♻️(refacto) refacto responses

WIP

.github/workflows/crowdin_upload.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v3
         with:
-          python-version: "3.11"
+          python-version: '3.13'
       - name: Upgrade pip and setuptools
         run: pip install --upgrade pip setuptools
       - name: Install development dependencies

.github/workflows/people.yml

@@ -224,7 +224,7 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.13'
       - name: Install development dependencies
         run: pip install --user .[dev]
       - name: Check code formatting with ruff
@@ -281,7 +281,7 @@ jobs:
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.13'
       - name: Install development dependencies
         run: pip install --user .[dev]
       - name: Install gettext (required to compile messages)

CHANGELOG.md

@@ -8,6 +8,42 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Added
+
+- ✨(invitations) can delete domain invitations
+
+## [1.22.2] - 2026-01-26
+
+### Fixed
+
+- 🐛(aliases) authorize special domain devnull in alias destinations #1029 
+
+## [1.22.1] - 2026-01-21
+
+- 🔒️(organization) the first user is not admin #776
+- 🐛(admin) fix broken alias import #1021
+
+## [1.22.0] - 2026-01-19
+
+### Added
+- ✨(front) create, manage & delete aliases
+- ✨(domains) alias sorting and admin
+- ✨(aliases) delete all aliases in one call #1002
+
+### Fixed
+- 🔒️(security) upgrade python version to fix vulnerability #1010
+- 🐛(dimail) ignore oxadmin when importing mailboxes from dimail #986
+- ✨(aliases) fix deleting single aliases #1002
+
+### Changed
+- 🐛(dimail) allow mailboxes and aliases to have the same local part #986
+
+### Removed
+- 🔥(plugins) remove CommuneCreation plugin
+
+## [1.21.0] - 2025-12-05
+
+- ✨(aliases) import existing aliases from dimail
 - 🛂(permissions) return 404 to users with no access to domain #985 
 - ✨(aliases) can create, list and delete aliases #974
 
@@ -454,7 +490,11 @@ and this project adheres to
 - ✨(domains) create and manage domains on admin + API
 - ✨(domains) mailbox creation + link to email provisioning API
 
-[unreleased]: https://github.com/suitenumerique/people/compare/v1.20.0...main
+[unreleased]: https://github.com/suitenumerique/people/compare/v1.22.2...main
+[1.22.2]: https://github.com/suitenumerique/people/releases/v1.22.2
+[1.22.1]: https://github.com/suitenumerique/people/releases/v1.22.1
+[1.22.0]: https://github.com/suitenumerique/people/releases/v1.22.0
+[1.21.0]: https://github.com/suitenumerique/people/releases/v1.21.0
 [1.20.0]: https://github.com/suitenumerique/people/releases/v1.20.0
 [1.19.1]: https://github.com/suitenumerique/people/releases/v1.19.1
 [1.19.0]: https://github.com/suitenumerique/people/releases/v1.19.0

Dockerfile

@@ -1,10 +1,10 @@
 # Django People
 
 # ---- base image to inherit from ----
-FROM python:3.12.6-alpine3.20 AS base
+FROM python:3.13.11-alpine AS base
 
 # Upgrade pip to its latest release to speed up dependencies installation
-RUN python -m pip install --upgrade pip setuptools
+RUN python -m pip install --upgrade pip
 
 # Upgrade system packages to install security updates
 RUN apk update && \

Makefile

@@ -108,6 +108,7 @@ bootstrap: \
 # -- Docker/compose
 build: ## build the app-dev container
 	@$(COMPOSE) build app-dev
+	@$(COMPOSE) build dimail
 .PHONY: build
 
 down: ## stop and remove containers, networks, images, and volumes
@@ -123,7 +124,7 @@ run: ## start the wsgi (production) and servers with production Docker images
 .PHONY: run
 
 run-dev: ## start the servers in development mode (watch) Docker images
-	@$(COMPOSE) up --force-recreate --detach app-dev frontend-dev celery-dev celery-beat-dev nginx maildev
+	@$(COMPOSE) up --force-recreate --detach app-dev dimail frontend-dev celery-dev celery-beat-dev nginx maildev
 .PHONY: run-dev
 
 status: ## an alias for "docker compose ps"

docker-compose.yml

@@ -46,8 +46,6 @@ services:
       postgresql:
         condition: service_healthy
         restart: true
-      dimail:
-        condition: service_started
       maildev:
         condition: service_started
       redis:

env.d/development/france.dist

@@ -1,2 +1 @@
 INSTALLED_PLUGINS=plugins.la_suite
-DNS_PROVISIONING_TARGET_ZONE=test.collectivite.fr

src/backend/core/authentication/backends.py

@@ -17,8 +17,6 @@ from core.models import (
     AccountService,
     Contact,
     Organization,
-    OrganizationAccess,
-    OrganizationRoleChoices,
 )
 
 logger = logging.getLogger(__name__)
@@ -131,15 +129,6 @@ class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
 
         user = super().create_user(claims | {"organization": organization})
 
-        if organization_created:
-            # Warning: we may remove this behavior in the near future when we
-            # add a feature to claim the organization ownership.
-            OrganizationAccess.objects.create(
-                organization=organization,
-                user=user,
-                role=OrganizationRoleChoices.ADMIN,
-            )
-
         # Initiate the user's profile
         Contact.objects.create(
             owner=user,

src/backend/core/tests/authentication/test_backends.py

@@ -100,7 +100,7 @@ def test_authentication_getter_existing_user_change_fields(
     monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
 
     # One and only one additional update query when a field has changed
-    with django_assert_num_queries(2):
+    with django_assert_num_queries(4):
         authenticated_user = klass.get_or_create_user(
             access_token="test-token", id_token=None, payload=None
         )
@@ -160,7 +160,8 @@ def test_authentication_getter_existing_user_via_email(
 
     monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked)
 
-    with django_assert_num_queries(3):  # user by email + user by sub + update sub
+    with django_assert_num_queries(5):
+        # 5 = user by email + user by sub + update sub + 2 from django-lasuite
         user = klass.get_or_create_user(
             access_token="test-token", id_token=None, payload=None
         )
@@ -390,6 +391,8 @@ def test_authentication_getter_new_user_with_registration_id_new_organization(
     assert user.organization.domain_list == expected_domain_list
     assert user.organization.registration_id_list == expected_registration_id_list
 
+    assert models.OrganizationAccess.objects.filter(user=user).exists() is False
+
 
 def test_authentication_getter_existing_user_via_email_update_organization(
     django_assert_num_queries, monkeypatch

src/backend/core/tests/resource_server/test_authentication.py

@@ -1,7 +1,6 @@
 """Tests for the authentication process of the resource server."""
 
 import base64
-import json
 
 import pytest
 import responses
@@ -84,8 +83,7 @@ def test_resource_server_authentication_class(client, settings):
     settings.OIDC_OP_JWKS_ENDPOINT = "https://oidc.example.com/jwks"
     settings.OIDC_OP_INTROSPECTION_ENDPOINT = "https://oidc.example.com/introspect"
 
-    responses.add(
-        responses.POST,
+    responses.post(
         "https://oidc.example.com/introspect",
         json={
             "iss": "https://oidc.example.com",
@@ -181,23 +179,20 @@ def test_jwt_resource_server_authentication_class(  # pylint: disable=unused-arg
 
     # Mock the JWKS endpoint
     public_numbers = private_key.public_key().public_numbers()
-    responses.add(
-        responses.GET,
+    responses.get(
         settings.OIDC_OP_JWKS_ENDPOINT,
-        body=json.dumps(
-            {
-                "keys": [
-                    {
-                        "kty": settings.OIDC_RS_ENCRYPTION_KEY_TYPE,
-                        "alg": settings.OIDC_RS_SIGNING_ALGO,
-                        "use": "sig",
-                        "kid": "1234567890",
-                        "n": to_base64url_uint(public_numbers.n).decode("ascii"),
-                        "e": to_base64url_uint(public_numbers.e).decode("ascii"),
-                    }
-                ]
-            }
-        ),
+        json={
+            "keys": [
+                {
+                    "kty": settings.OIDC_RS_ENCRYPTION_KEY_TYPE,
+                    "alg": settings.OIDC_RS_SIGNING_ALGO,
+                    "use": "sig",
+                    "kid": "1234567890",
+                    "n": to_base64url_uint(public_numbers.n).decode("ascii"),
+                    "e": to_base64url_uint(public_numbers.e).decode("ascii"),
+                }
+            ]
+        },
     )
 
     def encrypt_jwt(json_data):
@@ -225,8 +220,7 @@ def test_jwt_resource_server_authentication_class(  # pylint: disable=unused-arg
             ],
         )
 
-    responses.add(
-        responses.POST,
+    responses.post(
         "https://oidc.example.com/introspect",
         body=encrypt_jwt(
             {

src/backend/core/tests/utils/test_webhooks_matrix_client.py

@@ -37,7 +37,7 @@ def test_matrix_webhook__search_user_unknown(caplog):
     # Mock successful responses
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_empty()["message"]),
+        json=matrix.mock_search_empty()["message"],
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -62,7 +62,7 @@ def test_matrix_webhook__search_multiple_ids(caplog):
     # Mock successful responses
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful_multiple(user)["message"]),
+        json=matrix.mock_search_successful_multiple(user)["message"],
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -92,7 +92,7 @@ def test_matrix_webhook__invite_user_to_room_forbidden(caplog):
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
@@ -123,7 +123,7 @@ def test_matrix_webhook__invite_user_to_room_already_in_room(caplog):
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
@@ -165,7 +165,7 @@ def test_matrix_webhook__invite_user_to_room_success(caplog):
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
@@ -216,7 +216,7 @@ def test_matrix_webhook__override_secret_for_tchap():
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
@@ -250,17 +250,17 @@ def test_matrix_webhook__kick_user_from_room_not_in_room(caplog):
     # Mock successful responses
     responses.post(
         re.compile(r".*/join"),
-        body=str(matrix.mock_join_room_successful),
+        json=matrix.mock_join_room_successful,
         status=status.HTTP_200_OK,
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
         re.compile(r".*/kick"),
-        body=str(matrix.mock_kick_user_not_in_room()["message"]),
+        json=matrix.mock_kick_user_not_in_room()["message"],
         status=matrix.mock_kick_user_not_in_room()["status_code"],
     )
     webhooks_synchronizer.remove_user_from_group(team=webhook.team, user=user)
@@ -296,7 +296,7 @@ def test_matrix_webhook__kick_user_from_room_success(caplog):
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(
@@ -345,7 +345,7 @@ def test_matrix_webhook__kick_user_from_room_forbidden(caplog):
     )
     responses.post(
         re.compile(r".*/search"),
-        body=json.dumps(matrix.mock_search_successful(user)["message"]),
+        json=matrix.mock_search_successful(user)["message"],
         status=matrix.mock_search_successful(user)["status_code"],
     )
     responses.post(

src/backend/locale/en_US/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-people\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-10-22 08:25+0000\n"
-"PO-Revision-Date: 2025-10-22 09:28\n"
+"POT-Creation-Date: 2026-01-23 17:58+0000\n"
+"PO-Revision-Date: 2026-01-26 11:02\n"
 "Last-Translator: \n"
 "Language-Team: English\n"
 "Language: en_US\n"
@@ -45,24 +45,24 @@ msgstr ""
 msgid "People core application"
 msgstr ""
 
-#: build/lib/core/authentication/backends.py:104
-#: core/authentication/backends.py:104
+#: build/lib/core/authentication/backends.py:102
+#: core/authentication/backends.py:102
 msgid "Claims contained no recognizable user identification"
 msgstr ""
 
-#: build/lib/core/authentication/backends.py:124
-#: core/authentication/backends.py:124
+#: build/lib/core/authentication/backends.py:122
+#: core/authentication/backends.py:122
 msgid "Claims contained no recognizable organization identification"
 msgstr ""
 
-#: build/lib/core/authentication/backends.py:181
-#: build/lib/core/authentication/backends.py:183
-#: core/authentication/backends.py:181 core/authentication/backends.py:183
+#: build/lib/core/authentication/backends.py:170
+#: build/lib/core/authentication/backends.py:172
+#: core/authentication/backends.py:170 core/authentication/backends.py:172
 msgid "Invalid authorization header."
 msgstr ""
 
-#: build/lib/core/authentication/backends.py:188
-#: core/authentication/backends.py:188
+#: build/lib/core/authentication/backends.py:177
+#: core/authentication/backends.py:177
 msgid "Invalid api key."
 msgstr ""
 
@@ -149,8 +149,8 @@ msgstr ""
 
 #: build/lib/core/models.py:250 build/lib/core/models.py:364
 #: build/lib/core/models.py:510 build/lib/core/models.py:1121
-#: build/lib/mailbox_manager/models.py:54 core/models.py:250 core/models.py:364
-#: core/models.py:510 core/models.py:1121 mailbox_manager/models.py:54
+#: build/lib/mailbox_manager/models.py:55 core/models.py:250 core/models.py:364
+#: core/models.py:510 core/models.py:1121 mailbox_manager/models.py:55
 msgid "name"
 msgstr ""
 
@@ -361,90 +361,101 @@ msgstr ""
 msgid "Account services"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:16 mailbox_manager/admin.py:16
+#: build/lib/mailbox_manager/admin.py:14 mailbox_manager/admin.py:14
 msgid "Import emails from dimail"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:34 mailbox_manager/admin.py:34
+#: build/lib/mailbox_manager/admin.py:32 build/lib/mailbox_manager/admin.py:71
+#: mailbox_manager/admin.py:32 mailbox_manager/admin.py:71
 #, python-format
 msgid "Synchronisation failed for %(domain)s with message: %(err)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:41 mailbox_manager/admin.py:41
+#: build/lib/mailbox_manager/admin.py:39 mailbox_manager/admin.py:39
 #, python-format
 msgid "Synchronisation succeed for %(domain)s. Imported mailboxes: %(mailboxes)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:48 mailbox_manager/admin.py:48
+#: build/lib/mailbox_manager/admin.py:46 build/lib/mailbox_manager/admin.py:91
+#: mailbox_manager/admin.py:46 mailbox_manager/admin.py:91
 #, python-format
 msgid "Sync require enabled domains. Excluded domains: %(domains)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:53 mailbox_manager/admin.py:53
+#: build/lib/mailbox_manager/admin.py:51 mailbox_manager/admin.py:51
+msgid "Import aliases from dimail"
+msgstr ""
+
+#: build/lib/mailbox_manager/admin.py:78 mailbox_manager/admin.py:78
+#, python-format
+msgid "Synchronisation succeed for %(domain)s.Imported %(count_imported)s aliases: %(aliases)s"
+msgstr ""
+
+#: build/lib/mailbox_manager/admin.py:96 mailbox_manager/admin.py:96
 msgid "Check and update status from dimail"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:70 mailbox_manager/admin.py:70
+#: build/lib/mailbox_manager/admin.py:113 mailbox_manager/admin.py:113
 #, python-format
 msgid "- %(domain)s with message: %(err)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:83 mailbox_manager/admin.py:83
+#: build/lib/mailbox_manager/admin.py:126 mailbox_manager/admin.py:126
 msgid "Check domains done with success."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:84 mailbox_manager/admin.py:84
+#: build/lib/mailbox_manager/admin.py:127 mailbox_manager/admin.py:127
 #, python-format
 msgid "Domains updated: %(domains)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:86 mailbox_manager/admin.py:86
+#: build/lib/mailbox_manager/admin.py:129 mailbox_manager/admin.py:129
 msgid "No domain updated."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:93 mailbox_manager/admin.py:93
+#: build/lib/mailbox_manager/admin.py:136 mailbox_manager/admin.py:136
 msgid "Check domain failed for:"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:101 mailbox_manager/admin.py:101
+#: build/lib/mailbox_manager/admin.py:144 mailbox_manager/admin.py:144
 #, python-format
 msgid "Domains disabled are excluded from check: %(domains)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:106 mailbox_manager/admin.py:106
+#: build/lib/mailbox_manager/admin.py:149 mailbox_manager/admin.py:149
 msgid "Fetch domain expected config from dimail"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:120 mailbox_manager/admin.py:120
+#: build/lib/mailbox_manager/admin.py:163 mailbox_manager/admin.py:163
 #, python-format
 msgid "Domain expected config fetched with success for %(domain)s."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:126 mailbox_manager/admin.py:126
+#: build/lib/mailbox_manager/admin.py:169 mailbox_manager/admin.py:169
 #, python-format
 msgid "Failed to fetch domain expected config for %(domain)s."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:132 mailbox_manager/admin.py:132
+#: build/lib/mailbox_manager/admin.py:175 mailbox_manager/admin.py:175
 #, python-format
 msgid "Domains disabled are excluded from fetch: %(domains)s"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:137 mailbox_manager/admin.py:137
+#: build/lib/mailbox_manager/admin.py:180 mailbox_manager/admin.py:180
 msgid "Send pending mailboxes to dimail"
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:153 mailbox_manager/admin.py:153
+#: build/lib/mailbox_manager/admin.py:196 mailbox_manager/admin.py:196
 #, python-format
 msgid "Failed to send the following mailboxes : %(mailboxes)s."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:159 mailbox_manager/admin.py:159
+#: build/lib/mailbox_manager/admin.py:202 mailbox_manager/admin.py:202
 #, python-format
 msgid "Pending mailboxes successfully sent for %(domain)s."
 msgstr ""
 
-#: build/lib/mailbox_manager/admin.py:165 mailbox_manager/admin.py:165
+#: build/lib/mailbox_manager/admin.py:208 mailbox_manager/admin.py:208
 #, python-format
 msgid "Domains disabled are excluded from : %(domains)s"
 msgstr ""
@@ -476,90 +487,102 @@ msgstr ""
 msgid "Action required"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:33 mailbox_manager/models.py:33
+#: build/lib/mailbox_manager/models.py:34 mailbox_manager/models.py:34
 msgid "[La Suite] Your domain is ready"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:38 mailbox_manager/models.py:38
+#: build/lib/mailbox_manager/models.py:39 mailbox_manager/models.py:39
 msgid "[La Suite] Your domain requires action"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:43 mailbox_manager/models.py:43
+#: build/lib/mailbox_manager/models.py:44 mailbox_manager/models.py:44
 msgid "[La Suite] Your domain has failed"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:69 mailbox_manager/models.py:69
+#: build/lib/mailbox_manager/models.py:70 mailbox_manager/models.py:70
 msgid "support email"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:73 mailbox_manager/models.py:73
+#: build/lib/mailbox_manager/models.py:74 mailbox_manager/models.py:74
 msgid "last check details"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:74 mailbox_manager/models.py:74
+#: build/lib/mailbox_manager/models.py:75 mailbox_manager/models.py:75
 msgid "A JSON object containing the last health check details"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:79 mailbox_manager/models.py:79
+#: build/lib/mailbox_manager/models.py:80 mailbox_manager/models.py:80
 msgid "expected config"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:80 mailbox_manager/models.py:80
+#: build/lib/mailbox_manager/models.py:81 mailbox_manager/models.py:81
 msgid "A JSON object containing the expected config"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:85 mailbox_manager/models.py:85
+#: build/lib/mailbox_manager/models.py:86 mailbox_manager/models.py:86
 msgid "Mail domain"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:86 mailbox_manager/models.py:86
+#: build/lib/mailbox_manager/models.py:87 mailbox_manager/models.py:87
 msgid "Mail domains"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:200 mailbox_manager/models.py:200
+#: build/lib/mailbox_manager/models.py:203 mailbox_manager/models.py:203
 msgid "User/mail domain relation"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:201 mailbox_manager/models.py:201
+#: build/lib/mailbox_manager/models.py:204 mailbox_manager/models.py:204
 msgid "User/mail domain relations"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:274 mailbox_manager/models.py:274
+#: build/lib/mailbox_manager/models.py:277 mailbox_manager/models.py:277
 msgid "local_part"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:288 mailbox_manager/models.py:288
+#: build/lib/mailbox_manager/models.py:291 mailbox_manager/models.py:291
 msgid "secondary email address"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:299 mailbox_manager/models.py:299
+#: build/lib/mailbox_manager/models.py:302 mailbox_manager/models.py:302
 msgid "email"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:305 mailbox_manager/models.py:305
+#: build/lib/mailbox_manager/models.py:308 mailbox_manager/models.py:308
 msgid "Mailbox"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:306 mailbox_manager/models.py:306
+#: build/lib/mailbox_manager/models.py:309 mailbox_manager/models.py:309
 msgid "Mailboxes"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:348 mailbox_manager/models.py:348
+#: build/lib/mailbox_manager/models.py:351 mailbox_manager/models.py:351
 msgid "You can't create or update a mailbox for a disabled domain."
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:405 mailbox_manager/models.py:405
+#: build/lib/mailbox_manager/models.py:408 mailbox_manager/models.py:408
 msgid "Mail domain invitation"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:406 mailbox_manager/models.py:406
+#: build/lib/mailbox_manager/models.py:409 mailbox_manager/models.py:409
 msgid "Mail domain invitations"
 msgstr ""
 
-#: build/lib/mailbox_manager/models.py:418 mailbox_manager/models.py:418
+#: build/lib/mailbox_manager/models.py:421 mailbox_manager/models.py:421
 msgid "[La Suite] You have been invited to join La Régie"
 msgstr ""
 
+#: build/lib/mailbox_manager/models.py:465 mailbox_manager/models.py:465
+msgid "destination address"
+msgstr ""
+
+#: build/lib/mailbox_manager/models.py:483 mailbox_manager/models.py:483
+msgid "Alias"
+msgstr ""
+
+#: build/lib/mailbox_manager/models.py:484 mailbox_manager/models.py:484
+msgid "Aliases"
+msgstr ""
+
 #: build/lib/mailbox_manager/utils/dimail.py:296
 #: mailbox_manager/utils/dimail.py:296
 msgid "Your new mailbox information"

src/backend/locale/fr_FR/LC_MESSAGES/django.po

@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: lasuite-people\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-10-22 08:25+0000\n"
-"PO-Revision-Date: 2025-10-22 09:28\n"
+"POT-Creation-Date: 2026-01-23 17:58+0000\n"
+"PO-Revision-Date: 2026-01-26 11:02\n"
 "Last-Translator: \n"
 "Language-Team: French\n"
 "Language: fr_FR\n"
@@ -45,24 +45,24 @@ msgstr "Les plugins de post-création ont été exécutés pour les organisation
 msgid "People core application"
 msgstr "Application cœur de People"
 
-#: build/lib/core/authentication/backends.py:104
-#: core/authentication/backends.py:104
+#: build/lib/core/authentication/backends.py:102
+#: core/authentication/backends.py:102
 msgid "Claims contained no recognizable user identification"
 msgstr "Les claims ne contiennent aucune identification reconnaissable pour l'organisation"
 
-#: build/lib/core/authentication/backends.py:124
-#: core/authentication/backends.py:124
+#: build/lib/core/authentication/backends.py:122
+#: core/authentication/backends.py:122
 msgid "Claims contained no recognizable organization identification"
 msgstr "Les claims ne contiennent aucune identification reconnaissable pour l'organisation"
 
-#: build/lib/core/authentication/backends.py:181
-#: build/lib/core/authentication/backends.py:183
-#: core/authentication/backends.py:181 core/authentication/backends.py:183
+#: build/lib/core/authentication/backends.py:170
+#: build/lib/core/authentication/backends.py:172
+#: core/authentication/backends.py:170 core/authentication/backends.py:172
 msgid "Invalid authorization header."
 msgstr "En-tête d'autorisation invalide."
 
-#: build/lib/core/authentication/backends.py:188
-#: core/authentication/backends.py:188
+#: build/lib/core/authentication/backends.py:177
+#: core/authentication/backends.py:177
 msgid "Invalid api key."
 msgstr "Clé API invalide."
 
@@ -149,8 +149,8 @@ msgstr "contacts"
 
 #: build/lib/core/models.py:250 build/lib/core/models.py:364
 #: build/lib/core/models.py:510 build/lib/core/models.py:1121
-#: build/lib/mailbox_manager/models.py:54 core/models.py:250 core/models.py:364
-#: core/models.py:510 core/models.py:1121 mailbox_manager/models.py:54
+#: build/lib/mailbox_manager/models.py:55 core/models.py:250 core/models.py:364
+#: core/models.py:510 core/models.py:1121 mailbox_manager/models.py:55
 msgid "name"
 msgstr "nom"
 
@@ -361,90 +361,101 @@ msgstr "Compte de service"
 msgid "Account services"
 msgstr "Comptes de service"
 
-#: build/lib/mailbox_manager/admin.py:16 mailbox_manager/admin.py:16
+#: build/lib/mailbox_manager/admin.py:14 mailbox_manager/admin.py:14
 msgid "Import emails from dimail"
 msgstr "Importer les emails depuis dimail"
 
-#: build/lib/mailbox_manager/admin.py:34 mailbox_manager/admin.py:34
+#: build/lib/mailbox_manager/admin.py:32 build/lib/mailbox_manager/admin.py:71
+#: mailbox_manager/admin.py:32 mailbox_manager/admin.py:71
 #, python-format
 msgid "Synchronisation failed for %(domain)s with message: %(err)s"
 msgstr "La synchronisation a échoué pour %(domain)s avec le message : %(err)s"
 
-#: build/lib/mailbox_manager/admin.py:41 mailbox_manager/admin.py:41
+#: build/lib/mailbox_manager/admin.py:39 mailbox_manager/admin.py:39
 #, python-format
 msgid "Synchronisation succeed for %(domain)s. Imported mailboxes: %(mailboxes)s"
 msgstr "La synchronisation a réussi pour %(domain)s. Importation des boîtes mails : %(mailboxes)s"
 
-#: build/lib/mailbox_manager/admin.py:48 mailbox_manager/admin.py:48
+#: build/lib/mailbox_manager/admin.py:46 build/lib/mailbox_manager/admin.py:91
+#: mailbox_manager/admin.py:46 mailbox_manager/admin.py:91
 #, python-format
 msgid "Sync require enabled domains. Excluded domains: %(domains)s"
 msgstr "La synchro nécessite des domaines activés. Les domaines exclus sont : %(domains)s"
 
-#: build/lib/mailbox_manager/admin.py:53 mailbox_manager/admin.py:53
+#: build/lib/mailbox_manager/admin.py:51 mailbox_manager/admin.py:51
+msgid "Import aliases from dimail"
+msgstr ""
+
+#: build/lib/mailbox_manager/admin.py:78 mailbox_manager/admin.py:78
+#, python-format
+msgid "Synchronisation succeed for %(domain)s.Imported %(count_imported)s aliases: %(aliases)s"
+msgstr ""
+
+#: build/lib/mailbox_manager/admin.py:96 mailbox_manager/admin.py:96
 msgid "Check and update status from dimail"
 msgstr "Vérifier et mettre à jour le statut à partir de dimail"
 
-#: build/lib/mailbox_manager/admin.py:70 mailbox_manager/admin.py:70
+#: build/lib/mailbox_manager/admin.py:113 mailbox_manager/admin.py:113
 #, python-format
 msgid "- %(domain)s with message: %(err)s"
 msgstr "- %(domain)s avec le message : %(err)s"
 
-#: build/lib/mailbox_manager/admin.py:83 mailbox_manager/admin.py:83
+#: build/lib/mailbox_manager/admin.py:126 mailbox_manager/admin.py:126
 msgid "Check domains done with success."
 msgstr "Vérification des domaines effectuée avec succès."
 
-#: build/lib/mailbox_manager/admin.py:84 mailbox_manager/admin.py:84
+#: build/lib/mailbox_manager/admin.py:127 mailbox_manager/admin.py:127
 #, python-format
 msgid "Domains updated: %(domains)s"
 msgstr "Domaines mis à jour : %(domains)s"
 
-#: build/lib/mailbox_manager/admin.py:86 mailbox_manager/admin.py:86
+#: build/lib/mailbox_manager/admin.py:129 mailbox_manager/admin.py:129
 msgid "No domain updated."
 msgstr "Aucun domaine mis à jour."
 
-#: build/lib/mailbox_manager/admin.py:93 mailbox_manager/admin.py:93
+#: build/lib/mailbox_manager/admin.py:136 mailbox_manager/admin.py:136
 msgid "Check domain failed for:"
 msgstr "La vérification du domaine a échoué pour :"
 
-#: build/lib/mailbox_manager/admin.py:101 mailbox_manager/admin.py:101
+#: build/lib/mailbox_manager/admin.py:144 mailbox_manager/admin.py:144
 #, python-format
 msgid "Domains disabled are excluded from check: %(domains)s"
 msgstr "Les domaines désactivés sont exclus de la vérification : %(domains)s"
 
-#: build/lib/mailbox_manager/admin.py:106 mailbox_manager/admin.py:106
+#: build/lib/mailbox_manager/admin.py:149 mailbox_manager/admin.py:149
 msgid "Fetch domain expected config from dimail"
 msgstr "Récupérer la configuration attendue du domaine depuis dimail"
 
-#: build/lib/mailbox_manager/admin.py:120 mailbox_manager/admin.py:120
+#: build/lib/mailbox_manager/admin.py:163 mailbox_manager/admin.py:163
 #, python-format
 msgid "Domain expected config fetched with success for %(domain)s."
 msgstr "La configuration du domaine attendue a été récupérée avec succès pour %(domain)s."
 
-#: build/lib/mailbox_manager/admin.py:126 mailbox_manager/admin.py:126
+#: build/lib/mailbox_manager/admin.py:169 mailbox_manager/admin.py:169
 #, python-format
 msgid "Failed to fetch domain expected config for %(domain)s."
 msgstr "Impossible de récupérer la configuration attendue pour %(domain)s."
 
-#: build/lib/mailbox_manager/admin.py:132 mailbox_manager/admin.py:132
+#: build/lib/mailbox_manager/admin.py:175 mailbox_manager/admin.py:175
 #, python-format
 msgid "Domains disabled are excluded from fetch: %(domains)s"
 msgstr "Les domaines désactivés sont exclus de la récupération : %(domains)s"
 
-#: build/lib/mailbox_manager/admin.py:137 mailbox_manager/admin.py:137
+#: build/lib/mailbox_manager/admin.py:180 mailbox_manager/admin.py:180
 msgid "Send pending mailboxes to dimail"
 msgstr "Envoyer les adresses mail en attente à dimail"
 
-#: build/lib/mailbox_manager/admin.py:153 mailbox_manager/admin.py:153
+#: build/lib/mailbox_manager/admin.py:196 mailbox_manager/admin.py:196
 #, python-format
 msgid "Failed to send the following mailboxes : %(mailboxes)s."
 msgstr "Échec de l'envoi des adresses mail suivantes : %(mailboxes)s."
 
-#: build/lib/mailbox_manager/admin.py:159 mailbox_manager/admin.py:159
+#: build/lib/mailbox_manager/admin.py:202 mailbox_manager/admin.py:202
 #, python-format
 msgid "Pending mailboxes successfully sent for %(domain)s."
 msgstr "Succès de l'envoi des adresses en attente pour le domaine %(domain)s."
 
-#: build/lib/mailbox_manager/admin.py:165 mailbox_manager/admin.py:165
+#: build/lib/mailbox_manager/admin.py:208 mailbox_manager/admin.py:208
 #, python-format
 msgid "Domains disabled are excluded from : %(domains)s"
 msgstr "Les domaines désactivés ont été exclu : %(domains)s"
@@ -476,90 +487,102 @@ msgstr "Désactivé"
 msgid "Action required"
 msgstr "Action requise"
 
-#: build/lib/mailbox_manager/models.py:33 mailbox_manager/models.py:33
+#: build/lib/mailbox_manager/models.py:34 mailbox_manager/models.py:34
 msgid "[La Suite] Your domain is ready"
 msgstr "[La Suite] Votre domaine est prêt"
 
-#: build/lib/mailbox_manager/models.py:38 mailbox_manager/models.py:38
+#: build/lib/mailbox_manager/models.py:39 mailbox_manager/models.py:39
 msgid "[La Suite] Your domain requires action"
 msgstr "[La Suite] Des actions sont requises sur votre domaine"
 
-#: build/lib/mailbox_manager/models.py:43 mailbox_manager/models.py:43
+#: build/lib/mailbox_manager/models.py:44 mailbox_manager/models.py:44
 msgid "[La Suite] Your domain has failed"
 msgstr "[La Suite] Votre domaine est en erreur"
 
-#: build/lib/mailbox_manager/models.py:69 mailbox_manager/models.py:69
+#: build/lib/mailbox_manager/models.py:70 mailbox_manager/models.py:70
 msgid "support email"
 msgstr "adresse email du support"
 
-#: build/lib/mailbox_manager/models.py:73 mailbox_manager/models.py:73
+#: build/lib/mailbox_manager/models.py:74 mailbox_manager/models.py:74
 msgid "last check details"
 msgstr "détails de la dernière vérification"
 
-#: build/lib/mailbox_manager/models.py:74 mailbox_manager/models.py:74
+#: build/lib/mailbox_manager/models.py:75 mailbox_manager/models.py:75
 msgid "A JSON object containing the last health check details"
 msgstr "Un objet JSON contenant les derniers détails du bilan de santé"
 
-#: build/lib/mailbox_manager/models.py:79 mailbox_manager/models.py:79
+#: build/lib/mailbox_manager/models.py:80 mailbox_manager/models.py:80
 msgid "expected config"
 msgstr "configuration attendue"
 
-#: build/lib/mailbox_manager/models.py:80 mailbox_manager/models.py:80
+#: build/lib/mailbox_manager/models.py:81 mailbox_manager/models.py:81
 msgid "A JSON object containing the expected config"
 msgstr "Un objet JSON contenant la configuration attendue"
 
-#: build/lib/mailbox_manager/models.py:85 mailbox_manager/models.py:85
+#: build/lib/mailbox_manager/models.py:86 mailbox_manager/models.py:86
 msgid "Mail domain"
 msgstr "Domaine de messagerie"
 
-#: build/lib/mailbox_manager/models.py:86 mailbox_manager/models.py:86
+#: build/lib/mailbox_manager/models.py:87 mailbox_manager/models.py:87
 msgid "Mail domains"
 msgstr "Domaines de messagerie"
 
-#: build/lib/mailbox_manager/models.py:200 mailbox_manager/models.py:200
+#: build/lib/mailbox_manager/models.py:203 mailbox_manager/models.py:203
 msgid "User/mail domain relation"
 msgstr "Relation utilisateur/domaine de messagerie"
 
-#: build/lib/mailbox_manager/models.py:201 mailbox_manager/models.py:201
+#: build/lib/mailbox_manager/models.py:204 mailbox_manager/models.py:204
 msgid "User/mail domain relations"
 msgstr "Relations utilisateur/domaine de messagerie"
 
-#: build/lib/mailbox_manager/models.py:274 mailbox_manager/models.py:274
+#: build/lib/mailbox_manager/models.py:277 mailbox_manager/models.py:277
 msgid "local_part"
 msgstr "local_part"
 
-#: build/lib/mailbox_manager/models.py:288 mailbox_manager/models.py:288
+#: build/lib/mailbox_manager/models.py:291 mailbox_manager/models.py:291
 msgid "secondary email address"
 msgstr "adresse email secondaire"
 
-#: build/lib/mailbox_manager/models.py:299 mailbox_manager/models.py:299
+#: build/lib/mailbox_manager/models.py:302 mailbox_manager/models.py:302
 msgid "email"
 msgstr "email"
 
-#: build/lib/mailbox_manager/models.py:305 mailbox_manager/models.py:305
+#: build/lib/mailbox_manager/models.py:308 mailbox_manager/models.py:308
 msgid "Mailbox"
 msgstr "Boîte mail"
 
-#: build/lib/mailbox_manager/models.py:306 mailbox_manager/models.py:306
+#: build/lib/mailbox_manager/models.py:309 mailbox_manager/models.py:309
 msgid "Mailboxes"
 msgstr "Boîtes mail"
 
-#: build/lib/mailbox_manager/models.py:348 mailbox_manager/models.py:348
+#: build/lib/mailbox_manager/models.py:351 mailbox_manager/models.py:351
 msgid "You can't create or update a mailbox for a disabled domain."
 msgstr "Vous ne pouvez pas créer ou mettre à jour une boîte mail pour un domaine désactivé."
 
-#: build/lib/mailbox_manager/models.py:405 mailbox_manager/models.py:405
+#: build/lib/mailbox_manager/models.py:408 mailbox_manager/models.py:408
 msgid "Mail domain invitation"
 msgstr "Invitation au domaine de messagerie"
 
-#: build/lib/mailbox_manager/models.py:406 mailbox_manager/models.py:406
+#: build/lib/mailbox_manager/models.py:409 mailbox_manager/models.py:409
 msgid "Mail domain invitations"
 msgstr "Invitations au domaine de messagerie"
 
-#: build/lib/mailbox_manager/models.py:418 mailbox_manager/models.py:418
+#: build/lib/mailbox_manager/models.py:421 mailbox_manager/models.py:421
 msgid "[La Suite] You have been invited to join La Régie"
 msgstr "[La Suite] Vous avez été invité(e) à rejoindre la Régie"
 
+#: build/lib/mailbox_manager/models.py:465 mailbox_manager/models.py:465
+msgid "destination address"
+msgstr "adresse de destination"
+
+#: build/lib/mailbox_manager/models.py:483 mailbox_manager/models.py:483
+msgid "Alias"
+msgstr "Alias"
+
+#: build/lib/mailbox_manager/models.py:484 mailbox_manager/models.py:484
+msgid "Aliases"
+msgstr "Alias"
+
 #: build/lib/mailbox_manager/utils/dimail.py:296
 #: mailbox_manager/utils/dimail.py:296
 msgid "Your new mailbox information"

src/backend/mailbox_manager/admin.py

@@ -10,8 +10,6 @@ from requests import exceptions
 from mailbox_manager import enums, models
 from mailbox_manager.utils.dimail import DimailAPIClient
 
-# Prevent Ruff complaining about mark_safe below
-
 
 @admin.action(description=_("Import emails from dimail"))
 def sync_mailboxes_from_dimail(modeladmin, request, queryset):  # pylint: disable=unused-argument
@@ -50,6 +48,51 @@ def sync_mailboxes_from_dimail(modeladmin, request, queryset):  # pylint: disabl
         )
 
 
+@admin.action(description=_("Import aliases from dimail"))
+def sync_aliases_from_dimail(modeladmin, request, queryset):  # pylint: disable=unused-argument
+    """
+    Admin action to import existing aliases from dimail.
+    Checks alias is not a duplicate and that usernames don't clash with existing mailboxes.
+    """
+    excluded_domains = []
+
+    client = DimailAPIClient()
+
+    for domain in queryset:
+        if domain.status != enums.MailDomainStatusChoices.ENABLED:
+            excluded_domains.append(domain.name)
+            continue
+
+        try:
+            imported_aliases = client.import_aliases(domain)
+        except exceptions.HTTPError as err:
+            messages.error(
+                request,
+                _("Synchronisation failed for %(domain)s with message: %(err)s")
+                % {"domain": domain.name, "err": err},
+            )
+        else:
+            messages.success(
+                request,
+                _(
+                    "Synchronisation succeed for %(domain)s.\
+Imported %(count_imported)s aliases: %(aliases)s"
+                )
+                % {
+                    "domain": domain.name,
+                    "count_imported": len(imported_aliases),
+                    "aliases": ", ".join(imported_aliases),
+                },
+            )
+
+    if excluded_domains:
+        messages.warning(
+            request,
+            _("Sync require enabled domains. Excluded domains: %(domains)s")
+            % {"domains": ", ".join(excluded_domains)},
+        )
+
+
 @admin.action(description=_("Check and update status from dimail"))
 def fetch_domain_status_from_dimail(modeladmin, request, queryset):  # pylint: disable=unused-argument
     """Admin action to check domain health with dimail and update domain status."""
@@ -193,6 +236,7 @@ class MailDomainAdmin(admin.ModelAdmin):
     inlines = (UserMailDomainAccessInline,)
     actions = (
         sync_mailboxes_from_dimail,
+        sync_aliases_from_dimail,
         fetch_domain_status_from_dimail,
         fetch_domain_expected_config_from_dimail,
         send_pending_mailboxes,
@@ -266,3 +310,13 @@ class MailDomainInvitationAdmin(admin.ModelAdmin):
     def is_expired(self, obj):
         """Return the expiration date of the invitation."""
         return obj.is_expired
+
+
+@admin.register(models.Alias)
+class AliasAdmin(admin.ModelAdmin):
+    """Admin for alias model."""
+
+    list_display = ("local_part", "domain", "destination", "updated_at")
+    list_filter = ("domain",)
+    search_fields = ("local_part", "domain__name", "destination")
+    readonly_fields = ["updated_at"]

src/backend/mailbox_manager/api/client/serializers.py

@@ -4,6 +4,7 @@ from logging import getLogger
 
 from django.contrib.auth.hashers import make_password
 from django.core import exceptions as django_exceptions
+from django.shortcuts import get_object_or_404
 
 from requests.exceptions import HTTPError
 from rest_framework import exceptions, serializers
@@ -78,17 +79,6 @@ class MailboxSerializer(serializers.ModelSerializer):
 
         return mailbox
 
-    def validate_local_part(self, value):
-        """Validate this local part does not match a mailbox."""
-        if models.Alias.objects.filter(
-            local_part=value, domain__slug=self.context["domain_slug"]
-        ):
-            raise exceptions.ValidationError(
-                f'Local part "{value}" already used by an alias.'
-            )
-
-        return value
-
 
 class MailboxUpdateSerializer(MailboxSerializer):
     """A more restrictive serializer when updating mailboxes"""
@@ -306,7 +296,9 @@ class MailDomainInvitationSerializer(serializers.ModelSerializer):
 
 
 class AliasSerializer(serializers.ModelSerializer):
-    """Serialize mailbox."""
+    """Serialize aliases."""
+
+    domain = MailDomainSerializer(default="")
 
     class Meta:
         model = models.Alias
@@ -314,8 +306,13 @@ class AliasSerializer(serializers.ModelSerializer):
             "id",
             "local_part",
             "destination",
+            "domain",
         ]
-        read_only_fields = ["id"]
+        read_only_fields = ["id", "domain"]
+
+    def validate_domain(self, value):  # pylint: disable=unused-argument
+        """Forcefully set domain field to url domain."""
+        return get_object_or_404(models.MailDomain, slug=self.context["domain_slug"])
 
     def create(self, validated_data):
         """
@@ -330,14 +327,3 @@ class AliasSerializer(serializers.ModelSerializer):
             return super().create(validated_data)
 
         return None
-
-    def validate_local_part(self, value):
-        """Validate this local part does not match a mailbox."""
-        if models.Mailbox.objects.filter(
-            local_part=value, domain__slug=self.context["domain_slug"]
-        ).exists():
-            raise exceptions.ValidationError(
-                f'Local part "{value}" already used by a mailbox.'
-            )
-
-        return value

src/backend/mailbox_manager/api/client/viewsets.py

@@ -1,6 +1,7 @@
 """API endpoints"""
 
 from django.db.models import Q, Subquery
+from django.http import Http404
 
 from rest_framework import exceptions, filters, mixins, status, viewsets
 from rest_framework.decorators import action
@@ -347,6 +348,7 @@ class MailDomainInvitationViewset(
     mixins.CreateModelMixin,
     mixins.ListModelMixin,
     mixins.RetrieveModelMixin,
+    mixins.DestroyModelMixin,
     viewsets.GenericViewSet,
 ):
     """API ViewSet for user invitations to domain management.
@@ -364,6 +366,9 @@ class MailDomainInvitationViewset(
 
     PUT / PATCH : Not permitted. Instead of updating your invitation,
         delete and create a new one.
+
+    DELETE /api/<version>/mail-domains/<domain_slug>/invitations/:<invitation_id>/
+        Delete targeted invitation
     """
 
     lookup_field = "id"
@@ -422,16 +427,20 @@ class AliasViewSet(
         - destination: str
         Return a newly created alias
 
-    DELETE /api/<version>/mail-domains/<domain_slug>/accesses/<alias-local-part>/
+    DELETE /api/<version>/mail-domains/<domain_slug>/aliases/<alias_pk>/
         Delete targeted alias
+
+    DELETE /api/<version>/mail-domains/<domain_slug>/aliases/?local_part=<local_part>/
+        Delete all aliases of targeted local_part
     """
 
-    lookup_field = "local_part"
+    lookup_field = "pk"
     permission_classes = [permissions.DomainResourcePermission]
     serializer_class = serializers.AliasSerializer
-    queryset = (
-        models.Alias.objects.all().select_related("domain").order_by("-created_at")
-    )
+    queryset = models.Alias.objects.all().select_related("domain")
+    filter_backends = [filters.OrderingFilter]
+    ordering_fields = ["local_part"]
+    ordering = ["local_part"]
 
     def get_serializer_context(self):
         """Extra context provided to the serializer class."""
@@ -459,39 +468,43 @@ class AliasViewSet(
 
         return queryset
 
-    def get_permissions(self):
-        """Add a specific permission for domain viewers to delete their aliases."""
-        if self.action in ["destroy"]:
-            permission_classes = [
-                permissions.DomainResourcePermission
-                | permissions.IsAliasDestinationPermission,
-            ]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
-
-    def perform_create(self, serializer):
-        """Create new mailbox."""
-        domain_slug = self.kwargs.get("domain_slug", "")
-        if domain_slug:
-            serializer.validated_data["domain"] = models.MailDomain.objects.get(
-                slug=domain_slug
-            )
-        super().perform_create(serializer)
-
     def destroy(self, request, *args, **kwargs):
-        """Override destroy method to send a delete request to dimail
-        and return clear message if domain out of sync."""
+        """
+        Override destroy method to delete specific alias and send request to dimail.
+        """
         instance = self.get_object()
         self.perform_destroy(instance)
 
         client = DimailAPIClient()
         dimail_response = client.delete_alias(instance)
+
         if dimail_response.status_code == status.HTTP_404_NOT_FOUND:
             return Response(
-                "Alias already deleted. Domain out of sync, please contact our support.",
+                "Domain out of sync with mailbox provider, please contact our support.",
                 status=status.HTTP_200_OK,
             )
 
         return Response(status=status.HTTP_204_NO_CONTENT)
+
+    @action(methods=["DELETE"], detail=False)
+    def delete(self, request, *args, **kwargs):
+        """Bulk delete aliases. Filtering is required and accepted filter is local_part."""
+
+        if "local_part" not in self.request.query_params:
+            return Response(status=status.HTTP_400_BAD_REQUEST)
+
+        local_part = self.request.query_params["local_part"]
+        queryset = self.get_queryset().filter(
+            local_part=local_part
+        )  # Manually call get_queryset to filter by domain and role
+        if not queryset:
+            raise Http404("No Alias matches the given query.")
+
+        # view is bounded to a domain, fetch is from the queryset to spare a dedicated DB request"
+        domain_name = queryset[0].domain.name
+        queryset.delete()
+
+        client = DimailAPIClient()
+        client.delete_multiple_alias(local_part, domain_name)
+
+        return Response(status=status.HTTP_204_NO_CONTENT)

src/backend/mailbox_manager/api/permissions.py

@@ -26,7 +26,7 @@ class DomainPermission(IsAuthenticated):
             slug=view.kwargs.get("domain_slug", ""),
             accesses__user=request.user,
         )
-        # domain = models.MailDomain.objects.get(slug=view.kwargs.get("domain_slug", ""))
+
         abilities = domain.get_abilities(request.user)
         if request.method.lower() == "delete":
             return abilities.get("manage_accesses", False)
@@ -55,17 +55,3 @@ class IsMailboxOwnerPermission(permissions.BasePermission):
     def has_object_permission(self, request, view, obj):
         """If the user is trying to update their own mailbox."""
         return obj.get_email() == request.user.email
-
-
-class IsAliasDestinationPermission(IsAuthenticated):
-    """Can delete an alias if the alias points to their own email address."""
-
-    def has_permission(self, request, view):
-        """This permission is specifically about updates"""
-        domain = models.MailDomain.objects.get(slug=view.kwargs.get("domain_slug", ""))
-        abilities = domain.get_abilities(request.user)
-        return abilities["get"]
-
-    def has_object_permission(self, request, view, obj):
-        """If the user is trying to update their own mailbox."""
-        return obj.destination == request.user.email

src/backend/mailbox_manager/migrations/0028_alias.py

@@ -19,7 +19,7 @@ class Migration(migrations.Migration):
                 ('created_at', models.DateTimeField(auto_now_add=True, help_text='date and time at which a record was created', verbose_name='created at')),
                 ('updated_at', models.DateTimeField(auto_now=True, help_text='date and time at which a record was last updated', verbose_name='updated at')),
                 ('local_part', models.CharField(max_length=100)),
-                ('destination', models.EmailField(max_length=254, verbose_name='destination address')),
+                ('destination', models.CharField(max_length=254, validators=[django.core.validators.EmailValidator(allowlist=['localhost', 'devnull'])], verbose_name='destination address')),
                 ('domain', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='aliases', to='mailbox_manager.maildomain')),
             ],
             options={

src/backend/mailbox_manager/migrations/0029_alter_alias_unique_together_alias_no_duplicate.py

@@ -0,0 +1,21 @@
+# Generated by Django 5.2.9 on 2025-12-17 17:01
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mailbox_manager', '0028_alias'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='alias',
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name='alias',
+            constraint=models.UniqueConstraint(fields=('domain', 'local_part', 'destination'), name='no_duplicate'),
+        ),
+    ]

src/backend/mailbox_manager/models.py

@@ -9,6 +9,7 @@ from django.conf import settings
 from django.contrib.auth.base_user import AbstractBaseUser
 from django.contrib.sites.models import Site
 from django.core import exceptions, mail, validators
+from django.core.validators import EmailValidator
 from django.db import models
 from django.db.models.functions import Lower
 from django.template.loader import render_to_string
@@ -89,6 +90,8 @@ class MailDomain(BaseModel):
     def __str__(self):
         return self.name
 
+    objects = models.Manager()
+
     def save(self, *args, **kwargs):
         """Override save function to compute the slug."""
         self.slug = self.get_slug()
@@ -458,7 +461,15 @@ class Alias(BaseModel):
     """Model for aliases."""
 
     local_part = models.CharField(max_length=100, blank=False)
-    destination = models.EmailField(_("destination address"), null=False, blank=False)
+    destination = models.CharField(
+        _("destination address"),
+        max_length=254,
+        null=False,
+        blank=False,
+        validators=[
+            EmailValidator(allowlist=["localhost", "devnull"]),
+        ],
+    )
     domain = models.ForeignKey(
         MailDomain,
         on_delete=models.CASCADE,
@@ -471,8 +482,12 @@ class Alias(BaseModel):
         db_table = "people_aliases"
         verbose_name = _("Alias")
         verbose_name_plural = _("Aliases")
-        unique_together = ("local_part", "destination")
         ordering = ["-created_at"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["domain", "local_part", "destination"], name="no_duplicate"
+            )
+        ]
 
     def __str__(self):
         return f"{self.local_part} to {self.destination}"

src/backend/mailbox_manager/tests/api/aliases/test_api_aliases_bulk_delete.py

@@ -0,0 +1,129 @@
+"""
+Tests for aliases API endpoint in People's app mailbox_manager.
+Focus on "bulk delete" action.
+"""
+# pylint: disable=W0613
+
+import re
+
+import pytest
+import responses
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from core import factories as core_factories
+
+from mailbox_manager import enums, factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_aliases_bulk_delete__anonymous_get_401():
+    """Anonymous user should not be able to bulk delete."""
+    mail_domain = factories.MailDomainFactory()
+    alias_, _, _ = factories.AliasFactory.create_batch(3, domain=mail_domain)
+
+    client = APIClient()
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/?local_part={alias_.local_part}",
+    )
+
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert models.Alias.objects.count() == 3
+
+
+def test_api_aliases_bulk_delete__no_access_get_404():
+    """User with no access to domain should not be able to bulk delete."""
+    mail_domain = factories.MailDomainFactory()
+    alias_, _, _ = factories.AliasFactory.create_batch(3, domain=mail_domain)
+
+    client = APIClient()
+    client.force_login(core_factories.UserFactory())
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/?local_part={alias_.local_part}",
+    )
+
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert models.Alias.objects.count() == 3
+
+
+def test_api_aliases_bulk_delete__viewer_get_403():
+    """Viewer user should not be able to bulk delete."""
+    access = factories.MailDomainAccessFactory(role=enums.MailDomainRoleChoices.VIEWER)
+    alias_, _, _ = factories.AliasFactory.create_batch(3, domain=access.domain)
+
+    client = APIClient()
+    client.force_login(access.user)
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/aliases/?local_part={alias_.local_part}",
+    )
+
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert models.Alias.objects.count() == 3
+
+
+@responses.activate
+def test_api_aliases_bulk_delete__administrators_allowed_all_destination(
+    dimail_token_ok,
+):
+    """
+    Administrators of a domain should be allowed to bulk delete all aliases
+    of a given local_part.
+    """
+    authenticated_user = core_factories.UserFactory()
+    mail_domain = factories.MailDomainFactory(
+        users=[(authenticated_user, enums.MailDomainRoleChoices.ADMIN)]
+    )
+    alias_ = factories.AliasFactory(domain=mail_domain)
+    factories.AliasFactory.create_batch(
+        2, domain=mail_domain, local_part=alias_.local_part
+    )
+
+    # additional aliases that shouldn't be affected
+    factories.AliasFactory.create_batch(
+        2, domain=mail_domain, destination=alias_.destination
+    )
+    factories.AliasFactory(
+        local_part=alias_.local_part,
+        destination=alias_.destination,
+    )
+
+    # Mock dimail response
+    responses.delete(
+        re.compile(r".*/aliases/"),
+        status=status.HTTP_204_NO_CONTENT,
+        content_type="application/json",
+    )
+
+    client = APIClient()
+    client.force_login(authenticated_user)
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/?local_part={alias_.local_part}",
+    )
+
+    assert response.status_code == status.HTTP_204_NO_CONTENT
+    assert models.Alias.objects.count() == 3
+    assert not models.Alias.objects.filter(
+        domain=mail_domain, local_part=alias_.local_part
+    ).exists()
+
+
+def test_api_aliases_bulk_delete__no_local_part_bad_request():
+    """Filtering by local part is mandatory when bulk deleting aliases."""
+    authenticated_user = core_factories.UserFactory()
+    mail_domain = factories.MailDomainFactory(
+        users=[(authenticated_user, enums.MailDomainRoleChoices.ADMIN)]
+    )
+    alias_ = factories.AliasFactory(domain=mail_domain)
+    factories.AliasFactory.create_batch(
+        2, domain=mail_domain, local_part=alias_.local_part
+    )
+
+    client = APIClient()
+    client.force_login(authenticated_user)
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/",
+    )
+
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert models.Alias.objects.count() == 3

src/backend/mailbox_manager/tests/api/aliases/test_api_aliases_create.py

@@ -4,7 +4,6 @@ Focus on "create" action.
 """
 # pylint: disable=W0613
 
-import json
 import re
 
 import pytest
@@ -60,8 +59,9 @@ def test_api_aliases_create__viewer_forbidden():
     assert not models.Alias.objects.exists()
 
 
+@responses.activate
 def test_api_aliases_create__duplicate_forbidden():
-    """Cannot create alias if same local part + destination."""
+    """Cannot create alias if existing alias same domain + local part + destination."""
     access = factories.MailDomainAccessFactory(
         role="owner", domain=factories.MailDomainEnabledFactory()
     )
@@ -80,26 +80,6 @@ def test_api_aliases_create__duplicate_forbidden():
     assert models.Alias.objects.filter(domain=access.domain).count() == 1
 
 
-def test_api_aliases_create__existing_mailbox_bad_request():
-    """Cannot create alias if local_part is already used by a mailbox."""
-    access = factories.MailDomainAccessFactory(
-        role="owner", domain=factories.MailDomainEnabledFactory()
-    )
-    mailbox = factories.MailboxFactory(domain=access.domain)
-
-    client = APIClient()
-    client.force_login(access.user)
-    response = client.post(
-        f"/api/v1.0/mail-domains/{access.domain.slug}/aliases/",
-        {"local_part": mailbox.local_part, "destination": "someone@outsidedomain.com"},
-    )
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert response.json() == {
-        "local_part": [f'Local part "{mailbox.local_part}" already used by a mailbox.']
-    }
-    assert not models.Alias.objects.exists()
-
-
 @responses.activate
 def test_api_aliases_create__async_alias_bad_request(dimail_token_ok):
     """
@@ -113,10 +93,9 @@ def test_api_aliases_create__async_alias_bad_request(dimail_token_ok):
     client = APIClient()
     client.force_login(access.user)
     # Mock dimail response
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(r".*/aliases/"),
-        body=json.dumps({"detail": "Alias already exists"}),
+        json={"detail": "Alias already exists"},
         status=status.HTTP_409_CONFLICT,
         content_type="application/json",
     )
@@ -150,17 +129,14 @@ def test_api_aliases_create__admins_ok(role, dimail_token_ok):
     client.force_login(access.user)
     # Prepare responses
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/aliases/"),
-        body=json.dumps(
-            {
-                "username": "contact",
-                "domain": access.domain.name,
-                "destination": "someone@outsidedomain.com",
-                "allow_to_send": True,
-            }
-        ),
+        json={
+            "username": "contact",
+            "domain": access.domain.name,
+            "destination": "someone@outsidedomain.com",
+            "allow_to_send": True,
+        },
         status=status.HTTP_201_CREATED,
         content_type="application/json",
     )
@@ -173,3 +149,64 @@ def test_api_aliases_create__admins_ok(role, dimail_token_ok):
     alias = models.Alias.objects.get()
     assert alias.local_part == "contact"
     assert alias.destination == "someone@outsidedomain.com"
+
+
+@responses.activate
+def test_api_aliases_create__existing_mailbox_ok(dimail_token_ok):
+    """Can create alias even if local_part is already used by a mailbox."""
+    access = factories.MailDomainAccessFactory(
+        role="owner", domain=factories.MailDomainEnabledFactory()
+    )
+    mailbox = factories.MailboxFactory(domain=access.domain)
+
+    client = APIClient()
+    client.force_login(access.user)
+
+    responses.post(
+        re.compile(rf".*/domains/{access.domain.name}/aliases/"),
+        json={
+            "username": mailbox.local_part,
+            "domain": access.domain.name,
+            "destination": "someone@outsidedomain.com",
+            "allow_to_send": False,
+        },
+        status=status.HTTP_201_CREATED,
+        content_type="application/json",
+    )
+
+    response = client.post(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/aliases/",
+        {"local_part": mailbox.local_part, "destination": "someone@outsidedomain.com"},
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    assert models.Alias.objects.exists()
+
+
+@responses.activate
+def test_api_aliases_create__devnull_destination_ok(dimail_token_ok):
+    """Can create alias where destination is devnull@devnull."""
+    access = factories.MailDomainAccessFactory(
+        role="owner", domain=factories.MailDomainEnabledFactory()
+    )
+
+    client = APIClient()
+    client.force_login(access.user)
+
+    responses.post(
+        re.compile(rf".*/domains/{access.domain.name}/aliases/"),
+        json={
+            "username": "spammy-address",
+            "domain": access.domain.name,
+            "destination": "devnull@devnull",
+            "allow_to_send": False,
+        },
+        status=status.HTTP_201_CREATED,
+        content_type="application/json",
+    )
+
+    response = client.post(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/aliases/",
+        {"local_part": "spammy-address", "destination": "devnull@devnull"},
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    assert models.Alias.objects.exists()

src/backend/mailbox_manager/tests/api/aliases/test_api_aliases_delete.py

@@ -1,6 +1,6 @@
 """
 Tests for aliases API endpoint in People's app mailbox_manager.
-Focus on "list" action.
+Focus on "delete" action.
 """
 # pylint: disable=W0613
 
@@ -20,11 +20,12 @@ pytestmark = pytest.mark.django_db
 
 def test_api_aliases_delete__anonymous():
     """Anonymous user should not be able to delete aliases."""
-    alias = factories.AliasFactory()
+    alias_ = factories.AliasFactory()
 
     response = APIClient().delete(
-        f"/api/v1.0/mail-domains/{alias.domain.slug}/aliases/{alias.local_part}/",
+        f"/api/v1.0/mail-domains/{alias_.domain.slug}/aliases/{alias_.pk}/"
     )
+
     assert response.status_code == status.HTTP_401_UNAUTHORIZED
     assert models.Alias.objects.count() == 1
 
@@ -35,12 +36,12 @@ def test_api_aliases_delete__no_access_forbidden_not_found():
     mail domain to which they are not related.
     """
     authenticated_user = core_factories.UserFactory()
-    alias = factories.AliasFactory()
+    alias_ = factories.AliasFactory()
 
     client = APIClient()
     client.force_login(authenticated_user)
     response = client.delete(
-        f"/api/v1.0/mail-domains/{alias.domain.slug}/aliases/{alias.local_part}/",
+        f"/api/v1.0/mail-domains/{alias_.domain.slug}/aliases/{alias_.pk}/"
     )
 
     assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -56,59 +57,40 @@ def test_api_aliases_delete__viewer_forbidden():
     mail_domain = factories.MailDomainFactory(
         users=[(authenticated_user, enums.MailDomainRoleChoices.VIEWER)]
     )
-    alias = factories.AliasFactory(domain=mail_domain)
+    alias_ = factories.AliasFactory(domain=mail_domain)
 
     client = APIClient()
     client.force_login(authenticated_user)
     response = client.delete(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias.local_part}/",
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias_.pk}/"
     )
 
     assert response.status_code == status.HTTP_403_FORBIDDEN
     assert models.Alias.objects.count() == 1
 
 
-@responses.activate
-def test_api_aliases_delete__viewer_can_delete_self_alias(dimail_token_ok):
-    """
-    Authenticated users should be allowed to delete aliases when linking
-    to their own mailbox.
-    """
-    authenticated_user = core_factories.UserFactory()
-    mail_domain = factories.MailDomainFactory(
-        users=[(authenticated_user, enums.MailDomainRoleChoices.VIEWER)]
-    )
-    alias = factories.AliasFactory(
-        domain=mail_domain, destination=authenticated_user.email
-    )
-
-    # Mock dimail response
-    responses.delete(
-        re.compile(r".*/aliases/"),
-        status=status.HTTP_204_NO_CONTENT,
-        content_type="application/json",
-    )
-
-    client = APIClient()
-    client.force_login(authenticated_user)
-    response = client.delete(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias.local_part}/",
-    )
-
-    assert response.status_code == status.HTTP_204_NO_CONTENT
-    assert not models.Alias.objects.exists()
-
-
 @responses.activate
 def test_api_aliases_delete__administrators_allowed(dimail_token_ok):
     """
-    Administrators of a mail domain should be allowed to delete accesses excepted owner accesses.
+    Administrators of a mail domain should be allowed to delete aliases.
     """
     authenticated_user = core_factories.UserFactory()
     mail_domain = factories.MailDomainFactory(
         users=[(authenticated_user, enums.MailDomainRoleChoices.ADMIN)]
     )
-    alias = factories.AliasFactory(domain=mail_domain)
+    alias_ = factories.AliasFactory(domain=mail_domain)
+    factories.AliasFactory.create_batch(
+        2, domain=mail_domain, local_part=alias_.local_part
+    )
+
+    # additional aliases that shouldn't be affected
+    factories.AliasFactory.create_batch(
+        2, domain=mail_domain, destination=alias_.destination
+    )
+    factories.AliasFactory(
+        local_part=alias_.local_part,
+        destination=alias_.destination,
+    )
 
     # Mock dimail response
     responses.delete(
@@ -120,11 +102,10 @@ def test_api_aliases_delete__administrators_allowed(dimail_token_ok):
     client = APIClient()
     client.force_login(authenticated_user)
     response = client.delete(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias.local_part}/",
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias_.pk}/"
     )
-
     assert response.status_code == status.HTTP_204_NO_CONTENT
-    assert not models.Alias.objects.exists()
+    assert models.Alias.objects.count() == 5
 
 
 @responses.activate
@@ -136,8 +117,7 @@ def test_api_aliases_delete__404_out_of_sync(dimail_token_ok):
     mail_domain = factories.MailDomainFactory(
         users=[(authenticated_user, enums.MailDomainRoleChoices.ADMIN)]
     )
-    alias = factories.AliasFactory(domain=mail_domain)
-
+    alias_ = factories.AliasFactory(domain=mail_domain)
     # Mock dimail response
     responses.delete(
         re.compile(r".*/aliases/"),
@@ -149,11 +129,11 @@ def test_api_aliases_delete__404_out_of_sync(dimail_token_ok):
     client = APIClient()
     client.force_login(authenticated_user)
     response = client.delete(
-        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias.local_part}/",
+        f"/api/v1.0/mail-domains/{mail_domain.slug}/aliases/{alias_.pk}/"
     )
     assert response.status_code == status.HTTP_200_OK
     assert (
         response.json()
-        == "Alias already deleted. Domain out of sync, please contact our support."
+        == "Domain out of sync with mailbox provider, please contact our support."
     )
     assert not models.Alias.objects.exists()

src/backend/mailbox_manager/tests/api/aliases/test_api_aliases_list.py

@@ -59,4 +59,7 @@ def test_api_aliases_list__authorized_ok(role):
         f"/api/v1.0/mail-domains/{access.domain.slug}/aliases/",
     )
     assert response.status_code == status.HTTP_200_OK
+    assert response.json()["results"] == sorted(
+        response.json()["results"], key=lambda x: x["local_part"]
+    )
     assert response.json()["count"] == 5

src/backend/mailbox_manager/tests/api/invitations/test_api_domain_invitations_delete.py

@@ -0,0 +1,76 @@
+"""
+Tests for MailDomainInvitation API endpoint in People's app mailbox_manager.
+Focus on "delete" action.
+"""
+
+import pytest
+from rest_framework import status
+from rest_framework.test import APIClient
+
+from mailbox_manager import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_api_domain_invitations__delete__anonymous():
+    """Anonymous users should not be able to delete invitations."""
+    domain = factories.MailDomainEnabledFactory()
+    invitation = factories.MailDomainInvitationFactory()
+
+    response = APIClient().delete(
+        f"/api/v1.0/mail-domains/{domain.slug}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+    assert response.json() == {
+        "detail": "Authentication credentials were not provided."
+    }
+    assert models.MailDomainInvitation.objects.count() == 1
+
+
+def test_api_domain_invitations__delete__no_access_not_found():
+    """Users should not be permitted to delete invitations
+    on domains they don't manage."""
+    domain = factories.MailDomainEnabledFactory()
+    invitation = factories.MailDomainInvitationFactory()
+
+    other_access = factories.MailDomainAccessFactory(role="owner")  # unrelated access
+    client = APIClient()
+    client.force_login(other_access.user)
+
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{domain.slug}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_404_NOT_FOUND
+    assert models.MailDomainInvitation.objects.count() == 1
+
+
+def test_api_domain_invitations__delete__viewers_forbidden():
+    """Domain viewers should not be permitted to delete invitations."""
+    access = factories.MailDomainAccessFactory(role="viewer")
+    invitation = factories.MailDomainInvitationFactory(domain=access.domain)
+
+    client = APIClient()
+    client.force_login(access.user)
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+    assert models.MailDomainInvitation.objects.count() == 1
+
+
+@pytest.mark.parametrize(
+    "role",
+    ["owner", "administrator"],
+)
+def test_api_domain_invitations__delete_admins_ok(role):
+    """Domain owners and admins should be able to delete invitations."""
+    access = factories.MailDomainAccessFactory(role=role)
+    invitation = factories.MailDomainInvitationFactory(domain=access.domain)
+
+    client = APIClient()
+    client.force_login(access.user)
+    response = client.delete(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/invitations/{invitation.id}/",
+    )
+    assert response.status_code == status.HTTP_204_NO_CONTENT
+    assert not models.MailDomainInvitation.objects.exists()

src/backend/mailbox_manager/tests/api/mail_domain/test_api_mail_domains_create.py

@@ -68,8 +68,7 @@ def test_api_mail_domains__create_authenticated():
 
     domain_name = "test.domain.fr"
 
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(r".*/domains/"),
         body=str(
             {
@@ -81,17 +80,15 @@ def test_api_mail_domains__create_authenticated():
     )
     body_content_domain1 = CHECK_DOMAIN_BROKEN.copy()
     body_content_domain1["name"] = domain_name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain_name}/check/"),
-        body=json.dumps(body_content_domain1),
+        json=body_content_domain1,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain_name}/spec/"),
-        body=json.dumps(DOMAIN_SPEC),
+        json=DOMAIN_SPEC,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -155,30 +152,25 @@ def test_api_mail_domains__create_dimail_domain(caplog):
     client.force_login(user)
     domain_name = "test.fr"
 
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(r".*/domains/"),
-        body=str(
-            {
-                "name": domain_name,
-            }
-        ),
+        json={
+            "name": domain_name,
+        }
         status=status.HTTP_201_CREATED,
         content_type="application/json",
     )
     body_content_domain1 = CHECK_DOMAIN_OK.copy()
     body_content_domain1["name"] = domain_name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain_name}/check/"),
-        body=json.dumps(body_content_domain1),
+        json=body_content_domain1,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain_name}/spec/"),
-        body=json.dumps(DOMAIN_SPEC),
+        json=DOMAIN_SPEC,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -213,8 +205,7 @@ def test_api_mail_domains__no_creation_when_dimail_duplicate(caplog):
         "status_code": status.HTTP_409_CONFLICT,
         "detail": "Domain already exists",
     }
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(r".*/domains/"),
         body=str({"detail": dimail_error["detail"]}),
         status=dimail_error["status_code"],

src/backend/mailbox_manager/tests/api/mail_domain/test_api_mail_domains_fetch.py

@@ -104,14 +104,12 @@ def test_api_mail_domains__fetch_from_dimail_admin_successful(role):
     assert domain.expected_config is None
     assert domain.last_check_details is None
 
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
         json=dimail_fixtures.CHECK_DOMAIN_OK,
         status=200,
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/spec/"),
         json=dimail_fixtures.DOMAIN_SPEC,
         status=200,

src/backend/mailbox_manager/tests/api/mailboxes/test_api_mailboxes_create.py

@@ -122,8 +122,7 @@ def test_api_mailboxes__create_display_name_no_constraint_on_different_domains(
 
     # ensure response
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{new_mailbox_data['local_part']}@{access.domain.name}"
@@ -160,8 +159,7 @@ def test_api_mailboxes__create_roles_success(role, dimail_token_ok, mailbox_data
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{mail_domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_data['local_part']}@{mail_domain.name}"
@@ -210,8 +208,7 @@ def test_api_mailboxes__create_with_accent_success(role, dimail_token_ok):
 
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{mail_domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_values['local_part']}@{mail_domain.name}"
@@ -285,8 +282,7 @@ def test_api_mailboxes__create_without_secondary_email(role, caplog, dimail_toke
     del mailbox_values["secondary_email"]
 
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{mail_domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_values['local_part']}@{mail_domain.name}"
@@ -386,8 +382,7 @@ def test_api_mailboxes__same_local_part_on_different_domains(dimail_token_ok):
         factories.MailboxFactory.build(local_part=existing_mailbox.local_part)
     ).data
 
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_values['local_part']}@{access.domain.name}"
@@ -439,10 +434,9 @@ def test_api_mailboxes__create_pending_mailboxes(domain_status, mailbox_data):
     assert mailbox.status == "pending"
 
 
-def test_api_mailboxes__existing_alias_bad_request(mailbox_data):
-    """
-    Cannot create mailbox if local_part is already used by an alias.
-    """
+@responses.activate
+def test_api_mailboxes__existing_alias_ok(mailbox_data, dimail_token_ok):
+    """Can create mailbox even if local_part is already used by an alias."""
     alias = factories.AliasFactory()
     access = factories.MailDomainAccessFactory(
         role=enums.MailDomainRoleChoices.ADMIN, domain=alias.domain
@@ -450,7 +444,16 @@ def test_api_mailboxes__existing_alias_bad_request(mailbox_data):
 
     client = APIClient()
     client.force_login(access.user)
-    # No response because we expect no outside calls to be made
+
+    responses.post(
+        re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
+        body=response_mailbox_created(
+            f"{mailbox_data['local_part']}@{access.domain.name}"
+        ),
+        status=status.HTTP_201_CREATED,
+        content_type="application/json",
+    )
+
     response = client.post(
         f"/api/v1.0/mail-domains/{access.domain.slug}/mailboxes/",
         {
@@ -461,11 +464,8 @@ def test_api_mailboxes__existing_alias_bad_request(mailbox_data):
         },
         format="json",
     )
-    assert response.status_code == status.HTTP_400_BAD_REQUEST
-    assert response.json() == {
-        "local_part": [f'Local part "{alias.local_part}" already used by an alias.']
-    }
-    assert not models.Mailbox.objects.exists()
+    assert response.status_code == status.HTTP_201_CREATED
+    assert models.Mailbox.objects.exists()
 
 
 ### REACTING TO DIMAIL-API
@@ -515,8 +515,7 @@ def test_api_mailboxes__async_dimail_unauthorized(
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(
             rf".*/domains/{access.domain.name}/mailboxes/{mailbox_data['local_part']}"
         ),
@@ -557,8 +556,7 @@ def test_api_mailboxes__domain_owner_or_admin_successful_creation_and_provisioni
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_data['local_part']}@{access.domain.name}"
@@ -615,8 +613,7 @@ def test_api_mailboxes__domain_owner_or_admin_successful_creation_sets_password(
     client = APIClient()
     client.force_login(access.user)
     # Ensure successful response using "responses":
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_data['local_part']}@{access.domain.name}"
@@ -658,8 +655,7 @@ def test_api_mailboxes__dimail_token_permission_denied(caplog, mailbox_data):
     client = APIClient()
     client.force_login(access.user)
     # Ensure successful response using "responses":
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(r".*/token/"),
         body='{"details": "Permission denied"}',
         status=status.HTTP_403_FORBIDDEN,
@@ -703,8 +699,7 @@ def test_api_mailboxes__user_unrelated_to_domain(dimail_token_ok, mailbox_data):
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body='{"details": "Permission denied"}',
         status=status.HTTP_403_FORBIDDEN,
@@ -739,15 +734,13 @@ def test_api_mailboxes__duplicate_display_name(dimail_token_ok, mailbox_data):
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body='{"detail": "Internal server error"}',
         status=status.HTTP_500_INTERNAL_SERVER_ERROR,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(
             rf".*/domains/{access.domain.name}/address/{mailbox_data['local_part']}"
         ),
@@ -796,15 +789,13 @@ def test_api_mailboxes__handling_dimail_unexpected_error(
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body='{"detail": "Internal server error"}',
         status=status.HTTP_500_INTERNAL_SERVER_ERROR,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(
             rf".*/domains/{access.domain.name}/address/{mailbox_data['local_part']}/"
         ),
@@ -847,15 +838,13 @@ def test_api_mailboxes__display_name_duplicate_error(dimail_token_ok, mailbox_da
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body='{"detail": "Internal server error"}',
         status=status.HTTP_500_INTERNAL_SERVER_ERROR,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(
             rf".*/domains/{access.domain.name}/address/{mailbox_data['local_part']}/"
         ),
@@ -906,8 +895,7 @@ def test_api_mailboxes__send_correct_logger_infos(
     client.force_login(access.user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(
             f"{mailbox_data['local_part']}@{access.domain.name}"
@@ -957,8 +945,7 @@ def test_api_mailboxes__sends_new_mailbox_notification(
     client.force_login(user)
     # Ensure successful response using "responses":
     # token response in fixtures
-    responses.add(
-        responses.POST,
+    responses.post(
         re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
         body=response_mailbox_created(f"{mailbox_data['local_part']}@{access.domain}"),
         status=status.HTTP_201_CREATED,

src/backend/mailbox_manager/tests/api/mailboxes/test_api_mailboxes_reset_password.py

@@ -113,7 +113,7 @@ Please add a valid secondary email before trying again."
     ],
 )
 @responses.activate
-def test_api_mailboxes__reset_password_admin_successful(role):
+def test_api_mailboxes__reset_password_admin_successful(role, dimail_token_ok):
     """Owner and admin users should be able to reset password on mailboxes.
     New password should be sent to secondary email."""
     mail_domain = factories.MailDomainEnabledFactory()
@@ -123,15 +123,7 @@ def test_api_mailboxes__reset_password_admin_successful(role):
     client = APIClient()
     client.force_login(access.user)
     dimail_url = settings.MAIL_PROVISIONING_API_URL
-
-    responses.add(
-        responses.GET,
-        f"{dimail_url}/token/",
-        body=dimail.TOKEN_OK,
-        status=200,
-    )
-    responses.add(
-        responses.POST,
+    responses.post(
         f"{dimail_url}/domains/{mail_domain.name}/mailboxes/{mailbox.local_part}/reset_password/",
         body=dimail.response_mailbox_created(str(mailbox)),
         status=200,
@@ -161,7 +153,7 @@ def test_api_mailboxes__reset_password_non_existing():
 
 
 @responses.activate
-def test_api_mailboxes__reset_password_connexion_failed():
+def test_api_mailboxes__reset_password_connexion_failed(dimail_token_ok):
     """
     No mail is sent when password reset failed because of connexion error.
     """
@@ -173,16 +165,8 @@ def test_api_mailboxes__reset_password_connexion_failed():
     )
     client = APIClient()
     client.force_login(access.user)
-
     dimail_url = settings.MAIL_PROVISIONING_API_URL
-    responses.add(
-        responses.GET,
-        f"{dimail_url}/token/",
-        body=dimail.TOKEN_OK,
-        status=200,
-    )
-    responses.add(
-        responses.POST,
+    responses.post(
         f"{dimail_url}/domains/{mail_domain.name}/mailboxes/{mailbox.local_part}/reset_password/",
         body=ConnectionError(),
     )

src/backend/mailbox_manager/tests/commands/test_fetch_domain_status.py

@@ -48,8 +48,7 @@ def test_fetch_domain_status():
         (domain_failed, body_content_ok3),
     ]:
         # mock dimail API
-        responses.add(
-            responses.GET,
+        responses.get(
             re.compile(rf".*/domains/{domain.name}/check/"),
             body=json.dumps(body_content),
             status=status.HTTP_200_OK,

src/backend/mailbox_manager/tests/conftest.py

@@ -9,17 +9,15 @@ import responses
 from rest_framework import status
 
 from mailbox_manager import factories
-from mailbox_manager.tests.fixtures.dimail import TOKEN_OK
 
 
 ## DIMAIL RESPONSES
 @pytest.fixture(name="dimail_token_ok")
 def fixture_dimail_token_ok():
     """Mock dimail response when /token/ endpoit is given valid credentials."""
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(r".*/token/"),
-        body=TOKEN_OK,
+        json={"access_token": "token", "token_type": "bearer"},
         status=status.HTTP_200_OK,
         content_type="application/json",
     )

src/backend/mailbox_manager/tests/fixtures/dimail.py

@@ -287,10 +287,6 @@ DOMAIN_SPEC = [
 ]
 
 
-## TOKEN
-TOKEN_OK = json.dumps({"access_token": "token", "token_type": "bearer"})
-
-
 ## ALLOWS
 def response_allows_created(user_name, domain_name):
     """mimic dimail response upon successful allows creation.

src/backend/mailbox_manager/tests/models/test_aliases.py

@@ -0,0 +1,19 @@
+"""
+Unit tests for the Alias model
+"""
+
+import pytest
+
+from mailbox_manager import factories, models
+
+pytestmark = pytest.mark.django_db
+
+
+def test_models_aliases__devnull_destination_ok():
+    """Can create alias where destination is devnull@devnull."""
+
+    models.Alias.objects.create(
+        local_part="spam",
+        domain=factories.MailDomainEnabledFactory(),
+        destination="devnull@devnull",
+    )

src/backend/mailbox_manager/tests/test_admin_actions.py

@@ -2,7 +2,6 @@
 Unit tests for admin actions
 """
 
-import json
 import re
 
 from django.urls import reverse
@@ -19,7 +18,6 @@ from .fixtures.dimail import (
     CHECK_DOMAIN_BROKEN,
     CHECK_DOMAIN_OK,
     DOMAIN_SPEC,
-    TOKEN_OK,
     response_mailbox_created,
 )
 
@@ -76,17 +74,15 @@ def test_fetch_domain_status__should_switch_to_failed_when_domain_broken(client)
     body_content_domain1["name"] = domain1.name
     body_content_domain2 = CHECK_DOMAIN_BROKEN.copy()
     body_content_domain2["name"] = domain2.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain1.name}/check/"),
-        body=json.dumps(body_content_domain1),
+        json=body_content_domain1,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain2.name}/check/"),
-        body=json.dumps(body_content_domain2),
+        json=body_content_domain2,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -101,7 +97,9 @@ def test_fetch_domain_status__should_switch_to_failed_when_domain_broken(client)
 
 @responses.activate
 @pytest.mark.django_db
-def test_fetch_domain_status__should_switch_to_enabled_when_domain_ok(client):
+def test_fetch_domain_status__should_switch_to_enabled_when_domain_ok(
+    client, dimail_token_ok
+):
     """Test admin action should switch domain state to ENABLED
     when dimail's response is "ok". It should also activate any pending mailbox."""
     admin = core_factories.UserFactory(is_staff=True, is_superuser=True)
@@ -119,22 +117,14 @@ def test_fetch_domain_status__should_switch_to_enabled_when_domain_ok(client):
     body_content_domain1 = CHECK_DOMAIN_OK.copy()
     body_content_domain1["name"] = domain1.name
 
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain1.name}/check/"),
-        body=json.dumps(body_content_domain1),
+        json=body_content_domain1,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
-    # we need to get a token to create mailboxes
-    responses.add(
-        responses.GET,
-        re.compile(r".*/token/"),
-        body=TOKEN_OK,
-        status=status.HTTP_200_OK,
-        content_type="application/json",
-    )
-    responses.add(
+    # token call in fixtures
+    responses.post(
         responses.POST,
         re.compile(rf".*/domains/{domain1.name}/mailboxes/"),
         body=response_mailbox_created(f"truc@{domain1.name}"),
@@ -172,10 +162,9 @@ def test_fetch_domain_expected_config(client, domain_status):
         "action": "fetch_domain_expected_config_from_dimail",
         "_selected_action": [domain.id],
     }
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/spec/"),
-        body=json.dumps(DOMAIN_SPEC),
+        json=DOMAIN_SPEC,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -208,7 +197,7 @@ def test_fetch_domain_expected_config__should_not_fetch_for_disabled_domain(clie
 
 @responses.activate
 @pytest.mark.django_db
-def test_send_pending_mailboxes(client):
+def test_send_pending_mailboxes(client, dimail_token_ok):
     """Test admin action to send pending mailboxes to dimail."""
     admin = core_factories.UserFactory(is_staff=True, is_superuser=True)
     client.force_login(admin)
@@ -223,15 +212,8 @@ def test_send_pending_mailboxes(client):
 
     url = reverse("admin:mailbox_manager_maildomain_changelist")
     for mailbox in mailboxes:
-        responses.add(
-            responses.GET,
-            re.compile(r".*/token/"),
-            body=TOKEN_OK,
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
-        responses.add(
-            responses.POST,
+        # token call in fixture
+        responses.post(
             re.compile(rf".*/domains/{domain.name}/mailboxes/"),
             body=response_mailbox_created(f"{mailbox.local_part}@{domain.name}"),
             status=status.HTTP_201_CREATED,
@@ -247,7 +229,7 @@ def test_send_pending_mailboxes(client):
 
 @responses.activate
 @pytest.mark.django_db
-def test_send_pending_mailboxes__listing_failed_mailboxes(client):
+def test_send_pending_mailboxes__listing_failed_mailboxes(client, dimail_token_ok):
     """Test admin action to send pending mailboxes to dimail."""
     admin = core_factories.UserFactory(is_staff=True, is_superuser=True)
     client.force_login(admin)
@@ -261,15 +243,8 @@ def test_send_pending_mailboxes__listing_failed_mailboxes(client):
     }
 
     url = reverse("admin:mailbox_manager_maildomain_changelist")
-    responses.add(
-        responses.GET,
-        re.compile(r".*/token/"),
-        body=TOKEN_OK,
-        status=status.HTTP_200_OK,
-        content_type="application/json",
-    )
-    responses.add(
-        responses.POST,
+    # token call in fixtures
+    responses.post(
         re.compile(rf".*/domains/{domain.name}/mailboxes/"),
         body=response_mailbox_created(f"{mailbox.local_part}@{domain.name}"),
         status=status.HTTP_409_CONFLICT,

src/backend/mailbox_manager/tests/test_tasks.py

@@ -2,7 +2,6 @@
 Unit tests for mailbox manager tasks.
 """
 
-import json
 import re
 from unittest import mock
 
@@ -63,18 +62,16 @@ def test_fetch_domain_status_task_success():  # pylint: disable=too-many-locals
         (domain_failed, body_content_ok3),
     ]:
         # Mock dimail API with success response
-        responses.add(
-            responses.GET,
+        responses.get(
             re.compile(rf".*/domains/{domain.name}/check/"),
-            body=json.dumps(body_content),
+            json=body_content,
             status=200,
             content_type="application/json",
         )
     # domain_enabled2 is broken with internal error, we try to fix it
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain_enabled2.name}/fix/"),
-        body=json.dumps(body_content_broken_internal),
+        json=body_content_broken_internal,
         status=200,
         content_type="application/json",
     )
@@ -170,10 +167,9 @@ def test_fetch_domains_status_error_handling(caplog):
     domain = factories.MailDomainEnabledFactory()
 
     # Mock dimail API with error response
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps({"error": "Internal Server Error"}),
+        json={"error": "Internal Server Error"},
         status=500,
         content_type="application/json",
     )

src/backend/mailbox_manager/tests/test_utils_dimail_client.py

@@ -2,12 +2,10 @@
 Unit tests for dimail client
 """
 
-import json
+# pylint: disable=W0613
+
 import logging
 import re
-from email.errors import HeaderParseError, NonASCIILocalPartDefect
-from logging import Logger
-from unittest import mock
 
 import pytest
 import responses
@@ -21,14 +19,14 @@ from .fixtures.dimail import (
     CHECK_DOMAIN_BROKEN_EXTERNAL,
     CHECK_DOMAIN_BROKEN_INTERNAL,
     CHECK_DOMAIN_OK,
-    TOKEN_OK,
     response_mailbox_created,
 )
 
 pytestmark = pytest.mark.django_db
 
 
-def test_dimail_synchronization__already_sync():
+@responses.activate
+def test_dimail_synchronization__already_sync(dimail_token_ok):
     """
     No mailbox should be created when everything is already synced.
     """
@@ -39,35 +37,26 @@ def test_dimail_synchronization__already_sync():
     assert pre_sync_mailboxes.count() == 3
 
     dimail_client = DimailAPIClient()
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response using "responses":
-        rsps.add(
-            rsps.GET,
-            re.compile(r".*/token/"),
-            body='{"access_token": "dimail_people_token"}',
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
-        rsps.add(
-            rsps.GET,
-            re.compile(rf".*/domains/{domain.name}/mailboxes/"),
-            body=json.dumps(
-                [
-                    {
-                        "type": "mailbox",
-                        "status": "broken",
-                        "email": f"{mailbox.local_part}@{domain.name}",
-                        "givenName": mailbox.first_name,
-                        "surName": mailbox.last_name,
-                        "displayName": f"{mailbox.first_name} {mailbox.last_name}",
-                    }
-                    for mailbox in pre_sync_mailboxes
-                ]
-            ),
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
-        imported_mailboxes = dimail_client.import_mailboxes(domain)
+
+    # Ensure successful response using "responses":
+    # token response in fixtures
+    responses.get(
+        re.compile(rf".*/domains/{domain.name}/mailboxes/"),
+        json=[
+            {
+                "type": "mailbox",
+                "status": "broken",
+                "email": f"{mailbox.local_part}@{domain.name}",
+                "givenName": mailbox.first_name,
+                "surName": mailbox.last_name,
+                "displayName": f"{mailbox.first_name} {mailbox.last_name}",
+            }
+            for mailbox in pre_sync_mailboxes
+        ],
+        status=status.HTTP_200_OK,
+        content_type="application/json",
+    )
+    imported_mailboxes = dimail_client.import_mailboxes(domain)
 
     post_sync_mailboxes = models.Mailbox.objects.filter(domain=domain)
     assert post_sync_mailboxes.count() == 3
@@ -75,97 +64,159 @@ def test_dimail_synchronization__already_sync():
     assert set(models.Mailbox.objects.filter(domain=domain)) == set(pre_sync_mailboxes)
 
 
-@mock.patch.object(Logger, "warning")
-def test_dimail_synchronization__synchronize_mailboxes(mock_warning):
-    """A mailbox existing solely on dimail should be synchronized
-    upon calling sync function on its domain"""
+@responses.activate
+def test_dimail_synchronization__synchronize_mailboxes(caplog, dimail_token_ok):  # pylint: disable=W0613, R0914
+    """Importing mailboxes from dimail should synchronize valid mailboxes
+    and log errors for invalid ones."""
+    caplog.set_level(logging.INFO)
+
     domain = factories.MailDomainEnabledFactory()
-    assert not models.Mailbox.objects.exists()
+
+    existing_alias = factories.AliasFactory(domain=domain)
 
     dimail_client = DimailAPIClient()
-    with responses.RequestsMock() as rsps:
-        # Ensure successful response using "responses":
-        rsps.add(
-            rsps.GET,
-            re.compile(r".*/token/"),
-            body='{"access_token": "dimail_people_token"}',
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
+    # Ensure successful response using "responses":
+    # successful token in fixtures
+    mailbox_valid = {
+        "type": "mailbox",
+        "status": "ok",
+        "email": f"validmailbox@{domain.name}",
+        "givenName": "Michael",
+        "surName": "Roch",
+        "displayName": "Michael Roch",
+    }
+    mailbox_oxadmin = {
+        "type": "mailbox",
+        "status": "broken",
+        "email": f"oxadmin@{domain.name}",
+        "givenName": "Admin",
+        "surName": "Context",
+        "displayName": "Context Admin",
+    }
+    mailbox_with_wrong_domain = {
+        "type": "mailbox",
+        "status": "broken",
+        "email": "johndoe@wrongdomain.com",
+        "givenName": "John",
+        "surName": "Doe",
+        "displayName": "John Doe",
+    }
+    mailbox_with_invalid_domain = {
+        "type": "mailbox",
+        "status": "broken",
+        "email": f"naw@ake@{domain.name}",
+        "givenName": "Joe",
+        "surName": "Doe",
+        "displayName": "Joe Doe",
+    }
+    mailbox_with_invalid_local_part = {
+        "type": "mailbox",
+        "status": "broken",
+        "email": f"obalmaské@{domain.name}",
+        "givenName": "Jean",
+        "surName": "Vang",
+        "displayName": "Jean Vang",
+    }
+    mailbox_existing_alias = {
+        "type": "mailbox",
+        "status": "broken",
+        "email": f"{existing_alias.local_part}@{domain.name}",
+        "givenName": "Support",
+        "surName": "email",
+        "displayName": "Support email",
+    }
 
-        mailbox_valid = {
-            "type": "mailbox",
-            "status": "broken",
-            "email": f"oxadmin@{domain.name}",
-            "givenName": "Admin",
-            "surName": "Context",
-            "displayName": "Context Admin",
-        }
-        mailbox_with_wrong_domain = {
-            "type": "mailbox",
-            "status": "broken",
-            "email": "johndoe@wrongdomain.com",
-            "givenName": "John",
-            "surName": "Doe",
-            "displayName": "John Doe",
-        }
-        mailbox_with_invalid_domain = {
-            "type": "mailbox",
-            "status": "broken",
-            "email": f"naw@ake@{domain.name}",
-            "givenName": "Joe",
-            "surName": "Doe",
-            "displayName": "Joe Doe",
-        }
-        mailbox_with_invalid_local_part = {
-            "type": "mailbox",
-            "status": "broken",
-            "email": f"obalmaské@{domain.name}",
-            "givenName": "Jean",
-            "surName": "Vang",
-            "displayName": "Jean Vang",
-        }
+    responses.get(
+        re.compile(rf".*/domains/{domain.name}/mailboxes/"),
+        json=[
+            mailbox_valid,
+            mailbox_oxadmin,
+            mailbox_with_wrong_domain,
+            mailbox_with_invalid_domain,
+            mailbox_with_invalid_local_part,
+            mailbox_existing_alias,
+        ],
+        status=status.HTTP_200_OK,
+        content_type="application/json",
+    )
 
-        rsps.add(
-            rsps.GET,
-            re.compile(rf".*/domains/{domain.name}/mailboxes/"),
-            body=json.dumps(
-                [
-                    mailbox_valid,
-                    mailbox_with_wrong_domain,
-                    mailbox_with_invalid_domain,
-                    mailbox_with_invalid_local_part,
-                ]
-            ),
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
+    imported_mailboxes = dimail_client.import_mailboxes(domain)
 
-        imported_mailboxes = dimail_client.import_mailboxes(domain)
+    # 4 imports failed: oxadmin, wrong domain, HeaderParseError, NonASCIILocalPartDefect
+    assert len(caplog.records) == 5
+    log_messages = [record.message for record in caplog.records]
 
-        # 3 imports failed: wrong domain, HeaderParseError, NonASCIILocalPartDefect
-        assert mock_warning.call_count == 3
+    expected_messages = [
+        f"Not importing OX technical address: oxadmin@{domain.name}",
+        f"Import of email {mailbox_with_wrong_domain['email']} failed because of a wrong domain",
+        f"Import of email {mailbox_with_invalid_domain['email']} failed with error Invalid Domain",
+        f"Import of email {mailbox_with_invalid_local_part['email']} failed with error local-part \
+contains non-ASCII characters)",
+    ]
+    for message in expected_messages:
+        assert message in log_messages
 
-        # first we try to import email with a wrong domain
-        assert mock_warning.call_args_list[0][0] == (
-            "Import of email %s failed because of a wrong domain",
-            mailbox_with_wrong_domain["email"],
-        )
+    assert models.Mailbox.objects.count() == 2
+    assert imported_mailboxes == [
+        mailbox_valid["email"],
+        mailbox_existing_alias["email"],
+    ]
 
-        # then we try to import email with invalid domain
-        invalid_mailbox_log = mock_warning.call_args_list[1][0]
-        assert invalid_mailbox_log[1] == mailbox_with_invalid_domain["email"]
-        assert isinstance(invalid_mailbox_log[2], HeaderParseError)
 
-        # finally we try to import email with non ascii local part
-        non_ascii_mailbox_log = mock_warning.call_args_list[2][0]
-        assert non_ascii_mailbox_log[1] == mailbox_with_invalid_local_part["email"]
-        assert isinstance(non_ascii_mailbox_log[2], NonASCIILocalPartDefect)
+@responses.activate
+def test_dimail_synchronization__synchronize_aliases(dimail_token_ok):  # pylint: disable=unused-argument
+    """Importing aliases from dimail should synchronize valid aliases
+    and log errors for invalid ones."""
+    alias = factories.AliasFactory()
+    dimail_client = DimailAPIClient()
 
-        mailbox = models.Mailbox.objects.get()
-        assert mailbox.local_part == "oxadmin"
-        assert mailbox.status == enums.MailboxStatusChoices.ENABLED
-        assert imported_mailboxes == [mailbox_valid["email"]]
+    existing_mailbox = factories.MailboxFactory(domain=alias.domain)
+
+    # Ensure successful response using "responses":
+    # token response in fixtures
+    incoming_aliases = [
+        {
+            "username": "contact",
+            "domain": alias.domain.name,
+            "destination": alias.destination,  # same destination = ok
+            "allow_to_send": False,
+        },
+        {
+            "username": alias.local_part,  # same username = ok
+            "domain": alias.domain.name,
+            "destination": "maheius.endorecles@somethingelse.com",
+            "allow_to_send": False,
+        },
+        {  # same username + same destination = big nono
+            "username": alias.local_part,
+            "domain": alias.domain.name,
+            "destination": alias.destination,
+            "allow_to_send": False,
+        },
+        {  # mailbox with same username = ok
+            "username": existing_mailbox.local_part,
+            "domain": alias.domain.name,
+            "destination": existing_mailbox.secondary_email,
+            "allow_to_send": False,
+        },
+        {  # alias to devnull@devnull
+            "username": "spam",
+            "domain": alias.domain.name,
+            "destination": "devnull@devnull",
+            "allow_to_send": False,
+        },
+    ]
+    responses.get(
+        re.compile(rf".*/domains/{alias.domain.name}/aliases/"),
+        json=incoming_aliases,
+        status=status.HTTP_200_OK,
+        content_type="application/json",
+    )
+
+    imported_aliases = dimail_client.import_aliases(alias.domain)
+
+    assert len(imported_aliases) == 4
+    assert models.Alias.objects.count() == 5
 
 
 @pytest.mark.parametrize(
@@ -183,10 +234,9 @@ def test_dimail__fetch_domain_status__switch_to_enabled(domain_status):
     domain = factories.MailDomainFactory(status=domain_status)
     body_content = CHECK_DOMAIN_OK.copy()
     body_content["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_content),
+        json=body_content,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -221,10 +271,9 @@ def test_dimail__fetch_domain_status__switch_to_action_required(
     domain = factories.MailDomainFactory(status=domain_status)
     body_domain_broken = CHECK_DOMAIN_BROKEN_EXTERNAL.copy()
     body_domain_broken["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_domain_broken),
+        json=body_domain_broken,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -238,10 +287,9 @@ def test_dimail__fetch_domain_status__switch_to_action_required(
     # Now domain is OK again
     body_domain_ok = CHECK_DOMAIN_OK.copy()
     body_domain_ok["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_domain_ok),
+        json=body_domain_ok,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -267,18 +315,16 @@ def test_dimail__fetch_domain_status__switch_to_failed(domain_status):
     # nothing can be done by support team, domain should be in failed
     body_domain_broken = CHECK_DOMAIN_BROKEN_INTERNAL.copy()
     body_domain_broken["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_domain_broken),
+        json=body_domain_broken,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
     # the endpoint fix is called and still returns KO for internal checks
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/fix/"),
-        body=json.dumps(body_domain_broken),
+        json=body_domain_broken,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -305,10 +351,9 @@ def test_dimail__fetch_domain_status__full_fix_scenario(domain_status):
     # with all checks KO, domain should be in action required
     body_domain_broken = CHECK_DOMAIN_BROKEN.copy()
     body_domain_broken["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_domain_broken),
+        json=body_domain_broken,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -324,20 +369,18 @@ def test_dimail__fetch_domain_status__full_fix_scenario(domain_status):
     # the fetch_domain_status call
     body_domain_broken_internal = CHECK_DOMAIN_BROKEN_INTERNAL.copy()
     body_domain_broken_internal["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/check/"),
-        body=json.dumps(body_domain_broken_internal),
+        json=body_domain_broken_internal,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
     # the endpoint fix is called and returns OK. Hooray!
     body_domain_ok = CHECK_DOMAIN_OK.copy()
     body_domain_ok["name"] = domain.name
-    responses.add(
-        responses.GET,
+    responses.get(
         re.compile(rf".*/domains/{domain.name}/fix/"),
-        body=json.dumps(body_domain_ok),
+        json=body_domain_ok,
         status=status.HTTP_200_OK,
         content_type="application/json",
     )
@@ -348,7 +391,8 @@ def test_dimail__fetch_domain_status__full_fix_scenario(domain_status):
     assert domain.last_check_details == body_domain_ok
 
 
-def test_dimail__send_pending_mailboxes(caplog):
+@responses.activate
+def test_dimail__send_pending_mailboxes(caplog, dimail_token_ok):
     """Status of pending mailboxes should switch to "enabled"
     when calling send_pending_mailboxes."""
     caplog.set_level(logging.INFO)
@@ -365,22 +409,16 @@ def test_dimail__send_pending_mailboxes(caplog):
     )
 
     dimail_client = DimailAPIClient()
-    with responses.RequestsMock() as rsps:
-        rsps.add(
-            rsps.GET,
-            re.compile(r".*/token/"),
-            body=TOKEN_OK,
-            status=status.HTTP_200_OK,
-            content_type="application/json",
-        )
-        rsps.add(
-            rsps.POST,
-            re.compile(rf".*/domains/{domain.name}/mailboxes/"),
-            body=response_mailbox_created(f"mock@{domain.name}"),
-            status=status.HTTP_201_CREATED,
-            content_type="application/json",
-        )
-        dimail_client.send_pending_mailboxes(domain=domain)
+
+    # Ensure successful response using "responses":
+    # token response in fixtures
+    responses.post(
+        re.compile(rf".*/domains/{domain.name}/mailboxes/"),
+        body=response_mailbox_created(f"mock@{domain.name}"),
+        status=status.HTTP_201_CREATED,
+        content_type="application/json",
+    )
+    dimail_client.send_pending_mailboxes(domain=domain)
 
     mailbox1.refresh_from_db()
     mailbox2.refresh_from_db()

src/backend/mailbox_manager/utils/dimail.py

@@ -45,7 +45,7 @@ class DimailAPIClient:
     API_CREDENTIALS = settings.MAIL_PROVISIONING_API_CREDENTIALS
     API_TIMEOUT = settings.MAIL_PROVISIONING_API_TIMEOUT
 
-    def get_headers(self):
+    def _get_headers(self):
         """
         Return Bearer token. Requires MAIL_PROVISIONING_API_CREDENTIALS setting,
         to get a token from dimail /token/ endpoint.
@@ -82,7 +82,7 @@ class DimailAPIClient:
                 "Token denied. Please check your MAIL_PROVISIONING_API_CREDENTIALS."
             )
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def create_domain(self, domain_name, request_user):
         """Send a domain creation request to dimail API."""
@@ -117,7 +117,7 @@ class DimailAPIClient:
             )
             return response
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def create_mailbox(self, mailbox, request_user=None):
         """Send a CREATE mailbox request to mail provisioning API."""
@@ -130,7 +130,7 @@ class DimailAPIClient:
             # displayName value has to be unique
             "displayName": f"{mailbox.first_name} {mailbox.last_name}",
         }
-        headers = self.get_headers()
+        headers = self._get_headers()
 
         try:
             response = session.post(
@@ -194,7 +194,7 @@ class DimailAPIClient:
                     }
                 )
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def create_user(self, user_id):
         """Send a request to dimail, to create a new user there. In dimail, user ids are subs."""
@@ -231,7 +231,7 @@ class DimailAPIClient:
             )
             return response
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def create_allow(self, user_id, domain_name):
         """Send a request to dimail for a new 'allow' between user and the domain."""
@@ -273,9 +273,9 @@ class DimailAPIClient:
             )
             return response
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
-    def raise_exception_for_unexpected_response(self, response):
+    def _raise_exception_for_unexpected_response(self, response):
         """Raise error when encountering an unexpected error in dimail."""
         try:
             error_content = json.loads(
@@ -299,7 +299,7 @@ class DimailAPIClient:
             title, template_name, recipient, mailbox_data, issuer
         )
 
-    def notify_mailbox_password_reset(self, recipient, mailbox_data, issuer=None):
+    def _notify_mailbox_password_reset(self, recipient, mailbox_data, issuer=None):
         """
         Send email to notify of password reset
         and send new password.
@@ -359,7 +359,7 @@ class DimailAPIClient:
         try:
             response = session.get(
                 f"{self.API_URL}/domains/{domain.name}/mailboxes/",
-                headers=self.get_headers(),
+                headers=self._get_headers(),
                 verify=True,
                 timeout=self.API_TIMEOUT,
             )
@@ -372,40 +372,48 @@ class DimailAPIClient:
             raise error
 
         if response.status_code != status.HTTP_200_OK:
-            return self.raise_exception_for_unexpected_response(response)
+            return self._raise_exception_for_unexpected_response(response)
 
         dimail_mailboxes = response.json()
         people_mailboxes = models.Mailbox.objects.filter(domain=domain)
         imported_mailboxes = []
         for dimail_mailbox in dimail_mailboxes:
-            if not dimail_mailbox["email"] in [
+            try:
+                address = Address(addr_spec=dimail_mailbox["email"])
+            except (HeaderParseError, NonASCIILocalPartDefect) as error:
+                logger.warning(
+                    "Import of email %s failed with error %s",
+                    dimail_mailbox["email"],
+                    error,
+                )
+                continue
+
+            if address.username == "oxadmin":
+                logger.warning(
+                    "Not importing OX technical address: %s", dimail_mailbox["email"]
+                )
+                continue
+
+            if str(address) not in [
                 str(people_mailbox) for people_mailbox in people_mailboxes
             ]:
-                try:
-                    # sometimes dimail api returns email from another domain,
-                    # so we decide to exclude this kind of email
-                    address = Address(addr_spec=dimail_mailbox["email"])
-                    if address.domain == domain.name:
-                        # creates a mailbox on our end
-                        mailbox = models.Mailbox.objects.create(
-                            first_name=dimail_mailbox["givenName"],
-                            last_name=dimail_mailbox["surName"],
-                            local_part=address.username,
-                            domain=domain,
-                            status=enums.MailboxStatusChoices.ENABLED,
-                            password=make_password(None),  # unusable password
-                        )
-                        imported_mailboxes.append(str(mailbox))
-                    else:
-                        logger.warning(
-                            "Import of email %s failed because of a wrong domain",
-                            dimail_mailbox["email"],
-                        )
-                except (HeaderParseError, NonASCIILocalPartDefect) as err:
+                # sometimes dimail api returns email from another domain,
+                # so we decide to exclude this kind of email
+                if address.domain == domain.name:
+                    # creates a mailbox on our end
+                    mailbox = models.Mailbox.objects.create(
+                        first_name=dimail_mailbox["givenName"],
+                        last_name=dimail_mailbox["surName"],
+                        local_part=address.username,
+                        domain=domain,
+                        status=enums.MailboxStatusChoices.ENABLED,
+                        password=make_password(None),  # unusable password
+                    )
+                    imported_mailboxes.append(str(mailbox))
+                else:
                     logger.warning(
-                        "Import of email %s failed with error %s",
+                        "Import of email %s failed because of a wrong domain",
                         dimail_mailbox["email"],
-                        err,
                     )
         return imported_mailboxes
 
@@ -414,7 +422,7 @@ class DimailAPIClient:
         response = session.patch(
             f"{self.API_URL}/domains/{mailbox.domain.name}/mailboxes/{mailbox.local_part}",
             json={"active": "no"},
-            headers=self.get_headers(),
+            headers=self._get_headers(),
             verify=True,
             timeout=self.API_TIMEOUT,
         )
@@ -426,7 +434,7 @@ class DimailAPIClient:
                 request_user,
             )
             return response
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def enable_mailbox(self, mailbox, request_user=None):
         """Send a request to enable a mailbox to dimail API"""
@@ -438,7 +446,7 @@ class DimailAPIClient:
                 "surName": mailbox.last_name,
                 "displayName": f"{mailbox.first_name} {mailbox.last_name}",
             },
-            headers=self.get_headers(),
+            headers=self._get_headers(),
             verify=True,
             timeout=self.API_TIMEOUT,
         )
@@ -450,7 +458,7 @@ class DimailAPIClient:
                 request_user,
             )
             return response
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def send_pending_mailboxes(self, domain):
         """Send requests for all pending mailboxes of a domain. Returns a list of failed mailboxes for this domain."""
@@ -499,7 +507,7 @@ class DimailAPIClient:
             raise error
         if response.status_code == status.HTTP_200_OK:
             return response.json()
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def fix_domain(self, domain):
         """Send a request to dimail to fix a domain.
@@ -516,7 +524,7 @@ class DimailAPIClient:
                 str(domain),
             )
             return response.json()
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def fetch_domain_status(self, domain):
         """Send a request to check and update status of a domain."""
@@ -641,7 +649,7 @@ class DimailAPIClient:
         try:
             response = session.post(
                 f"{self.API_URL}/domains/{mailbox.domain.name}/mailboxes/{mailbox.local_part}/reset_password/",
-                headers=self.get_headers(),
+                headers=self._get_headers(),
                 verify=True,
                 timeout=self.API_TIMEOUT,
             )
@@ -655,7 +663,7 @@ class DimailAPIClient:
 
         if response.status_code == status.HTTP_200_OK:
             # send new password to secondary email
-            self.notify_mailbox_password_reset(
+            self._notify_mailbox_password_reset(
                 recipient=mailbox.secondary_email,
                 mailbox_data={
                     "email": response.json()["email"],
@@ -667,7 +675,7 @@ class DimailAPIClient:
                 mailbox,
             )
             return response
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def create_alias(self, alias, request_user=None):
         """Send a Create alias request to mail provisioning API."""
@@ -676,7 +684,7 @@ class DimailAPIClient:
             "user_name": alias.local_part,
             "destination": alias.destination,
         }
-        headers = self.get_headers()
+        headers = self._get_headers()
 
         try:
             response = session.post(
@@ -724,12 +732,12 @@ class DimailAPIClient:
                 }
             )
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
 
     def delete_alias(self, alias, request_user=None):
         """Send a Delete alias request to mail provisioning API."""
 
-        headers = self.get_headers()
+        headers = self._get_headers()
 
         try:
             response = session.delete(
@@ -772,7 +780,78 @@ class DimailAPIClient:
                 str(alias.domain),
             )
             # we don't raise error because we actually want this alias to be deleted
-            # to match dimail's states
             return response
 
-        return self.raise_exception_for_unexpected_response(response)
+        return self._raise_exception_for_unexpected_response(response)
+
+    def delete_multiple_alias(self, local_part, domain_name):
+        """Send a Delete alias request to mail provisioning API."""
+
+        try:
+            response = session.delete(
+                f"{self.API_URL}/domains/{domain_name}/aliases/{local_part}/all",
+                json={},
+                headers=self._get_headers(),
+                verify=True,
+                timeout=self.API_TIMEOUT,
+            )
+        except requests.exceptions.ConnectionError as error:
+            logger.error(
+                "Connection error while trying to reach %s.",
+                self.API_URL,
+                exc_info=error,
+            )
+            raise error
+        # response.raise_for_status()
+
+        return response
+
+    def import_aliases(self, domain):
+        """Import aliases from dimail. Useful if people fall out of sync with dimail."""
+
+        try:
+            response = session.get(
+                f"{self.API_URL}/domains/{domain.name}/aliases/",
+                headers=self._get_headers(),
+                verify=True,
+                timeout=self.API_TIMEOUT,
+            )
+        except requests.exceptions.ConnectionError as error:
+            logger.error(
+                "Connection error while trying to reach %s.",
+                self.API_URL,
+                exc_info=error,
+            )
+            raise error
+
+        if response.status_code != status.HTTP_200_OK:
+            return self._raise_exception_for_unexpected_response(response)
+
+        incoming_aliases = response.json()
+        known_aliases = [
+            (known_alias.local_part, known_alias.destination)
+            for known_alias in models.Alias.objects.filter(domain=domain)
+        ]
+
+        imported_aliases = []
+        for incoming_alias in incoming_aliases:
+            if (
+                incoming_alias["username"],
+                incoming_alias["destination"],
+            ) not in known_aliases:
+                try:
+                    new_alias = models.Alias.objects.create(
+                        local_part=incoming_alias["username"],
+                        destination=incoming_alias["destination"],
+                        domain=domain,
+                    )
+                except (HeaderParseError, NonASCIILocalPartDefect) as err:
+                    logger.warning(
+                        "Import of alias %s to %s failed with error %s",
+                        incoming_alias["username"],
+                        incoming_alias["destination"],
+                        err,
+                    )
+                else:
+                    imported_aliases.append(str(new_alias))
+        return imported_aliases

src/backend/people/settings.py

@@ -581,26 +581,6 @@ class Base(Configuration):
         environ_name="MAIL_CHECK_DOMAIN_INTERVAL",
         environ_prefix=None,
     )
-    DNS_PROVISIONING_TARGET_ZONE = values.Value(
-        default=None,
-        environ_name="DNS_PROVISIONING_TARGET_ZONE",
-        environ_prefix=None,
-    )
-    DNS_PROVISIONING_API_URL = values.Value(
-        default="https://api.scaleway.com",
-        environ_name="DNS_PROVISIONING_API_URL",
-        environ_prefix=None,
-    )
-    DNS_PROVISIONING_RESOURCE_ID = values.Value(
-        default=None,
-        environ_name="DNS_PROVISIONING_RESOURCE_ID",
-        environ_prefix=None,
-    )
-    DNS_PROVISIONING_API_CREDENTIALS = values.Value(
-        default=None,
-        environ_name="DNS_PROVISIONING_API_CREDENTIALS",
-        environ_prefix=None,
-    )
     MATRIX_BASE_HOME_SERVER = values.Value(
         default="https://matrix.agent.dinum.tchap.gouv.fr",
         environ_name="MATRIX_BASE_HOME_SERVER",

src/backend/plugins/la_suite/hooks.py

@@ -11,22 +11,9 @@ from core.plugins.registry import register_hook
 from plugins.la_suite.hooks_utils.all_organizations import (
     get_organization_name_and_metadata_from_siret,
 )
-from plugins.la_suite.hooks_utils.communes import CommuneCreation
 
 
 @register_hook("organization_created")
 def get_organization_name_and_metadata_from_siret_hook(organization):
     """After creating an organization, update the organization name & metadata."""
     get_organization_name_and_metadata_from_siret(organization)
-
-
-@register_hook("organization_created")
-def commune_organization_created(organization):
-    """After creating an organization, update the organization name."""
-    CommuneCreation().run_after_create(organization)
-
-
-@register_hook("organization_access_granted")
-def commune_organization_access_granted(organization_access):
-    """After granting an organization access, check for needed domain access grant."""
-    CommuneCreation().run_after_grant_access(organization_access)

src/backend/plugins/la_suite/hooks_utils/all_organizations.py

@@ -21,25 +21,45 @@ API_URL = "https://recherche-entreprises.api.gouv.fr/search?q={siret}"
 
 def _get_organization_name_and_metadata_from_results(data, siret):
     """Return the organization name and metadata from the results of a SIRET search."""
-    org_metadata = {}
-    for result in data["results"]:
-        for organization in result["matching_etablissements"]:
-            if organization.get("siret") == siret:
-                org_metadata["is_public_service"] = result.get("complements", {}).get(
-                    "est_service_public", False
-                )
-                org_metadata["is_commune"] = (
-                    str(result.get("nature_juridique", "")) == "7210"
-                )
+    # Find matching organization
+    match = next(
+        (
+            (res, org)
+            for res in data.get("results", [])
+            for org in res.get("matching_etablissements", [])
+            if org.get("siret") == siret
+        ),
+        None,
+    )
 
-                store_signs = organization.get("liste_enseignes") or []
-                if store_signs:
-                    return store_signs[0].title(), org_metadata
-                if name := result.get("nom_raison_sociale"):
-                    return name.title(), org_metadata
+    if not match:
+        logger.warning("No organization name found for SIRET %s", siret)
+        return None, {}
+
+    result, organization = match
+
+    # Extract metadata
+    is_commune = str(result.get("nature_juridique", "")) == "7210"
+    metadata = {
+        "is_public_service": result.get("complements", {}).get(
+            "est_service_public", False
+        ),
+        "is_commune": is_commune,
+    }
+
+    # Extract name (priority: commune name > store signs > business name)
+    name = None
+    if is_commune:
+        name = result.get("siege", {}).get("libelle_commune")
+    if not name:  # Fallback for non-communes OR if commune has no libelle_commune
+        store_signs = organization.get("liste_enseignes") or []
+        name = store_signs[0] if store_signs else result.get("nom_raison_sociale")
+
+    if name:
+        return name.title(), metadata
 
     logger.warning("No organization name found for SIRET %s", siret)
-    return None, org_metadata
+    return None, metadata
 
 
 def get_organization_name_and_metadata_from_siret(organization):

src/backend/plugins/la_suite/hooks_utils/communes.py

@@ -1,243 +0,0 @@
-"""Organization related plugins."""
-
-import logging
-import re
-
-from django.conf import settings
-from django.utils.text import slugify
-
-import requests
-from requests.adapters import HTTPAdapter, Retry
-
-from mailbox_manager.enums import MailDomainRoleChoices
-from mailbox_manager.models import MailDomain, MailDomainAccess
-
-logger = logging.getLogger(__name__)
-
-
-class ApiCall:
-    """Encapsulates a call to an external API"""
-
-    inputs: dict = {}
-    method: str = "GET"
-    base: str = ""
-    url: str = ""
-    params: dict = {}
-    headers: dict = {}
-    response_data = None
-
-    def execute(self):
-        """Call the specified API endpoint with supplied parameters and record response"""
-        if self.method in ("POST", "PATCH"):
-            response = requests.request(
-                method=self.method,
-                url=f"{self.base}/{self.url}",
-                json=self.params,
-                headers=self.headers,
-                timeout=20,
-            )
-        else:
-            response = requests.request(
-                method=self.method,
-                url=f"{self.base}/{self.url}",
-                params=self.params,
-                headers=self.headers,
-                timeout=20,
-            )
-        self.response_data = response.json()
-        logger.info(
-            "API call: %s %s %s %s",
-            self.method,
-            self.url,
-            self.params,
-            self.response_data,
-        )
-
-
-class CommuneCreation:
-    """
-    This plugin handles setup tasks for French communes.
-    """
-
-    _api_url = "https://recherche-entreprises.api.gouv.fr/search?q={siret}"
-
-    def get_organization_name_from_results(self, data, siret):
-        """Return the organization name from the results of a SIRET search."""
-        for result in data["results"]:
-            nature = "nature_juridique"
-            commune = nature in result and result[nature] == "7210"
-            if commune:
-                return result["siege"]["libelle_commune"].title()
-
-        logger.warning("Not a commune: SIRET %s", siret)
-        return None
-
-    def dns_call(self, spec):
-        """Call to add a DNS record"""
-        zone_name = self.zone_name(spec.inputs["name"])
-
-        records = [
-            {
-                "name": item["target"],
-                "type": item["type"].upper(),
-                "data": item["value"],
-                "ttl": 3600,
-            }
-            for item in spec.response_data
-        ]
-        result = ApiCall()
-        result.method = "PATCH"
-        result.base = "https://api.scaleway.com"
-        result.url = f"/domain/v2beta1/dns-zones/{zone_name}/records"
-        result.params = {"changes": [{"add": {"records": records}}]}
-        result.headers = {"X-Auth-Token": settings.DNS_PROVISIONING_API_CREDENTIALS}
-        return result
-
-    def normalize_name(self, name: str) -> str:
-        """Map the name to a standard form"""
-        name = re.sub("'", "-", name)
-        return slugify(name)
-
-    def zone_name(self, name: str) -> str:
-        """Derive the zone name from the commune name"""
-        normalized = self.normalize_name(name)
-        return f"{normalized}.{settings.DNS_PROVISIONING_TARGET_ZONE}"
-
-    def complete_commune_creation(self, name: str) -> ApiCall:
-        """Specify the tasks to be completed after a commune is created."""
-        inputs = {"name": self.normalize_name(name)}
-
-        create_zone = ApiCall()
-        create_zone.method = "POST"
-        create_zone.base = "https://api.scaleway.com"
-        create_zone.url = "/domain/v2beta1/dns-zones"
-        create_zone.params = {
-            "project_id": settings.DNS_PROVISIONING_RESOURCE_ID,
-            "domain": settings.DNS_PROVISIONING_TARGET_ZONE,
-            "subdomain": inputs["name"],
-        }
-        create_zone.headers = {
-            "X-Auth-Token": settings.DNS_PROVISIONING_API_CREDENTIALS
-        }
-
-        zone_name = self.zone_name(inputs["name"])
-
-        create_domain = ApiCall()
-        create_domain.method = "POST"
-        create_domain.base = settings.MAIL_PROVISIONING_API_URL
-        create_domain.url = "/domains/"
-        create_domain.params = {
-            "name": zone_name,
-            "delivery": "virtual",
-            "features": ["webmail", "mailbox"],
-            "context_name": zone_name,
-        }
-        create_domain.headers = {
-            "Authorization": f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-        }
-
-        spec_domain = ApiCall()
-        spec_domain.inputs = inputs
-        spec_domain.base = settings.MAIL_PROVISIONING_API_URL
-        spec_domain.url = f"/domains/{zone_name}/spec"
-        spec_domain.headers = {
-            "Authorization": f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-        }
-
-        return [create_zone, create_domain, spec_domain]
-
-    def complete_zone_creation(self, spec_call):
-        """Specify the tasks to be performed to set up the zone."""
-        return self.dns_call(spec_call)
-
-    def run_after_create(self, organization):
-        """After creating an organization, update the organization name."""
-        logger.info("In CommuneCreation")
-        if not organization.registration_id_list:
-            # No registration ID to convert...
-            return
-
-        # In the nominal case, there is only one registration ID because
-        # the organization has been created from it.
-        try:
-            # Retry logic as the API may be rate limited
-            s = requests.Session()
-            retries = Retry(total=5, backoff_factor=0.1, status_forcelist=[429])
-            s.mount("https://", HTTPAdapter(max_retries=retries))
-
-            siret = organization.registration_id_list[0]
-            response = s.get(self._api_url.format(siret=siret), timeout=10)
-            response.raise_for_status()
-            data = response.json()
-            name = self.get_organization_name_from_results(data, siret)
-            # Not a commune ?
-            if not name:
-                return
-        except requests.RequestException as exc:
-            logger.exception("%s: Unable to fetch organization name from SIRET", exc)
-            return
-
-        organization.name = name
-        organization.save(update_fields=["name", "updated_at"])
-        logger.info("Organization %s name updated to %s", organization, name)
-
-        zone_name = self.zone_name(name)
-        support = "support-regie@numerique.gouv.fr"
-        MailDomain.objects.get_or_create(name=zone_name, support_email=support)
-
-        # Compute and execute the rest of the process
-        tasks = self.complete_commune_creation(name)
-        for task in tasks:
-            task.execute()
-        last_task = self.complete_zone_creation(tasks[-1])
-        last_task.execute()
-
-    def complete_grant_access(self, sub, zone_name):
-        """Specify the tasks to be completed after making a user admin"""
-        create_user = ApiCall()
-        create_user.method = "POST"
-        create_user.base = settings.MAIL_PROVISIONING_API_URL
-        create_user.url = "/users/"
-        create_user.params = {
-            "name": sub,
-            "password": "no",
-            "is_admin": False,
-            "perms": [],
-        }
-        create_user.headers = {
-            "Authorization": f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-        }
-
-        grant_access = ApiCall()
-        grant_access.method = "POST"
-        grant_access.base = settings.MAIL_PROVISIONING_API_URL
-        grant_access.url = "/allows/"
-        grant_access.params = {
-            "user": sub,
-            "domain": zone_name,
-        }
-        grant_access.headers = {
-            "Authorization": f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-        }
-
-        return [create_user, grant_access]
-
-    def run_after_grant_access(self, organization_access):
-        """After granting an organization access, check for needed domain access grant."""
-        orga = organization_access.organization
-        user = organization_access.user
-        zone_name = self.zone_name(orga.name)
-
-        try:
-            domain = MailDomain.objects.get(name=zone_name)
-        except MailDomain.DoesNotExist:
-            domain = None
-
-        if domain:
-            MailDomainAccess.objects.create(
-                domain=domain, user=user, role=MailDomainRoleChoices.OWNER
-            )
-
-            tasks = self.complete_grant_access(user.sub, zone_name)
-            for task in tasks:
-                task.execute()

src/backend/plugins/la_suite/tests/hooks/test_commune_creation.py

@@ -1,231 +0,0 @@
-"""Tests for the CommuneCreation plugin."""
-
-from django.conf import settings
-from django.test.utils import override_settings
-
-import pytest
-import responses
-
-from plugins.la_suite.hooks_utils.communes import ApiCall, CommuneCreation
-
-pytestmark = pytest.mark.django_db
-
-
-def test_extract_name_from_org_data_when_commune():
-    """Test the name is extracted correctly for a French commune."""
-    data = {
-        "results": [
-            {
-                "nom_complet": "COMMUNE DE VARZY",
-                "nom_raison_sociale": "COMMUNE DE VARZY",
-                "siege": {
-                    "libelle_commune": "VARZY",
-                    "liste_enseignes": ["MAIRIE"],
-                    "siret": "21580304000017",
-                },
-                "nature_juridique": "7210",
-                "matching_etablissements": [
-                    {
-                        "siret": "21580304000017",
-                        "libelle_commune": "VARZY",
-                        "liste_enseignes": ["MAIRIE"],
-                    }
-                ],
-            }
-        ]
-    }
-
-    plugin = CommuneCreation()
-    name = plugin.get_organization_name_from_results(data, "21580304000017")
-    assert name == "Varzy"
-
-
-def test_api_call_execution():
-    """Test that calling execute() faithfully executes the API call"""
-    task = ApiCall()
-    task.method = "POST"
-    task.base = "https://some_host"
-    task.url = "some_url"
-    task.params = {"some_key": "some_value"}
-    task.headers = {"Some-Header": "Some-Header-Value"}
-
-    with responses.RequestsMock() as rsps:
-        rsps.add(
-            rsps.POST,
-            url="https://some_host/some_url",
-            body='{"some_key": "some_value"}',
-            content_type="application/json",
-            headers={"Some-Header": "Some-Header-Value"},
-        )
-
-        task.execute()
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_tasks_on_commune_creation_include_zone_creation():
-    """Test the first task in commune creation: creating the DNS sub-zone"""
-    plugin = CommuneCreation()
-    name = "Varzy"
-
-    tasks = plugin.complete_commune_creation(name)
-
-    assert tasks[0].base == "https://api.scaleway.com"
-    assert tasks[0].url == "/domain/v2beta1/dns-zones"
-    assert tasks[0].method == "POST"
-    assert tasks[0].params == {
-        "project_id": settings.DNS_PROVISIONING_RESOURCE_ID,
-        "domain": "collectivite.fr",
-        "subdomain": "varzy",
-    }
-    assert tasks[0].headers["X-Auth-Token"] == settings.DNS_PROVISIONING_API_CREDENTIALS
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_tasks_on_commune_creation_include_dimail_domain_creation():
-    """Test the second task in commune creation: creating the domain in Dimail"""
-    plugin = CommuneCreation()
-    name = "Merlaut"
-
-    tasks = plugin.complete_commune_creation(name)
-
-    assert tasks[1].base == settings.MAIL_PROVISIONING_API_URL
-    assert tasks[1].url == "/domains/"
-    assert tasks[1].method == "POST"
-    assert tasks[1].params == {
-        "name": "merlaut.collectivite.fr",
-        "delivery": "virtual",
-        "features": ["webmail", "mailbox"],
-        "context_name": "merlaut.collectivite.fr",
-    }
-    assert (
-        tasks[1].headers["Authorization"]
-        == f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-    )
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_tasks_on_commune_creation_include_fetching_spec():
-    """Test the third task in commune creation: asking Dimail for the spec"""
-    plugin = CommuneCreation()
-    name = "Loc-Eguiner"
-
-    tasks = plugin.complete_commune_creation(name)
-
-    assert tasks[2].base == settings.MAIL_PROVISIONING_API_URL
-    assert tasks[2].url == "/domains/loc-eguiner.collectivite.fr/spec"
-    assert tasks[2].method == "GET"
-    assert (
-        tasks[2].headers["Authorization"]
-        == f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-    )
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_tasks_on_commune_creation_include_dns_records():
-    """Test the next several tasks in commune creation: creating records"""
-    plugin = CommuneCreation()
-    name = "Abidos"
-
-    spec_response = [
-        {"target": "", "type": "mx", "value": "mx.dev.ox.numerique.gouv.fr."},
-        {
-            "target": "dimail._domainkey",
-            "type": "txt",
-            "value": "v=DKIM1; h=sha256; k=rsa; p=MIICIjANB<truncated>AAQ==",
-        },
-        {"target": "imap", "type": "cname", "value": "imap.dev.ox.numerique.gouv.fr."},
-        {"target": "smtp", "type": "cname", "value": "smtp.dev.ox.numerique.gouv.fr."},
-        {
-            "target": "",
-            "type": "txt",
-            "value": "v=spf1 include:_spf.dev.ox.numerique.gouv.fr -all",
-        },
-        {
-            "target": "webmail",
-            "type": "cname",
-            "value": "webmail.dev.ox.numerique.gouv.fr.",
-        },
-    ]
-
-    tasks = plugin.complete_commune_creation(name)
-    tasks[2].response_data = spec_response
-
-    expected = {
-        "changes": [
-            {
-                "add": {
-                    "records": [
-                        {
-                            "name": item["target"],
-                            "type": item["type"].upper(),
-                            "data": item["value"],
-                            "ttl": 3600,
-                        }
-                        for item in spec_response
-                    ]
-                }
-            }
-        ]
-    }
-
-    zone_call = plugin.complete_zone_creation(tasks[2])
-    assert zone_call.params == expected
-    assert zone_call.url == "/domain/v2beta1/dns-zones/abidos.collectivite.fr/records"
-    assert (
-        zone_call.headers["X-Auth-Token"] == settings.DNS_PROVISIONING_API_CREDENTIALS
-    )
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_tasks_on_grant_access():
-    """Test the final tasks after making user admin of an org"""
-    plugin = CommuneCreation()
-
-    tasks = plugin.complete_grant_access("some-sub", "mezos.collectivite.fr")
-
-    assert tasks[0].base == settings.MAIL_PROVISIONING_API_URL
-    assert tasks[0].url == "/users/"
-    assert tasks[0].method == "POST"
-    assert tasks[0].params == {
-        "name": "some-sub",
-        "password": "no",
-        "is_admin": False,
-        "perms": [],
-    }
-    assert (
-        tasks[0].headers["Authorization"]
-        == f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-    )
-
-    assert tasks[1].base == settings.MAIL_PROVISIONING_API_URL
-    assert tasks[1].url == "/allows/"
-    assert tasks[1].method == "POST"
-    assert tasks[1].params == {
-        "user": "some-sub",
-        "domain": "mezos.collectivite.fr",
-    }
-    assert (
-        tasks[1].headers["Authorization"]
-        == f"Basic {settings.MAIL_PROVISIONING_API_CREDENTIALS}"
-    )
-
-
-def test_normalize_name():
-    """Test name normalization"""
-    plugin = CommuneCreation()
-    assert plugin.normalize_name("Asnières-sur-Saône") == "asnieres-sur-saone"
-    assert plugin.normalize_name("Bâgé-le-Châtel") == "bage-le-chatel"
-    assert plugin.normalize_name("Courçais") == "courcais"
-    assert plugin.normalize_name("Moÿ-de-l'Aisne") == "moy-de-l-aisne"
-    assert plugin.normalize_name("Salouël") == "salouel"
-    assert (
-        plugin.normalize_name("Bors (Canton de Tude-et-Lavalette)")
-        == "bors-canton-de-tude-et-lavalette"
-    )
-
-
-@override_settings(DNS_PROVISIONING_TARGET_ZONE="collectivite.fr")
-def test_zone_name():
-    """Test transforming a commune name to a sub-zone of collectivite.fr"""
-    plugin = CommuneCreation()
-    assert plugin.zone_name("Bâgé-le-Châtel") == "bage-le-chatel.collectivite.fr"

src/backend/plugins/la_suite/tests/hooks/test_get_organization_name_and_metadata_from_siret.py

@@ -61,8 +61,7 @@ def test_organization_plugins_run_after_create(
     hook_settings, nature_juridique, is_commune, is_public_service
 ):
     """Test the run_after_create method of the organization plugins for nominal case."""
-    responses.add(
-        responses.GET,
+    responses.get(
         "https://recherche-entreprises.api.gouv.fr/search?q=12345678901234",
         json={
             "results": [
@@ -106,8 +105,7 @@ def test_organization_plugins_run_after_create(
 @responses.activate
 def test_organization_plugins_run_after_create_api_fail(hook_settings):
     """Test the plugin when the API call fails."""
-    responses.add(
-        responses.GET,
+    responses.get(
         "https://recherche-entreprises.api.gouv.fr/search?q=12345678901234",
         json={"error": "Internal Server Error"},
         status=500,
@@ -139,8 +137,7 @@ def test_organization_plugins_run_after_create_api_fail(hook_settings):
 )
 def test_organization_plugins_run_after_create_missing_data(hook_settings, results):
     """Test the plugin when the API call returns missing data."""
-    responses.add(
-        responses.GET,
+    responses.get(
         "https://recherche-entreprises.api.gouv.fr/search?q=12345678901234",
         json=results,
         status=200,
@@ -168,8 +165,7 @@ def test_organization_plugins_run_after_create_no_list_enseignes(
     hook_settings,
 ):
     """Test the run_after_create method of the organization plugins for nominal case."""
-    responses.add(
-        responses.GET,
+    responses.get(
         "https://recherche-entreprises.api.gouv.fr/search?q=12345678901234",
         json={
             "results": [

src/backend/plugins/la_suite/tests/hooks/test_hooks_loaded.py

@@ -26,15 +26,6 @@ def test_hooks_loaded():
     ]
     assert organization_created_hook_names == [
         "get_organization_name_and_metadata_from_siret_hook",
-        "commune_organization_created",
-    ]
-
-    organization_access_granted_hook_names = [
-        callback.__name__
-        for callback in registry.get_callbacks("organization_access_granted")
-    ]
-    assert organization_access_granted_hook_names == [
-        "commune_organization_access_granted"
     ]
 
     # cleanup the hooks

src/backend/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "people"
-version = "1.20.0"
+version = "1.22.2"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
@@ -27,40 +27,41 @@ requires-python = ">=3.11"
 dependencies = [
     "Brotli==1.2.0",
     "PyJWT==2.10.1",
-    "boto3==1.40.17",
-    "celery[redis]==5.5.3",
+    "boto3==1.42.24",
+    "celery[redis]==5.6.2",
     "django-celery-beat==2.8.1",
     "django-celery-results==2.6.0",
     "django-configurations==2.5.1",
-    "django-cors-headers==4.7.0",
-    "django-countries==7.6.1",
+    "django-cors-headers==4.9.0",
+    "django-countries==8.2.0",
     "django-extensions==4.1",
-    "django-lasuite==0.0.12",
-    "django-oauth-toolkit==3.0.1",
+    "django-lasuite==0.0.22",
+    "django-oauth-toolkit==3.2.0",
     "django-parler==2.3",
     "django-redis==6.0.0",
     "django-storages==1.14.6",
     "django-timezone-field>=5.1",
-    "django-treebeard==4.7.1",
-    "django-zxcvbn-password-validator==1.4.5",
-    "django==5.2.8",
+    "django-treebeard==4.8.0",
+    "django-zxcvbn-password-validator==1.5.2",
+    "django==5.2.9",
     "djangorestframework==3.16.1",
     "dockerflow==2024.4.2",
-    "drf_spectacular==0.28.0",
-    "drf_spectacular[sidecar]==0.28.0",
+    "drf_spectacular==0.29.0",
+    "drf_spectacular[sidecar]==0.29.0",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
     "flower==2.0.1",
     "gunicorn==23.0.0",
-    "joserfc==1.3.0",
-    "jsonschema==4.25.1",
-    "mozilla-django-oidc==4.0.1",
-    "nested-multipart-parser==1.5.0",
-    "psycopg[binary]==3.2.9",
-    "redis<=6.4.0",
+    "jaraco.context>=6.1.0",
+    "joserfc==1.6.1",
+    "jsonschema==4.26.0",
+    "mozilla-django-oidc==5.0.2",
+    "nested-multipart-parser==1.6.0",
+    "psycopg[binary]==3.3.2",
+    "redis<=7.1.0",
     "requests==2.32.5",
-    "sentry-sdk[django]==2.35.1",
-    "whitenoise==6.9.0",
+    "sentry-sdk[django]==2.49.0",
+    "whitenoise==6.11.0",
 ]
 
 [project.urls]
@@ -71,21 +72,21 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
-    "drf-spectacular-sidecar==2025.8.1",
+    "drf-spectacular-sidecar==2026.1.1",
     "ipdb==0.13.13",
-    "ipython==9.4.0",
+    "ipython==9.9.0",
     "jq==1.10.0",
-    "pyfakefs==5.9.2",
-    "pylint-django==2.6.1",
-    "pylint==3.3.8",
-    "pytest-cov==6.2.1",
+    "pyfakefs==6.0.0",
+    "pylint-django==2.7.0",
+    "pylint==4.0.4",
+    "pytest-cov==7.0.0",
     "pytest-django==4.11.1",
-    "pytest==8.4.1",
+    "pytest==9.0.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
     "responses==0.25.8",
-    "ruff==0.12.10",
-    "types-requests==2.32.4.20250809",
+    "ruff==0.14.11",
+    "types-requests==2.32.4.20260107",
     "freezegun==1.5.5",
 ]
 

src/frontend/apps/desk/.env.development

@@ -1 +1 @@
-NEXT_PUBLIC_API_ORIGIN=http://localhost:8071
+NEXT_PUBLIC_API_ORIGIN=http://localhost:8071

src/frontend/apps/desk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-desk",
-  "version": "1.20.0",
+  "version": "1.22.2",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -22,9 +22,9 @@
     "@tanstack/react-query": "5.90.5",
     "i18next": "25.6.0",
     "i18next-browser-languagedetector": "8.2.0",
-    "lodash": "4.17.21",
+    "lodash": "4.17.23",
     "luxon": "3.7.2",
-    "next": "15.4.7",
+    "next": "15.4.10",
     "react": "*",
     "react-dom": "*",
     "react-hook-form": "7.65.0",

src/frontend/apps/desk/src/components/Input.tsx

@@ -19,13 +19,17 @@ export const Input = ({ label, error, required, ...props }: InputProps) => {
       >
         {label} {required && '*'}
       </label>
+      {error && (
+        <Text $size="xs" $theme="danger" $variation="600">
+          {error}
+        </Text>
+      )}
       <input
         id={label}
         aria-required={required}
         required={required}
         style={{
           padding: '12px',
-          margin: '6px 0',
           borderRadius: '4px',
           fontSize: '14px',
           border: `1px solid ${error ? colorsTokens()['danger-500'] : colorsTokens()['greyscale-400']}`,
@@ -34,11 +38,6 @@ export const Input = ({ label, error, required, ...props }: InputProps) => {
         }}
         {...props}
       />
-      {error && (
-        <Text $size="xs" $color="error-500">
-          {error}
-        </Text>
-      )}
     </Box>
   );
 };

src/frontend/apps/desk/src/components/index.ts

@@ -11,3 +11,4 @@ export * from './Tag';
 export * from './Text';
 export * from './TextErrors';
 export * from './separators';
+export * from './tabs/CustomTabs';

src/frontend/apps/desk/src/components/tabs/CustomTabs.tsx

@@ -27,7 +27,7 @@ export const CustomTabs = ({ tabs }: Props) => {
             const id = tab.id ?? tab.label;
             return (
               <Tab key={id} aria-label={tab.ariaLabel} id={id}>
-                <Box $direction="row" $align="center" $gap="5px">
+                <Box $direction="row" $gap="5px">
                   {tab.iconName && (
                     <span className="material-icons" aria-hidden="true">
                       {tab.iconName}

src/frontend/apps/desk/src/components/tabs/custom-tabs.module.scss

@@ -1,63 +1,69 @@
 .customTabsContainer {
-  :global {
-    .react-aria-TabList {
-      display: flex;
+  display: flex;
+  width: 100%;
+  margin-top: 30px;
 
-      &[data-orientation='horizontal'] {
-        .react-aria-Tab {
-          border-bottom: 2px solid var(--c--theme--colors--greyscale-500);
-        }
-      }
+  :global(.react-aria-Tabs) {
+    width: 100%;
+    display: flex;
+    flex: 1;
+
+    &[data-orientation='horizontal'] {
+      flex-direction: column;
+    }
+  }
+
+  :global(.react-aria-TabList) {
+    display: flex;
+    width: 100%;
+    gap: 25px;
+  }
+
+  :global(.react-aria-Tab) {
+    display: flex;
+    padding: 0 10px 10px 10px;
+    cursor: pointer;
+    outline: none;
+    position: relative;
+    color: var(--c--theme--colors--secondary-900);
+    transition: color 200ms;
+    --border-color: transparent;
+    forced-color-adjust: none;
+
+    &[data-hovered] {
+      background-color: #fff;
+      color: var(--text-color-hover);
     }
 
-    .react-aria-Tab {
-      padding: 10px;
-      cursor: pointer;
-      outline: none;
-      position: relative;
-      color: var(--c--theme--colors--greyscale-700);
-      transition: color 200ms;
-
-      --border-color: transparent;
-
-      forced-color-adjust: none;
-
-      &[data-hovered],
-      &[data-focused] {
-        color: var(--c--theme--colors--greyscale-900);
-      }
+    &[data-selected] {
+      font-weight: 500;
+      color: var(--c--theme--colors--primary-text);
+      border-bottom: 2px solid var(--c--theme--colors--primary-text);
+    }
 
+    &[data-disabled] {
+      color: var(--text-color-disabled);
       &[data-selected] {
-        border-bottom: 2px solid var(--c--theme--colors--primary-600) !important;
-        color: var(--c--theme--colors--primary-600);
-      }
-
-      &[data-disabled] {
-        color: var(--c--theme--colors--greyscale-500);
-
-        &[data-selected] {
-          --border-color: var(--c--theme--colors--greyscale-200);
-        }
-      }
-
-      &[data-focus-visible]::after {
-        content: '';
-        position: absolute;
-        inset: 4px;
-        border-radius: 4px;
-        border: 1px solid var(--c--theme--colors--primary-600);
+        --border-color: var(--text-color-disabled);
       }
     }
 
-    .react-aria-TabPanel {
-      margin-top: 4px;
-      padding: 10px;
+    &[data-focus-visible]:after {
+      content: '';
+      position: absolute;
+      inset: 4px;
       border-radius: 4px;
-      outline: none;
+      border: 2px solid var(--focus-ring-color);
+    }
+  }
 
-      &[data-focus-visible] {
-        outline: 2px solid var(--c--theme--colors--primary-600);
-      }
+  :global(.react-aria-TabPanel) {
+    margin-top: 15px;
+    border-radius: 4px;
+    outline: none;
+
+    &[data-focus-visible] {
+      outline: 2px solid var(--focus-ring-color);
     }
   }
 }

src/frontend/apps/desk/src/features/mail-domains/access-management/api/__tests__/useDeleteMailDomainAccess.test.tsx

@@ -75,8 +75,7 @@ describe('useDeleteMailDomainAccess', () => {
       expect(onSuccess).toHaveBeenCalledWith(
         undefined,
         { slug: 'example-slug', accessId: '1-1-1-1-1' },
-        undefined,
-        { client: {}, meta: undefined, mutationKey: undefined },
+        undefined, // context
       ),
     );
     expect(fetchMock.lastUrl()).toContain(

src/frontend/apps/desk/src/features/mail-domains/access-management/api/__tests__/useUpdateMailDomainAccess.test.tsx

@@ -104,8 +104,7 @@ describe('useUpdateMailDomainAccess', () => {
       expect(onSuccess).toHaveBeenCalledWith(
         mockResponse, // data
         { slug: 'example-slug', accessId: '1-1-1-1-1', role: Role.VIEWER }, // variables
-        undefined, // onMutateResult
-        { client: {}, meta: undefined, mutationKey: undefined }, // context
+        undefined, // context
       ),
     );
     expect(fetchMock.lastUrl()).toContain(

src/frontend/apps/desk/src/features/mail-domains/access-management/api/useCreateMailDomainAccess.tsx

@@ -44,19 +44,42 @@ export const useCreateMailDomainAccess = (
   options?: UseCreateMailDomainAccessOptions,
 ) => {
   const queryClient = useQueryClient();
+  const {
+    onSuccess: optionsOnSuccess,
+    onError: optionsOnError,
+    ...restOptions
+  } = options || {};
 
   return useMutation<Access, APIError, CreateMailDomainAccessProps>({
     mutationFn: createMailDomainAccess,
-    ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    ...restOptions,
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_MAIL_DOMAIN_ACCESSES],
       });
       void queryClient.invalidateQueries({ queryKey: [KEY_MAIL_DOMAIN] });
-      options?.onSuccess?.(data, variables, onMutateResult, context);
+      if (optionsOnSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnSuccess as unknown as (
+            data: Access,
+            variables: CreateMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
+      }
     },
-    onError: (error, variables, onMutateResult, context) => {
-      options?.onError?.(error, variables, onMutateResult, context);
+    onError: (error, variables, context) => {
+      if (optionsOnError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnError as unknown as (
+            error: APIError,
+            variables: CreateMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
+      }
     },
   });
 };

src/frontend/apps/desk/src/features/mail-domains/access-management/api/useDeleteMailDomainAccess.tsx

@@ -46,10 +46,15 @@ export const useDeleteMailDomainAccess = (
   options?: UseDeleteMailDomainAccessOptions,
 ) => {
   const queryClient = useQueryClient();
+  const {
+    onSuccess: optionsOnSuccess,
+    onError: optionsOnError,
+    ...restOptions
+  } = options || {};
   return useMutation<void, APIError, DeleteMailDomainAccessProps>({
     mutationFn: deleteMailDomainAccess,
-    ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    ...restOptions,
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_MAIL_DOMAIN_ACCESSES],
       });
@@ -59,13 +64,27 @@ export const useDeleteMailDomainAccess = (
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_MAIL_DOMAIN],
       });
-      if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+      if (optionsOnSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnSuccess as unknown as (
+            data: void,
+            variables: DeleteMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
-      if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+    onError: (error, variables, context) => {
+      if (optionsOnError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnError as unknown as (
+            error: APIError,
+            variables: DeleteMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/mail-domains/access-management/api/useUpdateMailDomainAccess.ts

@@ -51,23 +51,42 @@ export const useUpdateMailDomainAccess = (
   options?: UseUpdateMailDomainAccessOptions,
 ) => {
   const queryClient = useQueryClient();
+  const {
+    onSuccess: optionsOnSuccess,
+    onError: optionsOnError,
+    ...restOptions
+  } = options || {};
   return useMutation<Access, APIError, UpdateMailDomainAccessProps>({
     mutationFn: updateMailDomainAccess,
-    ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    ...restOptions,
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_MAIL_DOMAIN_ACCESSES],
       });
       void queryClient.invalidateQueries({
         queryKey: [KEY_MAIL_DOMAIN],
       });
-      if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+      if (optionsOnSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnSuccess as unknown as (
+            data: Access,
+            variables: UpdateMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
-      if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+    onError: (error, variables, context) => {
+      if (optionsOnError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnError as unknown as (
+            error: APIError,
+            variables: UpdateMailDomainAccessProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/mail-domains/aliases/api/index.tsx

@@ -0,0 +1,4 @@
+export * from './useAliases';
+export * from './useAliasesInfinite';
+export * from './useCreateAlias';
+export * from './useDeleteAlias';

src/frontend/apps/desk/src/features/mail-domains/aliases/api/useAliases.tsx

@@ -0,0 +1,57 @@
+import { UseQueryOptions, useQuery } from '@tanstack/react-query';
+
+import { APIError, APIList, errorCauses, fetchAPI } from '@/api';
+
+import { Alias } from '../types';
+
+export type MailDomainAliasesParams = {
+  mailDomainSlug: string;
+  page: number;
+  ordering?: string;
+};
+
+type MailDomainAliasesResponse = APIList<Alias>;
+
+export const getMailDomainAliases = async ({
+  mailDomainSlug,
+  page,
+  ordering,
+}: MailDomainAliasesParams): Promise<MailDomainAliasesResponse> => {
+  let url = `mail-domains/${mailDomainSlug}/aliases/?page=${page}`;
+
+  if (ordering) {
+    url += '&ordering=' + ordering;
+  }
+
+  const response = await fetchAPI(url);
+
+  if (!response.ok) {
+    throw new APIError(
+      `Failed to get the aliases of mail domain ${mailDomainSlug}`,
+      await errorCauses(response),
+    );
+  }
+
+  return response.json() as Promise<MailDomainAliasesResponse>;
+};
+
+export const KEY_LIST_ALIAS = 'aliases';
+
+export function useAliases(
+  param: MailDomainAliasesParams,
+  queryConfig?: UseQueryOptions<
+    MailDomainAliasesResponse,
+    APIError,
+    MailDomainAliasesResponse
+  >,
+) {
+  return useQuery<
+    MailDomainAliasesResponse,
+    APIError,
+    MailDomainAliasesResponse
+  >({
+    queryKey: [KEY_LIST_ALIAS, param],
+    queryFn: () => getMailDomainAliases(param),
+    ...queryConfig,
+  });
+}

src/frontend/apps/desk/src/features/mail-domains/aliases/api/useAliasesInfinite.tsx

@@ -0,0 +1,32 @@
+import { useInfiniteQuery } from '@tanstack/react-query';
+
+import { KEY_LIST_ALIAS, getMailDomainAliases } from './useAliases';
+
+export type MailDomainAliasesInfiniteParams = {
+  mailDomainSlug: string;
+  ordering?: string;
+};
+
+export function useAliasesInfinite(
+  param: MailDomainAliasesInfiniteParams,
+  queryConfig = {},
+) {
+  return useInfiniteQuery({
+    initialPageParam: 1,
+    queryKey: [KEY_LIST_ALIAS, param],
+    queryFn: ({ pageParam }) =>
+      getMailDomainAliases({
+        mailDomainSlug: param.mailDomainSlug,
+        page: pageParam,
+        ordering: param.ordering,
+      }),
+    getNextPageParam(lastPage, allPages) {
+      // When there is no more page, return undefined
+      if (!lastPage.next) {
+        return undefined;
+      }
+      return allPages.length + 1;
+    },
+    ...queryConfig,
+  });
+}

src/frontend/apps/desk/src/features/mail-domains/aliases/api/useCreateAlias.tsx

@@ -0,0 +1,83 @@
+import {
+  UseMutationOptions,
+  useMutation,
+  useQueryClient,
+} from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { KEY_LIST_ALIAS } from './useAliases';
+
+export interface CreateAliasParams {
+  local_part: string;
+  destination: string;
+  mailDomainSlug: string;
+}
+
+export const createAlias = async ({
+  mailDomainSlug,
+  ...data
+}: CreateAliasParams): Promise<void> => {
+  const response = await fetchAPI(`mail-domains/${mailDomainSlug}/aliases/`, {
+    method: 'POST',
+    body: JSON.stringify(data),
+  });
+
+  if (!response.ok) {
+    const errorData = await errorCauses(response);
+    throw new APIError('Failed to create the alias', {
+      status: errorData.status,
+      cause: errorData.cause as string[],
+      data: errorData.data,
+    });
+  }
+};
+
+type UseCreateAliasParams = { mailDomainSlug: string } & UseMutationOptions<
+  void,
+  APIError,
+  CreateAliasParams
+>;
+
+export const useCreateAlias = (options: UseCreateAliasParams) => {
+  const queryClient = useQueryClient();
+  const {
+    onSuccess: optionsOnSuccess,
+    onError: optionsOnError,
+    ...restOptions
+  } = options;
+  return useMutation<void, APIError, CreateAliasParams>({
+    mutationFn: createAlias,
+    ...restOptions,
+    onSuccess: (data, variables, context) => {
+      void queryClient.invalidateQueries({
+        queryKey: [
+          KEY_LIST_ALIAS,
+          { mailDomainSlug: variables.mailDomainSlug },
+        ],
+      });
+      if (optionsOnSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnSuccess as unknown as (
+            data: void,
+            variables: CreateAliasParams,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
+      }
+    },
+    onError: (error, variables, context) => {
+      if (optionsOnError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnError as unknown as (
+            error: APIError,
+            variables: CreateAliasParams,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
+      }
+    },
+  });
+};

src/frontend/apps/desk/src/features/mail-domains/aliases/api/useDeleteAlias.tsx

@@ -0,0 +1,79 @@
+import {
+  UseMutationOptions,
+  useMutation,
+  useQueryClient,
+} from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { KEY_LIST_ALIAS } from './useAliases';
+
+interface DeleteAliasParams {
+  mailDomainSlug: string;
+  localPart: string;
+}
+
+export const deleteAlias = async ({
+  mailDomainSlug,
+  localPart,
+}: DeleteAliasParams): Promise<void> => {
+  const response = await fetchAPI(
+    `mail-domains/${mailDomainSlug}/aliases/delete/?local_part=${encodeURIComponent(localPart)}`,
+    {
+      method: 'DELETE',
+    },
+  );
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to delete the alias',
+      await errorCauses(response),
+    );
+  }
+};
+
+type UseDeleteAliasOptions = UseMutationOptions<
+  void,
+  APIError,
+  DeleteAliasParams
+>;
+
+export const useDeleteAlias = (options?: UseDeleteAliasOptions) => {
+  const queryClient = useQueryClient();
+  const {
+    onSuccess: optionsOnSuccess,
+    onError: optionsOnError,
+    ...restOptions
+  } = options || {};
+  return useMutation<void, APIError, DeleteAliasParams>({
+    mutationFn: deleteAlias,
+    ...restOptions,
+    onSuccess: (data, variables, context) => {
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_LIST_ALIAS],
+      });
+      if (optionsOnSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnSuccess as unknown as (
+            data: void,
+            variables: DeleteAliasParams,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
+      }
+    },
+    onError: (error, variables, context) => {
+      if (optionsOnError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          optionsOnError as unknown as (
+            error: APIError,
+            variables: DeleteAliasParams,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
+      }
+    },
+  });
+};

src/frontend/apps/desk/src/features/mail-domains/aliases/api/useDeleteAliasById.tsx

@@ -0,0 +1,75 @@
+import {
+  UseMutationOptions,
+  useMutation,
+  useQueryClient,
+} from '@tanstack/react-query';
+
+import { APIError, errorCauses, fetchAPI } from '@/api';
+
+import { KEY_LIST_ALIAS } from './useAliases';
+
+interface DeleteAliasByIdParams {
+  mailDomainSlug: string;
+  aliasId: string;
+}
+
+export const deleteAliasById = async ({
+  mailDomainSlug,
+  aliasId,
+}: DeleteAliasByIdParams): Promise<void> => {
+  // Use aliasId (pk) directly in URL as per API lookup_field = "pk"
+  const response = await fetchAPI(
+    `mail-domains/${mailDomainSlug}/aliases/${aliasId}/`,
+    {
+      method: 'DELETE',
+    },
+  );
+
+  if (!response.ok) {
+    throw new APIError(
+      'Failed to delete the alias',
+      await errorCauses(response),
+    );
+  }
+};
+
+type UseDeleteAliasByIdOptions = UseMutationOptions<
+  void,
+  APIError,
+  DeleteAliasByIdParams
+>;
+
+export const useDeleteAliasById = (options?: UseDeleteAliasByIdOptions) => {
+  const queryClient = useQueryClient();
+  return useMutation<void, APIError, DeleteAliasByIdParams>({
+    mutationFn: deleteAliasById,
+    ...options,
+    onSuccess: (data, variables, context) => {
+      void queryClient.invalidateQueries({
+        queryKey: [KEY_LIST_ALIAS],
+      });
+      if (options?.onSuccess) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: void,
+            variables: DeleteAliasByIdParams,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
+      }
+    },
+    onError: (error, variables, context) => {
+      if (options?.onError) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: DeleteAliasByIdParams,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
+      }
+    },
+  });
+};

src/frontend/apps/desk/src/features/mail-domains/aliases/components/AliasesView.tsx

@@ -0,0 +1,135 @@
+import { Button, Input, Tooltip } from '@openfun/cunningham-react';
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { useCunninghamTheme } from '@/cunningham';
+import { ModalCreateAlias } from '@/features/mail-domains/aliases/components';
+import { AliasesListView } from '@/features/mail-domains/aliases/components/panel';
+
+import { MailDomain } from '../../domains/types';
+
+export function AliasesView({ mailDomain }: { mailDomain: MailDomain }) {
+  const [searchValue, setSearchValue] = useState('');
+
+  const [isCreateAliasFormVisible, setIsCreateAliasFormVisible] =
+    useState(false);
+
+  const { t } = useTranslation();
+
+  const { colorsTokens } = useCunninghamTheme();
+  const colors = colorsTokens();
+
+  const canCreateAlias = mailDomain.status === 'enabled';
+
+  const handleInputChange = (event: React.ChangeEvent<HTMLInputElement>) => {
+    setSearchValue(event.target.value);
+  };
+
+  const clearInput = () => {
+    setSearchValue('');
+  };
+
+  const openModal = () => {
+    setIsCreateAliasFormVisible(true);
+  };
+
+  return (
+    <>
+      <div aria-label="Aliases panel" className="container">
+        <h3 style={{ fontWeight: 700, fontSize: '18px', marginBottom: 'base' }}>
+          {t('Aliases')}
+        </h3>
+        <div
+          className="sm:block md:flex"
+          style={{
+            display: 'flex',
+            justifyContent: 'space-between',
+            alignItems: 'center',
+            marginBottom: '20px',
+            gap: '1em',
+          }}
+        >
+          <div
+            style={{ width: 'calc(100% - 245px)' }}
+            className="c__input__wrapper__mobile"
+          >
+            <Input
+              style={{ width: '100%' }}
+              label={t('Search for an alias')}
+              icon={<span className="material-icons">search</span>}
+              rightIcon={
+                searchValue && (
+                  <span
+                    className="material-icons"
+                    onClick={clearInput}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter' || e.key === ' ') {
+                        clearInput();
+                      }
+                    }}
+                    role="button"
+                    tabIndex={0}
+                    style={{ cursor: 'pointer' }}
+                  >
+                    close
+                  </span>
+                )
+              }
+              value={searchValue}
+              onChange={handleInputChange}
+            />
+          </div>
+
+          <div
+            className="hidden md:flex"
+            style={{
+              background: colors['greyscale-200'],
+              height: '32px',
+              width: '1px',
+            }}
+          ></div>
+
+          <div
+            className="block md:hidden"
+            style={{ marginBottom: '10px' }}
+          ></div>
+
+          <div>
+            {mailDomain?.abilities.post ? (
+              <Button
+                data-testid="button-new-alias"
+                aria-label={t('Create an alias in {{name}} domain', {
+                  name: mailDomain?.name,
+                })}
+                disabled={!canCreateAlias}
+                onClick={() => setIsCreateAliasFormVisible(true)}
+              >
+                {t('New alias')}
+              </Button>
+            ) : (
+              <Tooltip content={t("You don't have the correct access right")}>
+                <div>
+                  <Button
+                    data-testid="button-new-alias"
+                    onClick={openModal}
+                    disabled={!isCreateAliasFormVisible}
+                  >
+                    {t('New alias')}
+                  </Button>
+                </div>
+              </Tooltip>
+            )}
+          </div>
+        </div>
+
+        <AliasesListView mailDomain={mailDomain} querySearch={searchValue} />
+        {isCreateAliasFormVisible && mailDomain ? (
+          <ModalCreateAlias
+            mailDomain={mailDomain}
+            closeModal={() => setIsCreateAliasFormVisible(false)}
+          />
+        ) : null}
+      </div>
+    </>
+  );
+}

src/frontend/apps/desk/src/features/mail-domains/aliases/components/ModalCreateAlias.tsx

@@ -0,0 +1,438 @@
+import { standardSchemaResolver } from '@hookform/resolvers/standard-schema';
+import {
+  Button,
+  Loader,
+  ModalSize,
+  VariantType,
+  useToastProvider,
+} from '@openfun/cunningham-react';
+import React, { useState } from 'react';
+import { Controller, FormProvider, useForm } from 'react-hook-form';
+import { useTranslation } from 'react-i18next';
+import { z } from 'zod';
+
+import { parseAPIError } from '@/api/parseAPIError';
+import {
+  Box,
+  HorizontalSeparator,
+  Icon,
+  Input,
+  Text,
+  TextErrors,
+} from '@/components';
+import { CustomModal } from '@/components/modal/CustomModal';
+
+import { MailDomain } from '../../domains/types';
+import { useCreateAlias } from '../api';
+
+const FORM_ID = 'form-create-alias';
+
+export const ModalCreateAlias = ({
+  mailDomain,
+  closeModal,
+}: {
+  mailDomain: MailDomain;
+  closeModal: () => void;
+}) => {
+  const { t } = useTranslation();
+  const { toast } = useToastProvider();
+  const [errorCauses, setErrorCauses] = useState<string[]>([]);
+  const [step] = useState(0);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [destinations, setDestinations] = useState<string[]>([]);
+  const [newDestination, setNewDestination] = useState('');
+  const [destinationError, setDestinationError] = useState<string | null>(null);
+
+  type AliasFormData = {
+    local_part: string;
+  };
+
+  const createAliasValidationSchema: z.ZodType<AliasFormData> = z.object({
+    local_part: z
+      .string()
+      .regex(/^((?!@|\s)([a-zA-Z0-9.\-]))*$/, t('Invalid format'))
+      .min(1, t('You must have minimum 1 character')),
+  });
+
+  const methods = useForm<AliasFormData>({
+    resolver: standardSchemaResolver(createAliasValidationSchema),
+    defaultValues: {
+      local_part: '',
+    },
+    mode: 'onChange',
+  });
+
+  const addDestination = () => {
+    const trimmed = newDestination.trim();
+    if (!trimmed) {
+      setDestinationError(t('Please enter an email address'));
+      return;
+    }
+
+    // Validation email
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (!emailRegex.test(trimmed)) {
+      setDestinationError(t('Please enter a valid email address'));
+      return;
+    }
+
+    // Vérifier si déjà présent
+    if (destinations.includes(trimmed)) {
+      setDestinationError(t('This email address is already in the list'));
+      return;
+    }
+
+    setDestinations([...destinations, trimmed]);
+    setNewDestination('');
+    setDestinationError(null);
+  };
+
+  const removeDestination = (index: number) => {
+    setDestinations(destinations.filter((_, i) => i !== index));
+  };
+
+  const handleDestinationKeyPress = (
+    event: React.KeyboardEvent<HTMLInputElement>,
+  ) => {
+    if (event.key === 'Enter') {
+      event.preventDefault();
+      addDestination();
+    }
+  };
+
+  const { mutate: createAlias } = useCreateAlias({
+    mailDomainSlug: mailDomain.slug,
+  });
+
+  const onSubmitCallback = async (event: React.FormEvent) => {
+    event.preventDefault();
+    const isValid = await methods.trigger();
+    if (!isValid) {
+      return;
+    }
+
+    if (destinations.length === 0) {
+      toast(t('Please add at least one destination email'), VariantType.ERROR, {
+        duration: 4000,
+      });
+      return;
+    }
+
+    const data = methods.getValues();
+
+    setIsSubmitting(true);
+    setErrorCauses([]);
+
+    let successCount = 0;
+    let errorCount = 0;
+    const allErrors: string[] = [];
+
+    for (const destination of destinations) {
+      try {
+        await new Promise<void>((resolve, reject) => {
+          createAlias(
+            {
+              local_part: data.local_part,
+              destination: destination.trim(),
+              mailDomainSlug: mailDomain.slug,
+            },
+            {
+              onSuccess: () => {
+                successCount++;
+                resolve();
+              },
+              onError: (error) => {
+                errorCount++;
+                const causes =
+                  parseAPIError({
+                    error,
+                    errorParams: [
+                      [
+                        ['Local part ".*" already used by a mailbox.'],
+                        t('This email prefix is already used by a mailbox.'),
+                        undefined,
+                      ],
+                      [
+                        ['Invalid format'],
+                        t('Invalid format for the email prefix.'),
+                        undefined,
+                      ],
+                    ],
+                    serverErrorParams: [
+                      t(
+                        'The domain must be enabled to create aliases. Please check the domain status.',
+                      ),
+                      undefined,
+                    ],
+                  }) || [];
+
+                if (causes.length > 0) {
+                  allErrors.push(...causes);
+                }
+
+                reject(error);
+              },
+            },
+          );
+        });
+      } catch {
+        // Erreur déjà gérée dans onError
+      }
+    }
+
+    setIsSubmitting(false);
+
+    // Afficher les résultats
+    if (errorCount > 0) {
+      setErrorCauses(allErrors);
+    }
+
+    if (successCount === destinations.length) {
+      toast(
+        t('All {{count}} alias(es) created successfully!', {
+          count: successCount,
+        }),
+        VariantType.SUCCESS,
+        { duration: 4000 },
+      );
+      closeModal();
+    } else if (successCount > 0) {
+      toast(
+        t('{{success}} alias(es) created, {{errors}} failed', {
+          success: successCount,
+          errors: errorCount,
+        }),
+        VariantType.WARNING,
+        { duration: 5000 },
+      );
+    } else {
+      toast(t('Failed to create aliases'), VariantType.ERROR, {
+        duration: 4000,
+      });
+    }
+  };
+
+  const steps = [
+    {
+      title: t('New alias'),
+      content: (
+        <FormProvider {...methods}>
+          {!!errorCauses.length && <TextErrors causes={errorCauses} />}
+          <form
+            id={FORM_ID}
+            onSubmit={(e) => {
+              void onSubmitCallback(e);
+            }}
+          >
+            <Box $padding={{ top: 'sm', horizontal: 'md' }} $gap="4px">
+              <Text $size="md" $weight="bold">
+                {t('Alias configuration')}
+              </Text>
+              <Text $theme="greyscale" $variation="600">
+                {t(
+                  'An alias allows you to redirect emails to one or more addresses.',
+                )}
+              </Text>
+            </Box>
+
+            <Box
+              $padding="md"
+              style={{
+                position: 'relative',
+                alignItems: 'end',
+                gap: '20px',
+                flexDirection: 'row',
+                alignContent: 'flex-end',
+              }}
+            >
+              <Controller
+                name="local_part"
+                control={methods.control}
+                render={({ field }) => (
+                  <Box $align="center">
+                    <Input
+                      {...field}
+                      label={t('Name of the alias')}
+                      required
+                      placeholder={t('contact')}
+                    />
+                  </Box>
+                )}
+              />
+              <Box
+                style={{
+                  display: 'flex',
+                  position: 'absolute',
+                  top: '58px',
+                  left: '210px',
+                }}
+              >
+                <Text className="mb-8" $weight="500">
+                  @{mailDomain.name}
+                </Text>
+              </Box>
+            </Box>
+
+            <HorizontalSeparator $withPadding={true} />
+
+            <Box $padding={{ horizontal: 'md' }}>
+              <Box $margin={{ top: 'base', bottom: 'base' }} $gap="12px">
+                <Text $size="sm" $weight="500">
+                  {t('Destination email addresses')}
+                </Text>
+
+                <Box $gap="4px">
+                  <Box $direction="row" $gap="8px" $align="end">
+                    <Box style={{ flex: 1 }}>
+                      <Input
+                        value={newDestination}
+                        onChange={(e) => {
+                          setNewDestination(e.target.value);
+                          setDestinationError(null);
+                        }}
+                        onKeyPress={handleDestinationKeyPress}
+                        label={t('Add destination email')}
+                        placeholder=""
+                      />
+                    </Box>
+                    <Button
+                      type="button"
+                      onClick={addDestination}
+                      disabled={!newDestination.trim()}
+                    >
+                      {t('Add destination')}
+                    </Button>
+                  </Box>
+                  {destinationError && (
+                    <Text $theme="warning" $size="sm">
+                      {destinationError}
+                    </Text>
+                  )}
+                </Box>
+
+                {/* Destinations Array  */}
+                {destinations.length > 0 && (
+                  <Box
+                    $margin={{ top: 'md' }}
+                    style={{
+                      border:
+                        '1px solid var(--c--contextuals--border--surface--primary)',
+                      borderRadius: '4px',
+                      overflow: 'hidden',
+                    }}
+                  >
+                    <table
+                      style={{ width: '100%', borderCollapse: 'collapse' }}
+                    >
+                      <thead>
+                        <tr
+                          style={{
+                            paddingBottom: '12px',
+                            borderBottom:
+                              '1px solid var(--c--contextuals--border--surface--primary)',
+                          }}
+                        >
+                          <th
+                            style={{
+                              textAlign: 'left',
+                              fontWeight: 500,
+                              fontSize: '14px',
+                            }}
+                          >
+                            {t('Email address')}
+                          </th>
+                          <th
+                            style={{
+                              paddingBottom: '12px',
+                              textAlign: 'right',
+                              width: '80px',
+                            }}
+                          >
+                            {t('Actions')}
+                          </th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {destinations.map((destination, index) => (
+                          <tr
+                            key={index}
+                            style={{
+                              paddingBottom: '12px',
+                              borderBottom:
+                                index < destinations.length - 1
+                                  ? '1px solid var(--c--contextuals--border--surface--primary)'
+                                  : 'none',
+                            }}
+                          >
+                            <td>
+                              <Text $size="sm">{destination}</Text>
+                            </td>
+                            <td style={{ textAlign: 'right' }}>
+                              <Button
+                                type="button"
+                                color="tertiary"
+                                onClick={() => removeDestination(index)}
+                                aria-label={t('Remove destination')}
+                                icon={<Icon iconName="delete" />}
+                              />
+                            </td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </Box>
+                )}
+              </Box>
+            </Box>
+          </form>
+        </FormProvider>
+      ),
+      leftAction: (
+        <Button color="secondary" onClick={closeModal}>
+          {t('Cancel')}
+        </Button>
+      ),
+      rightAction: (
+        <Button
+          type="submit"
+          form={FORM_ID}
+          disabled={
+            !methods.formState.isValid ||
+            destinations.length === 0 ||
+            isSubmitting
+          }
+        >
+          {isSubmitting ? t('Creating...') : t('Create alias')}
+        </Button>
+      ),
+    },
+  ];
+
+  return (
+    <div id="modal-new-alias">
+      <CustomModal
+        isOpen
+        hideCloseButton
+        step={step}
+        totalSteps={steps.length}
+        leftActions={steps[step].leftAction}
+        rightActions={steps[step].rightAction}
+        size={ModalSize.MEDIUM}
+        title={steps[step].title}
+        onClose={closeModal}
+        closeOnEsc
+        closeOnClickOutside
+      >
+        {steps[step].content}
+        {isSubmitting && (
+          <Box $align="center" $padding="md">
+            <Loader />
+            <Text $theme="greyscale" $variation="600" $margin={{ top: 'sm' }}>
+              {t('Creating alias...')}
+            </Text>
+          </Box>
+        )}
+      </CustomModal>
+    </div>
+  );
+};

src/frontend/apps/desk/src/features/mail-domains/aliases/components/ModalEditAlias.tsx

@@ -0,0 +1,578 @@
+import {
+  Button,
+  Loader,
+  ModalSize,
+  VariantType,
+  useToastProvider,
+} from '@openfun/cunningham-react';
+import React, { useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { parseAPIError } from '@/api/parseAPIError';
+import {
+  Box,
+  HorizontalSeparator,
+  Icon,
+  Input,
+  Text,
+  TextErrors,
+} from '@/components';
+import { Modal } from '@/components/Modal';
+import { CustomModal } from '@/components/modal/CustomModal';
+
+import { MailDomain } from '../../domains/types';
+import { useCreateAlias } from '../api/useCreateAlias';
+import { useDeleteAlias } from '../api/useDeleteAlias';
+import { useDeleteAliasById } from '../api/useDeleteAliasById';
+import { AliasGroup } from '../types';
+
+const FORM_ID = 'form-edit-alias';
+
+export const ModalEditAlias = ({
+  mailDomain,
+  aliasGroup,
+  closeModal,
+}: {
+  mailDomain: MailDomain;
+  aliasGroup: AliasGroup;
+  closeModal: () => void;
+}) => {
+  const { t } = useTranslation();
+  const { toast } = useToastProvider();
+  const [errorCauses, setErrorCauses] = useState<string[]>([]);
+  const [step] = useState(0);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [destinations, setDestinations] = useState<string[]>([]);
+  const [newDestination, setNewDestination] = useState('');
+  const [destinationError, setDestinationError] = useState<string | undefined>(
+    undefined,
+  );
+  const [confirmModal, setConfirmModal] = useState<{
+    isOpen: boolean;
+    title: string;
+    message: string;
+    onConfirm: () => void;
+  }>({
+    isOpen: false,
+    title: '',
+    message: '',
+    onConfirm: () => {},
+  });
+
+  useEffect(() => {
+    setDestinations([...aliasGroup.destinations]);
+  }, [aliasGroup]);
+
+  const addDestination = async () => {
+    const trimmed = newDestination.trim();
+    if (!trimmed) {
+      setDestinationError(t('Please enter an email address'));
+      return;
+    }
+
+    // Valid email format
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (!emailRegex.test(trimmed)) {
+      setDestinationError(t('Please enter a valid email address'));
+      return;
+    }
+
+    // Email already in list
+    if (destinations.includes(trimmed)) {
+      setDestinationError(t('This email address is already in the list'));
+      return;
+    }
+
+    // Check domain enabled
+    if (mailDomain.status !== 'enabled') {
+      setDestinationError(
+        t(
+          'The domain must be enabled to add destinations. Current status: {{status}}',
+          {
+            status: mailDomain.status,
+          },
+        ),
+      );
+      return;
+    }
+
+    setIsSubmitting(true);
+    setDestinationError(undefined);
+
+    try {
+      await new Promise<void>((resolve, reject) => {
+        createAlias(
+          {
+            local_part: aliasGroup.local_part,
+            destination: trimmed,
+            mailDomainSlug: mailDomain.slug,
+          },
+          {
+            onSuccess: () => {
+              toast(t('Destination added successfully'), VariantType.SUCCESS, {
+                duration: 4000,
+              });
+              setDestinations([...destinations, trimmed]);
+              setNewDestination('');
+              resolve();
+            },
+            onError: (error) => {
+              const causes =
+                parseAPIError({
+                  error,
+                  errorParams: [
+                    [
+                      ['Local part ".*" already used by a mailbox.'],
+                      t('This email prefix is already used by a mailbox.'),
+                      undefined,
+                    ],
+                    [
+                      ['Invalid format'],
+                      t('Invalid format for the email prefix.'),
+                      undefined,
+                    ],
+                  ],
+                  serverErrorParams: [
+                    t(
+                      'The domain must be enabled to add destinations. Please check the domain status.',
+                    ),
+                    undefined,
+                  ],
+                }) || [];
+
+              if (causes.length > 0) {
+                setDestinationError(causes[0]);
+              } else {
+                setDestinationError(
+                  t('Failed to add destination. Please try again.'),
+                );
+              }
+              reject(error);
+            },
+          },
+        );
+      });
+    } catch {
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const removeDestination = (destination: string) => {
+    setConfirmModal({
+      isOpen: true,
+      title: t('Remove destination'),
+      message: t(
+        'Are you sure you want to remove {{destination}} from this alias?',
+        { destination },
+      ),
+      onConfirm: () => {
+        setConfirmModal({ ...confirmModal, isOpen: false });
+        void handleRemoveDestination(destination);
+      },
+    });
+  };
+
+  const handleRemoveDestination = async (destination: string) => {
+    setIsSubmitting(true);
+
+    const aliasId = aliasGroup.destinationIds[destination];
+    if (!aliasId) {
+      toast(
+        t('Failed to find alias ID for this destination'),
+        VariantType.ERROR,
+        {
+          duration: 4000,
+        },
+      );
+      setIsSubmitting(false);
+      return;
+    }
+
+    try {
+      await new Promise<void>((resolve, reject) => {
+        deleteAliasById(
+          {
+            mailDomainSlug: mailDomain.slug,
+            aliasId,
+          },
+          {
+            onSuccess: () => {
+              toast(
+                t('Destination removed successfully'),
+                VariantType.SUCCESS,
+                {
+                  duration: 4000,
+                },
+              );
+              setDestinations(destinations.filter((d) => d !== destination));
+              resolve();
+              closeModal();
+            },
+            onError: (error) => {
+              const causes =
+                parseAPIError({
+                  error,
+                  errorParams: [],
+                  serverErrorParams: [
+                    t(
+                      'An error occurred while removing the destination. Please try again.',
+                    ),
+                    undefined,
+                  ],
+                }) || [];
+
+              if (causes.length > 0) {
+                setDestinationError(causes[0]);
+              } else {
+                toast(t('Failed to remove destination'), VariantType.ERROR, {
+                  duration: 4000,
+                });
+              }
+              reject(error);
+            },
+          },
+        );
+      });
+    } catch {
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleRemoveAllDestinations = () => {
+    setConfirmModal({
+      isOpen: true,
+      title: t('Delete this alias'),
+      message: t(
+        'Are you sure you want to remove all destinations from this alias? This action cannot be undone.',
+      ),
+      onConfirm: () => {
+        setConfirmModal({ ...confirmModal, isOpen: false });
+        void removeAllDestinations();
+      },
+    });
+  };
+
+  const removeAllDestinations = async () => {
+    if (destinations.length === 0) {
+      return;
+    }
+
+    setIsSubmitting(true);
+    setErrorCauses([]);
+
+    try {
+      await new Promise<void>((resolve, reject) => {
+        deleteAlias(
+          {
+            mailDomainSlug: mailDomain.slug,
+            localPart: aliasGroup.local_part,
+          },
+          {
+            onSuccess: () => {
+              toast(t('Alias deleted successfully'), VariantType.SUCCESS, {
+                duration: 4000,
+              });
+              setDestinations([]);
+              resolve();
+              closeModal();
+            },
+            onError: (error) => {
+              const causes =
+                parseAPIError({
+                  error,
+                  errorParams: [],
+                  serverErrorParams: [
+                    t(
+                      'An error occurred while deleting the alias. Please try again.',
+                    ),
+                    undefined,
+                  ],
+                }) || [];
+
+              if (causes.length > 0) {
+                setErrorCauses(causes);
+              } else {
+                toast(t('Failed to delete alias'), VariantType.ERROR, {
+                  duration: 4000,
+                });
+              }
+              reject(error);
+            },
+          },
+        );
+      });
+    } catch {
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleDestinationKeyPress = (
+    event: React.KeyboardEvent<HTMLInputElement>,
+  ) => {
+    if (event.key === 'Enter') {
+      event.preventDefault();
+      void addDestination();
+    }
+  };
+
+  const { mutate: createAlias } = useCreateAlias({
+    mailDomainSlug: mailDomain.slug,
+  });
+
+  const { mutate: deleteAliasById } = useDeleteAliasById();
+  const { mutate: deleteAlias } = useDeleteAlias();
+
+  const steps = [
+    {
+      title: t('Manage alias'),
+      content: (
+        <>
+          {!!errorCauses.length && <TextErrors causes={errorCauses} />}
+          <form
+            id={FORM_ID}
+            onSubmit={(e) => {
+              e.preventDefault();
+              void addDestination();
+            }}
+          >
+            <Box $padding={{ top: 'sm', horizontal: 'md' }} $gap="4px">
+              <Text $size="md" $weight="bold">
+                {t('Alias configuration')}
+              </Text>
+              <Text $theme="greyscale" $variation="600">
+                {t('Manage the destination email addresses for this alias.')}
+              </Text>
+            </Box>
+
+            <Box
+              $padding="md"
+              style={{
+                position: 'relative',
+                alignItems: 'end',
+                gap: '20px',
+                flexDirection: 'row',
+                alignContent: 'flex-end',
+              }}
+            >
+              <Box>
+                <Input
+                  value={aliasGroup.local_part}
+                  label={t('Name of the alias')}
+                  disabled
+                  readOnly
+                />
+              </Box>
+              <Box
+                style={{
+                  display: 'flex',
+                  position: 'absolute',
+                  top: '58px',
+                  left: '210px',
+                }}
+              >
+                <Text className="mb-8" $weight="500">
+                  @{mailDomain.name}
+                </Text>
+              </Box>
+            </Box>
+
+            <HorizontalSeparator $withPadding={true} />
+
+            <Box $padding={{ horizontal: 'md' }}>
+              <Box $margin={{ top: 'base', bottom: 'base' }} $gap="12px">
+                <Text $size="sm" $weight="500">
+                  {t('Destination email addresses')}
+                </Text>
+
+                <Box $gap="4px">
+                  <Box $direction="row" $gap="8px" $align="end">
+                    <Box style={{ flex: 1 }}>
+                      <Input
+                        value={newDestination}
+                        onChange={(e) => {
+                          setNewDestination(e.target.value);
+                          setDestinationError(undefined);
+                        }}
+                        onKeyPress={handleDestinationKeyPress}
+                        error={destinationError}
+                        label={t('Add destination email')}
+                        placeholder={t('john.appleseed@example.fr')}
+                      />
+                    </Box>
+                    <Button
+                      type="submit"
+                      form={FORM_ID}
+                      disabled={!newDestination.trim() || isSubmitting}
+                    >
+                      {isSubmitting ? t('Adding...') : t('Add')}
+                    </Button>
+                  </Box>
+                </Box>
+
+                {/* Tableau des destinations */}
+                {destinations.length > 0 && (
+                  <Box
+                    $margin={{ top: 'md' }}
+                    $css={`
+                      table tbody tr {
+                        transition: background-color 0.2s ease;
+                        cursor: pointer;
+                      }
+                      table tbody tr:hover {
+                        background-color: rgba(0, 0, 0, 0.04);
+                      }
+                    `}
+                  >
+                    <table
+                      style={{ width: '100%', borderCollapse: 'collapse' }}
+                    >
+                      <thead>
+                        <tr
+                          style={{
+                            paddingBottom: '12px',
+                            borderBottom:
+                              '1px solid var(--c--contextuals--border--surface--primary)',
+                          }}
+                        >
+                          <th
+                            style={{
+                              textAlign: 'left',
+                              fontWeight: 500,
+                              fontSize: '14px',
+                            }}
+                          >
+                            {t('Email address')}
+                          </th>
+                          <th
+                            style={{
+                              paddingBottom: '12px',
+                              textAlign: 'right',
+                              width: '80px',
+                            }}
+                          >
+                            {t('Actions')}
+                          </th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {destinations.map((destination, index) => (
+                          <tr
+                            key={index}
+                            style={{
+                              paddingBottom: '12px',
+                              marginBottom: '12px',
+                            }}
+                          >
+                            <td style={{ paddingLeft: '12px' }}>
+                              <Text $size="sm">{destination}</Text>
+                            </td>
+                            <td style={{ textAlign: 'right' }}>
+                              <Button
+                                type="button"
+                                color="tertiary"
+                                onClick={() => removeDestination(destination)}
+                                aria-label={t('Remove destination')}
+                                icon={<Icon iconName="delete" />}
+                                disabled={isSubmitting}
+                              />
+                            </td>
+                          </tr>
+                        ))}
+                      </tbody>
+                    </table>
+                  </Box>
+                )}
+              </Box>
+            </Box>
+          </form>
+        </>
+      ),
+      leftAction: (
+        <Button color="secondary" onClick={closeModal}>
+          {t('Close')}
+        </Button>
+      ),
+      rightAction: (
+        <Box $direction="row" $gap="6px">
+          {destinations.length > 0 && (
+            <Button
+              type="button"
+              color="danger"
+              onClick={handleRemoveAllDestinations}
+              disabled={isSubmitting}
+              icon={
+                <Icon iconName="delete" $theme="greyscale" $variation="000" />
+              }
+            >
+              {t('Delete this alias')}
+            </Button>
+          )}
+        </Box>
+      ),
+    },
+  ];
+
+  return (
+    <div id="modal-edit-alias">
+      <CustomModal
+        isOpen
+        hideCloseButton
+        step={step}
+        totalSteps={steps.length}
+        leftActions={steps[step].leftAction}
+        rightActions={steps[step].rightAction}
+        size={ModalSize.MEDIUM}
+        title={steps[step].title}
+        onClose={closeModal}
+        closeOnEsc
+        closeOnClickOutside
+      >
+        {steps[step].content}
+        {isSubmitting && (
+          <Box $align="center" $padding="md">
+            <Loader />
+            <Text $theme="greyscale" $variation="600" $margin={{ top: 'sm' }}>
+              {t('Updating alias...')}
+            </Text>
+          </Box>
+        )}
+      </CustomModal>
+
+      {/* Confirmation Modal */}
+      <Modal
+        isOpen={confirmModal.isOpen}
+        closeOnClickOutside
+        hideCloseButton
+        leftActions={
+          <Button
+            color="secondary"
+            fullWidth
+            onClick={() => setConfirmModal({ ...confirmModal, isOpen: false })}
+          >
+            {t('Cancel')}
+          </Button>
+        }
+        rightActions={
+          <Button
+            color="danger"
+            fullWidth
+            onClick={confirmModal.onConfirm}
+            disabled={isSubmitting}
+          >
+            {t('Confirm')}
+          </Button>
+        }
+        size={ModalSize.MEDIUM}
+        title={confirmModal.title}
+        onClose={() => setConfirmModal({ ...confirmModal, isOpen: false })}
+      >
+        <Box $padding="md">
+          <Text>{confirmModal.message}</Text>
+        </Box>
+      </Modal>
+    </div>
+  );
+};

src/frontend/apps/desk/src/features/mail-domains/aliases/components/index.ts

@@ -0,0 +1,3 @@
+export * from './AliasesView';
+export * from './ModalCreateAlias';
+export * from './ModalEditAlias';

src/frontend/apps/desk/src/features/mail-domains/aliases/components/panel/AliasesListView.tsx

@@ -0,0 +1,222 @@
+import { Button, DataGrid, SortModel } from '@openfun/cunningham-react';
+import type { InfiniteData } from '@tanstack/react-query';
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box, Text, TextErrors } from '@/components';
+import { useAuthStore } from '@/core/auth';
+import { Alias, AliasGroup } from '@/features/mail-domains/aliases/types';
+import { MailDomain } from '@/features/mail-domains/domains';
+
+import { useAliasesInfinite } from '../../api/useAliasesInfinite';
+import { ModalEditAlias } from '../ModalEditAlias';
+
+type MailDomainAliasesResponse = {
+  count: number;
+  next: string | null;
+  previous: string | null;
+  results: Alias[];
+};
+
+interface AliasesListViewProps {
+  mailDomain: MailDomain;
+  querySearch: string;
+}
+
+type SortModelItem = {
+  field: string;
+  sort: 'asc' | 'desc' | null;
+};
+
+function formatSortModel(sortModel: SortModelItem) {
+  return sortModel.sort === 'desc' ? `-${sortModel.field}` : sortModel.field;
+}
+
+export function AliasesListView({
+  mailDomain,
+  querySearch,
+}: AliasesListViewProps) {
+  const { t } = useTranslation();
+  const { userData } = useAuthStore();
+  const [editingAliasGroup, setEditingAliasGroup] = useState<AliasGroup | null>(
+    null,
+  );
+
+  const [sortModel] = useState<SortModel>([]);
+
+  const ordering = sortModel.length ? formatSortModel(sortModel[0]) : undefined;
+  const {
+    data,
+    isLoading,
+    error,
+    fetchNextPage,
+    hasNextPage,
+    isFetchingNextPage,
+  } = useAliasesInfinite({
+    mailDomainSlug: mailDomain.slug,
+    ordering,
+  }) as {
+    data: InfiniteData<MailDomainAliasesResponse, number> | undefined;
+    isLoading: boolean;
+    error: { cause?: string[] };
+    fetchNextPage: () => void;
+    hasNextPage: boolean | undefined;
+    isFetchingNextPage: boolean;
+  };
+
+  const aliasGroups: AliasGroup[] = useMemo(() => {
+    if (!mailDomain || !data?.pages?.length) {
+      return [];
+    }
+
+    const grouped = new Map<string, AliasGroup>();
+
+    data.pages.forEach((page) => {
+      page.results.forEach((alias: Alias) => {
+        const email = `${alias.local_part}@${mailDomain.name}`;
+        const existing = grouped.get(alias.local_part);
+        if (existing) {
+          if (!existing.destinations.includes(alias.destination)) {
+            existing.destinations.push(alias.destination);
+            existing.destinationIds[alias.destination] = alias.id;
+            existing.count_destinations = existing.destinations.length;
+          }
+        } else {
+          const destinationIds: Record<string, string> = {};
+          destinationIds[alias.destination] = alias.id;
+          grouped.set(alias.local_part, {
+            id: alias.local_part,
+            email,
+            local_part: alias.local_part,
+            destinations: [alias.destination],
+            destinationIds,
+            count_destinations: 1,
+          });
+        }
+      });
+    });
+
+    return Array.from(grouped.values());
+  }, [data, mailDomain]);
+
+  const filteredAliases = useMemo(() => {
+    if (!querySearch) {
+      return aliasGroups;
+    }
+    const lowerCaseSearch = querySearch.toLowerCase();
+    return aliasGroups.filter(
+      (alias) =>
+        alias.email.toLowerCase().includes(lowerCaseSearch) ||
+        alias.destinations.some((dest) =>
+          dest.toLowerCase().includes(lowerCaseSearch),
+        ),
+    );
+  }, [querySearch, aliasGroups]);
+
+  const loadMoreRef = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    if (!hasNextPage) {
+      return;
+    }
+    const ref = loadMoreRef.current;
+    const observer = new IntersectionObserver(
+      (entries) => {
+        if (entries[0].isIntersecting && hasNextPage && !isFetchingNextPage) {
+          fetchNextPage();
+        }
+      },
+      { threshold: 1 },
+    );
+    if (ref) {
+      observer.observe(ref);
+    }
+    return () => {
+      if (ref) {
+        observer.unobserve(ref);
+      }
+    };
+  }, [hasNextPage, isFetchingNextPage, fetchNextPage]);
+
+  return (
+    <div>
+      {error && <TextErrors causes={error.cause ?? []} />}
+
+      {!filteredAliases.length && (
+        <Text $align="center" $size="small" $padding={{ top: 'base' }}>
+          {t('No alias was created with this mail domain.')}
+        </Text>
+      )}
+
+      {filteredAliases && filteredAliases.length ? (
+        <>
+          <DataGrid
+            aria-label="aliaslist"
+            rows={filteredAliases}
+            columns={[
+              {
+                field: 'email',
+                headerName: `${t('Alias')} • ${filteredAliases.length}`,
+                renderCell: ({ row }) => (
+                  <Text $weight="400" $theme="greyscale">
+                    {row.email}
+                  </Text>
+                ),
+              },
+              {
+                field: 'destinations',
+                headerName: t('Destinations'),
+                enableSorting: false,
+                renderCell: ({ row }) => (
+                  <Text $weight="500" $theme="greyscale">
+                    {row.count_destinations} destination
+                    {row.count_destinations > 1 ? 's' : ''}
+                  </Text>
+                ),
+              },
+              {
+                id: 'actions',
+                renderCell: ({ row }) => {
+                  // Check if user can edit
+                  const isOwnerOrAdmin =
+                    mailDomain.abilities?.patch || mailDomain.abilities?.put;
+                  const isAliasDestination = row.destinations.some(
+                    (dest) => dest === userData?.email,
+                  );
+                  const canEdit = isOwnerOrAdmin || isAliasDestination;
+
+                  return (
+                    <Box $direction="row" $gap="sm" $align="center">
+                      {canEdit && (
+                        <Button
+                          color="tertiary"
+                          onClick={() => setEditingAliasGroup(row)}
+                          style={{
+                            fontWeight: '500',
+                            fontSize: '16px',
+                          }}
+                        >
+                          {t('Manage')}
+                        </Button>
+                      )}
+                    </Box>
+                  );
+                },
+              },
+            ]}
+            isLoading={isLoading}
+          />
+          {isFetchingNextPage && <div>{t('Loading more...')}</div>}
+        </>
+      ) : null}
+      <div ref={loadMoreRef} />
+      {editingAliasGroup && (
+        <ModalEditAlias
+          mailDomain={mailDomain}
+          aliasGroup={editingAliasGroup}
+          closeModal={() => setEditingAliasGroup(null)}
+        />
+      )}
+    </div>
+  );
+}

src/frontend/apps/desk/src/features/mail-domains/aliases/components/panel/index.ts

@@ -0,0 +1 @@
+export * from './AliasesListView';

src/frontend/apps/desk/src/features/mail-domains/aliases/index.tsx

@@ -0,0 +1,3 @@
+export * from './api';
+export * from './components';
+export * from './types';

src/frontend/apps/desk/src/features/mail-domains/aliases/types.ts

@@ -0,0 +1,24 @@
+import { UUID } from 'crypto';
+
+export interface Alias {
+  id: UUID;
+  local_part: string;
+  destination: string;
+}
+
+export interface ViewAlias {
+  id: string;
+  email: string;
+  local_part: string;
+  destination: string;
+  alias: Alias;
+}
+
+export interface AliasGroup {
+  id: string;
+  email: string;
+  local_part: string;
+  destinations: string[];
+  destinationIds: Record<string, string>;
+  count_destinations: number;
+}

src/frontend/apps/desk/src/features/mail-domains/domains/components/MailDomainView.tsx

@@ -3,8 +3,10 @@ import { useRouter } from 'next/navigation';
 import * as React from 'react';
 import { useTranslation } from 'react-i18next';
 
-import { Box, Tag, Text } from '@/components';
+import { Box, CustomTabs, Tag, Text } from '@/components';
 import { useCunninghamTheme } from '@/cunningham';
+import { AliasesView } from '@/features/mail-domains/aliases';
+import { useAliases } from '@/features/mail-domains/aliases/api/useAliases';
 import MailDomainsLogo from '@/features/mail-domains/assets/mail-domains-logo.svg';
 import {
   MailDomain,
@@ -13,6 +15,7 @@ import {
   Role,
 } from '@/features/mail-domains/domains';
 import { MailBoxesView } from '@/features/mail-domains/mailboxes';
+import { useMailboxes } from '@/features/mail-domains/mailboxes/api/useMailboxes';
 
 type Props = {
   mailDomain: MailDomain;
@@ -30,6 +33,18 @@ export const MailDomainView = ({
   const router = useRouter();
   const [showModal, setShowModal] = React.useState(false);
 
+  const { data: mailboxesData } = useMailboxes({
+    mailDomainSlug: mailDomain.slug,
+    page: 1,
+  });
+  const { data: aliasesData } = useAliases({
+    mailDomainSlug: mailDomain.slug,
+    page: 1,
+  });
+
+  const countMailboxes = mailboxesData?.count ?? 0;
+  const countAliases = aliasesData?.count ?? 0;
+
   const handleShowModal = () => {
     setShowModal(true);
   };
@@ -110,15 +125,27 @@ export const MailDomainView = ({
           $padding={{ horizontal: 'md' }}
           $margin={{ top: 'md' }}
           $background="white"
-          $align="center"
-          $gap="8px"
           $radius="4px"
-          $direction="row"
           $css={`
           border: 1px solid ${colorsTokens()['greyscale-200']};
         `}
         >
-          <MailBoxesView mailDomain={mailDomain} />
+          <CustomTabs
+            tabs={[
+              {
+                id: 'mailboxes',
+                label: t('Email addresses') + ` (${countMailboxes})`,
+                iconName: 'mail',
+                content: <MailBoxesView mailDomain={mailDomain} />,
+              },
+              {
+                id: 'aliases',
+                label: t('Aliases') + ` (${countAliases})`,
+                iconName: 'forward_to_inbox',
+                content: <AliasesView mailDomain={mailDomain} />,
+              },
+            ]}
+          />
         </Box>
       </Box>
     </>

src/frontend/apps/desk/src/features/mail-domains/domains/components/ModalAddMailDomain.tsx

@@ -27,7 +27,7 @@ export const ModalAddMailDomain = ({
 
   const addMailDomainValidationSchema = z.object({
     name: z.string().min(1, t('Example: saint-laurent.fr')),
-    supportEmail: z.email(t('Please enter a valid email address')),
+    supportEmail: z.string().email(t('Please enter a valid email address')),
   });
 
   const methods = useForm<{ name: string; supportEmail: string }>({

src/frontend/apps/desk/src/features/mail-domains/mailboxes/api/useCreateMailbox.tsx

@@ -46,7 +46,8 @@ export const useCreateMailbox = (options: UseCreateMailboxParams) => {
   const queryClient = useQueryClient();
   return useMutation<void, APIError, CreateMailboxParams>({
     mutationFn: createMailbox,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    ...options,
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [
           KEY_LIST_MAILBOX,
@@ -54,12 +55,26 @@ export const useCreateMailbox = (options: UseCreateMailboxParams) => {
         ],
       });
       if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: void,
+            variables: CreateMailboxParams,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
+    onError: (error, variables, context) => {
       if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: CreateMailboxParams,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/mail-domains/mailboxes/api/useUpdateMailbox.tsx

@@ -49,7 +49,8 @@ export const useUpdateMailbox = (options: UseUpdateMailboxParams) => {
   return useMutation<void, APIError, UpdateMailboxParams>({
     mutationFn: (data) =>
       updateMailbox({ ...data, mailboxId: options.mailboxId }),
-    onSuccess: (data, variables, onMutateResult, context) => {
+    ...options,
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [
           KEY_LIST_MAILBOX,
@@ -57,12 +58,26 @@ export const useUpdateMailbox = (options: UseUpdateMailboxParams) => {
         ],
       });
       if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: void,
+            variables: UpdateMailboxParams,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
+    onError: (error, variables, context) => {
       if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: UpdateMailboxParams,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/teams/member-management/api/useDeleteTeamAccess.ts

@@ -41,7 +41,7 @@ export const useDeleteTeamAccess = (options?: UseDeleteTeamAccessOptions) => {
   return useMutation<void, APIError, DeleteTeamAccessProps>({
     mutationFn: deleteTeamAccess,
     ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_TEAM_ACCESSES],
       });
@@ -52,12 +52,26 @@ export const useDeleteTeamAccess = (options?: UseDeleteTeamAccessOptions) => {
         queryKey: [KEY_LIST_TEAM],
       });
       if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: void,
+            variables: DeleteTeamAccessProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
+    onError: (error, variables, context) => {
       if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: DeleteTeamAccessProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/teams/member-management/api/useUpdateTeamAccess.ts

@@ -49,7 +49,7 @@ export const useUpdateTeamAccess = (options?: UseUpdateTeamAccessOptions) => {
   return useMutation<Access, APIError, UpdateTeamAccessProps>({
     mutationFn: updateTeamAccess,
     ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_TEAM_ACCESSES],
       });
@@ -57,12 +57,26 @@ export const useUpdateTeamAccess = (options?: UseUpdateTeamAccessOptions) => {
         queryKey: [KEY_TEAM],
       });
       if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: Access,
+            variables: UpdateTeamAccessProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
+    onError: (error, variables, context) => {
       if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: UpdateTeamAccessProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/desk/src/features/teams/team-management/api/useRemoveTeam.tsx

@@ -34,17 +34,31 @@ export const useRemoveTeam = (options?: UseRemoveTeamOptions) => {
   return useMutation<void, APIError, RemoveTeamProps>({
     mutationFn: removeTeam,
     ...options,
-    onSuccess: (data, variables, onMutateResult, context) => {
+    onSuccess: (data, variables, context) => {
       void queryClient.invalidateQueries({
         queryKey: [KEY_LIST_TEAM],
       });
       if (options?.onSuccess) {
-        options.onSuccess(data, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onSuccess as unknown as (
+            data: void,
+            variables: RemoveTeamProps,
+            context: unknown,
+          ) => void
+        )(data, variables, context);
       }
     },
-    onError: (error, variables, onMutateResult, context) => {
+    onError: (error, variables, context) => {
       if (options?.onError) {
-        options.onError(error, variables, onMutateResult, context);
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-explicit-any
+        (
+          options.onError as unknown as (
+            error: APIError,
+            variables: RemoveTeamProps,
+            context: unknown,
+          ) => void
+        )(error, variables, context);
       }
     },
   });

src/frontend/apps/e2e/__tests__/app-desk/domain-provisioning.spec.ts

@@ -1,27 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-import { keyCloakSignIn } from './common';
-
-test.beforeEach(async ({ page, browserName }) => {
-  await page.goto('/');
-  await keyCloakSignIn(page, browserName, 'marie');
-});
-
-test.describe('When a commune, domain is created on first login via ProConnect', () => {
-  test('it checks the domain has been created and is operational', async ({
-    page,
-  }) => {
-    const menu = page.locator('menu').first();
-
-    await menu.getByRole('button', { name: 'Mail Domains button' }).click();
-    await page.waitForURL('http://localhost:3000/mail-domains/**');
-    await expect(
-      page.getByRole('heading', {
-        name: 'Domains of the organization',
-        exact: true,
-      }),
-    ).toBeVisible();
-    await expect(page.getByText('merlaut.test.collectivite.fr')).toHaveCount(1);
-    await expect(page.getByText('No domains exist.')).toHaveCount(0);
-  });
-});

src/frontend/apps/e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "app-e2e",
-  "version": "1.20.0",
+  "version": "1.22.2",
   "private": true,
   "scripts": {
     "lint": "eslint . --ext .ts",

src/frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "people",
-  "version": "1.20.0",
+  "version": "1.22.2",
   "private": true,
   "workspaces": {
     "packages": [

src/frontend/packages/eslint-config-people/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-config-people",
-  "version": "1.20.0",
+  "version": "1.22.2",
   "license": "MIT",
   "scripts": {
     "lint": "eslint --ext .js ."

src/frontend/packages/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packages-i18n",
-  "version": "1.20.0",
+  "version": "1.22.2",
   "private": true,
   "scripts": {
     "extract-translation": "yarn extract-translation:desk",

src/frontend/yarn.lock

@@ -75,7 +75,7 @@
     json5 "^2.2.3"
     semver "^6.3.1"
 
-"@babel/core@^7.24.4", "@babel/core@^7.27.4":
+"@babel/core@^7.27.4":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.28.5.tgz#4c81b35e51e1b734f510c99b07dfbc7bbbb48f7e"
   integrity sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==
@@ -332,7 +332,7 @@
   dependencies:
     "@babel/types" "^7.27.0"
 
-"@babel/parser@^7.24.4", "@babel/parser@^7.27.2", "@babel/parser@^7.28.5":
+"@babel/parser@^7.27.2", "@babel/parser@^7.28.5":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.28.5.tgz#0b0225ee90362f030efd644e8034c99468893b08"
   integrity sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==
@@ -1312,10 +1312,10 @@
   dependencies:
     tslib "^2.4.0"
 
-"@emnapi/runtime@^1.5.0":
-  version "1.5.0"
-  resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.5.0.tgz#9aebfcb9b17195dce3ab53c86787a6b7d058db73"
-  integrity sha512-97/BJ3iXHww3djw6hYIfErCZFee7qCtrneuLa20UXFCOTCfBM2cvQHjWJ2EG0s0MtdNwInarqCTz35i4wWXHsQ==
+"@emnapi/runtime@^1.7.0":
+  version "1.7.1"
+  resolved "https://registry.yarnpkg.com/@emnapi/runtime/-/runtime-1.7.1.tgz#a73784e23f5d57287369c808197288b52276b791"
+  integrity sha512-PVtJr5CmLwYAU9PZDMITZoR5iAOShYREoR45EyyLrbntV50mdePTgUn4AmOw90Ifcj+x2kRjdzr1HP3RrNiHGA==
   dependencies:
     tslib "^2.4.0"
 
@@ -1776,135 +1776,147 @@
   resolved "https://registry.yarnpkg.com/@img/colour/-/colour-1.0.0.tgz#d2fabb223455a793bf3bf9c70de3d28526aa8311"
   integrity sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==
 
-"@img/sharp-darwin-arm64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.4.tgz#8a0dcac9e621ff533fbf2e830f6a977b38d67a0c"
-  integrity sha512-sitdlPzDVyvmINUdJle3TNHl+AG9QcwiAMsXmccqsCOMZNIdW2/7S26w0LyU8euiLVzFBL3dXPwVCq/ODnf2vA==
+"@img/sharp-darwin-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.34.5.tgz#6e0732dcade126b6670af7aa17060b926835ea86"
+  integrity sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==
   optionalDependencies:
-    "@img/sharp-libvips-darwin-arm64" "1.2.3"
+    "@img/sharp-libvips-darwin-arm64" "1.2.4"
 
-"@img/sharp-darwin-x64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.4.tgz#0ba2bd9dbf07f7300fab73305b787e66156f7752"
-  integrity sha512-rZheupWIoa3+SOdF/IcUe1ah4ZDpKBGWcsPX6MT0lYniH9micvIU7HQkYTfrx5Xi8u+YqwLtxC/3vl8TQN6rMg==
+"@img/sharp-darwin-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.34.5.tgz#19bc1dd6eba6d5a96283498b9c9f401180ee9c7b"
+  integrity sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==
   optionalDependencies:
-    "@img/sharp-libvips-darwin-x64" "1.2.3"
+    "@img/sharp-libvips-darwin-x64" "1.2.4"
 
-"@img/sharp-libvips-darwin-arm64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.3.tgz#f43c9aa3b74fd307e4318da63ebbe0ed4c34e744"
-  integrity sha512-QzWAKo7kpHxbuHqUC28DZ9pIKpSi2ts2OJnoIGI26+HMgq92ZZ4vk8iJd4XsxN+tYfNJxzH6W62X5eTcsBymHw==
+"@img/sharp-libvips-darwin-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.2.4.tgz#2894c0cb87d42276c3889942e8e2db517a492c43"
+  integrity sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==
 
-"@img/sharp-libvips-darwin-x64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.3.tgz#c42ff786d4a1f42ef8929dba4a989dd5df6417f0"
-  integrity sha512-Ju+g2xn1E2AKO6YBhxjj+ACcsPQRHT0bhpglxcEf+3uyPY+/gL8veniKoo96335ZaPo03bdDXMv0t+BBFAbmRA==
+"@img/sharp-libvips-darwin-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.2.4.tgz#e63681f4539a94af9cd17246ed8881734386f8cc"
+  integrity sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==
 
-"@img/sharp-libvips-linux-arm64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.3.tgz#c9073e5c4b629ee417f777db21c552910d84ed77"
-  integrity sha512-I4RxkXU90cpufazhGPyVujYwfIm9Nk1QDEmiIsaPwdnm013F7RIceaCc87kAH+oUB1ezqEvC6ga4m7MSlqsJvQ==
+"@img/sharp-libvips-linux-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.2.4.tgz#b1b288b36864b3bce545ad91fa6dadcf1a4ad318"
+  integrity sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==
 
-"@img/sharp-libvips-linux-arm@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.3.tgz#3cbc333fd6b8f224a14d69b03a1dd11df897c799"
-  integrity sha512-x1uE93lyP6wEwGvgAIV0gP6zmaL/a0tGzJs/BIDDG0zeBhMnuUPm7ptxGhUbcGs4okDJrk4nxgrmxpib9g6HpA==
+"@img/sharp-libvips-linux-arm@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.2.4.tgz#b9260dd1ebe6f9e3bdbcbdcac9d2ac125f35852d"
+  integrity sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==
 
-"@img/sharp-libvips-linux-ppc64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.3.tgz#68e0e0076299f43d838468675674fabcc7161d16"
-  integrity sha512-Y2T7IsQvJLMCBM+pmPbM3bKT/yYJvVtLJGfCs4Sp95SjvnFIjynbjzsa7dY1fRJX45FTSfDksbTp6AGWudiyCg==
+"@img/sharp-libvips-linux-ppc64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.2.4.tgz#4b83ecf2a829057222b38848c7b022e7b4d07aa7"
+  integrity sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==
 
-"@img/sharp-libvips-linux-s390x@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.3.tgz#7da9ab11a50c0ca905979f0aae14a4ccffab27b2"
-  integrity sha512-RgWrs/gVU7f+K7P+KeHFaBAJlNkD1nIZuVXdQv6S+fNA6syCcoboNjsV2Pou7zNlVdNQoQUpQTk8SWDHUA3y/w==
+"@img/sharp-libvips-linux-riscv64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.2.4.tgz#880b4678009e5a2080af192332b00b0aaf8a48de"
+  integrity sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==
 
-"@img/sharp-libvips-linux-x64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.3.tgz#3b162d6b190cf77926819040e09fb15eec42135e"
-  integrity sha512-3JU7LmR85K6bBiRzSUc/Ff9JBVIFVvq6bomKE0e63UXGeRw2HPVEjoJke1Yx+iU4rL7/7kUjES4dZ/81Qjhyxg==
+"@img/sharp-libvips-linux-s390x@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.2.4.tgz#74f343c8e10fad821b38f75ced30488939dc59ec"
+  integrity sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==
 
-"@img/sharp-libvips-linuxmusl-arm64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.3.tgz#ac99576630dd8e33cb598d7c4586f6e0655912ea"
-  integrity sha512-F9q83RZ8yaCwENw1GieztSfj5msz7GGykG/BA+MOUefvER69K/ubgFHNeSyUu64amHIYKGDs4sRCMzXVj8sEyw==
+"@img/sharp-libvips-linux-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.2.4.tgz#df4183e8bd8410f7d61b66859a35edeab0a531ce"
+  integrity sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==
 
-"@img/sharp-libvips-linuxmusl-x64@1.2.3":
-  version "1.2.3"
-  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.3.tgz#93e9495af7bf6c4e0d41dd71d0196c35c3753a1c"
-  integrity sha512-U5PUY5jbc45ANM6tSJpsgqmBF/VsL6LnxJmIf11kB7J5DctHgqm0SkuXzVWtIY90GnJxKnC/JT251TDnk1fu/g==
+"@img/sharp-libvips-linuxmusl-arm64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.2.4.tgz#c8d6b48211df67137541007ee8d1b7b1f8ca8e06"
+  integrity sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==
 
-"@img/sharp-linux-arm64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.4.tgz#0570ff1a4fa6e1d6779456fca8b5e8c18a6a9cf2"
-  integrity sha512-YXU1F/mN/Wu786tl72CyJjP/Ngl8mGHN1hST4BGl+hiW5jhCnV2uRVTNOcaYPs73NeT/H8Upm3y9582JVuZHrQ==
+"@img/sharp-libvips-linuxmusl-x64@1.2.4":
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.2.4.tgz#be11c75bee5b080cbee31a153a8779448f919f75"
+  integrity sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==
+
+"@img/sharp-linux-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.34.5.tgz#7aa7764ef9c001f15e610546d42fce56911790cc"
+  integrity sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==
   optionalDependencies:
-    "@img/sharp-libvips-linux-arm64" "1.2.3"
+    "@img/sharp-libvips-linux-arm64" "1.2.4"
 
-"@img/sharp-linux-arm@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.4.tgz#5f020d933f54f3fc49203d32c3b7dd0ec11ffcdb"
-  integrity sha512-Xyam4mlqM0KkTHYVSuc6wXRmM7LGN0P12li03jAnZ3EJWZqj83+hi8Y9UxZUbxsgsK1qOEwg7O0Bc0LjqQVtxA==
+"@img/sharp-linux-arm@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-arm/-/sharp-linux-arm-0.34.5.tgz#5fb0c3695dd12522d39c3ff7a6bc816461780a0d"
+  integrity sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==
   optionalDependencies:
-    "@img/sharp-libvips-linux-arm" "1.2.3"
+    "@img/sharp-libvips-linux-arm" "1.2.4"
 
-"@img/sharp-linux-ppc64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.4.tgz#8d5775f6dc7e30ea3a1efa43798b7690bb5cb344"
-  integrity sha512-F4PDtF4Cy8L8hXA2p3TO6s4aDt93v+LKmpcYFLAVdkkD3hSxZzee0rh6/+94FpAynsuMpLX5h+LRsSG3rIciUQ==
+"@img/sharp-linux-ppc64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.34.5.tgz#9c213a81520a20caf66978f3d4c07456ff2e0813"
+  integrity sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==
   optionalDependencies:
-    "@img/sharp-libvips-linux-ppc64" "1.2.3"
+    "@img/sharp-libvips-linux-ppc64" "1.2.4"
 
-"@img/sharp-linux-s390x@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.4.tgz#740aa5b369188ee2c1913b1015e7f830f4dfdb50"
-  integrity sha512-qVrZKE9Bsnzy+myf7lFKvng6bQzhNUAYcVORq2P7bDlvmF6u2sCmK2KyEQEBdYk+u3T01pVsPrkj943T1aJAsw==
+"@img/sharp-linux-riscv64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.34.5.tgz#cdd28182774eadbe04f62675a16aabbccb833f60"
+  integrity sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==
   optionalDependencies:
-    "@img/sharp-libvips-linux-s390x" "1.2.3"
+    "@img/sharp-libvips-linux-riscv64" "1.2.4"
 
-"@img/sharp-linux-x64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.4.tgz#573ce4196b2d0771bba32acc13a37b7adc9b6212"
-  integrity sha512-ZfGtcp2xS51iG79c6Vhw9CWqQC8l2Ot8dygxoDoIQPTat/Ov3qAa8qpxSrtAEAJW+UjTXc4yxCjNfxm4h6Xm2A==
+"@img/sharp-linux-s390x@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.34.5.tgz#93eac601b9f329bb27917e0e19098c722d630df7"
+  integrity sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==
   optionalDependencies:
-    "@img/sharp-libvips-linux-x64" "1.2.3"
+    "@img/sharp-libvips-linux-s390x" "1.2.4"
 
-"@img/sharp-linuxmusl-arm64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.4.tgz#3c91bc8348cc3b42b43c6fca14f9dbb5cb47bd0d"
-  integrity sha512-8hDVvW9eu4yHWnjaOOR8kHVrew1iIX+MUgwxSuH2XyYeNRtLUe4VNioSqbNkB7ZYQJj9rUTT4PyRscyk2PXFKA==
+"@img/sharp-linux-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linux-x64/-/sharp-linux-x64-0.34.5.tgz#55abc7cd754ffca5002b6c2b719abdfc846819a8"
+  integrity sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==
   optionalDependencies:
-    "@img/sharp-libvips-linuxmusl-arm64" "1.2.3"
+    "@img/sharp-libvips-linux-x64" "1.2.4"
 
-"@img/sharp-linuxmusl-x64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.4.tgz#33de7d476ac9e2db7ef654331b54cc679b806bda"
-  integrity sha512-lU0aA5L8QTlfKjpDCEFOZsTYGn3AEiO6db8W5aQDxj0nQkVrZWmN3ZP9sYKWJdtq3PWPhUNlqehWyXpYDcI9Sg==
+"@img/sharp-linuxmusl-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.34.5.tgz#d6515ee971bb62f73001a4829b9d865a11b77086"
+  integrity sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==
   optionalDependencies:
-    "@img/sharp-libvips-linuxmusl-x64" "1.2.3"
+    "@img/sharp-libvips-linuxmusl-arm64" "1.2.4"
 
-"@img/sharp-wasm32@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-wasm32/-/sharp-wasm32-0.34.4.tgz#d617f7b3f851f899802298f360667c20605c0198"
-  integrity sha512-33QL6ZO/qpRyG7woB/HUALz28WnTMI2W1jgX3Nu2bypqLIKx/QKMILLJzJjI+SIbvXdG9fUnmrxR7vbi1sTBeA==
+"@img/sharp-linuxmusl-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.34.5.tgz#d97978aec7c5212f999714f2f5b736457e12ee9f"
+  integrity sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==
+  optionalDependencies:
+    "@img/sharp-libvips-linuxmusl-x64" "1.2.4"
+
+"@img/sharp-wasm32@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-wasm32/-/sharp-wasm32-0.34.5.tgz#2f15803aa626f8c59dd7c9d0bbc766f1ab52cfa0"
+  integrity sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==
   dependencies:
-    "@emnapi/runtime" "^1.5.0"
+    "@emnapi/runtime" "^1.7.0"
 
-"@img/sharp-win32-arm64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.4.tgz#38e2c8a88826eac647f7c3f99efefb39897a8f5c"
-  integrity sha512-2Q250do/5WXTwxW3zjsEuMSv5sUU4Tq9VThWKlU2EYLm4MB7ZeMwF+SFJutldYODXF6jzc6YEOC+VfX0SZQPqA==
+"@img/sharp-win32-arm64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.34.5.tgz#3706e9e3ac35fddfc1c87f94e849f1b75307ce0a"
+  integrity sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==
 
-"@img/sharp-win32-ia32@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.4.tgz#003a7eb0fdaba600790c3007cfd756e41a9cf749"
-  integrity sha512-3ZeLue5V82dT92CNL6rsal6I2weKw1cYu+rGKm8fOCCtJTR2gYeUfY3FqUnIJsMUPIH68oS5jmZ0NiJ508YpEw==
+"@img/sharp-win32-ia32@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.34.5.tgz#0b71166599b049e032f085fb9263e02f4e4788de"
+  integrity sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==
 
-"@img/sharp-win32-x64@0.34.4":
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.4.tgz#b19f1f88ace8bfc20784a0ad31767f3438e025d1"
-  integrity sha512-xIyj4wpYs8J18sVN3mSQjwrw7fKUqRw+Z5rnHNCy5fYTxigBz81u5mOMPmFumwjcn8+ld1ppptMBCLic1nz6ig==
+"@img/sharp-win32-x64@0.34.5":
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/@img/sharp-win32-x64/-/sharp-win32-x64-0.34.5.tgz#a81ffb00e69267cd0a1d626eaedb8a8430b2b2f8"
+  integrity sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==
 
 "@internationalized/date@3.8.0", "@internationalized/date@^3.8.0":
   version "3.8.0"
@@ -2295,10 +2307,10 @@
     "@emnapi/runtime" "^1.4.0"
     "@tybys/wasm-util" "^0.9.0"
 
-"@next/env@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.4.7.tgz#a7594ad61ecc88452d58b624500a30b340dd8528"
-  integrity sha512-PrBIpO8oljZGTOe9HH0miix1w5MUiGJ/q83Jge03mHEE0E3pyqzAy2+l5G6aJDbXoobmxPJTVhbCuwlLtjSHwg==
+"@next/env@15.4.10":
+  version "15.4.10"
+  resolved "https://registry.yarnpkg.com/@next/env/-/env-15.4.10.tgz#a794b738d043d9e98ea435bd45254899f7f77714"
+  integrity sha512-knhmoJ0Vv7VRf6pZEPSnciUG1S4bIhWx+qTYBW/AjxEtlzsiNORPk8sFDCEvqLfmKuey56UB9FL1UdHEV3uBrg==
 
 "@next/eslint-plugin-next@15.3.2":
   version "15.3.2"
@@ -2307,45 +2319,45 @@
   dependencies:
     fast-glob "3.3.1"
 
-"@next/swc-darwin-arm64@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.4.7.tgz#df3a60b3e5c2e03acfffd1d1d3e6d8f289f4a863"
-  integrity sha512-2Dkb+VUTp9kHHkSqtws4fDl2Oxms29HcZBwFIda1X7Ztudzy7M6XF9HDS2dq85TmdN47VpuhjE+i6wgnIboVzQ==
+"@next/swc-darwin-arm64@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.4.8.tgz#f5030219421079036720b5948ea9de9bee02ac34"
+  integrity sha512-Pf6zXp7yyQEn7sqMxur6+kYcywx5up1J849psyET7/8pG2gQTVMjU3NzgIt8SeEP5to3If/SaWmaA6H6ysBr1A==
 
-"@next/swc-darwin-x64@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.4.7.tgz#393a79d0749352c6f0062619ff47132e01c8615a"
-  integrity sha512-qaMnEozKdWezlmh1OGDVFueFv2z9lWTcLvt7e39QA3YOvZHNpN2rLs/IQLwZaUiw2jSvxW07LxMCWtOqsWFNQg==
+"@next/swc-darwin-x64@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.4.8.tgz#3fc796bd522aee30eff608448919e0ea1c1da7d1"
+  integrity sha512-xla6AOfz68a6kq3gRQccWEvFC/VRGJmA/QuSLENSO7CZX5WIEkSz7r1FdXUjtGCQ1c2M+ndUAH7opdfLK1PQbw==
 
-"@next/swc-linux-arm64-gnu@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.4.7.tgz#b3a0c3143974284bb8c12dc517d27e109e263b29"
-  integrity sha512-ny7lODPE7a15Qms8LZiN9wjNWIeI+iAZOFDOnv2pcHStncUr7cr9lD5XF81mdhrBXLUP9yT9RzlmSWKIazWoDw==
+"@next/swc-linux-arm64-gnu@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.4.8.tgz#5c7bf6a0de49c2b4c21bc8bdb3b5e431dd922c7d"
+  integrity sha512-y3fmp+1Px/SJD+5ntve5QLZnGLycsxsVPkTzAc3zUiXYSOlTPqT8ynfmt6tt4fSo1tAhDPmryXpYKEAcoAPDJw==
 
-"@next/swc-linux-arm64-musl@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.4.7.tgz#d59cf07f53c3950659fd2171300ad76fec4eac1c"
-  integrity sha512-4SaCjlFR/2hGJqZLLWycccy1t+wBrE/vyJWnYaZJhUVHccpGLG5q0C+Xkw4iRzUIkE+/dr90MJRUym3s1+vO8A==
+"@next/swc-linux-arm64-musl@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.4.8.tgz#94e47838715e68a696b33295f4389a60bd8af00a"
+  integrity sha512-DX/L8VHzrr1CfwaVjBQr3GWCqNNFgyWJbeQ10Lx/phzbQo3JNAxUok1DZ8JHRGcL6PgMRgj6HylnLNndxn4Z6A==
 
-"@next/swc-linux-x64-gnu@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.4.7.tgz#dae73ecbaad28e38848510c63d59e4adca978e0f"
-  integrity sha512-2uNXjxvONyRidg00VwvlTYDwC9EgCGNzPAPYbttIATZRxmOZ3hllk/YYESzHZb65eyZfBR5g9xgCZjRAl9YYGg==
+"@next/swc-linux-x64-gnu@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.4.8.tgz#4f9656e8bf9f28dac1970d6ff95a245014646417"
+  integrity sha512-9fLAAXKAL3xEIFdKdzG5rUSvSiZTLLTCc6JKq1z04DR4zY7DbAPcRvNm3K1inVhTiQCs19ZRAgUerHiVKMZZIA==
 
-"@next/swc-linux-x64-musl@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.4.7.tgz#2dfb5cb4083b43da79f3db94b211ae07982ac622"
-  integrity sha512-ceNbPjsFgLscYNGKSu4I6LYaadq2B8tcK116nVuInpHHdAWLWSwVK6CHNvCi0wVS9+TTArIFKJGsEyVD1H+4Kg==
+"@next/swc-linux-x64-musl@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.4.8.tgz#c5c64e18370f54f6474e58bb01b12594a4ecdde6"
+  integrity sha512-s45V7nfb5g7dbS7JK6XZDcapicVrMMvX2uYgOHP16QuKH/JA285oy6HcxlKqwUNaFY/UC6EvQ8QZUOo19cBKSA==
 
-"@next/swc-win32-arm64-msvc@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.4.7.tgz#829b76781df2a5a0c4357b8986aca4028159a538"
-  integrity sha512-pZyxmY1iHlZJ04LUL7Css8bNvsYAMYOY9JRwFA3HZgpaNKsJSowD09Vg2R9734GxAcLJc2KDQHSCR91uD6/AAw==
+"@next/swc-win32-arm64-msvc@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.4.8.tgz#722d18ed569bee9e4a6651acdc756f9633cbee1f"
+  integrity sha512-KjgeQyOAq7t/HzAJcWPGA8X+4WY03uSCZ2Ekk98S9OgCFsb6lfBE3dbUzUuEQAN2THbwYgFfxX2yFTCMm8Kehw==
 
-"@next/swc-win32-x64-msvc@15.4.7":
-  version "15.4.7"
-  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.4.7.tgz#39390cba2d2ee049a7f42593db8cc6b685677997"
-  integrity sha512-HjuwPJ7BeRzgl3KrjKqD2iDng0eQIpIReyhpF5r4yeAHFwWRuAhfW92rWv/r3qeQHEwHsLRzFDvMqRjyM5DI6A==
+"@next/swc-win32-x64-msvc@15.4.8":
+  version "15.4.8"
+  resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.4.8.tgz#a29a53cd262ec5093b9ac24a5fd5e4540ec64eb4"
+  integrity sha512-Exsmf/+42fWVnLMaZHzshukTBxZrSwuuLKFvqhGHJ+mC1AokqieLY/XzAl3jc/CqhXLqLY3RRjkKJ9YnLPcRWg==
 
 "@nodelib/fs.scandir@2.1.5":
   version "2.1.5"
@@ -2373,6 +2385,54 @@
   resolved "https://registry.yarnpkg.com/@nolyfill/is-core-module/-/is-core-module-1.0.39.tgz#3dc35ba0f1e66b403c00b39344f870298ebb1c8e"
   integrity sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==
 
+"@openfun/cunningham-react@3.2.3":
+  version "3.2.3"
+  resolved "https://registry.yarnpkg.com/@openfun/cunningham-react/-/cunningham-react-3.2.3.tgz#107bddbbe3b487734e4c6fedee38461f45f8035e"
+  integrity sha512-itmlw1nxts+iUcPpXsTl7LWpDzA9OfQh8ox2P7HxR4a7kmQpN7Z3OGcrsiaj8jwsbJpdgOSouWubvQ3OZ25BAg==
+  dependencies:
+    "@fontsource-variable/roboto-flex" "5.2.5"
+    "@fontsource/material-icons-outlined" "5.2.5"
+    "@internationalized/date" "3.8.0"
+    "@openfun/cunningham-tokens" "*"
+    "@react-aria/calendar" "3.8.0"
+    "@react-aria/datepicker" "3.14.2"
+    "@react-aria/i18n" "3.12.8"
+    "@react-stately/calendar" "3.8.0"
+    "@react-stately/datepicker" "3.14.0"
+    "@tanstack/react-table" "8.21.3"
+    "@types/react-modal" "3.16.3"
+    chromatic "11.28.2"
+    classnames "2.5.1"
+    downshift "9.0.9"
+    react-aria "3.39.0"
+    react-aria-components "1.8.0"
+    react-modal "3.16.3"
+    react-stately "3.37.0"
+
+"@openfun/cunningham-react@4.0.0":
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/@openfun/cunningham-react/-/cunningham-react-4.0.0.tgz#5d273c72a2ced76cf060931b546238b7ee75c6ec"
+  integrity sha512-2JgIRDl2UE/PMcOrjjfxbhFRwEwF7JFAaPoN/Xjq+sOYHP6WasRxFRrkwhnuZ5ZU7lOpzaAFyPtkawoBF6GsEQ==
+  dependencies:
+    "@fontsource-variable/roboto-flex" "5.2.5"
+    "@fontsource/material-icons-outlined" "5.2.5"
+    "@internationalized/date" "3.8.0"
+    "@openfun/cunningham-tokens" "*"
+    "@react-aria/calendar" "3.8.0"
+    "@react-aria/datepicker" "3.14.2"
+    "@react-aria/i18n" "3.12.8"
+    "@react-stately/calendar" "3.8.0"
+    "@react-stately/datepicker" "3.14.0"
+    "@tanstack/react-table" "8.21.3"
+    "@types/react-modal" "3.16.3"
+    chromatic "11.28.2"
+    classnames "2.5.1"
+    downshift "9.0.9"
+    react-aria "3.39.0"
+    react-aria-components "1.8.0"
+    react-modal "3.16.3"
+    react-stately "3.37.0"
+
 "@openfun/cunningham-tokens@*":
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/@openfun/cunningham-tokens/-/cunningham-tokens-2.2.0.tgz#9ebab9e86ccddd97888e3be1413e0ffd2f81dcce"
@@ -3849,6 +3909,11 @@
   resolved "https://registry.yarnpkg.com/@rtsao/scc/-/scc-1.1.0.tgz#927dd2fae9bc3361403ac2c7a00c32ddce9ad7e8"
   integrity sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==
 
+"@rushstack/eslint-patch@^1.10.3":
+  version "1.15.0"
+  resolved "https://registry.yarnpkg.com/@rushstack/eslint-patch/-/eslint-patch-1.15.0.tgz#8184bcb37791e6d3c3c13a9bfbe4af263f66665f"
+  integrity sha512-ojSshQPKwVvSMR8yT2L/QtUkV5SXi/IfDiJ4/8d6UbTPjiHVmxZzUAzGD8Tzks1b9+qQkZa0isUOvYObedITaw==
+
 "@sinclair/typebox@^0.34.0":
   version "0.34.41"
   resolved "https://registry.yarnpkg.com/@sinclair/typebox/-/typebox-0.34.41.tgz#aa51a6c1946df2c5a11494a2cdb9318e026db16c"
@@ -4297,6 +4362,21 @@
     natural-compare "^1.4.0"
     ts-api-utils "^2.1.0"
 
+"@typescript-eslint/eslint-plugin@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.48.1.tgz#c772d1dbdd97cfddf85f5a161a97783233643631"
+  integrity sha512-X63hI1bxl5ohelzr0LY5coufyl0LJNthld+abwxpCoo6Gq+hSqhKwci7MUWkXo67mzgUK6YFByhmaHmUcuBJmA==
+  dependencies:
+    "@eslint-community/regexpp" "^4.10.0"
+    "@typescript-eslint/scope-manager" "8.48.1"
+    "@typescript-eslint/type-utils" "8.48.1"
+    "@typescript-eslint/utils" "8.48.1"
+    "@typescript-eslint/visitor-keys" "8.48.1"
+    graphemer "^1.4.0"
+    ignore "^7.0.0"
+    natural-compare "^1.4.0"
+    ts-api-utils "^2.1.0"
+
 "@typescript-eslint/parser@8.46.2":
   version "8.46.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.46.2.tgz#dd938d45d581ac8ffa9d8a418a50282b306f7ebf"
@@ -4308,6 +4388,17 @@
     "@typescript-eslint/visitor-keys" "8.46.2"
     debug "^4.3.4"
 
+"@typescript-eslint/parser@^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.48.1.tgz#4e3c66d9ec20683ec142417fafeadab61c479c3f"
+  integrity sha512-PC0PDZfJg8sP7cmKe6L3QIL8GZwU5aRvUFedqSIpw3B+QjRSUZeeITC2M5XKeMXEzL6wccN196iy3JLwKNvDVA==
+  dependencies:
+    "@typescript-eslint/scope-manager" "8.48.1"
+    "@typescript-eslint/types" "8.48.1"
+    "@typescript-eslint/typescript-estree" "8.48.1"
+    "@typescript-eslint/visitor-keys" "8.48.1"
+    debug "^4.3.4"
+
 "@typescript-eslint/project-service@8.46.2":
   version "8.46.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.46.2.tgz#ab2f02a0de4da6a7eeb885af5e059be57819d608"
@@ -4317,6 +4408,15 @@
     "@typescript-eslint/types" "^8.46.2"
     debug "^4.3.4"
 
+"@typescript-eslint/project-service@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.48.1.tgz#cfe1741613b9112d85ae766de9e09b27a7d3f2f1"
+  integrity sha512-HQWSicah4s9z2/HifRPQ6b6R7G+SBx64JlFQpgSSHWPKdvCZX57XCbszg/bapbRsOEv42q5tayTYcEFpACcX1w==
+  dependencies:
+    "@typescript-eslint/tsconfig-utils" "^8.48.1"
+    "@typescript-eslint/types" "^8.48.1"
+    debug "^4.3.4"
+
 "@typescript-eslint/scope-manager@8.31.0", "@typescript-eslint/scope-manager@^8.15.0":
   version "8.31.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.31.0.tgz#48c7f7d729ea038e36cae0ff511e48c2412fb11c"
@@ -4333,11 +4433,24 @@
     "@typescript-eslint/types" "8.46.2"
     "@typescript-eslint/visitor-keys" "8.46.2"
 
+"@typescript-eslint/scope-manager@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.48.1.tgz#8bc70643e7cca57864b1ff95dd350fc27756bec0"
+  integrity sha512-rj4vWQsytQbLxC5Bf4XwZ0/CKd362DkWMUkviT7DCS057SK64D5lH74sSGzhI6PDD2HCEq02xAP9cX68dYyg1w==
+  dependencies:
+    "@typescript-eslint/types" "8.48.1"
+    "@typescript-eslint/visitor-keys" "8.48.1"
+
 "@typescript-eslint/tsconfig-utils@8.46.2", "@typescript-eslint/tsconfig-utils@^8.46.2":
   version "8.46.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.46.2.tgz#d110451cb93bbd189865206ea37ef677c196828c"
   integrity sha512-a7QH6fw4S57+F5y2FIxxSDyi5M4UfGF+Jl1bCGd7+L4KsaUY80GsiF/t0UoRFDHAguKlBaACWJRmdrc6Xfkkag==
 
+"@typescript-eslint/tsconfig-utils@8.48.1", "@typescript-eslint/tsconfig-utils@^8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.48.1.tgz#68139ce2d258f984e2b33a95389158f1212af646"
+  integrity sha512-k0Jhs4CpEffIBm6wPaCXBAD7jxBtrHjrSgtfCjUvPp9AZ78lXKdTR8fxyZO5y4vWNlOvYXRtngSZNSn+H53Jkw==
+
 "@typescript-eslint/type-utils@8.46.2":
   version "8.46.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.46.2.tgz#802d027864e6fb752e65425ed09f3e089fb4d384"
@@ -4349,6 +4462,17 @@
     debug "^4.3.4"
     ts-api-utils "^2.1.0"
 
+"@typescript-eslint/type-utils@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.48.1.tgz#955bd3ddd648450f0a627925ff12ade63fb7516d"
+  integrity sha512-1jEop81a3LrJQLTf/1VfPQdhIY4PlGDBc/i67EVWObrtvcziysbLN3oReexHOM6N3jyXgCrkBsZpqwH0hiDOQg==
+  dependencies:
+    "@typescript-eslint/types" "8.48.1"
+    "@typescript-eslint/typescript-estree" "8.48.1"
+    "@typescript-eslint/utils" "8.48.1"
+    debug "^4.3.4"
+    ts-api-utils "^2.1.0"
+
 "@typescript-eslint/types@8.31.0":
   version "8.31.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.31.0.tgz#c48e20ec47a43b72747714f49ea9f7b38a4fa6c1"
@@ -4359,6 +4483,11 @@
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.46.2.tgz#2bad7348511b31e6e42579820e62b73145635763"
   integrity sha512-lNCWCbq7rpg7qDsQrd3D6NyWYu+gkTENkG5IKYhUIcxSb59SQC/hEQ+MrG4sTgBVghTonNWq42bA/d4yYumldQ==
 
+"@typescript-eslint/types@8.48.1", "@typescript-eslint/types@^8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.48.1.tgz#a9ff808f5f798f28767d5c0b015a88fa7ce46bd7"
+  integrity sha512-+fZ3LZNeiELGmimrujsDCT4CRIbq5oXdHe7chLiW8qzqyPMnn1puNstCrMNVAqwcl2FdIxkuJ4tOs/RFDBVc/Q==
+
 "@typescript-eslint/typescript-estree@8.31.0":
   version "8.31.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.31.0.tgz#9c7f84eff6ad23d63cf086c6e93af571cd561270"
@@ -4389,6 +4518,21 @@
     semver "^7.6.0"
     ts-api-utils "^2.1.0"
 
+"@typescript-eslint/typescript-estree@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.48.1.tgz#0d0e31fc47c5796c6463ab50cde19e1718d465b1"
+  integrity sha512-/9wQ4PqaefTK6POVTjJaYS0bynCgzh6ClJHGSBj06XEHjkfylzB+A3qvyaXnErEZSaxhIo4YdyBgq6j4RysxDg==
+  dependencies:
+    "@typescript-eslint/project-service" "8.48.1"
+    "@typescript-eslint/tsconfig-utils" "8.48.1"
+    "@typescript-eslint/types" "8.48.1"
+    "@typescript-eslint/visitor-keys" "8.48.1"
+    debug "^4.3.4"
+    minimatch "^9.0.4"
+    semver "^7.6.0"
+    tinyglobby "^0.2.15"
+    ts-api-utils "^2.1.0"
+
 "@typescript-eslint/utils@8.46.2", "@typescript-eslint/utils@^8.0.0", "@typescript-eslint/utils@^8.44.1":
   version "8.46.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.46.2.tgz#b313d33d67f9918583af205bd7bcebf20f231732"
@@ -4399,6 +4543,16 @@
     "@typescript-eslint/types" "8.46.2"
     "@typescript-eslint/typescript-estree" "8.46.2"
 
+"@typescript-eslint/utils@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.48.1.tgz#6cf7b99e0943b33a983ef687b9a86b65578b5c32"
+  integrity sha512-fAnhLrDjiVfey5wwFRwrweyRlCmdz5ZxXz2G/4cLn0YDLjTapmN4gcCsTBR1N2rWnZSDeWpYtgLDsJt+FpmcwA==
+  dependencies:
+    "@eslint-community/eslint-utils" "^4.7.0"
+    "@typescript-eslint/scope-manager" "8.48.1"
+    "@typescript-eslint/types" "8.48.1"
+    "@typescript-eslint/typescript-estree" "8.48.1"
+
 "@typescript-eslint/utils@^8.15.0":
   version "8.31.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.31.0.tgz#6fb52471a29fdd16fc253d568c5ad4b048f78ba4"
@@ -4425,6 +4579,14 @@
     "@typescript-eslint/types" "8.46.2"
     eslint-visitor-keys "^4.2.1"
 
+"@typescript-eslint/visitor-keys@8.48.1":
+  version "8.48.1"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.48.1.tgz#247d4fe6dcc044f45b7f1c15110bf95e5d73b334"
+  integrity sha512-BmxxndzEWhE4TIEEMBs8lP3MBWN3jFPs/p6gPm/wkv02o41hI6cq9AuSmGAaTTHPtA1FTi2jBre4A9rm5ZmX+Q==
+  dependencies:
+    "@typescript-eslint/types" "8.48.1"
+    eslint-visitor-keys "^4.2.1"
+
 "@ungap/structured-clone@^1.2.0", "@ungap/structured-clone@^1.3.0":
   version "1.3.0"
   resolved "https://registry.yarnpkg.com/@ungap/structured-clone/-/structured-clone-1.3.0.tgz#d06bbb384ebcf6c505fde1c3d0ed4ddffe0aaff8"
@@ -5616,7 +5778,7 @@ detect-libc@^1.0.3:
   resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-1.0.3.tgz#fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b"
   integrity sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==
 
-detect-libc@^2.1.0:
+detect-libc@^2.1.2:
   version "2.1.2"
   resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-2.1.2.tgz#689c5dcdc1900ef5583a4cb9f6d7b473742074ad"
   integrity sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==
@@ -6045,20 +6207,21 @@ escape-string-regexp@^4.0.0:
   resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz#14ba83a5d373e3d311e5afca29cf5bfad965bf34"
   integrity sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==
 
-eslint-config-next@16.0.0:
-  version "16.0.0"
-  resolved "https://registry.yarnpkg.com/eslint-config-next/-/eslint-config-next-16.0.0.tgz#ebf26f21fc3c516f2a9c6052c46ab7d9e7297285"
-  integrity sha512-DWKT1YAO9ex2rK0/EeiPpKU++ghTiG59z6m08/ReLRECOYIaEv17maSCYT8zmFQLwIrY5lhJ+iaJPQdT4sJd4g==
+eslint-config-next@15.3.2:
+  version "15.3.2"
+  resolved "https://registry.yarnpkg.com/eslint-config-next/-/eslint-config-next-15.3.2.tgz#ed2bc6607f54555bbeaf23a032b4e430e453b63c"
+  integrity sha512-FerU4DYccO4FgeYFFglz0SnaKRe1ejXQrDb8kWUkTAg036YWi+jUsgg4sIGNCDhAsDITsZaL4MzBWKB6f4G1Dg==
   dependencies:
-    "@next/eslint-plugin-next" "16.0.0"
+    "@next/eslint-plugin-next" "15.3.2"
+    "@rushstack/eslint-patch" "^1.10.3"
+    "@typescript-eslint/eslint-plugin" "^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+    "@typescript-eslint/parser" "^5.4.2 || ^6.0.0 || ^7.0.0 || ^8.0.0"
     eslint-import-resolver-node "^0.3.6"
     eslint-import-resolver-typescript "^3.5.2"
-    eslint-plugin-import "^2.32.0"
+    eslint-plugin-import "^2.31.0"
     eslint-plugin-jsx-a11y "^6.10.0"
     eslint-plugin-react "^7.37.0"
-    eslint-plugin-react-hooks "^7.0.0"
-    globals "16.4.0"
-    typescript-eslint "^8.46.0"
+    eslint-plugin-react-hooks "^5.0.0"
 
 eslint-config-prettier@10.1.8:
   version "10.1.8"
@@ -6094,7 +6257,7 @@ eslint-module-utils@^2.12.1:
   dependencies:
     debug "^3.2.7"
 
-eslint-plugin-import@2.32.0, eslint-plugin-import@^2.32.0:
+eslint-plugin-import@2.32.0, eslint-plugin-import@^2.31.0:
   version "2.32.0"
   resolved "https://registry.yarnpkg.com/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz#602b55faa6e4caeaa5e970c198b5c00a37708980"
   integrity sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==
@@ -6162,16 +6325,10 @@ eslint-plugin-prettier@5.5.4:
     prettier-linter-helpers "^1.0.0"
     synckit "^0.11.7"
 
-eslint-plugin-react-hooks@^7.0.0:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-7.0.1.tgz#66e258db58ece50723ef20cc159f8aa908219169"
-  integrity sha512-O0d0m04evaNzEPoSW+59Mezf8Qt0InfgGIBJnpC0h3NH/WjUAR7BIKUfysC6todmtiZ/A0oUVS8Gce0WhBrHsA==
-  dependencies:
-    "@babel/core" "^7.24.4"
-    "@babel/parser" "^7.24.4"
-    hermes-parser "^0.25.1"
-    zod "^3.25.0 || ^4.0.0"
-    zod-validation-error "^3.5.0 || ^4.0.0"
+eslint-plugin-react-hooks@^5.0.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-5.2.0.tgz#1be0080901e6ac31ce7971beed3d3ec0a423d9e3"
+  integrity sha512-+f15FfK64YQwZdJNELETdn5ibXEUQmW1DZL6KXhNnc2heoy/sg9VJJeT7n8TlMWouzWqSWavFkIhHyIbIAEapg==
 
 eslint-plugin-react@7.37.5, eslint-plugin-react@^7.37.0:
   version "7.37.5"
@@ -6423,6 +6580,11 @@ fdir@^6.4.4:
   resolved "https://registry.yarnpkg.com/fdir/-/fdir-6.4.4.tgz#1cfcf86f875a883e19a8fab53622cfe992e8d2f9"
   integrity sha512-1NZP+GK4GfuAv3PqKvxQRDMjdSRZjnkq7KfhlNrCNNlZ0ygQFpebfrnfnq/W7fpUnAv9aGWmY1zKx7FYL3gwhg==
 
+fdir@^6.5.0:
+  version "6.5.0"
+  resolved "https://registry.yarnpkg.com/fdir/-/fdir-6.5.0.tgz#ed2ab967a331ade62f18d077dae192684d50d350"
+  integrity sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==
+
 fetch-mock@9.11.0:
   version "9.11.0"
   resolved "https://registry.yarnpkg.com/fetch-mock/-/fetch-mock-9.11.0.tgz#371c6fb7d45584d2ae4a18ee6824e7ad4b637a3f"
@@ -6752,11 +6914,6 @@ global-prefix@^3.0.0:
     kind-of "^6.0.2"
     which "^1.3.1"
 
-globals@16.4.0:
-  version "16.4.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-16.4.0.tgz#574bc7e72993d40cf27cf6c241f324ee77808e51"
-  integrity sha512-ob/2LcVVaVGCYN+r14cnwnoDPUufjiYgSqRhiFD0Q1iI4Odora5RE8Iv1D24hAz5oMophRGkGz+yuvQmmUMnMw==
-
 globals@^11.1.0:
   version "11.12.0"
   resolved "https://registry.yarnpkg.com/globals/-/globals-11.12.0.tgz#ab8795338868a0babd8525758018c2a7eb95c42e"
@@ -6886,18 +7043,6 @@ heimdalljs@^0.2.6:
   dependencies:
     rsvp "~3.2.1"
 
-hermes-estree@0.25.1:
-  version "0.25.1"
-  resolved "https://registry.yarnpkg.com/hermes-estree/-/hermes-estree-0.25.1.tgz#6aeec17d1983b4eabf69721f3aa3eb705b17f480"
-  integrity sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==
-
-hermes-parser@^0.25.1:
-  version "0.25.1"
-  resolved "https://registry.yarnpkg.com/hermes-parser/-/hermes-parser-0.25.1.tgz#5be0e487b2090886c62bd8a11724cd766d5f54d1"
-  integrity sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==
-  dependencies:
-    hermes-estree "0.25.1"
-
 hoist-non-react-statics@^3.3.1, hoist-non-react-statics@^3.3.2:
   version "3.3.2"
   resolved "https://registry.yarnpkg.com/hoist-non-react-statics/-/hoist-non-react-statics-3.3.2.tgz#ece0acaf71d62c2969c2ec59feff42a4b1a85b45"
@@ -8025,7 +8170,12 @@ lodash.truncate@^4.4.2:
   resolved "https://registry.yarnpkg.com/lodash.truncate/-/lodash.truncate-4.4.2.tgz#5a350da0b1113b837ecfffd5812cbe58d6eae193"
   integrity sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==
 
-lodash@4.17.21, lodash@^4.17.21:
+lodash@4.17.23:
+  version "4.17.23"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.23.tgz#f113b0378386103be4f6893388c73d0bde7f2c5a"
+  integrity sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==
+
+lodash@^4.17.21:
   version "4.17.21"
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
   integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
@@ -8225,26 +8375,26 @@ neo-async@^2.6.2:
   resolved "https://registry.yarnpkg.com/neo-async/-/neo-async-2.6.2.tgz#b4aafb93e3aeb2d8174ca53cf163ab7d7308305f"
   integrity sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==
 
-next@16.0.0:
-  version "16.0.0"
-  resolved "https://registry.yarnpkg.com/next/-/next-16.0.0.tgz#f98a345ea27cb96979dbb88e5ede5ab753c99d8d"
-  integrity sha512-nYohiNdxGu4OmBzggxy9rczmjIGI+TpR5vbKTsE1HqYwNm1B+YSiugSrFguX6omMOKnDHAmBPY4+8TNJk0Idyg==
+next@15.4.10:
+  version "15.4.10"
+  resolved "https://registry.yarnpkg.com/next/-/next-15.4.10.tgz#4ee237d4eb16289f6e16167fbed59d8ada86aa59"
+  integrity sha512-itVlc79QjpKMFMRhP+kbGKaSG/gZM6RCvwhEbwmCNF06CdDiNaoHcbeg0PqkEa2GOcn8KJ0nnc7+yL7EjoYLHQ==
   dependencies:
-    "@next/env" "16.0.0"
+    "@next/env" "15.4.10"
     "@swc/helpers" "0.5.15"
     caniuse-lite "^1.0.30001579"
     postcss "8.4.31"
     styled-jsx "5.1.6"
   optionalDependencies:
-    "@next/swc-darwin-arm64" "16.0.0"
-    "@next/swc-darwin-x64" "16.0.0"
-    "@next/swc-linux-arm64-gnu" "16.0.0"
-    "@next/swc-linux-arm64-musl" "16.0.0"
-    "@next/swc-linux-x64-gnu" "16.0.0"
-    "@next/swc-linux-x64-musl" "16.0.0"
-    "@next/swc-win32-arm64-msvc" "16.0.0"
-    "@next/swc-win32-x64-msvc" "16.0.0"
-    sharp "^0.34.4"
+    "@next/swc-darwin-arm64" "15.4.8"
+    "@next/swc-darwin-x64" "15.4.8"
+    "@next/swc-linux-arm64-gnu" "15.4.8"
+    "@next/swc-linux-arm64-musl" "15.4.8"
+    "@next/swc-linux-x64-gnu" "15.4.8"
+    "@next/swc-linux-x64-musl" "15.4.8"
+    "@next/swc-win32-arm64-msvc" "15.4.8"
+    "@next/swc-win32-x64-msvc" "15.4.8"
+    sharp "^0.34.3"
 
 no-case@^3.0.4:
   version "3.0.4"
@@ -8543,6 +8693,11 @@ picomatch@^4.0.2:
   resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-4.0.2.tgz#77c742931e8f3b8820946c76cd0c1f13730d1dab"
   integrity sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==
 
+picomatch@^4.0.3:
+  version "4.0.3"
+  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-4.0.3.tgz#796c76136d1eead715db1e7bad785dedd695a042"
+  integrity sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==
+
 pirates@^4.0.7:
   version "4.0.7"
   resolved "https://registry.yarnpkg.com/pirates/-/pirates-4.0.7.tgz#643b4a18c4257c8a65104b73f3049ce9a0a15e22"
@@ -9339,37 +9494,39 @@ shallowequal@1.1.0:
   resolved "https://registry.yarnpkg.com/shallowequal/-/shallowequal-1.1.0.tgz#188d521de95b9087404fd4dcb68b13df0ae4e7f8"
   integrity sha512-y0m1JoUZSlPAjXVtPPW70aZWfIL/dSP7AFkRnniLCrK/8MDKog3TySTBmckD+RObVxH0v4Tox67+F14PdED2oQ==
 
-sharp@^0.34.4:
-  version "0.34.4"
-  resolved "https://registry.yarnpkg.com/sharp/-/sharp-0.34.4.tgz#73c2c5a425e98250b8b927e5537f711da8966e38"
-  integrity sha512-FUH39xp3SBPnxWvd5iib1X8XY7J0K0X7d93sie9CJg2PO8/7gmg89Nve6OjItK53/MlAushNNxteBYfM6DEuoA==
+sharp@^0.34.3:
+  version "0.34.5"
+  resolved "https://registry.yarnpkg.com/sharp/-/sharp-0.34.5.tgz#b6f148e4b8c61f1797bde11a9d1cfebbae2c57b0"
+  integrity sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==
   dependencies:
     "@img/colour" "^1.0.0"
-    detect-libc "^2.1.0"
-    semver "^7.7.2"
+    detect-libc "^2.1.2"
+    semver "^7.7.3"
   optionalDependencies:
-    "@img/sharp-darwin-arm64" "0.34.4"
-    "@img/sharp-darwin-x64" "0.34.4"
-    "@img/sharp-libvips-darwin-arm64" "1.2.3"
-    "@img/sharp-libvips-darwin-x64" "1.2.3"
-    "@img/sharp-libvips-linux-arm" "1.2.3"
-    "@img/sharp-libvips-linux-arm64" "1.2.3"
-    "@img/sharp-libvips-linux-ppc64" "1.2.3"
-    "@img/sharp-libvips-linux-s390x" "1.2.3"
-    "@img/sharp-libvips-linux-x64" "1.2.3"
-    "@img/sharp-libvips-linuxmusl-arm64" "1.2.3"
-    "@img/sharp-libvips-linuxmusl-x64" "1.2.3"
-    "@img/sharp-linux-arm" "0.34.4"
-    "@img/sharp-linux-arm64" "0.34.4"
-    "@img/sharp-linux-ppc64" "0.34.4"
-    "@img/sharp-linux-s390x" "0.34.4"
-    "@img/sharp-linux-x64" "0.34.4"
-    "@img/sharp-linuxmusl-arm64" "0.34.4"
-    "@img/sharp-linuxmusl-x64" "0.34.4"
-    "@img/sharp-wasm32" "0.34.4"
-    "@img/sharp-win32-arm64" "0.34.4"
-    "@img/sharp-win32-ia32" "0.34.4"
-    "@img/sharp-win32-x64" "0.34.4"
+    "@img/sharp-darwin-arm64" "0.34.5"
+    "@img/sharp-darwin-x64" "0.34.5"
+    "@img/sharp-libvips-darwin-arm64" "1.2.4"
+    "@img/sharp-libvips-darwin-x64" "1.2.4"
+    "@img/sharp-libvips-linux-arm" "1.2.4"
+    "@img/sharp-libvips-linux-arm64" "1.2.4"
+    "@img/sharp-libvips-linux-ppc64" "1.2.4"
+    "@img/sharp-libvips-linux-riscv64" "1.2.4"
+    "@img/sharp-libvips-linux-s390x" "1.2.4"
+    "@img/sharp-libvips-linux-x64" "1.2.4"
+    "@img/sharp-libvips-linuxmusl-arm64" "1.2.4"
+    "@img/sharp-libvips-linuxmusl-x64" "1.2.4"
+    "@img/sharp-linux-arm" "0.34.5"
+    "@img/sharp-linux-arm64" "0.34.5"
+    "@img/sharp-linux-ppc64" "0.34.5"
+    "@img/sharp-linux-riscv64" "0.34.5"
+    "@img/sharp-linux-s390x" "0.34.5"
+    "@img/sharp-linux-x64" "0.34.5"
+    "@img/sharp-linuxmusl-arm64" "0.34.5"
+    "@img/sharp-linuxmusl-x64" "0.34.5"
+    "@img/sharp-wasm32" "0.34.5"
+    "@img/sharp-win32-arm64" "0.34.5"
+    "@img/sharp-win32-ia32" "0.34.5"
+    "@img/sharp-win32-x64" "0.34.5"
 
 shebang-command@^2.0.0:
   version "2.0.0"
@@ -9923,6 +10080,14 @@ tinyglobby@^0.2.13:
     fdir "^6.4.4"
     picomatch "^4.0.2"
 
+tinyglobby@^0.2.15:
+  version "0.2.15"
+  resolved "https://registry.yarnpkg.com/tinyglobby/-/tinyglobby-0.2.15.tgz#e228dd1e638cea993d2fdb4fcd2d4602a79951c2"
+  integrity sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==
+  dependencies:
+    fdir "^6.5.0"
+    picomatch "^4.0.3"
+
 tldts-core@^6.1.86:
   version "6.1.86"
   resolved "https://registry.yarnpkg.com/tldts-core/-/tldts-core-6.1.86.tgz#a93e6ed9d505cb54c542ce43feb14c73913265d8"
@@ -10111,16 +10276,6 @@ typed-array-length@^1.0.7:
     possible-typed-array-names "^1.0.0"
     reflect.getprototypeof "^1.0.6"
 
-typescript-eslint@^8.46.0:
-  version "8.46.2"
-  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.46.2.tgz#da1adec683ba93a1b6c3850a4efb0922ffbc627d"
-  integrity sha512-vbw8bOmiuYNdzzV3lsiWv6sRwjyuKJMQqWulBOU7M0RrxedXledX8G8kBbQeiOYDnTfiXz0Y4081E1QMNB6iQg==
-  dependencies:
-    "@typescript-eslint/eslint-plugin" "8.46.2"
-    "@typescript-eslint/parser" "8.46.2"
-    "@typescript-eslint/typescript-estree" "8.46.2"
-    "@typescript-eslint/utils" "8.46.2"
-
 typescript@*, typescript@5.9.3, typescript@^5.0.4:
   version "5.9.3"
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-5.9.3.tgz#5b4f59e15310ab17a216f5d6cf53ee476ede670f"
@@ -10671,12 +10826,7 @@ yocto-queue@^0.1.0:
   resolved "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz#0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b"
   integrity sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==
 
-"zod-validation-error@^3.5.0 || ^4.0.0":
-  version "4.0.2"
-  resolved "https://registry.yarnpkg.com/zod-validation-error/-/zod-validation-error-4.0.2.tgz#bc605eba49ce0fcd598c127fee1c236be3f22918"
-  integrity sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==
-
-zod@4.1.12, "zod@^3.25.0 || ^4.0.0":
+zod@4.1.12:
   version "4.1.12"
   resolved "https://registry.yarnpkg.com/zod/-/zod-4.1.12.tgz#64f1ea53d00eab91853195653b5af9eee68970f0"
   integrity sha512-JInaHOamG8pt5+Ey8kGmdcAcg3OL9reK8ltczgHTAwNhMys/6ThXHityHxVV2p3fkw/c+MAvBHFVYHFZDmjMCQ==