5.1",
+    "sentry-sdk==1.44.0",
    "url-normalize==1.4.3",
    "whitenoise==6.6.0",
    "mozilla-django-oidc==4.0.1",
@@ -63,21 +63,21 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
    "django-extensions==3.2.3",
-    "drf-spectacular-sidecar==2024.6.1",
+    "drf-spectacular-sidecar==2024.4.1",
    "ipdb==0.13.13",
-    "ipython==8.25.0",
-    "pyfakefs==5.5.0",
+    "ipython==8.23.0",
+    "pyfakefs==5.3.5",
    "pylint-django==2.5.5",
-    "pylint==3.2.3",
+    "pylint==3.1.0",
    "pytest-cov==5.0.0",
    "pytest-django==4.8.0",
-    "pytest==8.2.2",
+    "pytest==8.1.1",
    "pytest-icdiff==0.9",
-    "pytest-xdist==3.6.1",
-    "responses==0.25.3",
-    "ruff==0.4.9",
-    "types-requests==2.32.0.20240602",
-    "freezegun==1.5.1",
+    "pytest-xdist==3.5.0",
+    "responses==0.25.0",
+    "ruff==0.3.5",
+    "types-requests==2.31.0.20240402",
+    "freezegun==1.4.0",
 ]

 [tool.setuptools]
@@ -1 +1 @@
-NEXT_PUBLIC_API_ORIGIN=http://localhost:8071
+NEXT_PUBLIC_API_URL=http://localhost:8071/api/v1.0/
@@ -0,0 +1 @@
+NEXT_PUBLIC_API_URL=https://desk-staging.beta.numerique.gouv.fr/api/v1.0/
@@ -1 +1 @@
-NEXT_PUBLIC_API_ORIGIN=http://test.jest
+NEXT_PUBLIC_API_URL=/api/
@@ -33,3 +33,4 @@ yarn-error.log*

 # typescript
 *.tsbuildinfo
+next-env.d.ts
@@ -1 +0,0 @@
-next-env.d.ts
@@ -1,4 +1,3 @@
-import '@testing-library/jest-dom';
 import * as dotenv from 'dotenv';

 dotenv.config({ path: './.env.test' });
@@ -1,5 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/basic-features/typescript for more information.
@@ -8,44 +8,38 @@
    "build:ci": "cp .env.development .env.local && yarn build",
    "build-theme": "cunningham -g css,ts -o src/cunningham --utility-classes",
    "start": "npx -y serve@latest out",
-    "lint": "tsc --noEmit && next lint",
+    "lint": "next lint",
    "prettier": "prettier --write .",
    "stylelint": "stylelint \"**/*.css\"",
    "test": "jest",
    "test:watch": "jest --watch"
  },
  "dependencies": {
-    "@gouvfr-lasuite/integration": "1.0.1",
-    "@hookform/resolvers": "3.6.0",
-    "@openfun/cunningham-react": "2.9.3",
-    "@tanstack/react-query": "5.45.1",
-    "i18next": "23.11.5",
+    "@openfun/cunningham-react": "2.7.0",
+    "@tanstack/react-query": "5.28.9",
+    "i18next": "23.10.1",
    "lodash": "4.17.21",
    "luxon": "3.4.4",
-    "next": "14.2.4",
-    "react": "*",
-    "react-aria-components": "1.2.1",
-    "react-dom": "*",
-    "react-hook-form": "7.52.0",
-    "react-i18next": "14.1.2",
+    "next": "14.1.4",
+    "react": "18.2.0",
+    "react-aria-components": "1.1.1",
+    "react-dom": "18.2.0",
+    "react-i18next": "14.1.0",
    "react-select": "5.8.0",
-    "styled-components": "6.1.11",
-    "zod": "3.23.8",
+    "styled-components": "6.1.8",
    "zustand": "4.5.2"
  },
  "devDependencies": {
-    "@hookform/devtools": "4.3.1",
    "@svgr/webpack": "8.1.0",
-    "@tanstack/react-query-devtools": "5.45.1",
-    "@testing-library/dom": "10.1.0",
-    "@testing-library/jest-dom": "6.4.6",
-    "@testing-library/react": "16.0.0",
+    "@tanstack/react-query-devtools": "5.28.10",
+    "@testing-library/jest-dom": "6.4.2",
+    "@testing-library/react": "14.2.2",
    "@testing-library/user-event": "14.5.2",
    "@types/jest": "29.5.12",
-    "@types/lodash": "4.17.5",
+    "@types/lodash": "4.17.0",
    "@types/luxon": "3.4.2",
    "@types/node": "*",
-    "@types/react": "18.3.3",
+    "@types/react": "18.2.73",
    "@types/react-dom": "*",
    "dotenv": "16.4.5",
    "eslint-config-people": "*",
@@ -53,8 +47,8 @@
    "jest": "29.7.0",
    "jest-environment-jsdom": "29.7.0",
    "node-fetch": "2.7.0",
-    "prettier": "3.3.2",
-    "stylelint": "16.6.1",
+    "prettier": "3.2.5",
+    "stylelint": "16.3.1",
    "stylelint-config-standard": "36.0.0",
    "stylelint-prettier": "5.0.0",
    "typescript": "*"
@@ -5,19 +5,22 @@ import { useAuthStore } from '@/core/auth';

 describe('fetchAPI', () => {
  beforeEach(() => {
+    process.env.NEXT_PUBLIC_API_URL = 'http://some.api.url/api/v1.0/';
    fetchMock.restore();
  });

  it('adds correctly the basename', () => {
-    fetchMock.mock('http://test.jest/api/v1.0/some/url', 200);
+    fetchMock.mock('http://some.api.url/api/v1.0/some/url', 200);

    void fetchAPI('some/url');

-    expect(fetchMock.lastUrl()).toEqual('http://test.jest/api/v1.0/some/url');
+    expect(fetchMock.lastUrl()).toEqual(
+      'http://some.api.url/api/v1.0/some/url',
+    );
  });

  it('adds the credentials automatically', () => {
-    fetchMock.mock('http://test.jest/api/v1.0/some/url', 200);
+    fetchMock.mock('http://some.api.url/api/v1.0/some/url', 200);

    void fetchAPI('some/url', { body: 'some body' });

@@ -31,14 +34,25 @@ describe('fetchAPI', () => {
  });

  it('logout if 401 response', async () => {
-    const logoutMock = jest.fn();
-    jest
-      .spyOn(useAuthStore.getState(), 'logout')
-      .mockImplementation(logoutMock);
+    const mockReplace = jest.fn();
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      enumerable: true,
+      value: {
+        replace: mockReplace,
+      },
+    });
+
+    useAuthStore.setState({ userData: { email: 'test@test.com' } });
+
+    fetchMock.mock('http://some.api.url/api/v1.0/some/url', 401);

-    fetchMock.mock('http://test.jest/api/v1.0/some/url', 401);
    await fetchAPI('some/url');

-    expect(logoutMock).toHaveBeenCalled();
+    expect(useAuthStore.getState().userData).toBeUndefined();
+
+    expect(mockReplace).toHaveBeenCalledWith(
+      'http://some.api.url/api/v1.0/authenticate/',
+    );
  });
 });
@@ -1,7 +0,0 @@
-export const baseApiUrl = (apiVersion: string = '1.0') => {
-  const origin =
-    process.env.NEXT_PUBLIC_API_ORIGIN ||
-    (typeof window !== 'undefined' ? window.location.origin : '');
-
-  return `${origin}/api/v${apiVersion}/`;
-};
@@ -1,6 +1,4 @@
-import { useAuthStore } from '@/core/auth';
-
-import { baseApiUrl } from './conf';
+import { login, useAuthStore } from '@/core/auth';

 /**
 * Retrieves the CSRF token from the document's cookies.
@@ -15,12 +13,9 @@ function getCSRFToken() {
    .pop();
 }

-export const fetchAPI = async (
-  input: string,
-  init?: RequestInit,
-  apiVersion = '1.0',
-) => {
-  const apiUrl = `${baseApiUrl(apiVersion)}${input}`;
+export const fetchAPI = async (input: string, init?: RequestInit) => {
+  const apiUrl = `${process.env.NEXT_PUBLIC_API_URL}${input}`;
+  const { logout } = useAuthStore.getState();

  const csrfToken = getCSRFToken();

@@ -34,9 +29,12 @@ export const fetchAPI = async (
    },
  });

+  // todo - handle 401, redirect to login screen
+  // todo - please have a look to this documentation page https://mozilla-django-oidc.readthedocs.io/en/stable/xhr.html
  if (response.status === 401) {
-    const { logout } = useAuthStore.getState();
    logout();
+    // Fix - force re-logging the user, will be refactored
+    login();
  }

  return response;
@@ -1,5 +1,4 @@
 export * from './APIError';
-export * from './conf';
 export * from './fetchApi';
 export * from './types';
 export * from './utils';
@@ -2,12 +2,6 @@ import { ComponentPropsWithRef, ReactHTML } from 'react';
 import styled from 'styled-components';
 import { CSSProperties } from 'styled-components/dist/types';

-import {
-  MarginPadding,
-  stylesMargin,
-  stylesPadding,
-} from '@/utils/styleBuilder';
-
 export interface BoxProps {
  as?: keyof ReactHTML;
  $align?: CSSProperties['alignItems'];
@@ -21,13 +15,11 @@ export interface BoxProps {
  $height?: CSSProperties['height'];
  $justify?: CSSProperties['justifyContent'];
  $overflow?: CSSProperties['overflow'];
-  $maxWidth?: CSSProperties['maxWidth'];
-  $margin?: MarginPadding;
-  $minWidth?: CSSProperties['minWidth'];
-  $padding?: MarginPadding;
  $position?: CSSProperties['position'];
  $radius?: CSSProperties['borderRadius'];
  $width?: CSSProperties['width'];
+  $maxWidth?: CSSProperties['maxWidth'];
+  $minWidth?: CSSProperties['minWidth'];
 }

 export type BoxType = ComponentPropsWithRef<typeof Box>;
@@ -44,9 +36,7 @@ export const Box = styled('div')<BoxProps>`
  ${({ $gap }) => $gap && `gap: ${$gap};`}
  ${({ $height }) => $height && `height: ${$height};`}
  ${({ $justify }) => $justify && `justify-content: ${$justify};`}
-  ${({ $margin }) => $margin && stylesMargin($margin)}
  ${({ $overflow }) => $overflow && `overflow: ${$overflow};`}
-  ${({ $padding }) => $padding && stylesPadding($padding)}
  ${({ $position }) => $position && `position: ${$position};`}
  ${({ $radius }) => $radius && `border-radius: ${$radius};`}
  ${({ $width }) => $width && `width: ${$width};`}
@@ -1,28 +1,30 @@
 import { PropsWithChildren } from 'react';
+import styled from 'styled-components';

 import { useCunninghamTheme } from '@/cunningham';

-import { Box, BoxType } from '.';
+import { BoxType } from '.';

-export const Card = ({
-  children,
-  $css,
-  ...props
-}: PropsWithChildren<BoxType>) => {
+const Wrapper = styled.div`
+  position: relative;
+  background-color: white;
+  border-radius: 0.25rem;
+  box-shadow: 2px 2px 5px var(--shadow-color) 88;
+  border: 1px solid var(--border-color);
+`;
+
+export const Card = ({ children, ...props }: PropsWithChildren<BoxType>) => {
  const { colorsTokens } = useCunninghamTheme();

  return (
-    <Box
-      $background="white"
-      $radius="4px"
-      $css={`
-        box-shadow: 2px 2px 5px ${colorsTokens()['primary-300']}88;
-        border: 1px solid ${colorsTokens()['card-border']};
-        ${$css}
-      `}
+    <Wrapper
+      style={{
+        '--border-color': colorsTokens()['card-border'],
+        '--shadow-color': colorsTokens()['primary-300'],
+      }}
      {...props}
    >
      {children}
-    </Box>
+    </Wrapper>
  );
 };
@@ -23,10 +23,6 @@ const StyledButton = styled(Button)`
  background: none;
  outline: none;
  transition: all 0.2s ease-in-out;
-  font-family: Marianne, Arial, serif;
-  font-weight: 500;
-  font-size: 0.938rem;
-  text-wrap: nowrap;
 `;

 interface DropButtonProps {
@@ -20,7 +20,7 @@ export const TextErrors = ({
        causes.map((cause, i) => (
          <Text
            key={`causes-${i}`}
-            $margin={{ top: 'small' }}
+            className="mt-s"
            $theme="danger"
            $textAlign="center"
            {...textProps}
@@ -31,7 +31,7 @@ export const TextErrors = ({

      {!causes && (
        <Text
-          $margin={{ top: 'small' }}
+          className="mt-s"
          $theme="danger"
          $textAlign="center"
          {...textProps}
@@ -1,51 +0,0 @@
-import { render, screen } from '@testing-library/react';
-
-import { Box } from '../Box';
-
-describe('<Box />', () => {
-  it('has the padding from prop', () => {
-    const { unmount } = render(<Box $padding="10px">My Box</Box>);
-
-    expect(screen.getByText('My Box')).toHaveStyle('padding: 10px');
-
-    unmount();
-
-    render(
-      <Box $padding={{ horizontal: 'xl', all: 'large', bottom: 'tiny' }}>
-        My Box
-      </Box>,
-    );
-
-    expect(screen.getByText('My Box')).toHaveStyle(`
-      padding-left: 4rem;
-      padding-right: 4rem;
-      padding-top: 3rem;
-      padding-bottom: 0.5rem;`);
-  });
-
-  it('has the margin from prop', () => {
-    const { unmount } = render(<Box $margin="10px">My Box</Box>);
-    expect(screen.getByText('My Box')).toHaveStyle('margin: 10px');
-
-    unmount();
-
-    render(
-      <Box
-        $margin={{
-          horizontal: 'auto',
-          vertical: 'big',
-          bottom: 'full',
-          all: 'xtiny',
-        }}
-      >
-        My Box
-      </Box>,
-    );
-
-    expect(screen.getByText('My Box')).toHaveStyle(`
-      margin-left: auto;
-      margin-right: auto;
-      margin-top: 1.625rem;
-      margin-bottom: 100%;`);
-  });
-});
@@ -1,19 +1,31 @@
-import { PropsWithChildren } from 'react';
+import styled from 'styled-components';

 import { Box } from '@/components';
 import { HEADER_HEIGHT, Header } from '@/features/header';
-import { Menu } from '@/features/menu';
+import { MENU_WIDTH, Menu } from '@/features/menu';

-export function MainLayout({ children }: PropsWithChildren) {
+const Container = styled.div`
+  display: flex;
+  flex-direction: row;
+  flex: 1;
+`;
+
+const Main = styled.main`
+  display: flex;
+  flex-wrap: nowrap;
+  flex-basis: 100%;
+  height: calc(100vh - ${HEADER_HEIGHT});
+  max-width: calc(100% - ${MENU_WIDTH});
+`;
+
+export function MainLayout({ children }: { children: React.ReactNode }) {
  return (
-    <Box $height="100vh" $css="overflow:hidden;">
+    <Box>
      <Header />
-      <Box $css="flex: 1;" $direction="row">
+      <Container>
        <Menu />
-        <Box as="main" $height={`calc(100vh - ${HEADER_HEIGHT})`} $width="100%">
-          {children}
-        </Box>
-      </Box>
+        <Main>{children}</Main>
+      </Container>
    </Box>
  );
 }
@@ -1,2 +1,2 @@
-export * from './types';
 export * from './getMe';
+export * from './types';
@@ -1,9 +1,13 @@
 import { create } from 'zustand';

-import { baseApiUrl } from '@/api';
-
 import { User, getMe } from './api';

+export const login = () => {
+  window.location.replace(
+    new URL('authenticate/', process.env.NEXT_PUBLIC_API_URL).href,
+  );
+};
+
 interface AuthStore {
  authenticated: boolean;
  initAuth: () => void;
@@ -26,10 +30,11 @@ export const useAuthStore = create<AuthStore>((set) => ({
        set({ authenticated: true, userData: data });
      })
      .catch(() => {
-        window.location.replace(new URL('authenticate/', baseApiUrl()).href);
+        // todo - implement a proper login screen to prevent automatic navigation.
+        login();
      });
  },
  logout: () => {
-    window.location.replace(new URL('logout/', baseApiUrl()).href);
+    set(initialState);
  },
 }));
@@ -19,6 +19,6 @@ declare module '*.svg?url' {

 namespace NodeJS {
  interface ProcessEnv {
-    NEXT_PUBLIC_API_ORIGIN?: string;
+    NEXT_PUBLIC_API_URL?: string;
  }
 }
@@ -165,14 +165,14 @@ export const ModalAddMembers = ({
      title={
        <Box $align="center" $gap="1rem">
          <IconAddMember width={48} color={colorsTokens()['primary-text']} />
-          <Text $size="h3" $margin="none">
+          <Text $size="h3" className="m-0">
            {t('Add a member')}
          </Text>
        </Box>
      }
    >
      <GlobalStyle />
-      <Box $margin={{ bottom: 'xl', top: 'large' }}>
+      <Box className="mb-xl mt-l">
        <SearchMembers
          team={team}
          setSelectedMembers={setSelectedMembers}
@@ -180,8 +180,8 @@ export const ModalAddMembers = ({
          disabled={isPending}
        />
        {selectedMembers.length > 0 && (
-          <Box $margin={{ top: 'small' }}>
-            <Text as="h4" $textAlign="left" $margin={{ bottom: 'tiny' }}>
+          <Box className="mt-s">
+            <Text as="h4" $textAlign="left" className="mb-t">
              {t('Choose a role')}
            </Text>
            <ChooseRole
@@ -110,9 +110,7 @@ export const SearchMembers = ({
      onInputChange={onInputChangeHandle}
      inputValue={input}
      placeholder={t('Search new members (name or email)')}
-      noOptionsMessage={() =>
-        t('Invite new members to {{teamName}}', { teamName: team.name })
-      }
+      noOptionsMessage={() => t('Invite new members to your team')}
      onChange={(value) => {
        setInput('');
        setUserQuery('');
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`"""People additionnal application, to manage email adresses."""`
				`@@ -0,0 +1 @@`
				`NEXT_PUBLIC_API_URL=https://desk-staging.beta.numerique.gouv.fr/api/v1.0/`