Publish desk-0.0.7.tgz

.dockerignore

@@ -1,36 +0,0 @@
-# Python
-__pycache__
-*.pyc
-**/__pycache__
-**/*.pyc
-venv
-.venv
-
-# System-specific files
-.DS_Store
-**/.DS_Store
-
-# Docker
-docker compose.*
-env.d
-
-# Docs
-docs
-*.md
-*.log
-
-# Development/test cache & configurations
-data
-.cache
-.circleci
-.git
-.vscode
-.iml
-.idea
-db.sqlite3
-.mypy_cache
-.pylint.d
-.pytest_cache
-
-# Frontend dependencies
-node_modules

.gitattributes

@@ -1,24 +0,0 @@
-# Set the default behavior for all files
-* text=auto eol=lf
-
-# Binary files (should not be modified)
-*.png binary
-*.jpg binary
-*.jpeg binary
-*.gif binary
-*.ico binary
-*.mov binary
-*.mp4 binary
-*.mp3 binary
-*.flv binary
-*.fla binary
-*.swf binary
-*.gz binary
-*.zip binary
-*.7z binary
-*.ttf binary
-*.woff binary
-*.woff2 binary
-*.eot binary
-*.pdf binary
-

.github/ISSUE_TEMPLATE.md

@@ -1,6 +0,0 @@
-<!---
-Thanks for filing an issue 😄 ! Before you submit, please read the following:
-
-Check the other issue templates if you are trying to submit a bug report, feature request, or question
-Search open/closed issues before submitting since someone might have asked the same thing before!
--->

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -1,28 +0,0 @@
----
-name: 🐛 Bug Report
-about: If something is not working as expected 🤔.
-
----
-
-## Bug Report
-
-**Problematic behavior**
-A clear and concise description of the behavior.
-
-**Expected behavior/code**
-A clear and concise description of what you expected to happen (or code).
-
-**Steps to Reproduce**
-1. Do this...
-2. Then this...
-3. And then the bug happens!
-
-**Environment**
-- People version:
-- Platform:
-
-**Possible Solution**
-<!--- Only if you have suggestions on a fix for the bug -->
-
-**Additional context/Screenshots**
-Add any other context about the problem here. If applicable, add screenshots to help explain.

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -1,23 +0,0 @@
----
-name: ✨ Feature Request
-about: I have a suggestion (and may want to build it 💪)!
-
----
-
-## Feature Request
-
-**Is your feature request related to a problem or unsupported use case? Please describe.**
-A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen. Add any considered drawbacks.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Discovery, Documentation, Adoption, Migration Strategy**
-If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
-Maybe a screenshot or design?
-
-**Do you want to work on it through a Pull Request?**
-<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->

.github/ISSUE_TEMPLATE/Support_question.md

@@ -1,22 +0,0 @@
----
-name: 🤗 Support Question
-about: If you have a question 💬, or something was not clear from the docs!
-
----
-
-<!-- ^ Click "Preview" for a nicer view! ^
-We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
-
----
-
-Please make sure you have read our [main Readme](https://github.com/suitenumerique/people).
-
-Also make sure it was not already answered in [an open or close issue](https://github.com/suitenumerique/people/issues).
-
-If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
-
-**Topic**
-What's the general area of your question: for example, docker setup, database schema, search functionality,...
-
-**Question**
-Try to be as specific as possible so we can help you as best we can. Please be patient 🙏

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +0,0 @@
-## Purpose
-
-Description...
-
-
-## Proposal
-
-Description...
-
-- [] item 1...
-- [] item 2...

.github/workflows/crowdin_download.yml

@@ -1,77 +0,0 @@
-name: Download translations from Crowdin
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'release/**'
-
-jobs:
-  install-dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-
-  synchronize-with-crowdin:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Create empty source files
-        run: |
-          touch src/backend/locale/django.pot
-          mkdir -p src/frontend/packages/i18n/locales/desk/
-          touch src/frontend/packages/i18n/locales/desk/translations-crowdin.json
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          create_pull_request: false
-          push_translations: false
-          push_sources: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate translations files
-        working-directory: src/frontend
-        run: yarn i18n:deploy
-      # Create a new PR
-      - name: Create a new Pull Request with new translated strings
-        uses: peter-evans/create-pull-request@v7
-        with:
-          commit-message: |
-            🌐(i18n) update translated strings
-
-            Update translated files with new translations
-          title: 🌐(i18n) update translated strings
-          body: |
-            ## Purpose
-
-            update translated strings
-
-            ## Proposal
-
-            - [x]  update translated strings
-          branch: i18n/update-translations
-          labels: i18n

.github/workflows/crowdin_upload.yml

@@ -1,76 +0,0 @@
-name: Update crowdin sources
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-jobs:
-  install-dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-      with-build_mails: true
-
-  synchronize-with-crowdin:
-    needs: install-dependencies
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      # Backend i18n
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the project
-        run: uv sync --locked --all-extras
-        working-directory: src/backend
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true
-      - name: Install gettext
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext pandoc
-      - name: generate pot files
-        working-directory: src/backend
-        run: |
-          DJANGO_CONFIGURATION=Build uv run python manage.py makemessages -a --keep-pot
-      # frontend i18n
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-          fail-on-cache-miss: true
-      - name: generate source translation file
-        working-directory: src/frontend
-        run: yarn i18n:extract
-      # crowdin workflow
-      - name: crowdin action
-        uses: crowdin/github-action@v2
-        with:
-          config: crowdin/config.yml
-          upload_sources: true
-          upload_translations: false
-          download_translations: false
-          create_pull_request: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # A numeric ID, found at https://crowdin.com/project/<projectName>/tools/api
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-
-          # Visit https://crowdin.com/settings#api-key to create this token
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
-
-          CROWDIN_BASE_PATH: "../src/"

.github/workflows/dependencies.yml

@@ -1,85 +0,0 @@
-name: Dependency reusable workflow
-
-on:
-  workflow_call:
-    inputs:
-      node_version:
-        required: false
-        default: '22.x'
-        type: string
-      with-front-dependencies-installation:
-        type: boolean
-        default: false
-      with-build_mails:
-        type: boolean
-        default: false
-
-jobs:
-  front-dependencies-installation:
-    if: ${{ inputs.with-front-dependencies-installation == true }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-      - name: Setup Node.js
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node_version }}
-      - name: Install dependencies
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        run: cd src/frontend/ && yarn install --frozen-lockfile
-      - name: Cache install frontend
-        if: steps.front-node_modules.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
-        with:
-          path: "src/frontend/**/node_modules"
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-  build-mails:
-    if: ${{ inputs.with-build_mails == true }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/mail
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-
-      - name: Setup Node.js
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node_version }}
-
-      - name: Install yarn
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: npm install -g yarn
-
-      - name: Install node dependencies
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile
-
-      - name: Build mails
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        run: yarn build
-
-      - name: Cache mail templates
-        if: steps.mail-templates.outputs.cache-hit != 'true'
-        uses: actions/cache@v5
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

.github/workflows/deploy.yml

@@ -1,35 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    tags:
-      - 'preprod'
-      - 'production'
-
-
-jobs:
-  notify-argocd:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Call argocd github webhook
-        run: |
-          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL
-          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_PRODUCTION_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
-          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_PRODUCTION_WEBHOOK_URL
-
-  start-test-on-preprod:
-    needs:
-      - notify-argocd
-    runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags/preprod')
-    steps:
-      -
-        name: Debug
-        run: |
-          echo "Start test when preprod is ready"

.github/workflows/docker-hub.yml

@@ -1,133 +0,0 @@
-name: Docker Hub Workflow
-run-name: Docker Hub Workflow
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'main'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'main'
-
-env:
-  DOCKER_USER: 1001:127
-
-jobs:
-  trivy-scan:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            lasuite/people-backend
-            lasuite/people-frontend
-      -
-        name: Run trivy scan (backend)
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '--target backend-production -f Dockerfile'
-          docker-image-name: 'docker.io/lasuite/people-backend:${{ github.sha }}'
-      -
-        name: Run trivy scan (frontend)
-        uses: numerique-gouv/action-trivy-cache@main
-        with:
-          docker-build-args: '--target frontend-production -f src/frontend/Dockerfile'
-          docker-image-name: 'docker.io/lasuite/people-frontend:${{ github.sha }}'
-
-  build-and-push-backend:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: lasuite/people-backend
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      - name: create-version-json
-        id: create-version-json
-        uses: jsdaniell/create-json@v1.2.3
-        with:
-          name: "version.json"
-          json: '{"source":"${{github.repository}}", "version":"${{github.ref_name}}", "commit":"${{github.sha}}", "build": "NA"}'
-          dir: 'src/backend'
-      -
-        name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          target: backend-production
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  build-and-push-frontend:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout repository
-        uses: actions/checkout@v6
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: lasuite/people-frontend
-      - name: create-version-json
-        id: create-version-json
-        uses: jsdaniell/create-json@v1.2.3
-        with:
-          name: "version.json"
-          json: '{"source":"${{github.repository}}", "version":"${{github.ref_name}}", "commit":"${{github.sha}}", "build": "NA"}'
-          dir: 'src/frontend/apps/desk'
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_HUB_USER }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./src/frontend/Dockerfile
-          target: frontend-production
-          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  notify-argocd:
-    needs:
-      - build-and-push-frontend
-      - build-and-push-backend
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
-    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
-        id: notify
-        with:
-          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
-          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
-          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"

.github/workflows/people.yml

@@ -1,303 +0,0 @@
-name: People Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - '*'
-
-jobs:
-  # Call the reusable workflow to install dependencies
-  dependencies:
-    uses: ./.github/workflows/dependencies.yml
-    with:
-      node_version: '22.x'
-      with-front-dependencies-installation: true
-      with-build_mails: true
-
-  lint-git:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' # Makes sense only for pull requests
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: show
-        run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/people.yml' | grep -E "(\bprint\(|\bpprint\()"
-      - name: Check absence of fixup commits
-        if: always()
-        run: |
-          ! git log | grep 'fixup!'
-      - name: Install gitlint
-        if: always()
-        run: pip install --user requests gitlint
-      - name: Lint commit messages added to main
-        if: always()
-        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
-
-  check-changelog:
-    runs-on: ubuntu-latest
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
-      github.event_name == 'pull_request'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Check that the CHANGELOG has been modified in the current branch
-        run: git log --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
-
-  lint-changelog:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Check CHANGELOG max line length
-        run: |
-          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
-          if [ $max_line_length -ge 80 ]; then
-            echo "ERROR: CHANGELOG has lines longer than 80 characters."
-            exit 1
-          fi
-
-  build-front:
-    runs-on: ubuntu-latest
-    needs: dependencies
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Build CI App
-        run: cd src/frontend/ && yarn ci:build
-
-      - name: Cache build frontend
-        uses: actions/cache@v5
-        with:
-          path: src/frontend/apps/desk/out/
-          key: build-front-${{ github.run_id }}
-
-  test-front:
-    runs-on: ubuntu-latest
-    needs: dependencies
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Test App
-        run: cd src/frontend/ && yarn app:test
-
-  lint-front:
-    runs-on: ubuntu-latest
-    needs: dependencies
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Check linting
-        run: cd src/frontend/ && yarn lint
-
-  test-e2e:
-    runs-on: ubuntu-latest
-    needs: [dependencies, build-front]
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        shardIndex: [1, 2, 3, 4]
-        shardTotal: [4]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set services env variables
-        run: |
-          make create-env-files
-          cat env.d/development/common.e2e.dist >> env.d/development/common
-
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true  
-
-      - name: Restore the frontend cache
-        uses: actions/cache@v5
-        id: front-node_modules
-        with:
-          path: 'src/frontend/**/node_modules'
-          key: front-node_modules-${{ hashFiles('src/frontend/**/yarn.lock') }}
-
-      - name: Restore the build cache
-        uses: actions/cache@v5
-        id: cache-build
-        with:
-          path: src/frontend/apps/desk/out/
-          key: build-front-${{ github.run_id }}
-
-      - name: Build and Start Docker Servers
-        env:
-          DOCKER_BUILDKIT: 1
-          COMPOSE_DOCKER_CLI_BUILD: 1
-        run: |
-          docker compose build --pull --build-arg BUILDKIT_INLINE_CACHE=1
-          make update-keycloak-realm-app
-          make add-dev-rsa-private-key-to-env
-          make run
-
-      - name: Apply DRF migrations
-        run: |
-          make migrate
-
-      - name: Add dummy data
-        run: |
-          make demo FLUSH_ARGS='--no-input'
-
-      - name: Run e2e tests
-        run: cd src/frontend/ && yarn e2e:test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
-
-      - name: Save logs
-        if: always()
-        run: docker compose logs > src/frontend/apps/e2e/report/logs.txt
-
-      - name: Save Dimail logs
-        if: always()
-        run: docker compose logs dimail > src/frontend/apps/e2e/report/dimail-logs.txt
-
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: playwright-report-${{ matrix.shardIndex }}
-          path: src/frontend/apps/e2e/report/
-          retention-days: 7
-
-  tests-e2e-feedback:
-    runs-on: ubuntu-latest
-    needs: [test-e2e]
-    if: always()
-    steps:
-      - name: All tests ok
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: exit 0
-      - name: Some tests failed
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-
-  lint-back:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: src/backend
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
-      - name: Check code formatting with ruff
-        run: uv run ruff format . --diff
-      - name: Lint code with ruff
-        run: uv run ruff check .
-      - name: Lint code with pylint
-        run: uv run pylint .
-
-  test-back:
-    runs-on: ubuntu-latest
-    needs: dependencies
-    defaults:
-      run:
-        working-directory: src/backend
-
-    services:
-      postgres:
-        image: postgres:16
-        env:
-          POSTGRES_DB: people
-          POSTGRES_USER: dinum
-          POSTGRES_PASSWORD: pass
-        ports:
-          - 5432:5432
-        # needed because the postgres container does not provide a healthcheck
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
-
-    env:
-      DJANGO_CONFIGURATION: Test
-      DJANGO_SETTINGS_MODULE: people.settings
-      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
-      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
-      DB_HOST: localhost
-      DB_NAME: people
-      DB_USER: dinum
-      DB_PASSWORD: pass
-      DB_PORT: 5432
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Create writable /data
-        run: |
-          sudo mkdir -p /data/media && \
-          sudo mkdir -p /data/static
-      - name: Restore the mail templates
-        uses: actions/cache@v5
-        id: mail-templates
-        with:
-          path: "src/backend/core/templates/mail"
-          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
-          fail-on-cache-miss: true  
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version-file: "src/backend/pyproject.toml"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install the dependencies
-        run: uv sync --locked --all-extras
-
-      - name: Install gettext (required to compile messages)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      - name: Generate a MO file from strings extracted from the project
-        run: uv run python manage.py compilemessages
-
-      - name: Run tests
-        run: uv run pytest -n 2

.github/workflows/release-helmchart.yml

@@ -1,36 +0,0 @@
-name: Release Chart
-run-name: Release Chart
-
-on:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  release:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Cleanup
-        run: |
-          rm -rf ./src/helm/extra
-          rm -rf ./src/helm/dimail
-          rm -rf ./src/helm/maildev
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Publish Helm charts
-        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
-        with:
-          charts_dir: ./src/helm
-          linting: on
-          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,80 +0,0 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-pip-wheel-metadata/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-.DS_Store
-.next/
-
-# Translations	# Translations
-*.pot
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-env.d/development/*
-!env.d/development/*.dist
-
-# npm
-node_modules
-
-# Mails
-src/backend/core/templates/mail/
-
-# Typescript client
-src/frontend/tsclient
-
-# Swagger
-**/swagger.json
-
-# Logs
-*.log
-
-# Celery beat
-src/backend/celerybeat-schedule
-
-# Test & lint
-.coverage
-coverage.json
-.pylint.d
-.pytest_cache
-db.sqlite3
-.mypy_cache
-
-# Site media
-/data/
-
-# IDEs
-.idea/
-.vscode/
-*.iml
-.devcontainer/
-.tool-versions

.gitlint

@@ -1,78 +0,0 @@
-# All these sections are optional, edit this file as you like.
-[general]
-# Ignore certain rules, you can reference them by their id or by their full name
-# ignore=title-trailing-punctuation, T3
-
-# verbosity should be a value between 1 and 3, the commandline -v flags take precedence over this
-# verbosity = 2
-
-# By default gitlint will ignore merge commits. Set to 'false' to disable.
-# ignore-merge-commits=true
-
-# By default gitlint will ignore fixup commits. Set to 'false' to disable.
-# ignore-fixup-commits=true
-
-# By default gitlint will ignore squash commits. Set to 'false' to disable.
-# ignore-squash-commits=true
-
-# Enable debug mode (prints more output). Disabled by default.
-# debug=true
-
-# Set the extra-path where gitlint will search for user defined rules
-# See http://jorisroovers.github.io/gitlint/user_defined_rules for details
-extra-path=gitlint/
-
-# [title-max-length]
-# line-length=80
-
-[title-must-not-contain-word]
-# Comma-separated list of words that should not occur in the title. Matching is case
-# insensitive. It's fine if the keyword occurs as part of a larger word (so "WIPING"
-# will not cause a violation, but "WIP: my title" will.
-words=wip
-
-#[title-match-regex]
-# python like regex (https://docs.python.org/2/library/re.html) that the
-# commit-msg title must be matched to.
-# Note that the regex can contradict with other rules if not used correctly
-# (e.g. title-must-not-contain-word).
-#regex=
-
-# [B1]
-# B1 = body-max-line-length
-# line-length=120
-# [body-min-length]
-# min-length=5
-
-# [body-is-missing]
-# Whether to ignore this rule on merge commits (which typically only have a title)
-# default = True
-# ignore-merge-commits=false
-
-# [body-changed-file-mention]
-# List of files that need to be explicitly mentioned in the body when they are changed
-# This is useful for when developers often erroneously edit certain files or git submodules.
-# By specifying this rule, developers can only change the file when they explicitly reference
-# it in the commit message.
-# files=gitlint/rules.py,README.md
-
-# [author-valid-email]
-# python like regex (https://docs.python.org/2/library/re.html) that the
-# commit author email address should be matched to
-# For example, use the following regex if you only want to allow email addresses from foo.com
-# regex=[^@]+@foo.com
-
-[ignore-by-title]
-# Allow empty body & wrong title pattern only when bots (pyup/greenkeeper)
-# upgrade dependencies
-regex=^(⬆️.*|Update (.*) from (.*) to (.*)|(chore|fix)\(package\): update .*)$
-ignore=B6,UC1
-
-# [ignore-by-body]
-# Ignore certain rules for commits of which the body has a line that matches a regex
-# E.g. Match bodies that have a line that that contain "release"
-# regex=(.*)release(.*)
-#
-# Ignore certain rules, you can reference them by their id or by their full name
-# Use 'all' to ignore all rules
-# ignore=T1,body-min-length

CHANGELOG.md

@@ -1,568 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
-and this project adheres to
-[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-### Fixed
-
-- ✨(mailboxes) enforce lowercase on mailboxes
-- 🐛(i18n) fix missing translations for status tag labels
-- 🚚(route) prioritize mail domains as default landing page
-
-### Changed
-
-- 🍱(static) update logo in invitation email template #1085
-- ✨(uiV2) use Lasuite UI kit, new layout
-
-## [1.23.1] - 2026-02-16
-
-- ✨(invitations) refresh expired invitations
-
-## [1.23.0] - 2026-02-12
-
-### Added
-
-- ✨(demo) add aliases to demo #1050
-- ✨(front) add icon to button to configure a domain
-- ✨(datagrid) add sort to mailboxes list + mail domain list
-- ✨(invitations) allow delete invitations mails domains access by an admin
-- ✨(front) delete invitations mails domains access
-- ✨(front) add show invitations mails domains access #1040
-- ✨(invitations) can delete domain invitations
-
-### Fixed
-
-- 🐛(domains) fix attemps to send invitations to existing users #953
-
-### Changed
-
-- 🚸(email) we should ignore case when looking for existing emails #1056
-- 🏗️(core) migrate from pip to uv
-- ✨(front) add show invitations mails domains access #1040
-
-## [1.22.2] - 2026-01-26
-
-### Fixed
-
-- 🐛(aliases) authorize special domain devnull in alias destinations #1029 
-
-## [1.22.1] - 2026-01-21
-
-- 🔒️(organization) the first user is not admin #776
-- 🐛(admin) fix broken alias import #1021
-
-## [1.22.0] - 2026-01-19
-
-### Added
-- ✨(front) create, manage & delete aliases
-- ✨(domains) alias sorting and admin
-- ✨(aliases) delete all aliases in one call #1002
-
-### Fixed
-- 🔒️(security) upgrade python version to fix vulnerability #1010
-- 🐛(dimail) ignore oxadmin when importing mailboxes from dimail #986
-- ✨(aliases) fix deleting single aliases #1002
-
-### Changed
-- 🐛(dimail) allow mailboxes and aliases to have the same local part #986
-
-### Removed
-- 🔥(plugins) remove CommuneCreation plugin
-
-## [1.21.0] - 2025-12-05
-
-- ✨(aliases) import existing aliases from dimail
-- 🛂(permissions) return 404 to users with no access to domain #985 
-- ✨(aliases) can create, list and delete aliases #974
-
-## [1.20.0] - 2025-10-22
-
-- ✨(models) impose uniqueness on display name, to match ox's constraint
-- 🐛(dimail) catch duplicate displayname error
-- ✨(mailbox) synchronize password of newly created mailbox with Dimail's
-
-## [1.19.1] - 2025-09-19
-
-- 🐛(fix) add enabled update your mailbox
-
-## [1.19.0] - 2025-09-03
-
-- ✨(front) add modal update mailboxes #954
-
-### Added
-
-- ✨(api) update mailboxes #934
-- ✨(api) give update rights to domain viewer on own mailbox #934
-
-### Fixed
-
-- 🐛(dimail) grab duplicate displayname error #961
-
-### Changed
-
-- 💥(sentry) remove `DJANGO_` before Sentry DSN env variable #957
-
-## [1.18.2] - 2025-07-03
-
-### Fixed
-
-- 🐛(front) fix missing pagination mail domains #950
-
-## [1.18.1] - 2025-07-02
-
-### Fixed
-
-- 🐛(front) fix missing pagination on mail domains #946
-
-## [1.18.0] - 2025-06-30
-
-### Added
-
-- 🐛(front) fix missing pagination mail domains
-- 🐛(front) fix button add mail domain
-- ✨(teams) add matrix webhook for teams #904
-- ✨(resource-server) add SCIM /Me endpoint #895
-- 🔧(git) set LF line endings for all text files #928
-
-### Changed
-
-- 🧑‍💻(docker) split frontend to another file #924
-
-### Fixed 
-
-- 🐛(webhook) handle user on different home server than room server
-
-## [1.17.0] - 2025-06-11
-
-### Added
-
-- ✨(frontend) add crisp script #914
-- ⚡️(fix) add error when mailbox create failed
-- ✨(mailbox) allow to reset password on mailboxes #834
-
-## [1.16.0] - 2025-05-05
-
-### Added
-
-- 🔧(sentry) add Celery beat task integration #892
-
-### Changed
-
-- ✨(uiv2) change mail domains
-- 🛂(dimail) simplify interop with dimail
-- ✨(mailbox) remove secondary email as required field
-
-### Fixed
-
-- 🔒️(drf) disable browsable HTML API renderer #897
-
-## [1.15.0] - 2025-04-04
-
-### Added
-
-- 🧱(helm) add la-suite ingress path
-- ➕(backend) add django-lasuite dependency #858
-- ✨(plugins) add endpoint to list siret of active organizations #771
-- ✨(core) create AccountServiceAuthentication backend #771
-- ✨(core) create AccountService model #771
-- 🧱(helm) disable createsuperuser job by setting #863
-- 🔒️(passwords) add validators for production #850
-- ✨(domains) allow to re-run check on domain if status is failed
-- ✨(organization) add `is_active` field
-- ✨(domains) notify support when domain status changes #668
-- ✨(domains) define domain check interval as a settings
-- ✨(oidc) add simple introspection backend #832
-- 🧑‍💻(tasks) run management commands #814
-
-### Changed
-
-- ♻️(plugins) rewrite plugin system as django app #844
-- 🔒️(users) restrict listable users to same organization #846 
-
-### Fixed
-
-- 🐛(dimail) enhance sentry log
-- 🐛(oauth2) force JWT signed for /userinfo #804
-- 🐛(front) disable retries in useQuery and useInfiniteQuery #818
-
-## [1.14.1] - 2025-03-17
-
-## [1.14.0] - 2025-03-17
-
-### Added
-
-- ✨(domains) enhance required action modal content
-- ✨(domains) add periodic tasks to fetch domain status
-- 🧑‍💻(docker) add celery beat to manage periodic tasks
-- ✨(organization) add metadata field #790
-- ⬆️(nginx) bump nginx-unprivileged to 1.27 #797
-- ✨(teams) allow broadly available teams #796
-- ✨(teams) update and enhance team invitation email
-- ✨(api) define dimail timeout as a setting
-- ✨(frontend) feature modal add new access role to domain 
-- ✨(api) allow invitations for domain management #708
-
-### Fixed
-
-- 🐛(oauth2) force JWT signed for /userinfo #804
-- 🐛(oauth2) add ProConnect scopes #802
-- 🐛(domains) use a dedicated mail to invite user to manage domain
-- 🐛(mailbox) fix mailbox creation email language
-
-## [1.13.1] - 2025-03-04
-
-### Fixed
-
-- 🐛(mailbox) fix migration to fill dn_email field
-
-## [1.13.0] - 2025-03-04
-
-### Added
-
-- ✨(oidc) people as an identity provider #638
-
-### Fixed
-
-- 💄(domains) improve user experience and avoid repeat fix_domain operations
-- 👽️(dimail) increase timeout value for check domain API call
-- 🧱(helm) add resource-server ingress path #743
-- 🌐(backend) synchronize translations with crowdin again
-
-## [1.12.1] - 2025-02-20
-
-### Fixed
-
-- 👽️(dimail) increase timeout value for API calls
-
-## [1.12.0] - 2025-02-18
-
-### Added
-
-- ✨(domains) allow user to re-run all fetch domain data from dimail
-- ✨(domains) display DNS config expected for domain with required actions
-- ✨(domains) check status after creation
-- ✨(domains) display required actions to do on domain
-- ✨(plugin) add CommuneCreation plugin with domain provisioning #658
-- ✨(frontend) display action required status on domain
-- ✨(domains) store last health check details on MailDomain
-- ✨(domains) add support email field on domain
-
-## [1.11.0] - 2025-02-07
-
-### Added
-
-- ✨(api) add count mailboxes to MailDomain serializer
-- ✨(dimail) manage 'action required' status for MailDomain
-- ✨(domains) add action required status on MailDomain
-- ✨(dimail) send pending mailboxes upon domain activation
-
-### Fixed
-
-- ✨(auth) fix empty names from ProConnect #687
-- 🚑️(teams) do not display add button when disallowed #676
-- 🚑️(plugins) fix name from SIRET specific case #674
-- 🐛(api) restrict mailbox sync to enabled domains
-
-## [1.10.1] - 2025-01-27
-
-### Added
-
-- ✨(dimail) management command to fetch domain status
-
-### Changed
-
-- ✨(scripts) adapts release script after moving the deployment part
-
-### Fixed
-
-- 🐛(dimail) fix imported mailboxes should be enabled instead of pending #659 
-- ⚡️(api) add missing cache for stats endpoint
-
-## [1.10.0] - 2025-01-21
-
-### Added
-
-- ✨(api) create stats endpoint
-- ✨(teams) add Team dependencies #560
-- ✨(organization) add admin action for plugin #640
-- ✨(anct) fetch and display organization names of communes #583
-- ✨(frontend) display email if no username #562
-- 🧑‍💻(oidc) add ability to pull registration ID (e.g. SIRET) from OIDC #577
-
-### Fixed
-
-- 🐛(frontend) improve e2e tests avoiding race condition from mocks #641
-- 🐛(backend) fix flaky test with search contact #605
-- 🐛(backend) fix flaky test with team access #646
-- 🧑‍💻(dimail) remove 'NoneType: None' log in debug mode
-- 🐛(frontend) fix flaky e2e test #636
-- 🐛(frontend) fix disable mailbox button display #631
-- 🐛(backend) fix dimail call despite mailbox creation failure on our side
-- 🧑‍💻(user) fix the User.language infinite migration #611
-
-## [1.9.1] - 2024-12-18
-
-## [1.9.0] - 2024-12-17
-
-### Fixed
-
-- 🐛(backend) fix manage roles on domain admin view
-
-### Added
-
-- ✨(backend) add admin action to check domain health
-- ✨(dimail) check domain health
-- ✨(frontend) disable mailbox and allow to create pending mailbox
-- ✨(organizations) add siret to name conversion #584
-- 💄(frontend) redirect home according to abilities #588
-- ✨(maildomain_access) add API endpoint to search users #508
-
-## [1.8.0] - 2024-12-12
-
-### Added
-
-- ✨(contacts) add "abilities" to API endpoint data #585
-- ✨(contacts) allow filter list API with email
-- ✨(contacts) return profile contact from same organization
-- ✨(dimail) automate allows requests to dimail
-- ✨(contacts) add notes & force full_name #565
-
-### Changed
-
-- ♻️(contacts) move user profile to contact #572
-- ♻️(contacts) split api test module in actions #573
-
-### Fixed
-
-- 🐛(backend) fix manage roles on domain admin view
-- 🐛(mailbox) fix activate mailbox feature
-- 🔧(helm) fix the configuration environment #579
-
-## [1.7.1] - 2024-11-28
-
-## [1.7.0] - 2024-11-28
-
-### Added
-
-- ✨(mailbox) allow to activate mailbox
-- ✨(mailbox) allow to disable mailbox
-- ✨(backend) add ServiceProvider #522
-- 💄(admin) allow header color customization #552 
-- ✨(organization) add API endpoints #551
-
-### Fixed
-
--  🐛(admin) add organization on user #555
-
-## [1.6.1] - 2024-11-22
-
-### Fixed
-
-- 🩹(mailbox) fix status of current mailboxes
-- 🚑️(backend) fix claim contains non-user field #548
-
-## [1.6.0] - 2024-11-20
-
-### Removed
-
-- 🔥(teams) remove search by trigram for team access and contact
-
-### Added
-
-- ✨(domains) allow creation of "pending" mailboxes
-- ✨(teams) allow team management for team admins/owners #509
-
-### Fixed
-
--  🔊(backend) update logger config to info #542
-
-## [1.5.0] - 2024-11-14
-
-### Removed
-
-- ⬆️(dependencies) remove unneeded dependencies
-- 🔥(teams) remove pagination of teams listing
-- 🔥(teams) remove search users by trigram
-- 🗃️(teams) remove `slug` field
-
-### Added
-
-- ✨(dimail) send domain creation requests to dimail #454
-- ✨(dimail) synchronize mailboxes from dimail to our db #453
-- ✨(ci) add security scan #429
-- ✨(teams) register contacts on admin views
-
-### Fixed
-
-- 🐛(mail) fix display button on outlook
-- 💚(ci) improve E2E tests #492
-- 🔧(sentry) restore default integrations
-- 🔇(backend) remove Sentry duplicated warning/errors
-- 👷(ci) add sharding e2e tests  #467
-- 🐛(dimail) fix unexpected status_code for proper debug #454
-
-## [1.4.1] - 2024-10-23
-
-### Fixed
-
-- 🚑️(frontend) fix MailDomainsLayout
-
-## [1.4.0] - 2024-10-23
-
-### Added
-
-- ✨(frontend) add tabs inside #466
-
-### Fixed
-
-- ✏️(mail) fix typo into mailbox creation email
-- 🐛(sentry) fix duplicated sentry errors #479
-- 🐛(script) improve and fix release script
-
-## [1.3.1] - 2024-10-18
-
-## [1.3.0] - 2024-10-18
-
-### Added
-
-- ✨(api) add RELEASE version on config endpoint #459
-- ✨(backend) manage roles on domain admin view
-- ✨(frontend) show version number in footer #369
-- 👔(backend) add Organization model
-
-### Changed
-
-- 🛂(backend) match email if no existing user matches the sub
-
-### Fixed
-
-- 💄(mail) improve mailbox creation email #462
-- 🐛(frontend) fix update accesses form #448
-- 🛂(backend) do not duplicate user when disabled
-
-## [1.2.1] - 2024-10-03
-
-### Fixed
-
-- 🔧(mail) use new scaleway email gateway #435 
-
-
-## [1.2.0] - 2024-09-30
-
-
-### Added
-
-- ✨(ci) add helmfile linter and fix argocd sync #424 
-- ✨(domains) add endpoint to list and retrieve domain accesses #404
-- 🍱(dev) embark dimail-api as container #366
-- ✨(dimail) allow la regie to request a token for another user #416
-- ✨(frontend) show username on AccountDropDown #412
-- 🥅(frontend) improve add & update group forms error handling #387
-- ✨(frontend) allow group members filtering #363
-- ✨(mailbox) send new mailbox confirmation email #397
-- ✨(domains) domain accesses update API #423
-- ✨(backend) domain accesses create API #428
-- 🥅(frontend) catch new errors on mailbox creation #392
-- ✨(api) domain accesses delete API #433
-- ✨(frontend) add mail domain access management #413
-
-### Fixed
-
-- ♿️(frontend) fix left nav panel #396
-- 🔧(backend) fix configuration to avoid different ssl warning #432 
-
-### Changed
-
-- ♻️(serializers) move business logic to serializers #414 
-
-## [1.1.0] - 2024-09-10
-
-### Added
-
-- 📈(monitoring) configure sentry monitoring #378
-- 🥅(frontend) improve api error handling #355
-
-### Changed
-
-- 🗃️(models) move dimail 'secret' to settings #372 
-
-### Fixed
-
-- 🐛(dimail) improve handling of dimail errors on failed mailbox creation #377
-- 💬(frontend) fix group member removal text #382
-- 💬(frontend) fix add mail domain text #382
-- 🐛(frontend) fix keyboard navigation #379
-- 🐛(frontend) fix add mail domain form submission #355
-
-## [1.0.2] - 2024-08-30
-
-### Added
-
-- 🔧Runtime config for the frontend (#345)
-- 🔧(helm) configure resource server in staging
-
-### Fixed 
-
-- 👽️(mailboxes) fix mailbox creation after dimail api improvement (#360)
-
-## [1.0.1] - 2024-08-19
-
-### Fixed
-
-- ✨(frontend) user can add mail domains
-
-## [1.0.0] - 2024-08-09
-
-### Added
-
-- ✨(domains) create and manage domains on admin + API
-- ✨(domains) mailbox creation + link to email provisioning API
-
-[unreleased]: https://github.com/suitenumerique/people/compare/v1.23.1...main
-[1.23.1]: https://github.com/suitenumerique/people/releases/v1.23.1
-[1.23.0]: https://github.com/suitenumerique/people/releases/v1.23.0
-[1.22.2]: https://github.com/suitenumerique/people/releases/v1.22.2
-[1.22.1]: https://github.com/suitenumerique/people/releases/v1.22.1
-[1.22.0]: https://github.com/suitenumerique/people/releases/v1.22.0
-[1.21.0]: https://github.com/suitenumerique/people/releases/v1.21.0
-[1.20.0]: https://github.com/suitenumerique/people/releases/v1.20.0
-[1.19.1]: https://github.com/suitenumerique/people/releases/v1.19.1
-[1.19.0]: https://github.com/suitenumerique/people/releases/v1.19.0
-[1.18.2]: https://github.com/suitenumerique/people/releases/v1.18.2
-[1.18.1]: https://github.com/suitenumerique/people/releases/v1.18.1
-[1.18.0]: https://github.com/suitenumerique/people/releases/v1.18.0
-[1.17.0]: https://github.com/suitenumerique/people/releases/v1.17.0
-[1.16.0]: https://github.com/suitenumerique/people/releases/v1.16.0
-[1.15.0]: https://github.com/suitenumerique/people/releases/v1.15.0
-[1.14.1]: https://github.com/suitenumerique/people/releases/v1.14.1
-[1.14.0]: https://github.com/suitenumerique/people/releases/v1.14.0
-[1.13.1]: https://github.com/suitenumerique/people/releases/v1.13.1
-[1.13.0]: https://github.com/suitenumerique/people/releases/v1.13.0
-[1.12.1]: https://github.com/suitenumerique/people/releases/v1.12.1
-[1.12.0]: https://github.com/suitenumerique/people/releases/v1.12.0
-[1.11.0]: https://github.com/suitenumerique/people/releases/v1.11.0
-[1.10.1]: https://github.com/suitenumerique/people/releases/v1.10.1
-[1.10.0]: https://github.com/suitenumerique/people/releases/v1.10.0
-[1.9.1]: https://github.com/suitenumerique/people/releases/v1.9.1
-[1.9.0]: https://github.com/suitenumerique/people/releases/v1.9.0
-[1.8.0]: https://github.com/suitenumerique/people/releases/v1.8.0
-[1.7.1]: https://github.com/suitenumerique/people/releases/v1.7.1
-[1.7.0]: https://github.com/suitenumerique/people/releases/v1.7.0
-[1.6.1]: https://github.com/suitenumerique/people/releases/v1.6.1
-[1.6.0]: https://github.com/suitenumerique/people/releases/v1.6.0
-[1.5.0]: https://github.com/suitenumerique/people/releases/v1.5.0
-[1.4.1]: https://github.com/suitenumerique/people/releases/v1.4.1
-[1.4.0]: https://github.com/suitenumerique/people/releases/v1.4.0
-[1.3.1]: https://github.com/suitenumerique/people/releases/v1.3.1
-[1.3.0]: https://github.com/suitenumerique/people/releases/v1.3.0
-[1.2.1]: https://github.com/suitenumerique/people/releases/v1.2.1
-[1.2.0]: https://github.com/suitenumerique/people/releases/v1.2.0
-[1.1.0]: https://github.com/suitenumerique/people/releases/v1.1.0
-[1.0.2]: https://github.com/suitenumerique/people/releases/v1.0.2
-[1.0.1]: https://github.com/suitenumerique/people/releases/v1.0.1
-[1.0.0]: https://github.com/suitenumerique/people/releases/v1.0.0

CONTRIBUTING.md

@@ -1,109 +0,0 @@
-# Contributing to the Project
-
-Thank you for taking the time to contribute! Please follow these guidelines to ensure a smooth and productive workflow. 🚀🚀🚀
-
-To get started with the project, please refer to the [README.md](https://github.com/suitenumerique/docs/blob/main/README.md) for detailed instructions.
-
-Please also check out our [dev handbook](https://suitenumerique.gitbook.io/handbook) to learn our best practices.
-
-## Help us with translations
-
-You can help us with translations on [Crowdin](https://crowdin.com/project/lasuite-people).
-Your language is not there? Request it on our Crowdin page 😊.
-
-## Creating an Issue
-
-When creating an issue, please provide the following details:
-
-1.  **Title**: A concise and descriptive title for the issue.
-2.  **Description**: A detailed explanation of the issue, including relevant context or screenshots if applicable.
-3.  **Steps to Reproduce**: If the issue is a bug, include the steps needed to reproduce the problem.
-4.  **Expected vs. Actual Behavior**: Describe what you expected to happen and what actually happened.
-5.  **Labels**: Add appropriate labels to categorize the issue (e.g., bug, feature request, documentation).
-
-## Selecting an issue
-
-We use a [GitHub Project](https://github.com/orgs/suitenumerique/projects/1) in order to prioritize our workload. 
-
-Please check in priority the issues that are in the **TODO cette semaine** column. 
-
-## Commit Message Format
-
-All commit messages must adhere to the following format:
-
-`<gitmoji>(type) title description`
-
-*   <**gitmoji**>: Use a gitmoji to represent the purpose of the commit. For example, ✨ for adding a new feature or 🔥 for removing something, see the list here: <https://gitmoji.dev/>.
-*   **(type)**: Describe the type of change. Common types include `backend`, `frontend`, `CI`, `docker` etc...
-*   **title**: A short, descriptive title for the change, starting with a lowercase character.
-*   **description**: Include additional details about what was changed and why.
-
-### Example Commit Message
-
-```
-✨(frontend) add user authentication logic 
-
-Implemented login and signup features, and integrated OAuth2 for social login.
-```
-
-## Changelog Update
-
-Please add a line to the changelog describing your development. The changelog entry should include a brief summary of the changes, this helps in tracking changes effectively and keeping everyone informed. We usually include the title of the pull request, followed by the pull request ID to finish the log entry. The changelog line should be less than 80 characters in total.
-
-### Example Changelog Message
-```
-## [Unreleased]
-
-## Added
-
-- ✨(frontend) add AI to the project #321
-```
-
-## Pull Requests
-
-It is nice to add information about the purpose of the pull request to help reviewers understand the context and intent of the changes. If you can, add some pictures or a small video to show the changes.
-
-### Don't forget to: 
-- check your commits
-- check the linting: `make lint && make frontend-lint`
-- check the tests: `make test`
-- add a changelog entry
-- squash your commits
-- rebase your branch on the latest `main` branch before pushing your changes `git pull --rebase origin main`
-
-### Process to have a nice commit history
-
-In the life time of your PR, you may need to add commits to fix things or add new features.
-Commit after commit, your PR will be full of commits but you have to clean it up with the following commands before merging on `main`:
-
-Gradually you can use `--fixup` to add commits to some of previous commit ( for example 1234567890).
-```
-git commit --fixup=1234567890
-```
-Then, you can squash your commits with the following command:
-```
-git rebase --autosquash -i -r  HEAD~<number-of-commits>
-```
-
-Or you can use:
-```
-git rebase -i HEAD~<number-of-commits>
-```
-and move, squash and/or rename your commits manually. You can squash them with previous commit replacing the `pick` by `f`. You can rename them with replacing the `pick` by `r`.
-Tada! You have a clean commit history.
-
-Once all the required tests have passed, you can request a review from the project maintainers.
-
-## Code Style
-
-Please maintain consistency in code style. Run any linting tools available to make sure the code is clean and follows the project's conventions.
-
-## Tests
-
-Make sure that all new features or fixes have corresponding tests. Run the test suite before pushing your changes to ensure that nothing is broken.
-
-## Asking for Help
-
-If you need any help while contributing, feel free to open a discussion or ask for guidance in the issue tracker. We are more than happy to assist!
-
-Thank you for your contributions! 👍

Dockerfile

@@ -1,154 +0,0 @@
-# Django People
-
-# ---- base image to inherit from ----
-FROM python:3.14.2-alpine AS base
-
-# Upgrade system packages to install security updates
-RUN apk update && \
-  apk upgrade
-
-# ---- Back-end builder image ----
-FROM base AS back-builder
-
-ENV UV_COMPILE_BYTECODE=1
-ENV UV_LINK_MODE=copy
-
-# Disable Python downloads, because we want to use the system interpreter
-# across both images. If using a managed Python version, it needs to be
-# copied from the build image into the final image;
-ENV UV_PYTHON_DOWNLOADS=0
-
-# install uv
-COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /uvx /bin/
-
-WORKDIR /app
-
-RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=bind,source=src/backend/uv.lock,target=uv.lock \
-    --mount=type=bind,source=src/backend/pyproject.toml,target=pyproject.toml \
-    uv sync --locked --no-install-project --no-dev
-COPY src/backend /app
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-dev
-
-
-# ---- mails ----
-FROM node:22 AS mail-builder
-
-COPY ./src/mail /mail/app
-
-WORKDIR /mail/app
-
-RUN yarn install --frozen-lockfile && \
-    yarn build
-
-
-# ---- static link collector ----
-FROM base AS link-collector
-ARG PEOPLE_STATIC_ROOT=/data/static
-
-# Install libpangocairo & rdfind
-RUN apk add \
-  pango \
-  rdfind
-
-WORKDIR /app
-
-# Copy the application from the builder
-COPY --from=back-builder /app /app
-
-ENV PATH="/app/.venv/bin:$PATH"
-
-# collectstatic
-RUN DJANGO_CONFIGURATION=Build DJANGO_JWT_PRIVATE_SIGNING_KEY=Dummy \
-    python manage.py collectstatic --noinput
-
-# Replace duplicated file by a symlink to decrease the overall size of the
-# final image
-RUN rdfind -makesymlinks true -followsymlinks true -makeresultsfile false ${PEOPLE_STATIC_ROOT}
-
-# ---- Core application image ----
-FROM base AS core
-
-ENV PYTHONUNBUFFERED=1
-
-# Install required system libs
-RUN apk add \
-  gettext \
-  cairo \
-  libffi-dev \
-  gdk-pixbuf \
-  pango \
-  shared-mime-info
-
-# Copy entrypoint
-COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
-
-# Give the "root" group the same permissions as the "root" user on /etc/passwd
-# to allow a user belonging to the root group to add new users; typically the
-# docker user (see entrypoint).
-RUN chmod g=u /etc/passwd
-
-# Copy the application from the builder
-COPY --from=back-builder /app /app
-
-WORKDIR /app
-
-# Ensure the uv venv is used at runtime
-ENV PATH="/app/.venv/bin:$PATH"
-
-# Generate compiled translation messages
-RUN DJANGO_CONFIGURATION=Build \
-    python manage.py compilemessages --ignore=".venv/**/*"
-
-# We wrap commands run in this container by the following entrypoint that
-# creates a user on-the-fly with the container user ID (see USER) and root group
-# ID.
-ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
-
-# ---- Development image ----
-FROM core AS backend-development
-
-# Switch back to the root user to install development dependencies
-USER root:root
-
-# Install psql
-RUN apk add postgresql-client
-
-# Install development dependencies
-RUN --mount=from=ghcr.io/astral-sh/uv:0.9.10,source=/uv,target=/bin/uv \
-    uv sync --all-extras --locked
-
-# Restore the un-privileged user running the application
-ARG DOCKER_USER
-USER ${DOCKER_USER}
-
-# Target database host (e.g. database engine following docker compose services
-# name) & port
-ENV DB_HOST=postgresql \
-    DB_PORT=5432
-
-# Run django development server
-CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
-
-# ---- Production image ----
-FROM core AS backend-production
-
-ARG PEOPLE_STATIC_ROOT=/data/static
-
-# Gunicorn
-RUN mkdir -p /usr/local/etc/gunicorn
-COPY docker/files/usr/local/etc/gunicorn/people.py /usr/local/etc/gunicorn/people.py
-
-# Un-privileged user running the application
-ARG DOCKER_USER
-USER ${DOCKER_USER}
-
-# Copy statics
-COPY --from=link-collector ${PEOPLE_STATIC_ROOT} ${PEOPLE_STATIC_ROOT}
-
-# Copy people mails
-COPY --from=mail-builder /mail/backend/core/templates/mail /app/core/templates/mail
-
-# The default command runs gunicorn WSGI server in people's main module
-CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/people.py", "people.wsgi:application"]

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 Direction Interministérielle du Numérique - Gouvernement Français
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

Makefile

@@ -1,440 +0,0 @@
-# /!\ /!\ /!\ /!\ /!\ /!\ /!\ DISCLAIMER /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\
-#
-# This Makefile is only meant to be used for DEVELOPMENT purpose as we are
-# changing the user id that will run in the container.
-#
-# PLEASE DO NOT USE IT FOR YOUR CI/PRODUCTION/WHATEVER...
-#
-# /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\ /!\
-#
-# Note to developers:
-#
-# While editing this file, please respect the following statements:
-#
-# 1. Every variable should be defined in the ad hoc VARIABLES section with a
-#    relevant subsection
-# 2. Every new rule should be defined in the ad hoc RULES section with a
-#    relevant subsection depending on the targeted service
-# 3. Rules should be sorted alphabetically within their section
-# 4. When a rule has multiple dependencies, you should:
-#    - duplicate the rule name to add the help string (if required)
-#    - write one dependency per line to increase readability and diffs
-# 5. .PHONY rule statement should be written after the corresponding rule
-# ==============================================================================
-# VARIABLES
-
-BOLD := \033[1m
-RESET := \033[0m
-GREEN := \033[1;32m
-
-
-# -- Database
-
-DB_HOST            = postgresql
-DB_PORT            = 5432
-
-# -- Docker
-# Get the current user ID to use for docker run and docker exec commands
-DOCKER_UID          = $(shell id -u)
-DOCKER_GID          = $(shell id -g)
-DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
-COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
-COMPOSE_EXEC        = $(COMPOSE) exec
-COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
-COMPOSE_RUN         = $(COMPOSE) run --rm --no-deps
-COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
-COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
-
-# -- Backend
-MANAGE              = $(COMPOSE_RUN_APP) python manage.py
-MAIL_YARN           = $(COMPOSE_RUN) -w /app/src/mail node yarn
-TSCLIENT_YARN       = $(COMPOSE_RUN) -w /app/src/tsclient node yarn
-
-# -- Frontend
-PATH_FRONT          = ./src/frontend
-PATH_FRONT_DESK     = $(PATH_FRONT)/apps/desk
-
-# ==============================================================================
-# RULES
-
-default: help
-
-data/media:
-	@mkdir -p data/media
-
-data/static:
-	@mkdir -p data/static
-
-# -- Project
-
-create-env-files: ## Copy the dist env files to env files
-create-env-files: \
-	env.d/development/common \
-	env.d/development/france \
-	env.d/development/crowdin \
-	env.d/development/postgresql \
-	env.d/development/kc_postgresql
-.PHONY: create-env-files
-
-add-dev-rsa-private-key-to-env: ## Add a generated RSA private key to the env file
-	@echo "Generating RSA private key PEM for development..."
-	@mkdir -p env.d/development/rsa
-	@openssl genrsa -out env.d/development/rsa/private.pem 2048
-	@echo -n "\nOAUTH2_PROVIDER_OIDC_RSA_PRIVATE_KEY=\"" >> env.d/development/common
-	@openssl rsa -in env.d/development/rsa/private.pem -outform PEM >> env.d/development/common
-	@echo "\"" >> env.d/development/common
-	@rm -rf env.d/development/rsa
-.PHONY: add-dev-rsa-private-key-to-env
-
-update-keycloak-realm-app: ## Create the Keycloak realm for the project
-	@echo "$(BOLD)Creating Keycloak realm for 'app'$(RESET)"
-	@sed -i 's|http://app-dev:8000|http://app:8000|g' ./docker/auth/realm.json
-.PHONY: update-keycloak-realm-app
-
-bootstrap: ## Prepare Docker images for the project and install frontend dependencies
-bootstrap: \
-	data/media \
-	data/static \
-	create-env-files \
-	build \
-	run-dev \
-	migrate \
-	back-i18n-compile \
-	mails-install \
-	mails-build \
-	dimail-setup-db
-.PHONY: bootstrap
-
-# -- Docker/compose
-build: ## build the app-dev container
-	@$(COMPOSE) build app-dev frontend-dev
-	@$(COMPOSE) build dimail
-.PHONY: build
-
-down: ## stop and remove containers, networks, images, and volumes
-	@$(COMPOSE) down
-.PHONY: down
-
-logs: ## display app-dev logs (follow mode)
-	@$(COMPOSE) logs -f app-dev
-.PHONY: logs
-
-run: ## start the wsgi (production) and servers with production Docker images
-	@$(COMPOSE) up --force-recreate --detach app frontend celery celery-beat nginx maildev
-.PHONY: run
-
-run-dev: ## start the servers in development mode (watch) Docker images
-	@$(COMPOSE) up --force-recreate --detach app-dev dimail frontend-dev celery-dev celery-beat-dev nginx maildev
-.PHONY: run-dev
-
-status: ## an alias for "docker compose ps"
-	@$(COMPOSE) ps
-.PHONY: status
-
-stop: ## stop the development server using Docker
-	@$(COMPOSE) stop
-.PHONY: stop
-
-# -- Backend
-
-demo: ## flush db then create a demo for load testing purpose
-	@$(MAKE) resetdb
-	@$(MANAGE) create_demo
-	@$(MAKE) dimail-setup-db
-.PHONY: demo
-
-
-# Nota bene: Black should come after isort just in case they don't agree...
-lint: ## lint back-end python sources
-lint: \
-  lint-ruff-format \
-  lint-ruff-check \
-  lint-pylint
-.PHONY: lint
-
-lint-ruff-format: ## format back-end python sources with ruff
-	@echo 'lint:ruff-format started…'
-	@$(COMPOSE_RUN_APP) ruff format .
-.PHONY: lint-ruff-format
-
-lint-ruff-check: ## lint back-end python sources with ruff
-	@echo 'lint:ruff-check started…'
-	@$(COMPOSE_RUN_APP) ruff check . --fix
-.PHONY: lint-ruff-check
-
-lint-pylint: ## lint back-end python sources with pylint only on changed files from main
-	@echo 'lint:pylint started…'
-	bin/pylint --diff-only=origin/main
-.PHONY: lint-pylint
-
-lint-front: ## lint front-end sources with eslint
-	cd $(PATH_FRONT) && yarn lint
-.PHONY: lint-front
-
-lint-front-fix: ## fix front-end sources with eslint
-	cd $(PATH_FRONT) && yarn lint-fix
-.PHONY: lint-front-fix
-
-test: ## run project tests
-	@$(MAKE) test-back-parallel
-.PHONY: test
-
-test-back: ## run back-end tests
-	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest $${args:-${1}}
-.PHONY: test-back
-
-test-back-parallel: ## run all back-end tests in parallel
-	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest -n auto $${args:-${1}}
-.PHONY: test-back-parallel
-
-test-coverage: ## compute, display and save test coverage
-	bin/pytest --cov=. --cov-report json .
-.PHONY: test-coverage
-
-makemigrations:  ## run django makemigrations for the people project.
-	@echo "$(BOLD)Running makemigrations$(RESET)"
-	@$(MANAGE) makemigrations $(ARGS)
-.PHONY: makemigrations
-
-migrate:  ## run django migrations for the people project.
-	@echo "$(BOLD)Running migrations$(RESET)"
-	@$(MANAGE) migrate $(ARGS)
-.PHONY: migrate
-
-showmigrations:  ## run django showmigrations for the people project.
-	@echo "$(BOLD)Running showmigrations$(RESET)"
-	@$(MANAGE) showmigrations $(ARGS)
-.PHONY: showmigrations
-
-superuser: ## Create an admin superuser with password "admin"
-	@echo "$(BOLD)Creating a Django superuser$(RESET)"
-	$(MANAGE) createsuperuser --username admin --password admin
-
-.PHONY: superuser
-
-back-i18n-compile: ## compile the gettext files
-	@$(MANAGE) compilemessages --ignore=".venv/**/*"
-.PHONY: back-i18n-compile
-
-back-i18n-generate: ## create the .pot files used for i18n
-back-i18n-generate: mails-build crowdin-download-sources
-	@$(MANAGE) makemessages -a --keep-pot
-.PHONY: back-i18n-generate
-
-shell: ## connect to database shell
-	@$(MANAGE) shell #_plus
-.PHONY: dbshell
-
-# -- Database
-
-dbshell: ## connect to database shell
-	docker compose exec app-dev python manage.py dbshell
-.PHONY: dbshell
-
-resetdb: FLUSH_ARGS ?=
-resetdb: ## flush database and create a superuser "admin"
-	@echo "$(BOLD)Flush database$(RESET)"
-	@$(MANAGE) flush $(FLUSH_ARGS)
-	@${MAKE} superuser
-.PHONY: resetdb
-
-env.d/development/common:
-	cp --update=none env.d/development/common.dist env.d/development/common
-
-env.d/development/france:
-	cp --update=none env.d/development/france.dist env.d/development/france
-
-env.d/development/postgresql:
-	cp --update=none env.d/development/postgresql.dist env.d/development/postgresql
-
-env.d/development/kc_postgresql:
-	cp --update=none env.d/development/kc_postgresql.dist env.d/development/kc_postgresql
-
-# -- Internationalization
-
-env.d/development/crowdin:
-	cp --update=none env.d/development/crowdin.dist env.d/development/crowdin
-
-crowdin-download: ## Download translated message from Crowdin
-	@$(COMPOSE_RUN_CROWDIN) download -c crowdin/config.yml
-.PHONY: crowdin-download
-
-crowdin-download-sources: ## Download sources from Crowdin
-	@$(COMPOSE_RUN_CROWDIN) download sources -c crowdin/config.yml
-.PHONY: crowdin-download-sources
-
-crowdin-upload: ## Upload source translations to Crowdin
-	@$(COMPOSE_RUN_CROWDIN) upload sources -c crowdin/config.yml
-.PHONY: crowdin-upload
-
-i18n-compile: ## compile all translations
-i18n-compile: \
-	back-i18n-compile \
-	frontend-i18n-compile
-.PHONY: i18n-compile
-
-i18n-generate: ## create the .pot files and extract frontend messages
-i18n-generate: \
-	crowdin-download-sources \
-	back-i18n-generate \
-	frontend-i18n-generate
-.PHONY: i18n-generate
-
-i18n-download-and-compile: ## download all translated messages and compile them to be used by all applications
-i18n-download-and-compile: \
-  crowdin-download \
-  i18n-compile
-.PHONY: i18n-download-and-compile
-
-i18n-generate-and-upload: ## generate source translations for all applications and upload them to Crowdin
-i18n-generate-and-upload: \
-  i18n-generate \
-  crowdin-upload
-.PHONY: i18n-generate-and-upload
-
-# -- INTEROPERABILTY
-# -- Dimail configuration
-dimail-setup-db:
-	@$(COMPOSE) up --force-recreate -d dimail
-	@echo "$(BOLD)Populating database of local dimail API container$(RESET)"
-	@$(MANAGE) setup_dimail_db --populate-from-people
-.PHONY: dimail-setup-db
-
-# -- Mail generator
-
-mails-clean-templates: ## Clean the generated mail templates directory
-	@echo "$(BOLD)Cleaning mail templates directory$(RESET)"
-	@rm -rf ./src/backend/core/templates/mail
-	@mkdir -p ./src/backend/core/templates/mail
-.PHONY: mails-clean-templates
-
-mails-build: mails-clean-templates ## Convert mjml files to html and text
-	@$(MAIL_YARN) build
-.PHONY: mails-build
-
-mails-build-html-to-plain-text: ## Convert html files to text
-	@$(MAIL_YARN) build-html-to-plain-text
-.PHONY: mails-build-html-to-plain-text
-
-mails-build-mjml-to-html:	## Convert mjml files to html and text
-	@$(MAIL_YARN) build-mjml-to-html
-.PHONY: mails-build-mjml-to-html
-
-mails-install: ## install the mail generator
-	@$(MAIL_YARN) install
-.PHONY: mails-install
-
-# -- TS client generator
-
-tsclient-install: ## Install the Typescript API client generator
-	@$(TSCLIENT_YARN) install
-.PHONY: tsclient-install
-
-tsclient: tsclient-install ## Generate a Typescript API client
-	@$(TSCLIENT_YARN) generate:api:client:local ../frontend/tsclient
-.PHONY: tsclient-install
-
-# -- Misc
-clean: ## restore repository state as it was freshly cloned
-	git clean -idx
-.PHONY: clean
-
-help:
-	@echo "$(BOLD)People Makefile"
-	@echo "Please use 'make $(BOLD)target$(RESET)' where $(BOLD)target$(RESET) is one of:"
-	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(firstword $(MAKEFILE_LIST)) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "$(GREEN)%-30s$(RESET) %s\n", $$1, $$2}'
-.PHONY: help
-
-# Front 
-install-front-desk: ## Install the frontend dependencies of app Desk  
-	cd $(PATH_FRONT_DESK) && yarn && yarn playwright install chromium
-.PHONY: install-front-desk
-
-run-front-desk: ## Start app Desk  
-	cd $(PATH_FRONT_DESK) && yarn dev
-.PHONY: run-front-desk
-
-frontend-i18n-extract: ## Extract the frontend translation inside a json to be used for crowdin
-	cd $(PATH_FRONT) && yarn i18n:extract
-.PHONY: frontend-i18n-extract
-
-frontend-i18n-generate: ## Generate the frontend json files used for crowdin
-frontend-i18n-generate: \
-	crowdin-download-sources \
-	frontend-i18n-extract
-.PHONY: frontend-i18n-generate
-
-frontend-i18n-compile: ## Format the crowin json files used deploy to the apps
-	cd $(PATH_FRONT) && yarn i18n:deploy
-.PHONY: frontend-i18n-compile
-
-# -- K8S
-start-kind: ## Create the kubernetes cluster
-	./bin/start-kind.sh
-.PHONY: start-kind
-
-install-external-secrets: ## install the kubernetes secrets from Vaultwarden
-	./bin/install-external-secrets.sh
-.PHONY: build-k8s-cluster
-
-tilt-up: ## start tilt - k8s local development
-	tilt up -f ./bin/Tiltfile
-.PHONY: tilt-up
-
-start-tilt-keycloak: ## start the kubernetes cluster using kind, without Pro Connect for authentication, use keycloak
-	DEV_ENV=dev-keycloak tilt up -f ./bin/Tiltfile
-.PHONY: build-k8s-cluster
-
-release:  ## helper for release and deployment
-	python scripts/release.py
-.PHONY: release
-
-install-secret: ## install the kubernetes secrets from Vaultwarden
-	if kubectl -n desk get secrets bitwarden-cli-desk; then \
-		echo "Secret already present"; \
-	else \
-		echo "Please provide the following information:"; \
-		read -p "Enter your vaultwarden email login: " LOGIN; \
-		read -p "Enter your vaultwarden password: " PASSWORD; \
-		read -p "Enter your vaultwarden server url: " URL; \
-		echo "\nCreate vaultwarden secret"; \
-		echo "apiVersion: v1" > /tmp/secret.yaml; \
-		echo "kind: Secret" >> /tmp/secret.yaml; \
-		echo "metadata:" >> /tmp/secret.yaml; \
-		echo "  name: bitwarden-cli-desk" >> /tmp/secret.yaml; \
-		echo "  namespace: desk" >> /tmp/secret.yaml; \
-		echo "type: Opaque" >> /tmp/secret.yaml; \
-		echo "stringData:" >> /tmp/secret.yaml; \
-		echo "  BW_HOST: $$URL" >> /tmp/secret.yaml; \
-		echo "  BW_PASSWORD: $$PASSWORD" >> /tmp/secret.yaml; \
-		echo "  BW_USERNAME: $$LOGIN" >> /tmp/secret.yaml; \
-		kubectl -n desk apply -f /tmp/secret.yaml;\
-		rm -f /tmp/secret.yaml; \
-	fi; \
-	if kubectl get ns external-secrets; then \
-		echo "External secret already deployed"; \
-	else \
-		helm repo add external-secrets https://charts.external-secrets.io; \
-		helm upgrade --install external-secrets \
-      external-secrets/external-secrets \
-       -n external-secrets \
-       --create-namespace \
-       --set installCRDs=true; \
-	fi
-.PHONY: build-k8s-cluster
-
-fetch-domain-status:
-	@$(MANAGE) fetch_domain_status
-.PHONY: fetch-domain-status
-
-# -- Keycloak related
-create-new-client:  ## run the add-keycloak-client.sh script for keycloak.
-	@echo "$(BOLD)Running add-keycloak-client.sh$(RESET)"
-	@$(COMPOSE_RUN) \
-		-v ./scripts/keycloak/add-keycloak-client.sh:/tmp/add-keycloak-client.sh \
-		--entrypoint="/tmp/add-keycloak-client.sh" \
-		keycloak \
-		$(filter-out $@,$(MAKECMDGOALS))
-.PHONY: create-new-client

README.md

@@ -1,111 +0,0 @@
-# People
-
-People is an application to handle users and teams, and distribute permissions across [La Suite](https://lasuite.numerique.gouv.fr/).
-
-It is built on top of [Django Rest
-Framework](https://www.django-rest-framework.org/).
-
-All interoperabilities will be described in `docs/interoperability`.
-
-## Getting started
-
-### Prerequisite
-
-Make sure you have a recent version of Docker and [Docker
-Compose](https://docs.docker.com/compose/install) installed on your laptop:
-
-```bash
-$ docker -v
-  Docker version 20.10.2, build 2291f61
-
-$ docker compose -v
-  docker compose version 1.27.4, build 40524192
-```
-
-> ⚠️ You may need to run the following commands with `sudo` but this can be
-> avoided by assigning your user to the `docker` group.
-
-### Bootstrap project
-
-The easiest way to start working on the project is to use GNU Make:
-
-```bash
-$ make bootstrap
-```
-
-This command builds the `app-dev` container, installs dependencies, performs
-database migrations and compile translations. It's a good idea to use this
-command each time you are pulling code from the project repository to avoid
-dependency-related or migration-related issues.
-
-Your Docker services should now be up and running! 🎉
-
-Note that if you need to run them afterward, you can use the eponym Make rule:
-
-```bash
-$ make run
-```
-
-or if you want to run them in development mode (with live reloading):
-
-```bash
-$ make run-dev
-```
-
-You can check all available Make rules using:
-
-```bash
-$ make help
-```
-
-### Django admin
-
-You can access the Django admin site at
-[http://localhost:8071/admin](http://localhost:8071/admin).
-
-You first need to create a superuser account:
-
-```bash
-$ make superuser
-```
-
-You can then login with sub `admin` and password `admin`.
-
-### Adding demo content
-
-You can create a basic demo site by running:
-
-```bash
-$ make demo
-```
-
-### Setting dimail database 
-
-To ease local development when working on interoperability between people and dimail, we embark dimail-api in a container running in "fake" mode. 
-
-To populate dimail local database with users/domains/permissions needed for basic development:
-- log in with "people" user
-- run `make dimail-setup-db`
-
-
-### Run frontend
-
-Run the front with:
-
-```bash
-$ make run-front-desk
-```
-
-Then access [http://localhost:3000](http://localhost:3000) with :
-user: people
-password: people
-
-## Contributing
-
-This project is intended to be community-driven, so please, do not hesitate to
-get in touch if you have any question related to our implementation or design
-decisions.
-
-## License
-
-This work is released under the MIT License (see [LICENSE](./LICENSE)).

SECURITY.md

@@ -1,23 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Security is very important to us.
-
-If you have any issue regarding security, please disclose the information responsibly submiting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at support-regie@numerique.gouv.fr
-
-We appreciate your effort to make People more secure.
-
-## Vulnerability disclosure policy
-
-Working with security issues in an open source project can be challenging, as we are required to disclose potential problems that could be exploited by attackers. With this in mind, our security fix policy is as follows:
-
-1. The Maintainers team will handle the fix as usual (Pull Request,
-release).
-2. In the release notes, we will include the identification numbers from the
-GitHub Advisory Database (GHSA) and, if applicable, the Common Vulnerabilities
-and Exposures (CVE) identifier for the vulnerability.
-3. Once this grace period has passed, we will publish the vulnerability.
-
-By adhering to this security policy, we aim to address security concerns
-effectively and responsibly in our open source software project.

UPGRADE.md

@@ -1,17 +0,0 @@
-# Upgrade
-
-All instructions to upgrade this project from one release to the next will be
-documented in this file. Upgrades must be run sequentially, meaning you should
-not skip minor/major releases while upgrading (fix releases can be skipped).
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-For most upgrades, you just need to run the django migrations with
-the following command inside your docker container:
-
-`python manage.py migrate`
-
-(Note : in your development environment, you can `make migrate`.)
-
-## [Unreleased]

bin/Tiltfile

@@ -1,103 +0,0 @@
-load('ext://uibutton', 'cmd_button', 'bool_input', 'location')
-load('ext://namespace', 'namespace_create', 'namespace_inject')
-namespace_create('desk')
-
-docker_build(
-    'localhost:5001/people-backend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    only=['./src/backend', './src/mail', './docker'],
-    target = 'backend-production',
-    live_update=[
-        sync('../src/backend', '/app'),
-        run(
-            'pip install -r /app/requirements.txt',
-            trigger=['./api/requirements.txt']
-        )
-    ]
-)
-
-docker_build(
-    'localhost:5001/people-frontend:latest',
-    context='..',
-    dockerfile='../Dockerfile',
-    build_args={'ENV': 'dev'},
-    only=['./src/frontend', './src/mail', './docker'],
-    target = 'frontend-builder-dev',
-    live_update=[
-        sync('../src/frontend', '/builder'),
-    ]
-)
-
-# helmfile in docker mount the current working directory and the helmfile.yaml
-# requires the keycloak config in another directory
-k8s_yaml(local('cd .. && helmfile -n desk -e ${DEV_ENV:-dev} template --file ./src/helm/helmfile.yaml'))
-
-migration = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py makemigrations
-'''
-cmd_button('Make migration',
-           argv=['sh', '-c', migration],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run makemigration',
-)
-
-pod_migrate = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py migrate --no-input
-'''
-cmd_button('Migrate db',
-           argv=['sh', '-c', pod_migrate],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Run database migration',
-)
-
-# Command to reset DB
-reset_db = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py flush --no-input
-kubectl -n desk exec "$POD_NAME" -- python manage.py createsuperuser --username admin@example.com --password admin
-'''
-cmd_button('Reset DB',
-           argv=['sh', '-c', reset_db],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Reset DB',
-)
-
-# Command to create demo data
-populate_people_with_demo_data = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py create_demo --force
-'''
-cmd_button('Populate with demo data',
-           argv=['sh', '-c', populate_people_with_demo_data],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Populate with demo data',
-)
-
-# Command to created domain/users/access from people to dimail
-populate_dimail_from_people = '''
-set -eu
-# get k8s pod name from tilt resource name
-POD_NAME="$(tilt get kubernetesdiscovery desk-backend -ojsonpath='{.status.pods[0].name}')"
-kubectl -n desk exec "$POD_NAME" -- python manage.py setup_dimail_db --populate-from-people
-'''
-cmd_button('Populate dimail from people',
-           argv=['sh', '-c', populate_dimail_from_people],
-           resource='desk-backend',
-           icon_name='developer_board',
-           text='Populate dimail from people',
-)

bin/_config.sh

@@ -1,110 +0,0 @@
-#!/usr/bin/env bash
-
-set -eo pipefail
-
-REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
-UNSET_USER=0
-
-COMPOSE_FILE="${REPO_DIR}/docker-compose.yml"
-COMPOSE_PROJECT="people"
-
-
-# _set_user: set (or unset) default user id used to run docker commands
-#
-# usage: _set_user
-#
-# You can override default user ID (the current host user ID), by defining the
-# USER_ID environment variable.
-#
-# To avoid running docker commands with a custom user, please set the
-# $UNSET_USER environment variable to 1.
-function _set_user() {
-
-    if [ $UNSET_USER -eq 1 ]; then
-        USER_ID=""
-        return
-    fi
-
-    # USER_ID = USER_ID or `id -u` if USER_ID is not set
-    USER_ID=${USER_ID:-$(id -u)}
-
-    echo "🙋(user) ID: ${USER_ID}"
-}
-
-# docker_compose: wrap docker compose command
-#
-# usage: docker_compose [options] [ARGS...]
-#
-# options: docker compose command options
-# ARGS   : docker compose command arguments
-function _docker_compose() {
-
-    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
-    docker compose \
-        -p "${COMPOSE_PROJECT}" \
-        -f "${COMPOSE_FILE}" \
-        --project-directory "${REPO_DIR}" \
-        "$@"
-}
-
-# _dc_run: wrap docker compose run command
-#
-# usage: _dc_run [options] [ARGS...]
-#
-# options: docker compose run command options
-# ARGS   : docker compose run command arguments
-function _dc_run() {
-    _set_user
-
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
-    fi
-
-    _docker_compose run --rm $user_args "$@"
-}
-
-# _dc_run_no_deps: wrap docker compose run command without dependencies
-#
-# usage: _dc_run_no_deps [options] [ARGS...]
-#
-# options: docker compose run command options
-# ARGS   : docker compose run command arguments
-function _dc_run_no_deps() {
-    _set_user
-
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
-    fi
-
-    _docker_compose run --no-deps --rm $user_args "$@"
-}
-
-# _dc_exec: wrap docker compose exec command
-#
-# usage: _dc_exec [options] [ARGS...]
-#
-# options: docker compose exec command options
-# ARGS   : docker compose exec command arguments
-function _dc_exec() {
-    _set_user
-
-    echo "🐳(compose) exec command: '\$@'"
-
-    user_args="--user=$USER_ID"
-    if [ -z $USER_ID ]; then
-        user_args=""
-    fi
-
-    _docker_compose exec $user_args "$@"
-}
-
-# _django_manage: wrap django's manage.py command with docker compose
-#
-# usage : _django_manage [ARGS...]
-#
-# ARGS : django's manage.py command arguments
-function _django_manage() {
-    _dc_run "app-dev" python manage.py "$@"
-}

bin/compose

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_docker_compose "$@"

bin/install-external-secrets.sh

@@ -1,90 +0,0 @@
-#!/usr/bin/env bash
-set -o errexit
-
-CURRENT_DIR=$(pwd)
-NAMESPACE=${1:-desk}
-SECRET_NAME=${2:-bitwarden-cli-desk}
-TEMP_SECRET_FILE=$(mktemp)
-
-
-cleanup() {
-    rm -f "${TEMP_SECRET_FILE}"
-}
-trap cleanup EXIT
-
-
-# Check if kubectl is available
-check_prerequisites() {
-    if ! command -v kubectl &> /dev/null; then
-        echo "Error: kubectl is not installed or not in PATH"
-        exit 1
-    fi
-}
-
-# Check if secret already exists
-check_secret_exists() {
-    kubectl -n "${NAMESPACE}" get secrets "${SECRET_NAME}" &> /dev/null
-}
-
-
-# Collect user input securely
-get_user_input() {
-    echo "Please provide the following information:"
-    read -p "Enter your Vaultwarden email login: " LOGIN
-    read -s -p "Enter your Vaultwarden password: " PASSWORD
-    echo
-    read -p "Enter your Vaultwarden server url: " URL
-}
-
-# Create and apply the secret
-create_secret() {
-    cat > "${TEMP_SECRET_FILE}" << EOF
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ${SECRET_NAME}
-  namespace: ${NAMESPACE}
-type: Opaque
-stringData:
-  BW_HOST: ${URL}
-  BW_PASSWORD: ${PASSWORD}
-  BW_USERNAME: ${LOGIN}
-EOF
-
-    kubectl -n "${NAMESPACE}" apply -f "${TEMP_SECRET_FILE}"
-}
-
-# Install external-secrets using Helm
-install_external_secrets() {
-    if ! kubectl get ns external-secrets &>/dev/null; then
-        echo "Installing external-secrets…"
-        helm repo add external-secrets https://charts.external-secrets.io
-        helm upgrade --install external-secrets \
-            external-secrets/external-secrets \
-            -n external-secrets \
-            --create-namespace \
-            --set installCRDs=true
-    else
-        echo "External secrets already deployed"
-    fi
-}
-
-main() {
-    check_prerequisites
-
-    if check_secret_exists; then
-        echo "Secret '${SECRET_NAME}' already present in namespace '${NAMESPACE}'"
-        exit 0
-    fi
-
-    echo -e ${TEMP_SECRET_FILE}
-
-    get_user_input
-    echo -e "\nCreating Vaultwarden secret…"
-    create_secret
-    install_external_secrets
-
-    echo "Secret installation completed successfully"
-}
-
-main "$@"

bin/manage

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_django_manage "$@"

bin/pylint

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-declare diff_from
-declare -a paths
-declare -a args
-
-# Parse options
-for arg in "$@"
-do
-    case $arg in
-        --diff-only=*)
-            diff_from="${arg#*=}"
-            shift
-            ;;
-        -*)
-            args+=("$arg")
-            shift
-            ;;
-        *)
-            paths+=("$arg")
-            shift
-            ;;
-    esac
-done
-
-if [[ -n "${diff_from}" ]]; then
-    # Run pylint only on modified files located in src/backend
-    # (excluding deleted files and migration files)
-    # shellcheck disable=SC2207
-    paths=($(git diff "${diff_from}" --name-only --diff-filter=d -- src/backend ':!**/migrations/*.py' | grep -E '^src/backend/.*\.py$'))
-fi
-
-# Fix docker vs local path when project sources are mounted as a volume
-read -ra paths <<< "$(echo "${paths[@]}" | sed "s|src/backend/||g")"
-_dc_run_no_deps app-dev pylint "${paths[@]}" "${args[@]}"

bin/pytest

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run \
-    -e DJANGO_CONFIGURATION=Test \
-    app-dev \
-    pytest "$@"

bin/start-kind.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-curl https://raw.githubusercontent.com/numerique-gouv/tools/refs/heads/main/kind/create_cluster.sh | bash -s -- desk

bin/update_openapi_schema

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run \
-    -e DJANGO_CONFIGURATION=Test \
-    app-dev \
-    python manage.py spectacular \
-    --api-version 'v1.0' \
-    --urlconf 'people.api_urls' \
-    --format openapi-json \
-    --file /app/core/tests/swagger/swagger.json

crowdin/config.yml

@@ -1,30 +0,0 @@
-#
-# Your crowdin's credentials
-#
-api_token_env: CROWDIN_API_TOKEN
-project_id_env: CROWDIN_PROJECT_ID
-base_path_env: CROWDIN_BASE_PATH
-
-#
-# Choose file structure in crowdin
-# e.g. true or false
-#
-preserve_hierarchy: true
-
-#
-# Files configuration
-#
-files:
-  [
-    {
-      source: "/backend/locale/django.pot",
-      dest: "/backend.pot",
-      translation: "/backend/locale/%locale_with_underscore%/LC_MESSAGES/django.po",
-    },
-    {
-      source: "/frontend/packages/i18n/locales/desk/translations-crowdin.json",
-      dest: "/desk.json",
-      translation: "/frontend/packages/i18n/locales/desk/%two_letters_code%/translations.json",
-      skip_untranslated_strings: true,
-    },
-  ]

docker-compose.yml

@@ -1,285 +0,0 @@
-services:
-  postgresql:
-    image: postgres:16
-    platform: linux/amd64
-    env_file:
-      - env.d/development/postgresql
-    ports:
-      - "15432:5432"
-    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
-
-  redis:
-    image: redis:5
-
-  maildev:
-    image: maildev/maildev:latest
-    ports:
-      - "1081:1080"
-
-  app-dev:
-    build:
-      context: .
-      target: backend-development
-      args:
-        DOCKER_USER: ${DOCKER_USER:-1000}
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    pull_policy: never
-    environment:
-      - PYLINTHOME=/app/.pylint.d
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/france
-      - env.d/development/postgresql
-    ports:
-      - "8071:8000"
-    volumes:
-      - ./src/backend:/app
-      - ./data/media:/data/media
-      - ./data/static:/data/static
-      - /app/.venv
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      maildev:
-        condition: service_started
-      redis:
-        condition: service_started
-
-  frontend-dev:
-    user: "${DOCKER_USER:-1000}"
-    build:
-      context: .
-      dockerfile: ./src/frontend/Dockerfile
-      target: frontend-dev
-    image: people:frontend-development
-    pull_policy: never
-    volumes:
-      - ./src/frontend:/home/frontend
-      - /home/frontend/node_modules
-      - /home/frontend/apps/desk/node_modules
-    ports:
-      - "3000:3000"
-
-  app:
-    build:
-      context: .
-      target: backend-production
-      args:
-        DOCKER_USER: ${DOCKER_USER:-1000}
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-production
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/france
-      - env.d/development/postgresql
-    ports:
-      - "8071:8000"
-    volumes:
-      - ./data/media:/data/media
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      redis:
-        condition: service_started
-
-  frontend:
-    user: "${DOCKER_USER:-1000}"
-    build:
-      context: .
-      dockerfile: ./src/frontend/Dockerfile
-      target: frontend-production
-      args:
-        API_ORIGIN: "http://localhost:8071"
-    image: people:frontend-production
-    pull_policy: build
-    ports:
-      - "3000:3000"
-
-  celery-dev:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    command: ["celery", "-A", "people.celery_app", "worker", "-l", "DEBUG"]
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    volumes:
-      - ./src/backend:/app
-      - ./data/media:/data/media
-      - ./data/static:/data/static
-      - /app/.venv
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      app-dev:
-        condition: service_started
-
-  celery-beat-dev:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    command: ["celery", "-A", "people.celery_app", "beat", "-l", "DEBUG"]
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    volumes:
-      - ./src/backend:/app
-      - ./data/media:/data/media
-      - ./data/static:/data/static
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-
-  celery:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-production
-    command: ["celery", "-A", "people.celery_app", "worker", "-l", "INFO"]
-    environment:
-      - DJANGO_CONFIGURATION=Demo
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-      app:
-        condition: service_started
-
-  celery-beat:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-production
-    command: ["celery", "-A", "people.celery_app", "beat", "-l", "INFO"]
-    environment:
-      - DJANGO_CONFIGURATION=Demo
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    volumes:
-      - ./src/backend:/app
-      - ./data/media:/data/media
-      - ./data/static:/data/static
-    depends_on:
-      postgresql:
-        condition: service_healthy
-        restart: true
-
-  nginx:
-    image: nginx:1.25
-    ports:
-      - "8083:8083"
-    volumes:
-      - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
-    depends_on:
-      keycloak:
-        condition: service_healthy
-        restart: true
-
-  crowdin:
-    image: crowdin/cli:4.6.1
-    volumes:
-      - ".:/app"
-    env_file:
-      - env.d/development/crowdin
-    user: "${DOCKER_USER:-1000}"
-    working_dir: /app
-
-  node:
-    image: node:22
-    user: "${DOCKER_USER:-1000}"
-    environment:
-      HOME: /tmp
-    volumes:
-      - ".:/app"
-
-  kc_postgresql:
-    image: postgres:14.3
-    ports:
-      - "5433:5432"
-    env_file:
-      - env.d/development/kc_postgresql
-    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
-
-  keycloak:
-    image: quay.io/keycloak/keycloak:20.0.1
-    volumes:
-      - ./docker/auth/realm.json:/opt/keycloak/data/import/realm.json
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    command:
-      - start-dev
-      - --features=preview
-      - --import-realm
-      - --proxy=edge
-      - --hostname-url=http://localhost:8083
-      - --hostname-admin-url=http://localhost:8083/
-      - --hostname-strict=false
-      - --hostname-strict-https=false
-      - --health-enabled=true
-      - --metrics-enabled=true
-    environment:
-      KEYCLOAK_ADMIN: admin
-      KEYCLOAK_ADMIN_PASSWORD: admin
-      KC_DB: postgres
-      KC_DB_URL_HOST: kc_postgresql
-      KC_DB_URL_DATABASE: keycloak
-      KC_DB_PASSWORD: pass
-      KC_DB_USERNAME: people
-      KC_DB_SCHEMA: public
-      PROXY_ADDRESS_FORWARDING: 'true'
-    healthcheck:
-      test: [ "CMD", "curl", "--head", "-fsS", "http://localhost:8080/health/ready" ]
-      interval: 1s
-      timeout: 2s
-      retries: 300
-    ports:
-      - "8080:8080"
-    depends_on:
-      kc_postgresql:
-        condition: service_healthy
-        restart: true
-
-  dimail: 
-    entrypoint: /opt/dimail-api/start-dev.sh
-    image: registry.mim-libre.fr/dimail/dimail-api:v0.5.2
-    pull_policy: always
-    environment:
-      DIMAIL_MODE: FAKE
-      DIMAIL_JWT_SECRET: fake_jwt_secret
-    ports:
-      - "8001:8000"
-
-  flower-dev:
-    user: ${DOCKER_USER:-1000}
-    image: people:backend-development
-    command: ["celery", "-A", "people.celery_app", "flower", "--port=5555"]
-    environment:
-      - DJANGO_CONFIGURATION=Development
-    env_file:
-      - env.d/development/common
-      - env.d/development/postgresql
-    ports:
-      - "5555:5555"
-    volumes:
-      - ./src/backend:/app
-    depends_on:
-      - celery-dev
-      - redis

docker/files/etc/nginx/conf.d/default.conf

@@ -1,13 +0,0 @@
-
-server {
-    listen 8083;
-    server_name localhost;
-    charset utf-8;
-
-    location / {
-        proxy_pass http://keycloak:8080;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}

docker/files/usr/local/bin/entrypoint

@@ -1,35 +0,0 @@
-#!/bin/sh
-#
-# The container user (see USER in the Dockerfile) is an un-privileged user that
-# does not exists and is not created during the build phase (see Dockerfile).
-# Hence, we use this entrypoint to wrap commands that will be run in the
-# container to create an entry for this user in the /etc/passwd file.
-#
-# The following environment variables may be passed to the container to
-# customize running user account:
-#
-#   * USER_NAME: container user name (default: default)
-#   * HOME     : container user home directory (default: none)
-#
-# To pass environment variables, you can either use the -e option of the docker run command:
-#
-#     docker run --rm -e USER_NAME=foo -e HOME='/home/foo' people:latest python manage.py migrate
-#
-# or define new variables in an environment file to use with docker or docker compose:
-#
-#     # env.d/production
-#     USER_NAME=foo
-#     HOME=/home/foo
-#
-#     docker run --rm --env-file env.d/production people:latest python manage.py migrate
-#
-
-echo "🐳(entrypoint) creating user running in the container..."
-if ! whoami > /dev/null 2>&1; then
-  if [ -w /etc/passwd ]; then
-    echo "${USER_NAME:-default}:x:$(id -u):$(id -g):${USER_NAME:-default} user:${HOME}:/sbin/nologin" >> /etc/passwd
-  fi
-fi
-
-echo "🐳(entrypoint) running your command: ${*}"
-exec "$@"

docker/files/usr/local/etc/gunicorn/people.py

@@ -1,16 +0,0 @@
-# Gunicorn-django settings
-bind = ["0.0.0.0:8000"]
-name = "people"
-python_path = "/app"
-
-# Run
-graceful_timeout = 90
-timeout = 90
-workers = 3
-
-# Logging
-# Using '-' for the access log file makes gunicorn log accesses to stdout
-accesslog = "-"
-# Using '-' for the error log file makes gunicorn log errors to stderr
-errorlog = "-"
-loglevel = "info"

docs/i18n.md

@@ -1,63 +0,0 @@
-# Internationalization (i18n)
-
-The backend and the frontend of the application are internationalized.
-This means that the application can be translated into different languages. 
-The application is currently available in English and French.
-
-## Local setup
-
-To be able to upload/retrieve translation files to/from Crowdin you need to
-setup your local environment with the following environment variables:
-
-```bash
-cp ./env.d/development/crowdin.dist ./env.d/development/crowdin
-```
-
-Then fill "CROWDIN_API_TOKEN" with your token and "CROWDIN_PROJECT_ID" with the project id
-in the `./env.d/development/crowdin` file.
-
-NB: If you don't have a personal Crowdin API token, go to Crowdin interface to generate it: 
-Settings -> API -> Personal Access Tokens -> New token
-
-This configuration file will be loaded by the crowdin docker instance.
-
-
-## How to update the translations
-
-### First way (safe way)
-
-1/ Generate the translation files for both frontend and backend
-  ```bash
-  make i18n-generate
-  ```
-  Check locally everything is ok before uploading the files to the translation platform.
-
-2/ Upload the files to the translation platform (crowdin):
-  ```bash
-  make crowdin-upload
-  ```
-
-3/ Fill the missing translations on the translation platform:
-
-  => [https://crowdin.com/project/lasuite-people](https://crowdin.com/project/lasuite-people)  
-
-4/ Download the translated files from the translation platform and compile them:
-  ```bash
-  make i18n-download-and-compile
-  ```
-
-### Second way (faster way)
-
-1/ Generate the translation files for both frontend and backend and upload them to the translation platform (crowdin):
-  ```bash
-  make i18n-generate-and-upload
-  ```
-
-2/ Fill the missing translations on the translation platform:
-  
-  => [https://crowdin.com/project/lasuite-people](https://crowdin.com/project/lasuite-people)  
-
-3/ Download the translated files from the translation platform and compile them:
-  ```bash
-  make i18n-download-and-compile
-  ```

docs/identityProvider.md

@@ -1,100 +0,0 @@
-# People as an Identity Provider
-
-The people project can be configured to act as an Identity Provider for an OIDC federation.
-
-The model containing the "identity" in `people` is the `Mailbox` model.
-
-The connection workflow looks like:
-
- - The user tries to reach a service provider.
- - The service provider redirects the user to OIDC federation (in dev we use Keycloak).
- - The user asks (or is redirected) to the Identity Provider (people).
- - The user enter their email and password.
- - If successful, the user is redirected to the OIDC federation with a token.
- - The federation make the same Authorization Flow as usual to authenticate on the Service Provider.
-
-
-## Technical aspects
-
-### The `Mailbox` model
-
-The `Mailbox` model can behave like a usual Django user:
-
- - It has a `password` field (and `last_login`)
- - It is considered as `authenticated`.
- - To be `active` it must have an `enabled` status.
- - To be able to log in, it must also have a `MailboxDomain` with an `enabled` status and an associated `Organization`.
-
-### The `MailboxModelBackend` authentication backend
-
-This authentication backend only allow authentication with `email` and `password` with a `Mailbox` user.
-This backend is combined with the `one_time_email_authenticated_session` middleware to restrict
-the session to the OIDC login process.
-A user connecting with this backend will only be able to access the `/o/authorize/` URL.
-
-### The OIDC validators
-
-There are two validators available:
-
- - `BaseValidator`: This validator retrieves simple claims
- - `ProConnectValidator`: This validator is a custom validator to allow ProConnect specific requirements.
-
-
-## Configuration
-
-The keycloak configuration is not described here, but you may find information in the code base.
-
-### Django settings
-
-The following settings are required to enable the OIDC Identity Provider feature:
-
- - OAUTH2_PROVIDER_OIDC_ENABLED: True
- - OAUTH2_PROVIDER_OIDC_RSA_PRIVATE_KEY: ...
-
-Optional:
-
- - OAUTH2_PROVIDER_VALIDATOR_CLASS: "mailbox_oauth2.validators.ProConnectValidator"
-
-If the `OAUTH2_PROVIDER_VALIDATOR_CLASS` is set to the `ProConnectValidator`, the claims will be
-automatically defined to match the ProConnect requirements.
-
-### Django OIDC application
-
-To enable an OIDC client to use people, you must declare it.
-
-```python
-from oauth2_provider.models import Application
-
-application = Application(
-    client_id="people-idp",
-    client_secret="local-tests-only",
-    client_type=Application.CLIENT_CONFIDENTIAL,
-    authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
-    name="People Identity Provider",
-    algorithm=Application.RS256_ALGORITHM,
-    redirect_uris="http://localhost:8083/realms/people/broker/oidc-people-local/endpoint",
-    skip_authorization=True,
-)
-application.clean()
-application.save()
-```
-
-## Security concerns
-
-### Failed login cooldown
-
-To prevent brute force attacks, 5 failed login will trigger a cooldown of 5 minutes before being able to log in again.
-
-### Password strength
-
-There is currently no constraint on the password strength as it can only be defined by Django administrators,
-and later we will generate it.
-If at some point the user is allowed to set their password, we will need to enforce a password strength policy.
-
-
-## What is missing (next steps)
-
-- `Mailbox` password can only be set through Django Admin panel (or shell), the next step will be to generate 
-  a secure password and send it or display it to the end user.
-- `MailboxDomain` organization can only be set through Django Admin panel (or shell), we need to provide a
-  way to auto-select it or allow an administrator to do so.

docs/interoperability/dimail.md

@@ -1,50 +0,0 @@
-# dimail 
-
-## What is dimail ? 
-
-The mailing solution provided in La Suite is [La Messagerie](https://webmail.numerique.gouv.fr/), using [Open-XChange](https://www.open-xchange.com/) (OX). OX not having a provisioning API, 'dimail-api' or 'dimail' was created to allow mail-provisioning through People.
-
-API and its documentation can be found [here](https://api.dev.ox.numerique.gouv.fr/docs#/).
-
-## Use of dimail container
-
-To ease local development, dimail provides a container that we embark in our docker-compose. In "FAKE" mode, it simulates all responses from Open Exchange.
-
-Bootstraping with command `make bootstrap` creates a container and initializes its database.
-
-Additional commands : 
-- Reset and populate the database with all the content of your People database with `dimail-setup-db`
-
-## Architecture
-
-### Domains
-
-Upon creating a domain on People, the same domain is created on dimail and will undergo a series of checks. When all checks have passed, the domain is considered enabled. 
-
-Domains in OX have a field called "context". "Contexts" are shared spaces between domains, allowing users to discover users not only on their domain but on their entire context.
-> [!NOTE]   
-> Contexts are only implemented in La Messagerie and are not currently in use in People. Domains created via People are in their own context.
-
-People users can have 3 levels of permissions on a domain:
-- Viewers can
-    - see the domain's information
-    - list its mailboxes and managers
-- Administrators can
-    - create mailboxes
-    - invite collaborators to manage domain
-    - change role of a viewer to administrators
-    - all of viewers permissions
-- Owners can
-    - promote administrators owners and demote owners
-    - all of viewers and administrators' permissions
-> [!NOTE]   
-> Contexts are only implemented in La Messagerie and are not currently in use in People. Domains created via People are in their own context.
-
-
-### Mailboxes 
-
-Mailboxes can be created by a domain owners or administrators in People's domain tab.
-
-On enabled domains, mailboxes are created at the same time on dimail (and a confirmation email is sent to the secondary email).
-On pending/failed domains, mailboxes are only created locally with "pending" status and are sent to dimail upon domain's (re)activation.
-On disabled domains, mailboxes creation is not allowed.

docs/local_development_kube.md

@@ -1,75 +0,0 @@
-# Local development with Kubernetes
-
-We use tilt to provide a local development environment for Kubernetes. 
-Tilt is a tool that helps you develop applications for Kubernetes. 
-It watches your files for changes, rebuilds your containers, and restarts your pods. 
-It's like having a conversation with your cluster.
-
-This is particularly useful when working on integrations or to test your helm charts.
-Otherwise, you can use your good old docker configuration as described in README.md. 
-
-## Prerequisites
-
-This guide assumes you have the following tools installed:
-
-- [Docker](https://docs.docker.com/get-docker/)
-- [Kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
-- [Kind](https://kind.sigs.k8s.io/docs/user/quick-start/)
-  * [mkcert](https://github.com/FiloSottile/mkcert)
-- [ctlptl](https://github.com/tilt-dev/ctlptl)
-- [Tilt](https://docs.tilt.dev/install.html)
-  * [helm](https://helm.sh/docs/intro/install/)
-  * [helmfile](https://github.com/helmfile/helmfile)
-  * [secrets](https://github.com/jkroepke/helm-secrets/wiki/Installation)
-
-[Install_prereq script](https://github.com/numerique-gouv/dk8s/blob/main/scripts/install-prereq.sh) (not tested).
-
-### Helmfile in Docker
-
-```bash
-#!/bin/sh
-
-docker run --rm --net=host \
-   -v "${HOME}/.kube:/root/.kube" \
-   -v "${HOME}/.config/helm:/root/.config/helm" \
-   -v "${HOME}/.minikube:/${HOME}/.minikube" \
-   -v "${PWD}:/wd" \
-   -e KUBECONFIG=/root/.kube/config \
-   --workdir /wd ghcr.io/helmfile/helmfile:v0.150.0 helmfile "$@"
-```
-
-## Create the kubernetes cluster
-
-Run the following command to create a kubernetes cluster using kind:
-
-```bash
-make start-kind
-
-# import your secrets from credentials manager
-# ! don't forget "https" before your url
-make install-external-secrets
-```
-
-That's it! You should now have a local development environment for Kubernetes.
-
-## Start the application
-
-```bash
-# You can either start :
-# ProConnect stack (but secrets must be set on your local cluster)
-make tilt-up
-
-# or standalone environment with keycloak
-make start-tilt-keycloak
-```
-
-Access your application at https://desk.127.0.0.1.nip.io 
-
-## Management
-
-To manage the cluster, you can use k9s.
-
-## Next steps
-
-- Add dimail to the local development environment
-- Add a reset demo `cmd_button` to Tilt

docs/models.md

@@ -1,265 +0,0 @@
-# What is People?
-
-Space Odyssey is a dynamic organization. They use the People application to enhance teamwork and
-streamline communication among  their co-workers. Let's explore how this application helps them
-interact efficiently.
-
-Let's see how we could interact with Django's shell to recreate David's environment in the app.
-
-## Profile contact
-
-The system identifies Dave through the `sub` associated with his OIDC session.
-The OIDC should also provide his email address.
-
-Note: as some Identity Providers do not provide a constant `sub`, the system should be able to
-fallback to the email address to find it the user is already in the database.
-
-When Dave logs in for the first time, the system checks if he is already in the database. If not
-a new user is created for him.
-
-Users needs to be linked to an Organization (see [organizations.md](./organizations.md)).
-
-```python
-space_odyssey, _created = Organization.objects.get_or_create(...)
-
-david_user = User.objects.create(
-    organization=space_odyssey,
-    language="en-us",
-    timezone="America/Los_Angeles",
-    name="David Bowman",
-    sub="1234567890",
-    email="david.bowman@spaceodyssey.com",
-)
-```
-
-The system then creates a profile contact for Dave, based on the information provided by the OIDC:
-
-```python
-david_profile_contact = Contact.objects.create(
-    owner=david_user,
-    user=david_user,  # this means it's the user's profile contact
-    full_name="David Bowman",
-    data={
-        "emails": [
-            {"type": "Work", "value": "david.bowman@spaceodyssey.com"},
-        ],
-    },
-)
-```
-
-**Future feature:**
-Dave will be prompted to confirm the details of the base contact stored in the database
-and fill the details for a better profile.
-
-His profile contact will be updated with the new information.
-
-```python
-Contact.objects.filter(user=david_user, owner=david_user).update(
-    short_name="Dave",
-    data={
-        "emails": [
-            {"type": "Work", "value": "david.bowman@spaceodyssey.com"},
-        ],
-        "phones": [
-            {"type": "Work", "value": "(123) 456-7890"},
-        ],
-        "addresses": [
-            {
-                "type": "Work",
-                "street": "123 Main St",
-                "city": "Cityville",
-                "state": "CA",
-                "zip": "12345",
-                "country": "USA",
-            }
-        ],
-        "links": [
-            {"type": "Website", "value": "http://www.spaceodyssey.com"},
-            {"type": "Twitter", "value": "https://www.twitter.com/dbowman"},
-        ],
-        "organizations": [
-            {
-                "name": "Space Odyssey Corporation",
-                "department": "IT",
-                "jobTitle": "AI Engineer",
-            },
-        ],
-    }
-)
-```
-
-David's profile contact is available to all users of his company/organization.
-
-
-## Contact override
-
-During a Space conference he attended, Dave met Dr Ryan Stone, a medical engineer who gave him
-her personal email address (because she will quit the company she works for). Ryan is already 
-present in the system.
-
-Dave can add it to his private version of the contact:
-
-```python
-ryan_user = User.objects.create(
-    organization=space_odyssey,
-    language="en-us",
-    timezone="America/Los_Angeles",
-    name="Ryan Stone",
-    sub="0987654321",
-    email="ryan.stone@spaceodyssey.com",
-)
-
-ryan_profile_contact = Contact.objects.create(
-    user=ryan_user,
-    owner=ryan_user,
-    full_name="Ryan Stone",
-    short_name="Dr Ryan",
-    data={
-        "emails": [
-            {"type": "Work", "value": "ryan.stone@hubblestation.com"},
-        ],
-    },
-)
-
-david_ryan_contact = Contact.objects.create(
-    override=ryan_profile_contact,
-    owner=david_user,
-    full_name="Ryan Stone",
-    short_name="Dr Ryan",
-    data={
-        "emails": [
-            {"type": "Home", "value": "ryan@stone.com"},
-        ],
-    },
-)
-```
-
-## Personal contacts
-
-Dave met a lot of people during the last Opensource Experience event. He can add them to his personal contacts:
-
-```python
-julie_personal_contact = Contact.objects.create(
-    owner=david_user,
-    full_name="Julie Powell",
-    short_name="Julie",
-    data={
-        "emails": [
-            {"type": "Work", "value": "julie.powell@example.com"},
-        ],
-        "phones": [
-            {"type": "Work", "value": "(123) 456-7890"},
-        ],
-    },
-)
-```
-
-These contacts are only available to Dave.
-
-
-## Contacts from shared directories
-
-This is a future feature that will allow Dave to access contacts from shared directories.
-Shared directories will provide contacts for all users from several organizations.
-
-
-## Team Collaboration
-
-Dave wants to form a team with Ryan and other colleagues to work together better on using the organization's digital tools for their projects.
-
-Dave would like to create a team with Ryan and some other colleagues, to enhance collaboration
-throughout their projects:
-
-```python
-projectx = Team.objects.create(name="Project X")
-```
-
-A team can for example be used to create an email alias or to define role based access rights
-(RBAC) in a specific application or all applications of the organization's digital Suite.
-
-Having created he team, Dave is automatically assigned the "owner" role. He invites Ryan,
-granting an "administrator" role to her so she can invite her own colleagues. Both of them can
-then proceed to invite other colleagues as simple members. If Ryan wants, she can upgrade a
-colleague to "administrator" but only David can upgrade someone to the "owner" status:
-
-```python
-TeamAccess.objects.create(user=david_user, team=projectx, role="owner")
-TeamAccess.objects.create(user=ryan_user, team=projectx, role="administrator")
-TeamAccess.objects.create(user=julie_user, team=projectx, role="member")
-```
-
-| Role                              | Member | Administrator | Owner |
-|-----------------------------------|--------|---------------|-------|
-| Can view team                     | ✔      | ✔             | ✔     |
-| Can set roles except for owners   |        | ✔             | ✔     |
-| Can set roles for owners          |        |               | ✔     |
-| Can delete team                   |        |               | ✔     |
-
-Importantly, the system ensures that there is always at least one owner left to maintain control
-of the team.
-
-# Models overview
-
-The following graph represents the application's models and their relationships:
-
-```mermaid
-erDiagram
-  %% Models
-
-  Contact {
-    UUID id PK
-    Contact base
-    User owner
-    string full_name
-    string short_name
-    json data
-    DateTime created_at
-    DateTime updated_at
-  }
-
-  User {
-    UUID id PK
-    Contact profile_contact
-    string language
-    string timezone
-    boolean is_device
-    boolean is_staff
-    boolean is_active
-    DateTime created_at
-    DateTime updated_at
-  }
-
-  Identity {
-    UUID id PK
-    User user
-    string sub
-    Email email
-    boolean is_main
-    DateTime created_at
-    DateTime updated_at
-  }
-
-  Team {
-    UUID id PK
-    string name
-    DateTime created_at
-    DateTime updated_at
-  }
-
-  TeamAccess {
-    UUID id PK
-    Team team
-    User user
-    string role
-    DateTime created_at
-    DateTime updated_at
-  }
-
-  %% Relations
-  User ||--o{ Contact : "owns"
-  Contact ||--o{ User : "profile for"
-  User ||--o{ TeamAccess : ""
-  Team ||--o{ TeamAccess : ""
-  Identity ||--o{ User : "connects"
-  Contact }o--|| Contact : "overrides"
-```

docs/organizations.md

@@ -1,41 +0,0 @@
-# Organization model
-
-## Purpose
-
-The initial `Organization` model allows to regroup `User` and `Team` under a same object.
-
-While the purpose was purely technical in the first place, few features emerged afterward.
-
-
-## Link with the `User` model
-
-Each user must have a "default" organization. 
-
-When a user logs in:
-
-- The backend tries to get an existing organization from a "registration ID" or from the user's mail domain
-- If the organization does not exist, it is created using the "registration ID" and fallbacks on the user's mail domain
-- The user organization is set to this organization.
-
-**Note:** While deploying the new code, we allow the already existing user to not have one.
-
-
-## Link with the `Team` model
-
-Each team must have an organization. This organization is not defined by the user, but automatically set
-using the user's organization.
-
-The team's organization does not restrict the users who can be added to the team.
-
-There is currently no feature relying on the team organization.
-
-**Note:** While deploying the new code, we allow the teams to not have one.
-
-
-## Organization-related features
-
-### Organization UI
-
-A new interface can be created to allow users to see all members of an organization. 
-This could be used along with the contacts.
-

docs/release.md

@@ -1,68 +0,0 @@
-# Releasing a new version
-
-Whenever we are cooking a new release (e.g. `4.18.1`) we should follow a standard procedure described below:
-
-1.  Checkout and pull changes from the `main` branch to ensure you have the latest updates.
-
-    ```bash
-    git checkout main
-    git pull
-    ```
-
-2.  The next steps are automated in the `scripts/release.py`, you can run it using:
-
-    ```bash
-    make release
-    ```
-
-    This script will ask you for the version you want to release and the kind of release (patch, minor, major). It will then:
-
-    - Create a new branch named: `release/4.18.1`.
-
-    - Bump the release number for backend and frontend project.
-
-    - Update the project's `Changelog` following the [keepachangelog](https://keepachangelog.com/en/0.3.0/) recommendations
-
-    - Commit your changes with the following format: 🔖 release emoji, type of release (patch/minor/patch) and release version:
-    
-        ```text
-        🔖(minor) release version 4.18.1
-        ```
-
-    - Triggers Crowdin translation action and open related PR
-
-    - Open release PR. Wait for an approval from your peers and merge it.
-
-    > [!NOTE]  
-    > It also open the PR for pre-prod deployment, see following section.
-
-3.  Following release script instructions, 
-
-    - merge translation and release pulls requests
-
-    - tag and push your commit:
-
-    ```bash
-    git tag v4.18.1 && git push origin tag v4.18.1
-    ```
-
-    This triggers the CI building new Docker images. You can ensure images were successfully built on Docker Hub [here for back-end](https://hub.docker.com/r/lasuite/people-backend/tags) and [here for front-end](https://hub.docker.com/r/lasuite/people-frontend/tags).
-
-
-# Deploying 
-
-## Staging
-
-The `staging` platform is deployed automatically with every update of the `main` branch.
-
-## Pre-prod and production
-
-If you used the release script and had permission to push on [lasuite-deploiement](https://github.com/numerique-gouv/lasuite-deploiement), a deployment branch has been created. You can skip step 1.
-
-Otherwise, for manual preprod and for production deployments :
-1. Bump tag version for both front-end and back-end images in the `.gotmpl` file located in `manifests/<your-product>/env.d/<your-environment>/`, 
-2. Add optional new secrets and variables, if applicable
-3. Create a pull request
-4. Submit to approval and merge PR
-
-The release is now done! 🎉

docs/resourceServer.md

@@ -1,164 +0,0 @@
-## Resource Server
-
-For detailed information, please refer to the [OAuth 2.0 Resource Server documentation](https://www.oauth.com/oauth2-servers/the-resource-server/) and review the relevant commits that implement the resource server backend.
-
----
-#### Overview
-
-A resource server is a crucial component in an OAuth 2.0 ecosystem. It is responsible for accepting access tokens issued by the authorization server (in this case, Agent Connect), introspecting and validating those tokens, and then returning the requested protected resources to the client.
-
-By implementing a resource server, we can securely share data between different services within La Suite. This ensures that only clients with the appropriate scopes and permissions can access specific resources, thereby enhancing security and maintaining proper access control across services.
-
----
-#### Disclaimer
-
-- Currently compatible only with Agent Connect.
-- The development setup requires simplification, with dependencies on Agent Connect ideally mocked.
-- Terminology aligns with the specification: what is referred to as a "resource server" is known as a "data provider" in Agent Connect.
-- This documentation is WIP.
-
----
-## Running Locally
-
-#### Prerequisites
-
-- **Agent Connect Stack**: Ensure the local Agent Connect stack is running. A solid understanding of its configuration and operation is recommended (advanced level).
-- **People Stack**: Make sure the People stack is up and running.
-- **Ngrok**: Install and set up Ngrok for secure tunneling.
-
-
----
-
-### Update People's configurations
-
-#### Environment variables
-
-
-Agent Connect includes two pre-configured mocked data providers in its default stack (`bdd-fca-low`).
-
-Use the client ID and client secret from one of these data providers. **Note:** Make sure to retrieve the decrypted secret, as it is stored encrypted in the database. You can find these values in the `dp.js` fixture file, where they are exposed in a comment.
-
-Configure your environment with the following values from Agent Connect:
-
-```
-OIDC_RS_CLIENT_ID=<your-client-id-from-ac>
-OIDC_RS_CLIENT_SECRET=<your-decrypted-client-secret-from-ac>
-
-# In development, the resource server use insecure settings
-OIDC_VERIFY_SSL=False
-
-# Update the endpoints as follows
-OIDC_OP_JWKS_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/jwks
-OIDC_OP_INTROSPECTION_ENDPOINT=https://core-fca-low.docker.dev-franceconnect.fr/api/v2/checktoken
-OIDC_OP_URL=https://core-fca-low.docker.dev-franceconnect.fr/api/v2
-```
-
-#### Docker Network Configuration
-
-To enable communication between the Docker networks for People and Agent Connect, update your docker-compose configuration. This setup is required because the Authorization Server and Resource Server will exchange requests over a back-channel, necessitating their accessibility to each other.
-
-1. **Create a Network**: Define a new network to bridge the two Docker networks.
-
-    ```yaml
-    networks:
-      authorization_server:
-        external: true
-        driver: bridge
-        name: "${DESK_NETWORK:-fc_public}"
-    ```
-
-2. **Update Network for `app-dev`**: Ensure your `app-dev` service is connected to both the default network and the new `authorization_server` network.
-
-    ```yaml
-    app-dev:
-      ...
-      networks:
-        - default
-        - authorization_server
-    ```
-
-
-#### Ngrok
-
-To expose your local resource server through an HTTP tunnel, use Ngrok. This is necessary because, in the Agent Connect development stack, the resource server needs to be accessible to a user agent via a publicly accessible URL.
-
-```
-$ ngrok http 8071
-```
-
----
-
-
-### Update AgentConnect's configurations
-
-Modify the AgentConnect configuration to include the local resource server settings.
-
-**Update `fsa1-low` Environment File**:
-
-Add your Ngrok URL and configure the `DATA_APIS` list with the appropriate values.
-
- ```env
- App_DATA_APIS=[{"name":"Data Provider 1","url":"https://your-ngrok-url/api/v1.0/any-path","secret":"***"}, ...]
- ```
-
-**Update Fixture in `dp.js`**:
-
-Adjust the configuration for the data provider to match your local setup. Ensure that the `client_id`, `client_secret`, and other parameters are correctly set and aligned with your environment. This can be configured through environment variables.
-
- ```javascript
- const dps = [
-   // Data Provider Configuration
-   {
-     uid: "6f21b751-ed06-48b6-a59c-36e1300a368a",
-     title: "Mock Data Provider - 1",
-     active: true,
-     slug: "DESK",
-     client_id: "***",
-     client_secret: "***",
-       // client_secret decrypted : ****
-     jwks_uri: "https://your-ngrok-url/api/v1.0/jwks", // Update this line
-     checktoken_signed_response_alg: "ES256",
-     checktoken_encrypted_response_alg: "RSA-OAEP",
-     checktoken_encrypted_response_enc: "A256GCM",
-   },
- ];
- ```
-
-**Note**: Ensure that the `jwks_uri` and other cryptographic parameters (e.g., `checktoken_signed_response_alg`, `checktoken_encrypted_response_alg`, and `checktoken_encrypted_response_enc`) match your actual setup and are configured via environment variables where necessary.
-
----
-
-### Usage
-
-This section is a work in progress. Please note the following important points:
-
-#### User `sub` Matching
-
-Ensure that the `sub` (subject) field for users in AgentConnect matches the corresponding value in the People database. To synchronize this, you can run `make demo`, then edit the user's `sub` field to match the value returned by AgentConnect. For this, you'll need to update the editable field in Django Admin, specifically in `admin.py`. Adjust the `get_readonly_fields` method as follows:
-
-```python
-def get_readonly_fields(self, request, obj=None):
-    """The 'sub' field should only be editable during creation, not for updates."""
-    if obj:
-        return self.readonly_fields
-    return self.readonly_fields + ["sub"]  # update this line adding 'sub'
-```
-
-#### Scope for `groups`
-Ensure that the `groups` scope is requested from the service provider during authentication with AgentConnect.
-
-#### Resource Server Requests
-By default, the `fsa1-low` environment calls the resource server using a POST request.
-
-#### Testing
-
-Most of the testing has been done using the `/users/me` endpoint. Update the `api/viewset.py` configuration to allow both GET and POST methods for this endpoint:
-
-```python
-@decorators.action(
-    detail=False,
-    methods=["get", "post"], # update this line adding 'post'
-    url_name="me",
-    url_path="me",
-)
-```

docs/serviceProviders.md

@@ -1,28 +0,0 @@
-# ServiceProvider model
-
-## Purpose
-
-The `ServiceProvider` model represents a ... service provider, also known as "tools using some data from this project".
-
-
-## Link with the `Organization` model
-
-An organization can be linked to several service providers. 
-The goal here, is to allow users of an organization to have access, to a service provider or not.
-The first implementation does not have any feature related, but the first feature will probably be
-to list applications visible in the "all application menu" (aka "la gaufre").
-
-
-## Link with the `Team` model
-
-A team can be linked to several service providers.
-This is used as a filter when a service provider calls the resource server, only the teams linked to
-this service provider are returned. This is mandatory for data segregation: we don't want all service
-providers to be able to list all data regarding other service providers.
-
-
-## Limitations
-
-There is currently no way to provision all the service providers automatically. So when a service provider
-creates a team via the resource server, we create the `ServiceProvider` on the fly, without any understandable name.
-This will need to be improved later.

docs/testsE2E.md

@@ -1,51 +0,0 @@
-# E2E tests
-
-## Run E2E tests
-
-``` bash
-# you need the dockers to be up and running
-make bootstrap
-
-# you will need to have few accounts in the database
-make demo FLUSH_ARGS='--no-input'
-
-# run the tests
-cd src/frontend/apps/e2e
-yarn test:ui --workers=1
-```
-
-A new browser window will open and you will be able to run the tests.
-
-## Available accounts
-
-The `make demo` command creates the following accounts:
- - `e2e.team-<role>@example.com` where `<role>` is one of `administrator`, `member`, `owner`:
-    this account only belong to a team with the specified role.
- - `e2e.mail-<role>@example.com` where `<role>` is one of `administrator`, `member`, `owner`:
-    this account only have a mailbox with the specified role access.
- - `e2e.team-<team_role>-mail-<domain_role>@example.com` with a combination of roles as for the
-    previous accounts.
-
-For each account, the password is `password-e2e.<role>`, for instance `password-e2e.team-member`.
-
-In the E2E tests you can use these accounts to benefit from there accesses, 
-using the `keyCloakSignIn(page, browserName, <account_name>)`. The account name is the 
-username without the prefix `e2e.`.
-
-``` typescript jsx
-await keyCloakSignIn(page, browserName, 'mail-owner');
-```
-
-The `keyCloakSignIn` function will sign in the user on Keycloak using the proper username and password.
-
-.. note::
-    This only works because the OIDC setting is set to fallback on user email.
-
-## Add a new account
-
-In case you need to add a new account for specific tests you need:
-- to create a new user with the same format in the backend database: 
-  update `[create_demo.py](../src/backend/demo/management/commands/create_demo.py)`
-- to create a new account in Keycloak: update [realm.json](../docker/auth/realm.json)
-- if the keycloak was running locally, you need to destroy its database and 
-  restart the database and the keycloak containers.

docs/tsclient.md

@@ -1,25 +0,0 @@
-# Api client TypeScript
-
-The backend application can automatically create a TypeScript client to be used in frontend
-applications. It is used in the People front application itself.
-
-This client is made with [openapi-typescript-codegen](https://github.com/ferdikoomen/openapi-typescript-codegen)
-and People's backend OpenAPI schema (available [here](http://localhost:8071/v1.0/swagger/) if you have the backend running).
-
-## Requirements
-
-We'll need the online OpenAPI schema generated by swagger. Therefore you will first need to
-install the backend application.
-
-## Install openApiClientJs
-
-```sh
-$ cd src/tsclient
-$ yarn install
-```
-
-## Generate the client
-
-```sh
-yarn generate:api:client:local <output_path_for_generated_client>
-```

env.d/development/common.dist

@@ -1,71 +0,0 @@
-# Django
-DJANGO_ALLOWED_HOSTS=*
-DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
-DJANGO_SETTINGS_MODULE=people.settings
-DJANGO_SUPERUSER_PASSWORD=admin
-DJANGO_CORS_ALLOWED_ORIGINS=http://localhost:3000
-
-# Python
-PYTHONPATH=/app
-
-# People settings
-
-# Mail
-DJANGO_EMAIL_HOST="maildev"
-DJANGO_EMAIL_PORT=1025
-
-# Backend url
-PEOPLE_BASE_URL="http://localhost:8072"
-
-# OIDC
-OIDC_OP_JWKS_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/certs
-OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8083/realms/people/protocol/openid-connect/auth
-OIDC_OP_TOKEN_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/token
-OIDC_OP_USER_ENDPOINT=http://nginx:8083/realms/people/protocol/openid-connect/userinfo
-
-OIDC_RP_CLIENT_ID=people
-OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
-OIDC_RP_SIGN_ALGO=RS256
-OIDC_RP_SCOPES="openid email"
-
-LOGIN_REDIRECT_URL=http://localhost:3000
-LOGIN_REDIRECT_URL_FAILURE=http://localhost:3000
-LOGOUT_REDIRECT_URL=http://localhost:3000
-
-OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8083", "http://localhost:3000"]
-OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
-
-OIDC_RS_CLIENT_ID=people
-OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
-OIDC_RS_PRIVATE_KEY_STR="-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC3boG1kwEGUYL+
-U58RPrVToIsF9jHB64S6WJIIInPmAclBciXFb6BWG11mbRIgo8ha3WVnC/tGHbXb
-ndiKdrH2vKHOsDhV9AmgHgNgWaUK9L0uuKEb/xMLePYWsYlgzcQJx8RZY7RQyWqE
-20WfzFxeuCE7QMb6VXSOgwQMnJsKocguIh3VCI9RIBq3B1kdgW35AD63YKOygmGx
-qjcWwbjhKLvkF7LpBdlyAEzOKqg4T5uCcHMfksMW2+foTJx70RrZM/KHU+Zysuw7
-uhhVsgPBG+CsqBSjHQhs7jzymqxtQAfe1FkrCRxOq5Pv2Efr7kgtVSkJJiX3KutM
-vnWuEypxAgMBAAECggEAGqKS9pbrN+vnmb7yMsqYgVVnQn0aggZNHlLkl4ZLLnuV
-aemlhur7zO0JzajqUC+AFQOfaQxiFu8S/FoJ+qccFdATrcPEVmTKbgPVqSyzLKlX
-fByGll5eOVT95NMwN8yBGgt2HSW/ZditXS/KxxahVgamGqjAC9MTSutGz/8Ae1U+
-DNDBJCc6RAqu3T02tV9A2pSpVC1rSktDMpLUTscnsfxpaEQATd9DJUcHEvIwoX8q
-GJpycPEhNhdPXqpln5SoMHcf/zS5ssF/Mce0lJJXYyE0LnEk9X12jMWyBqmLqXUY
-cKLyynaFbis0DpQppwKx2y8GpL76k+Ci4dOHIvFknQKBgQDj/2WRMcWOvfBrggzj
-FHpcme2gSo5A5c0CVyI+Xkf1Zab6UR6T7GiImEoj9tq0+o2WEix9rwoypgMBq8rz
-/rrJAPSZjgv6z71k4EnO2FIB5R03vQmoBRCN8VlgvLM0xv52zyjV4Wx66Q4MDjyH
-EgkpHyB0FzRZh0UzhnE/pYSetQKBgQDN9eLB1nA4CBSr1vMGNfQyfBQl3vpO9EP4
-VSS3KnUqCIjJeLu682Ylu7SFxcJAfzUpy5S43hEvcuJsagsVKfmCAGcYZs9/xq3I
-vzYyhaEOS5ezNxLSh4+yCNBPlmrmDyoazag0t8H8YQFBN6BVcxbATHqdWGUhIhYN
-eEpEMOh2TQKBgGBr7kRNTENlyHtu8IxIaMcowfn8DdUcWmsW9oBx1vTNHKTYEZp1
-bG/4F8LF7xCCtcY1wWMV17Y7xyG5yYcOv2eqY8dc72wO1wYGZLB5g5URlB2ycJcC
-LVIaM7ZZl2BGl+8fBSIOx5XjYfFvQ+HLmtwtMchm19jVAEseHF7SXRfRAoGAK15j
-aT2mU6Yf9C9G7T/fM+I8u9zACHAW/+ut14PxN/CkHQh3P16RW9CyqpiB1uLyZuKf
-Zm4cYElotDuAKey0xVMgYlsDxnwni+X3m5vX1hLE1s/5/qrc7zg75QZfbCI1U3+K
-s88d4e7rPLhh4pxhZgy0pP1ADkIHMr7ppIJH8OECgYEApNfbgsJVPAMzucUhJoJZ
-OmZHbyCtJvs4b+zxnmhmSbopifNCgS4zjXH9qC7tsUph1WE6L2KXvtApHGD5H4GQ
-IH5em4M/pHIcsqCi1qggBMbdvzHBUtC3R4sK0CpEFHlN+Y59aGazidcN2FPupNJv
-MbyqKyC6DAzv4jEEhHaN7oY=
------END PRIVATE KEY-----
-"
-
-# INTEROP
-MAIL_PROVISIONING_API_CREDENTIALS="bGFfcmVnaWU6cGFzc3dvcmQ=" # Dev and test key for dimail interop

env.d/development/common.e2e.dist

@@ -1,10 +0,0 @@
-# For the CI job test-e2e
-SUSTAINED_THROTTLE_RATES="200/hour"
-BURST_THROTTLE_RATES="200/minute"
-
-OIDC_ORGANIZATION_REGISTRATION_ID_FIELD="siret"
-
-OAUTH2_PROVIDER_OIDC_ENABLED=True
-OAUTH2_PROVIDER_VALIDATOR_CLASS="mailbox_oauth2.validators.ProConnectValidator"
-
-INSTALLED_PLUGINS=plugins.la_suite

env.d/development/crowdin.dist

@@ -1,3 +0,0 @@
-CROWDIN_API_TOKEN=Your-Api-Token
-CROWDIN_PROJECT_ID=Your-Project-Id
-CROWDIN_BASE_PATH=/app/src

env.d/development/france.dist

@@ -1 +0,0 @@
-INSTALLED_PLUGINS=plugins.la_suite

env.d/development/kc_postgresql.dist

@@ -1,11 +0,0 @@
-# Postgresql db container configuration
-POSTGRES_DB=keycloak
-POSTGRES_USER=people
-POSTGRES_PASSWORD=pass
-
-# App database configuration
-DB_HOST=kc_postgresql
-DB_NAME=keycloak
-DB_USER=people
-DB_PASSWORD=pass
-DB_PORT=5433

env.d/development/postgresql.dist

@@ -1,11 +0,0 @@
-# Postgresql db container configuration
-POSTGRES_DB=people
-POSTGRES_USER=dinum
-POSTGRES_PASSWORD=pass
-
-# App database configuration
-DB_HOST=postgresql
-DB_NAME=people
-DB_USER=dinum
-DB_PASSWORD=pass
-DB_PORT=5432

gitlint/gitlint_emoji.py

@@ -1,37 +0,0 @@
-"""
-Gitlint extra rule to validate that the message title is of the form
-"<gitmoji>(<scope>) <subject>"
-"""
-from __future__ import unicode_literals
-
-import re
-
-import requests
-
-from gitlint.rules import CommitMessageTitle, LineRule, RuleViolation
-
-
-class GitmojiTitle(LineRule):
-    """
-    This rule will enforce that each commit title is of the form "<gitmoji>(<scope>) <subject>"
-    where gitmoji is an emoji from the list defined in https://gitmoji.carloscuesta.me and
-    subject should be all lowercase
-    """
-
-    id = "UC1"
-    name = "title-should-have-gitmoji-and-scope"
-    target = CommitMessageTitle
-
-    def validate(self, title, _commit):
-        """
-        Download the list possible gitmojis from the project's GitHub repository and check that
-        title contains one of them.
-        """
-        gitmojis = requests.get(
-            "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
-        ).json()["gitmojis"]
-        emojis = [item["emoji"] for item in gitmojis]
-        pattern = r"^({:s})\(.*\)\s[a-z].*$".format("|".join(emojis))
-        if not re.search(pattern, title):
-            violation_msg = 'Title does not match regex "<gitmoji>(<scope>) <subject>"'
-            return [RuleViolation(self.id, violation_msg, title)]

index.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+entries:
+  desk:
+  - apiVersion: v2
+    created: "2025-04-04T15:18:37.26211182Z"
+    digest: 6ed51877f235df54a8ee6a755d250eea7380c7844405aca71ec56c76e8bf0ca8
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.7.tgz
+    version: 0.0.7
+  - apiVersion: v2
+    created: "2025-04-03T08:45:12.524733248Z"
+    digest: 68cc9b3e55d5121c58b92de5b039425dfbd02ae615f90db29f2e6246f8e96dd6
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.6.tgz
+    version: 0.0.6
+  - apiVersion: v2
+    created: "2025-03-18T10:39:23.60062239Z"
+    digest: 64731b659628f808a32025d0d84cd61e35396752b997fda0a47407832edb0ad6
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.5.tgz
+    version: 0.0.5
+  - apiVersion: v2
+    created: "2025-03-07T10:44:07.382172233Z"
+    digest: fdab9e6d8edf9067ee9d8c1625e581dfaa306d0af47d82d9140b1e460bf2bd33
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.4.tgz
+    version: 0.0.4
+  - apiVersion: v2
+    created: "2025-02-21T10:27:42.681637955Z"
+    digest: b372ad2c15c0b3299ba3d62594b30d3ff72c5046e628c82cf9888d6a29478ac6
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.3.tgz
+    version: 0.0.3
+  - apiVersion: v2
+    created: "2025-02-10T11:07:06.529791151Z"
+    digest: fd98df8a48d776dba464ac9ccd64f7af88e3bdcd063d3ee63efc8eec7069eeb0
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.2.tgz
+    version: 0.0.2
+  - apiVersion: v2
+    created: "2025-01-10T13:48:53.486954486Z"
+    digest: 455fb4075627754032d285ab9a0ece7fa7ab8976b779c9e22e7c635023313916
+    name: desk
+    type: application
+    urls:
+    - https://suitenumerique.github.io/people/desk-0.0.1.tgz
+    version: 0.0.1
+generated: "2025-04-04T15:18:37.261017181Z"

renovate.json

@@ -1,24 +0,0 @@
-{
-  "extends": ["github>numerique-gouv/renovate-configuration"],
-  "dependencyDashboard": true,
-  "labels": ["dependencies", "noChangeLog"],
-  "packageRules": [
-    {
-      "enabled": false,
-      "groupName": "ignored python dependencies",
-      "matchManagers": ["pep621"],
-      "matchPackageNames": []
-    },
-    {
-      "enabled": false,
-      "groupName": "ignored js dependencies",
-      "matchManagers": ["npm"],
-      "matchPackageNames": ["fetch-mock", "node", "node-fetch", "eslint", "@hookform/resolvers"]
-    },
-    {
-      "groupName": "docker-compose dependencies",
-      "matchManagers": ["docker-compose"],
-      "matchPackageNames": ["dimail-api"]
-    }
-  ]
-}

scripts/install-pre-commit-hook.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
-PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
-
-cat <<'EOF' >$PRE_COMMIT_FILE
-#!/usr/bin/env bash
-
-# directories containing potential secrets
-DIRS="."
-
-bold=$(tput bold)
-normal=$(tput sgr0)
-
-# allow to read user input, assigns stdin to keyboard
-exec </dev/tty
-
-for d in $DIRS; do
-	# find files containing secrets that should be encrypted
-	for f in $(find "${d}" -type f -regex ".*\.enc\..*"); do
-		if ! $(grep -q "unencrypted_suffix" $f); then
-			printf '\xF0\x9F\x92\xA5 '
-			echo "File $f has non encrypted secrets!"
-			exit 1
-		fi
-	done
-done
-EOF
-
-chmod +x $PRE_COMMIT_FILE

scripts/keycloak/add-keycloak-client.sh

@@ -1,149 +0,0 @@
-#!/bin/bash
-
-# Script to add a new client to Keycloak using the kcadm.sh CLI
-# Usage: ./add-keycloak-client.sh [client_id] [client_secret]
-
-# Default values
-CLIENT_ID=${1:-"some-client-id"}
-CLIENT_SECRET=${2:-"ThisIsAnExampleKeyForDevPurposeOnly"}
-KEYCLOAK_URL=${KEYCLOAK_URL:-"http://keycloak:8080"}
-KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-"admin"}
-KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-"admin"}
-REALM=${REALM:-"people"}
-
-# Check for kcadm.sh in common locations
-KCADM_LOCATIONS=(
-  "/opt/keycloak/bin/kcadm.sh"
-  "/opt/jboss/keycloak/bin/kcadm.sh"
-  "/usr/local/bin/kcadm.sh"
-  "./bin/kcadm.sh"
-  "$(which kcadm.sh 2>/dev/null)"
-)
-
-KCADM=""
-for loc in "${KCADM_LOCATIONS[@]}"; do
-  if [ -x "$loc" ]; then
-    KCADM="$loc"
-    break
-  fi
-done
-
-if [ -z "$KCADM" ]; then
-  echo "Error: kcadm.sh not found. Please specify its location manually."
-  echo "You can set the KCADM environment variable to the path of kcadm.sh"
-  exit 1
-fi
-
-echo "Using Keycloak Admin CLI at: $KCADM"
-echo "Logging in to Keycloak at $KEYCLOAK_URL..."
-
-# Login to Keycloak
-$KCADM config credentials \
-  --server $KEYCLOAK_URL \
-  --realm master \
-  --user $KEYCLOAK_ADMIN \
-  --password $KEYCLOAK_ADMIN_PASSWORD
-
-if [ $? -ne 0 ]; then
-  echo "Failed to login to Keycloak. Please check your credentials and try again."
-  exit 1
-fi
-
-echo "Successfully logged in to Keycloak."
-echo "Creating new client '$CLIENT_ID' in realm '$REALM'..."
-
-# Create a temporary JSON file with client configuration
-CLIENT_JSON=$(mktemp)
-cat > "$CLIENT_JSON" << EOF
-{
-  "clientId": "$CLIENT_ID",
-  "name": "",
-  "description": "",
-  "rootUrl": "",
-  "adminUrl": "",
-  "baseUrl": "",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "$CLIENT_SECRET",
-  "redirectUris": [
-    "http://localhost:8070/*",
-    "http://localhost:8071/*",
-    "http://localhost:3200/*",
-    "http://localhost:8088/*",
-    "http://localhost:3000/*"
-  ],
-  "webOrigins": [
-    "http://localhost:3200",
-    "http://localhost:8088",
-    "http://localhost:8070",
-    "http://localhost:3000"
-  ],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": false,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": true,
-  "protocol": "openid-connect",
-  "attributes": {
-    "access.token.lifespan": "-1",
-    "client.secret.creation.time": "$(date +%s)",
-    "user.info.response.signature.alg": "RS256",
-    "post.logout.redirect.uris": "http://localhost:8070/*##http://localhost:3200/*##http://localhost:3000/*",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "use.jwks.url": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "use.refresh.tokens": "true",
-    "tls-client-certificate-bound-access-tokens": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "acr.loa.map": "{}",
-    "require.pushed.authorization.requests": "false",
-    "display.on.consent.screen": "false",
-    "client.session.idle.timeout": "-1",
-    "token.response.type.bearer.lower-case": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "acr",
-    "roles",
-    "profile",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ]
-}
-EOF
-
-# Create the client using kcadm.sh
-$KCADM create clients -r "$REALM" -f "$CLIENT_JSON"
-
-if [ $? -ne 0 ]; then
-  echo "Failed to create client. Check the error message above."
-  rm "$CLIENT_JSON"
-  exit 1
-fi
-
-echo "✅ Client '$CLIENT_ID' created successfully!"
-echo "  Client ID: $CLIENT_ID"
-echo "  Client Secret: $CLIENT_SECRET"
-
-# Clean up temporary file
-rm "$CLIENT_JSON"
-
-# Display the created client
-echo "Client details:"
-$KCADM get clients -r "$REALM" --query "clientId=$CLIENT_ID"

scripts/release.py

@@ -1,166 +0,0 @@
-# pylint: disable=line-too-long
-
-import datetime
-import os
-import re
-import sys
-
-from utils import run_command
-
-
-RELEASE_KINDS = {'p': 'patch', 'm': 'minor', 'mj': 'major'}
-
-
-def update_files(version):
-    """Update all files needed with new release version"""
-    # pyproject.toml
-    sys.stdout.write("Update pyproject.toml...\n")
-    path = "src/backend/pyproject.toml"
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if line.startswith("version = "):
-                lines[index] = re.sub(r'\"(.*?)\"', f'"{version}"', line)
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-    # frontend package.json
-    sys.stdout.write("Update package.json...\n")
-    files_to_modify = []
-    filename = "package.json"
-    for root, _dir, files in os.walk("src/frontend"):
-        if filename in files and "node_modules" not in root and ".next" not in root:
-            files_to_modify.append(os.path.join(root, filename))
-
-    for path in files_to_modify:
-        with open(path, 'r') as file:
-            lines = file.readlines()
-            for index, line in enumerate(lines):
-                if "version" in line:
-                    lines[index] = re.sub(r'"version": \"(.*?)\"', f'"version": "{version}"', line)
-        with open(path, 'w+') as file:
-            file.writelines(lines)
-    return
-
-
-def update_helm_files(path):
-    sys.stdout.write("Update helm files...\n")
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if "tag:" in line:
-                lines[index] = re.sub(r'\"(.*?)\"', f'"v{version}"', line)
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-
-def update_changelog(path, version):
-    """Update changelog file with release info
-    """
-    sys.stdout.write("Update CHANGELOG...\n")
-    with open(path, 'r') as file:
-        lines = file.readlines()
-        for index, line in enumerate(lines):
-            if "## [Unreleased]" in line:
-                today = datetime.date.today()
-                lines.insert(index + 1, f"\n## [{version}] - {today}\n")
-            if line.startswith("[unreleased]"):
-                last_version = lines[index + 1].split("]")[0][1:]
-                new_unreleased_line = line.replace(last_version, version)
-                new_release_line = lines[index + 1].replace(last_version, version)
-                lines[index] = new_unreleased_line
-                lines.insert(index + 1, new_release_line)
-                break
-
-    with open(path, 'w+') as file:
-        file.writelines(lines)
-
-
-def deployment_part(version):
-    """ Update helm file of preprod on deployment repository numerique-gouv/lasuite-deploiement
-    """
-    # Move to lasuite-deploiement repository
-    try:
-        os.chdir('../lasuite-deploiement')
-    except FileNotFoundError:
-        sys.stdout.write("\033[1;31m[Error] You must have a clone of https://github.com/numerique-gouv/lasuite-deploiement\x1b[0m")
-        sys.stdout.write("\033[0;32mPlease clone it and re-run script with option --only-deployment-part\x1b[0m")
-        sys.stdout.write("  >>> python scripts/release.py --only-deployment-part \x1b[0m")
-    else:
-        run_command("git checkout main", shell=True)
-        run_command("git pull", shell=True)
-        deployment_branch = f"regie/{version}/preprod"
-        run_command(f"git checkout -b {deployment_branch}", shell=True)
-        run_command("git pull --rebase origin main", shell=True)
-        path = f"manifests/regie/env.d/preprod/values.desk.yaml.gotmpl"
-        update_helm_files(path)
-        run_command(f"git add {path}", shell=True)
-        message = f"""🔖(regie) bump preprod version to {version}"""
-        run_command(f"git commit -m '{message}'", shell=True)
-        confirm = input(f"""\033[0;32m
-### DEPLOYMENT ###
-NEXT COMMAND on lasuite-deploiement repository: 
-    >> git push origin {deployment_branch}
-Continue ? (y,n) 
-\x1b[0m""").strip()
-        if confirm == 'y':
-            run_command(f"git push origin {deployment_branch}", shell=True)
-        sys.stdout.write(f"""\033[1;34m
-PLEASE DO THE FOLLOWING INSTRUCTIONS: 
---> Check if you need to bump chart version in the manifests/regie/helmfile.yaml file
-    and settings in the manifests/regie/env.d/preprod/values.desk.yaml.gotmpl file
-    add commits into {deployment_branch} branch to do it if needed, then...
---> Please submit PR {deployment_branch} and merge code to main [https://github.com/numerique-gouv/lasuite-deploiement]
-\x1b[0m""")
-
-
-def project_part(version, kind):
-    """Manage only la regie part with update of CHANGELOG, version files and tag"""
-    sys.stdout.write('Let\'s go to create branch to release\n')
-    branch_to_release = f"release/{version}"
-    run_command(f"git checkout -b {branch_to_release}", shell=True)
-    run_command("git pull --rebase origin main", shell=True)
-
-    update_changelog("CHANGELOG.md", version)
-    update_files(version)
-
-    run_command("git add CHANGELOG.md", shell=True)
-    run_command("git add src/", shell=True)
-    message = f"""🔖({RELEASE_KINDS[kind]}) release version {version}
-
-Update all version files and changelog for {RELEASE_KINDS[kind]} release."""
-    run_command(f"git commit -m '{message}'", shell=True)
-    confirm = input(f"""\033[0;32m
-### RELEASE ###
-NEXT COMMAND on current repository:
-    >> git push origin {branch_to_release}
-Continue ? (y,n)
-\x1b[0m""").strip()
-    if confirm == 'y':
-        run_command(f"git push origin {branch_to_release}", shell=True)
-    sys.stdout.write(f"""
-\033[1;34mPLEASE DO THE FOLLOWING INSTRUCTIONS:
---> A github action will download last translations from crowdin and create a PR (i18n/update-translations) to merge into the release branch.
-    Please wait for this, approve and merge this translations PR into the release branch {branch_to_release}.
---> Then please submit PR {branch_to_release} and merge code to main [https://github.com/suitenumerique/people/]
---> Then do:
-    >> git checkout main
-    >> git pull
-    >> git tag v{version} 
-    >> git push origin v{version} 
---> Please check and wait for the docker image v{version} to be published here:
- - https://hub.docker.com/r/lasuite/people-backend/tags 
- - https://hub.docker.com/r/lasuite/people-frontend/tags
---> Now please generate release on github interface for the current tag v{version}
- \x1b[0m""")
-
-
-if __name__ == "__main__":
-    version, kind = None, None
-    while not version:
-        version = input("Enter your release version:").strip()
-    while kind not in RELEASE_KINDS:
-        kind = input("Enter kind of release (p:patch, m:minor, mj:major):").strip()
-    if "--only-deployment-part" not in sys.argv:
-        project_part(version, kind)
-    deployment_part(version)

scripts/update-git-submodule.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-git submodule update --init --recursive
-git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'

scripts/utils.py

@@ -1,14 +0,0 @@
-import subprocess
-import sys
-
-
-def run_command(cmd, msg=None, shell=False, cwd='.', stdout=None):
-    if msg is None:
-        msg = f"# Running: {cmd}"
-    if stdout is not None:
-        stdout.write(msg + '\n')
-        if stdout != sys.stdout:
-            sys.stdout(msg)
-    subprocess.check_call(cmd, shell=shell, cwd=cwd, stdout=stdout, stderr=stdout)
-    if stdout is not None:
-        stdout.flush()

src/backend/.pylintrc

@@ -1,473 +0,0 @@
-[MASTER]
-
-# A comma-separated list of package or module names from where C extensions may
-# be loaded. Extensions are loading into the active Python interpreter and may
-# run arbitrary code
-extension-pkg-whitelist=
-
-# Add files or directories to the blacklist. They should be base names, not
-# paths.
-ignore=migrations
-
-# Add files or directories matching the regex patterns to the blacklist. The
-# regex matches against base names, not paths.
-ignore-patterns=
-
-# Python code to execute, usually for sys.path manipulation such as
-# pygtk.require().
-#init-hook=
-
-# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
-# number of processors available to use.
-jobs=0
-
-# List of plugins (as comma separated values of python modules names) to load,
-# usually to register additional checkers.
-load-plugins=pylint_django,pylint.extensions.no_self_use
-
-# Pickle collected data for later comparisons.
-persistent=yes
-
-# Specify a configuration file.
-#rcfile=
-
-# When enabled, pylint would attempt to guess common misconfiguration and emit
-# user-friendly hints instead of false-positive error messages
-suggestion-mode=yes
-
-# Allow loading of arbitrary C extensions. Extensions are imported into the
-# active Python interpreter and may run arbitrary code.
-unsafe-load-any-extension=no
-
-
-[MESSAGES CONTROL]
-
-# Only show warnings with the listed confidence levels. Leave empty to show
-# all. Valid levels: HIGH, INFERENCE, INFERENCE_FAILURE, UNDEFINED
-confidence=
-
-# Disable the message, report, category or checker with the given id(s). You
-# can either give multiple identifiers separated by comma (,) or put this
-# option multiple times (only on the command line, not in the configuration
-# file where it should appear only once).You can also use "--disable=all" to
-# disable everything first and then reenable specific checks. For example, if
-# you want to run only the similarities checker, you can use "--disable=all
-# --enable=similarities". If you want to run only the classes checker, but have
-# no Warning level messages displayed, use"--disable=all --enable=classes
-# --disable=W"
-disable=bad-inline-option,
-        deprecated-pragma,
-        django-not-configured,
-        file-ignored,
-        locally-disabled,
-        no-self-use,
-        raw-checker-failed,
-        suppressed-message,
-        useless-suppression
-
-# Enable the message, report, category or checker with the given id(s). You can
-# either give multiple identifier separated by comma (,) or put this option
-# multiple time (only on the command line, not in the configuration file where
-# it should appear only once). See also the "--disable" option for examples.
-enable=c-extension-no-member
-
-
-[REPORTS]
-
-# Python expression which should return a note less than 10 (10 is the highest
-# note). You have access to the variables errors warning, statement which
-# respectively contain the number of errors / warnings messages and the total
-# number of statements analyzed. This is used by the global evaluation report
-# (RP0004).
-evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
-
-# Template used to display messages. This is a python new-style format string
-# used to format the message information. See doc for all details
-#msg-template=
-
-# Set the output format. Available formats are text, parseable, colorized, json
-# and msvs (visual studio).You can also give a reporter class, eg
-# mypackage.mymodule.MyReporterClass.
-output-format=text
-
-# Tells whether to display a full report or only the messages
-reports=no
-
-# Activate the evaluation score.
-score=yes
-
-
-[REFACTORING]
-
-# Maximum number of nested blocks for function / method body
-max-nested-blocks=5
-
-# Complete name of functions that never returns. When checking for
-# inconsistent-return-statements if a never returning function is called then
-# it will be considered as an explicit return statement and no message will be
-# printed.
-never-returning-functions=optparse.Values,sys.exit
-
-
-[LOGGING]
-
-# Logging modules to check that the string format arguments are in logging
-# function parameter format
-logging-modules=logging
-
-
-[SPELLING]
-
-# Limits count of emitted suggestions for spelling mistakes
-max-spelling-suggestions=4
-
-# Spelling dictionary name. Available dictionaries: none. To make it working
-# install python-enchant package.
-spelling-dict=
-
-# List of comma separated words that should not be checked.
-spelling-ignore-words=
-
-# A path to a file that contains private dictionary; one word per line.
-spelling-private-dict-file=
-
-# Tells whether to store unknown words to indicated private dictionary in
-# --spelling-private-dict-file option instead of raising a message.
-spelling-store-unknown-words=no
-
-
-[MISCELLANEOUS]
-
-# List of note tags to take in consideration, separated by a comma.
-notes=FIXME,
-      XXX,
-      TODO
-
-
-[TYPECHECK]
-
-# List of decorators that produce context managers, such as
-# contextlib.contextmanager. Add to this list to register other decorators that
-# produce valid context managers.
-contextmanager-decorators=contextlib.contextmanager
-
-# List of members which are set dynamically and missed by pylint inference
-# system, and so shouldn't trigger E1101 when accessed. Python regular
-# expressions are accepted.
-generated-members=
-
-# Tells whether missing members accessed in mixin class should be ignored. A
-# mixin class is detected if its name ends with "mixin" (case insensitive).
-ignore-mixin-members=yes
-
-# This flag controls whether pylint should warn about no-member and similar
-# checks whenever an opaque object is returned when inferring. The inference
-# can return multiple potential results while evaluating a Python object, but
-# some branches might not be evaluated, which results in partial inference. In
-# that case, it might be useful to still emit no-member and other checks for
-# the rest of the inferred objects.
-ignore-on-opaque-inference=yes
-
-# List of class names for which member attributes should not be checked (useful
-# for classes with dynamically set attributes). This supports the use of
-# qualified names.
-ignored-classes=optparse.Values,thread._local,_thread._local,responses,
-                Team,Contact
-
-# List of module names for which member attributes should not be checked
-# (useful for modules/projects where namespaces are manipulated during runtime
-# and thus existing member attributes cannot be deduced by static analysis. It
-# supports qualified module names, as well as Unix pattern matching.
-ignored-modules=
-
-# Show a hint with possible names when a member name was not found. The aspect
-# of finding the hint is based on edit distance.
-missing-member-hint=yes
-
-# The minimum edit distance a name should have in order to be considered a
-# similar match for a missing member name.
-missing-member-hint-distance=1
-
-# The total number of similar names that should be taken in consideration when
-# showing a hint for a missing member.
-missing-member-max-choices=1
-
-
-[VARIABLES]
-
-# List of additional names supposed to be defined in builtins. Remember that
-# you should avoid to define new builtins when possible.
-additional-builtins=
-
-# Tells whether unused global variables should be treated as a violation.
-allow-global-unused-variables=yes
-
-# List of strings which can identify a callback function by name. A callback
-# name must start or end with one of those strings.
-callbacks=cb_,
-          _cb
-
-# A regular expression matching the name of dummy variables (i.e. expectedly
-# not used).
-dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
-
-# Argument names that match this expression will be ignored. Default to name
-# with leading underscore
-ignored-argument-names=_.*|^ignored_|^unused_
-
-# Tells whether we should check for unused import in __init__ files.
-init-import=no
-
-# List of qualified module names which can have objects that can redefine
-# builtins.
-redefining-builtins-modules=six.moves,past.builtins,future.builtins
-
-
-[FORMAT]
-
-# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
-expected-line-ending-format=
-
-# Regexp for a line that is allowed to be longer than the limit.
-ignore-long-lines=^\s*(# )?<?https?://\S+>?$
-
-# Number of spaces of indent required inside a hanging  or continued line.
-indent-after-paren=4
-
-# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
-# tab).
-indent-string='    '
-
-# Maximum number of characters on a single line.
-max-line-length=100
-
-# Maximum number of lines in a module
-max-module-lines=1000
-
-# Allow the body of a class to be on the same line as the declaration if body
-# contains single statement.
-single-line-class-stmt=no
-
-# Allow the body of an if to be on the same line as the test if there is no
-# else.
-single-line-if-stmt=no
-
-
-[SIMILARITIES]
-
-# Ignore comments when computing similarities.
-ignore-comments=yes
-
-# Ignore docstrings when computing similarities.
-ignore-docstrings=yes
-
-# Ignore imports when computing similarities.
-ignore-imports=yes
-
-# Minimum lines number of a similarity.
-# First implementations of CMS wizards have common fields we do not want to factorize for now
-min-similarity-lines=35
-
-
-[BASIC]
-
-# Naming style matching correct argument names
-argument-naming-style=snake_case
-
-# Regular expression matching correct argument names. Overrides argument-
-# naming-style
-#argument-rgx=
-
-# Naming style matching correct attribute names
-attr-naming-style=snake_case
-
-# Regular expression matching correct attribute names. Overrides attr-naming-
-# style
-#attr-rgx=
-
-# Bad variable names which should always be refused, separated by a comma
-bad-names=foo,
-          bar,
-          baz,
-          toto,
-          tutu,
-          tata
-
-# Naming style matching correct class attribute names
-class-attribute-naming-style=any
-
-# Regular expression matching correct class attribute names. Overrides class-
-# attribute-naming-style
-#class-attribute-rgx=
-
-# Naming style matching correct class names
-class-naming-style=PascalCase
-
-# Regular expression matching correct class names. Overrides class-naming-style
-#class-rgx=
-
-# Naming style matching correct constant names
-const-naming-style=UPPER_CASE
-
-# Regular expression matching correct constant names. Overrides const-naming-
-# style
-const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__)|urlpatterns|logger)$
-
-# Minimum line length for functions/classes that require docstrings, shorter
-# ones are exempt.
-docstring-min-length=-1
-
-# Naming style matching correct function names
-function-naming-style=snake_case
-
-# Regular expression matching correct function names. Overrides function-
-# naming-style
-#function-rgx=
-
-# Good variable names which should always be accepted, separated by a comma
-good-names=i,
-           j,
-           k,
-           cm,
-           ex,
-           Run,
-           _
-
-# Include a hint for the correct naming format with invalid-name
-include-naming-hint=no
-
-# Naming style matching correct inline iteration names
-inlinevar-naming-style=any
-
-# Regular expression matching correct inline iteration names. Overrides
-# inlinevar-naming-style
-#inlinevar-rgx=
-
-# Naming style matching correct method names
-method-naming-style=snake_case
-
-# Regular expression matching correct method names. Overrides method-naming-
-# style
-method-rgx=([a-z_][a-z0-9_]{2,50}|setUp|set[Uu]pClass|tearDown|tear[Dd]ownClass|assert[A-Z]\w*|maxDiff|test_[a-z0-9_]+)$
-
-# Naming style matching correct module names
-module-naming-style=snake_case
-
-# Regular expression matching correct module names. Overrides module-naming-
-# style
-#module-rgx=
-
-# Colon-delimited sets of names that determine each other's naming style when
-# the name regexes allow several styles.
-name-group=
-
-# Regular expression which should only match function or class names that do
-# not require a docstring.
-# Ignore: private stuff and `Params` class from FactoryBoy
-no-docstring-rgx=(^_|^Params$)
-
-# List of decorators that produce properties, such as abc.abstractproperty. Add
-# to this list to register other decorators that produce valid properties.
-property-classes=abc.abstractproperty
-
-# Naming style matching correct variable names
-variable-naming-style=snake_case
-
-# Regular expression matching correct variable names. Overrides variable-
-# naming-style
-#variable-rgx=
-
-
-[IMPORTS]
-
-# Allow wildcard imports from modules that define __all__.
-allow-wildcard-with-all=no
-
-# Analyse import fallback blocks. This can be used to support both Python 2 and
-# 3 compatible code, which means that the block might have code that exists
-# only in one or another interpreter, leading to false positives when analysed.
-analyse-fallback-blocks=no
-
-# Deprecated modules which should not be used, separated by a comma
-deprecated-modules=optparse,tkinter.tix
-
-# Create a graph of external dependencies in the given file (report RP0402 must
-# not be disabled)
-ext-import-graph=
-
-# Create a graph of every (i.e. internal and external) dependencies in the
-# given file (report RP0402 must not be disabled)
-import-graph=
-
-# Create a graph of internal dependencies in the given file (report RP0402 must
-# not be disabled)
-int-import-graph=
-
-# Force import order to recognize a module as part of the standard
-# compatibility libraries.
-known-standard-library=
-
-# Force import order to recognize a module as part of a third party library.
-known-third-party=enchant
-
-
-[CLASSES]
-
-# List of method names used to declare (i.e. assign) instance attributes.
-defining-attr-methods=__init__,
-                      __new__,
-                      setUp
-
-# List of member names, which should be excluded from the protected access
-# warning.
-exclude-protected=_asdict,
-                  _fields,
-                  _replace,
-                  _source,
-                  _make
-
-# List of valid names for the first argument in a class method.
-valid-classmethod-first-arg=cls
-
-# List of valid names for the first argument in a metaclass class method.
-valid-metaclass-classmethod-first-arg=mcs
-
-
-[DESIGN]
-
-# Maximum number of arguments for function / method
-max-args=5
-
-# Maximum number of attributes for a class (see R0902).
-max-attributes=7
-
-# Maximum number of boolean expressions in a if statement
-max-bool-expr=5
-
-# Maximum number of branch for function / method body
-max-branches=12
-
-# Maximum number of locals for function / method body
-max-locals=15
-
-# Maximum number of parents for a class (see R0901).
-max-parents=7
-
-# Maximum number of public methods for a class (see R0904).
-max-public-methods=20
-
-# Maximum number of return / yield for function / method body
-max-returns=6
-
-# Maximum number of statements in function / method body
-max-statements=50
-
-# Minimum number of public methods for a class (see R0903).
-min-public-methods=0
-
-
-[EXCEPTIONS]
-
-# Exceptions that will emit a warning when being caught. Defaults to
-# "Exception"
-overgeneral-exceptions=builtins.Exception

src/backend/MANIFEST.in

@@ -1,3 +0,0 @@
-include LICENSE
-include README.md
-recursive-include src/backend/people *.html *.png *.gif *.css *.ico *.jpg *.jpeg *.po *.mo *.eot *.svg *.ttf *.woff *.woff2

src/backend/__init__.py

@@ -1 +0,0 @@
-"""Root module."""

src/backend/conftest.py

@@ -1,30 +0,0 @@
-"""Global fixtures for the backend tests."""
-
-import pytest
-from urllib3.connectionpool import HTTPConnectionPool
-
-
-@pytest.fixture(autouse=True)
-def no_http_requests(monkeypatch):
-    """
-    Prevents HTTP requests from being made during tests.
-    This is useful for tests that do not require actual HTTP requests
-    and helps to avoid network-related issues.
-
-    Credits: https://blog.jerrycodes.com/no-http-requests/
-    """
-
-    allowed_hosts = {"localhost"}
-    original_urlopen = HTTPConnectionPool.urlopen
-
-    def urlopen_mock(self, method, url, *args, **kwargs):
-        if self.host in allowed_hosts:
-            return original_urlopen(self, method, url, *args, **kwargs)
-
-        raise RuntimeError(
-            f"The test was about to {method} {self.scheme}://{self.host}{url}"
-        )
-
-    monkeypatch.setattr(
-        "urllib3.connectionpool.HTTPConnectionPool.urlopen", urlopen_mock
-    )

src/backend/core/__init__.py

@@ -1 +0,0 @@
-"""Core root module."""

src/backend/core/admin.py

@@ -1,304 +0,0 @@
-"""Admin classes and registrations for People's core app."""
-
-from django.conf import settings
-from django.contrib import admin, messages
-from django.contrib.auth import admin as auth_admin
-from django.utils.translation import gettext_lazy as _
-
-from treebeard.admin import TreeAdmin
-from treebeard.forms import movenodeform_factory
-
-from mailbox_manager.admin import MailDomainAccessInline
-
-from . import models
-from .plugins.registry import registry as plugin_hooks_registry
-
-
-class TeamAccessInline(admin.TabularInline):
-    """Inline admin class for team accesses."""
-
-    extra = 0
-    autocomplete_fields = ["user", "team"]
-    model = models.TeamAccess
-    readonly_fields = ("created_at", "updated_at")
-
-
-class OrganizationAccessInline(admin.TabularInline):
-    """Inline admin class for organization accesses."""
-
-    autocomplete_fields = ["user", "organization"]
-    extra = 0
-    model = models.OrganizationAccess
-    readonly_fields = ("created_at", "updated_at")
-
-
-class TeamWebhookInline(admin.TabularInline):
-    """Inline admin class for team webhooks."""
-
-    extra = 0
-    autocomplete_fields = ["team"]
-    model = models.TeamWebhook
-    readonly_fields = ("created_at", "updated_at")
-
-
-@admin.register(models.User)
-class UserAdmin(auth_admin.UserAdmin):
-    """Admin class for the User model"""
-
-    autocomplete_fields = ["organization"]
-    fieldsets = (
-        (
-            None,
-            {
-                "fields": (
-                    "id",
-                    "sub",
-                    "password",
-                    "organization",
-                )
-            },
-        ),
-        (
-            _("Personal info"),
-            {
-                "fields": (
-                    "name",
-                    "email",
-                    "language",
-                    "timezone",
-                )
-            },
-        ),
-        (
-            _("Permissions"),
-            {
-                "fields": (
-                    "is_active",
-                    "is_device",
-                    "is_staff",
-                    "is_superuser",
-                    "groups",
-                    "user_permissions",
-                ),
-            },
-        ),
-        (_("Important dates"), {"fields": ("created_at", "updated_at")}),
-    )
-    add_fieldsets = (
-        (
-            None,
-            {
-                "classes": ("wide",),
-                "fields": ("sub", "email", "password1", "password2"),
-            },
-        ),
-    )
-    inlines = (TeamAccessInline, MailDomainAccessInline, OrganizationAccessInline)
-    list_display = (
-        "get_user",
-        "organization",
-        "created_at",
-        "updated_at",
-        "is_active",
-        "is_device",
-        "is_staff",
-        "is_superuser",
-    )
-    list_filter = ("is_staff", "is_superuser", "is_device", "is_active")
-    ordering = ("is_active", "-is_superuser", "-is_staff", "-is_device", "-updated_at")
-    readonly_fields = ["id", "created_at", "updated_at"]
-    search_fields = ("id", "email", "sub", "name")
-
-    def get_readonly_fields(self, request, obj=None):
-        """The sub should only be editable for a create, not for updates."""
-        if obj:
-            return self.readonly_fields + ["sub"]
-        return self.readonly_fields
-
-    def get_user(self, obj):
-        """Provide a nice display for user"""
-        return (
-            obj.name if obj.name else (obj.email if obj.email else f"[sub] {obj.sub}")
-        )
-
-    get_user.short_description = _("User")
-
-
-class TeamServiceProviderInline(admin.TabularInline):
-    """Inline admin class for service providers."""
-
-    can_delete = False
-    model = models.Team.service_providers.through
-    extra = 0
-
-
-@admin.register(models.Team)
-class TeamAdmin(TreeAdmin):
-    """Team admin interface declaration."""
-
-    form = movenodeform_factory(models.Team)
-    inlines = (TeamAccessInline, TeamWebhookInline, TeamServiceProviderInline)
-    exclude = ("service_providers",)  # Handled by the inline
-    list_display = (
-        "name",
-        "created_at",
-        "updated_at",
-    )
-    search_fields = ("name",)
-    readonly_fields = ("path", "depth", "numchild")
-
-
-@admin.register(models.TeamAccess)
-class TeamAccessAdmin(admin.ModelAdmin):
-    """Team access admin interface declaration."""
-
-    list_display = (
-        "user",
-        "team",
-        "role",
-        "created_at",
-        "updated_at",
-    )
-
-
-@admin.register(models.Invitation)
-class InvitationAdmin(admin.ModelAdmin):
-    """Admin interface to handle invitations."""
-
-    fields = (
-        "email",
-        "team",
-        "role",
-        "created_at",
-        "issuer",
-    )
-    readonly_fields = (
-        "created_at",
-        "is_expired",
-        "issuer",
-    )
-    list_display = (
-        "email",
-        "team",
-        "created_at",
-        "is_expired",
-    )
-
-    def get_readonly_fields(self, request, obj=None):
-        """Mark all fields read only, i.e. disable update."""
-        if obj:
-            return self.fields
-        return self.readonly_fields
-
-    def change_view(self, request, object_id, form_url="", extra_context=None):
-        """Custom edit form. Remove 'save' buttons."""
-        extra_context = extra_context or {}
-        extra_context["show_save_and_continue"] = False
-        extra_context["show_save"] = False
-        extra_context["show_save_and_add_another"] = False
-        return super().change_view(request, object_id, extra_context=extra_context)
-
-    def save_model(self, request, obj, form, change):
-        """Fill in current logged-in user as issuer."""
-        obj.issuer = request.user
-        obj.save()
-
-
-@admin.register(models.Contact)
-class ContactAdmin(admin.ModelAdmin):
-    """Contact admin interface declaration."""
-
-    list_display = (
-        "full_name",
-        "owner",
-        "override",
-    )
-
-
-class OrganizationServiceProviderInline(admin.TabularInline):
-    """Inline admin class for service providers."""
-
-    can_delete = False
-    model = models.Organization.service_providers.through
-    extra = 0
-
-
-@admin.action(description=_("Run post creation plugins"), permissions=["change"])
-def run_post_creation_plugins(modeladmin, request, queryset):  # pylint: disable=unused-argument
-    """Run the post creation plugins for the selected organizations."""
-    for organization in queryset:
-        plugin_hooks_registry.execute_hook("organization_created", organization)
-
-    messages.success(
-        request,
-        _("Post creation plugins have been run for the selected organizations."),
-    )
-
-
-@admin.register(models.Organization)
-class OrganizationAdmin(admin.ModelAdmin):
-    """Admin interface for organizations."""
-
-    actions = [run_post_creation_plugins]
-    list_display = (
-        "name",
-        "is_active",
-        "created_at",
-        "updated_at",
-    )
-    list_filter = ("is_active",)
-    search_fields = ("name",)
-    inlines = (OrganizationAccessInline, OrganizationServiceProviderInline)
-    exclude = ("service_providers",)  # Handled by the inline
-
-    def get_actions(self, request):
-        """Adapt actions list to the context."""
-        actions = super().get_actions(request)
-        if not plugin_hooks_registry.get_callbacks("organization_created"):
-            actions.pop("run_post_creation_plugins", None)
-        return actions
-
-
-@admin.register(models.OrganizationAccess)
-class OrganizationAccessAdmin(admin.ModelAdmin):
-    """Organization access admin interface declaration."""
-
-    autocomplete_fields = ("user", "organization")
-    list_display = (
-        "user",
-        "organization",
-        "role",
-        "created_at",
-        "updated_at",
-    )
-
-
-@admin.register(models.ServiceProvider)
-class ServiceProviderAdmin(admin.ModelAdmin):
-    """Admin interface for service providers."""
-
-    list_display = (
-        "name",
-        "audience_id",
-        "created_at",
-        "updated_at",
-    )
-    search_fields = ("name", "audience_id")
-    readonly_fields = ("created_at", "updated_at")
-
-
-@admin.register(models.AccountService)
-class AccountServiceAdmin(admin.ModelAdmin):
-    """Admin interface for account services."""
-
-    list_display = ("name", "created_at", "updated_at")
-    readonly_fields = ("api_key", "created_at", "updated_at")
-
-    def get_form(self, request, obj=None, change=False, **kwargs):
-        """Add help text to the scopes field to provide list of available scopes."""
-        form = super().get_form(request, obj, change, **kwargs)
-        form.base_fields[
-            "scopes"
-        ].help_text = f"Scopes define what the service can access. \
-            Available scopes: {', '.join(settings.ACCOUNT_SERVICE_SCOPES)}"
-        return form

src/backend/core/api/__init__.py

@@ -1,42 +0,0 @@
-"""People core API endpoints"""
-
-from django.conf import settings
-from django.core.exceptions import ValidationError
-
-from rest_framework import exceptions as drf_exceptions
-from rest_framework import views as drf_views
-from rest_framework.decorators import api_view
-from rest_framework.response import Response
-
-
-def exception_handler(exc, context):
-    """Handle Django ValidationError as an accepted exception.
-
-    For the parameters, see ``exception_handler``
-    This code comes from twidi's gist:
-    https://gist.github.com/twidi/9d55486c36b6a51bdcb05ce3a763e79f
-    """
-    if isinstance(exc, ValidationError):
-        if hasattr(exc, "message_dict"):
-            detail = exc.message_dict
-        elif hasattr(exc, "message"):
-            detail = exc.message
-        elif hasattr(exc, "messages"):
-            detail = exc.messages
-        else:
-            detail = ""
-
-        exc = drf_exceptions.ValidationError(detail=detail)
-
-    return drf_views.exception_handler(exc, context)
-
-
-# pylint: disable=unused-argument
-@api_view(["GET"])
-def get_frontend_configuration(request):
-    """Returns the frontend configuration dict as configured in settings."""
-    frontend_configuration = {
-        "LANGUAGE_CODE": settings.LANGUAGE_CODE,
-    }
-    frontend_configuration.update(settings.FRONTEND_CONFIGURATION)
-    return Response(frontend_configuration)

src/backend/core/api/client/__init__.py

@@ -1 +0,0 @@
-"""People core client API endpoints"""

src/backend/core/api/client/serializers.py

@@ -1,349 +0,0 @@
-"""Client serializers for the People core app."""
-
-from rest_framework import exceptions, serializers
-from timezone_field.rest_framework import TimeZoneSerializerField
-
-from core import models
-from core.models import ServiceProvider
-
-
-class ContactSerializer(serializers.ModelSerializer):
-    """Serialize contacts."""
-
-    abilities = serializers.SerializerMethodField()
-
-    class Meta:
-        model = models.Contact
-        fields = [
-            "id",
-            "abilities",
-            "override",
-            "data",
-            "full_name",
-            "notes",
-            "owner",
-            "short_name",
-        ]
-        read_only_fields = ["id", "owner", "abilities"]
-        extra_kwargs = {
-            "override": {"required": False},
-        }
-
-    def update(self, instance, validated_data):
-        """Make "override" field readonly but only for update/patch."""
-        validated_data.pop("override", None)
-        return super().update(instance, validated_data)
-
-    def get_abilities(self, contact) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return contact.get_abilities(request.user)
-        return {}
-
-
-class DynamicFieldsModelSerializer(serializers.ModelSerializer):
-    """
-    A ModelSerializer that takes an additional `fields` argument that
-    controls which fields should be displayed.
-    """
-
-    def __init__(self, *args, **kwargs):
-        """Pass arguments to superclass except 'fields', then drop fields not listed therein."""
-
-        # Don't pass the 'fields' arg up to the superclass
-        fields = kwargs.pop("fields", None)
-
-        # Instantiate the superclass normally
-        super().__init__(*args, **kwargs)
-
-        if fields is not None:
-            # Drop any fields that are not specified in the `fields` argument.
-            allowed = set(fields)
-            existing = set(self.fields)
-            for field_name in existing - allowed:
-                self.fields.pop(field_name)
-
-
-class OrganizationSerializer(serializers.ModelSerializer):
-    """Serialize organizations."""
-
-    abilities = serializers.SerializerMethodField()
-
-    class Meta:
-        model = models.Organization
-        fields = ["id", "name", "registration_id_list", "domain_list", "abilities"]
-        read_only_fields = ["id", "registration_id_list", "domain_list"]
-
-    def get_abilities(self, organization) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return organization.get_abilities(request.user)
-        return {}
-
-
-class UserOrganizationSerializer(serializers.ModelSerializer):
-    """Serialize organizations for users."""
-
-    class Meta:
-        model = models.Organization
-        fields = ["id", "name", "registration_id_list"]
-        read_only_fields = ["id", "name", "registration_id_list"]
-
-
-class UserSerializer(DynamicFieldsModelSerializer):
-    """Serialize users."""
-
-    timezone = TimeZoneSerializerField(use_pytz=False, required=True)
-    email = serializers.ReadOnlyField()
-    name = serializers.ReadOnlyField()
-    organization = UserOrganizationSerializer(read_only=True)
-
-    class Meta:
-        model = models.User
-        fields = [
-            "id",
-            "email",
-            "language",
-            "name",
-            "organization",
-            "timezone",
-            "is_device",
-            "is_staff",
-        ]
-        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]
-
-
-class UserMeSerializer(UserSerializer):
-    """
-    Serialize the current user.
-
-    Same as the `UserSerializer` but with abilities.
-    """
-
-    abilities = serializers.SerializerMethodField()
-    organization = UserOrganizationSerializer(read_only=True)
-
-    class Meta:
-        model = models.User
-        fields = [
-            "email",
-            "id",
-            "is_device",
-            "is_staff",
-            "language",
-            "name",
-            "organization",
-            "timezone",
-            # added fields
-            "abilities",
-        ]
-        read_only_fields = ["id", "name", "email", "is_device", "is_staff"]
-
-    def get_abilities(self, user: models.User) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        if user != self.context["request"].user:  # Should not happen
-            raise RuntimeError(
-                "UserMeSerializer.get_abilities: user is not the same as the request user",
-            )
-        return user.get_abilities()
-
-
-class TeamAccessSerializer(serializers.ModelSerializer):
-    """Serialize team accesses."""
-
-    abilities = serializers.SerializerMethodField(read_only=True)
-
-    class Meta:
-        model = models.TeamAccess
-        fields = ["id", "user", "role", "abilities"]
-        read_only_fields = ["id", "abilities"]
-
-    def update(self, instance, validated_data):
-        """Make "user" field is readonly but only on update."""
-        validated_data.pop("user", None)
-        return super().update(instance, validated_data)
-
-    def get_abilities(self, access) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return access.get_abilities(request.user)
-        return {}
-
-    def validate(self, attrs):
-        """
-        Check access rights specific to writing (create/update)
-        """
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-        role = attrs.get("role")
-
-        # Update
-        if self.instance:
-            can_set_role_to = self.instance.get_abilities(user)["set_role_to"]
-
-            if role and role not in can_set_role_to:
-                message = (
-                    f"You are only allowed to set role to {', '.join(can_set_role_to)}"
-                    if can_set_role_to
-                    else "You are not allowed to set this role for this team."
-                )
-                raise exceptions.PermissionDenied(message)
-
-        # Create
-        else:
-            try:
-                team_id = self.context["team_id"]
-            except KeyError as exc:
-                raise exceptions.ValidationError(
-                    "You must set a team ID in kwargs to create a new team access."
-                ) from exc
-
-            if not models.TeamAccess.objects.filter(
-                team=team_id,
-                user=user,
-                role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-            ).exists():
-                raise exceptions.PermissionDenied(
-                    "You are not allowed to manage accesses for this team."
-                )
-
-            if (
-                role == models.RoleChoices.OWNER
-                and not models.TeamAccess.objects.filter(
-                    team=team_id,
-                    user=user,
-                    role=models.RoleChoices.OWNER,
-                ).exists()
-            ):
-                raise exceptions.PermissionDenied(
-                    "Only owners of a team can assign other users as owners."
-                )
-
-        attrs["team_id"] = self.context["team_id"]
-        return attrs
-
-
-class TeamAccessReadOnlySerializer(TeamAccessSerializer):
-    """Serialize team accesses for list and retrieve actions."""
-
-    user = UserSerializer(read_only=True, fields=["id", "name", "email"])
-
-    class Meta:
-        model = models.TeamAccess
-        fields = [
-            "id",
-            "user",
-            "role",
-            "abilities",
-        ]
-        read_only_fields = [
-            "id",
-            "user",
-            "role",
-            "abilities",
-        ]
-
-
-class TeamSerializer(serializers.ModelSerializer):
-    """Serialize teams."""
-
-    abilities = serializers.SerializerMethodField(read_only=True)
-    is_visible_all_services = serializers.BooleanField(required=False, default=True)
-    service_providers = serializers.PrimaryKeyRelatedField(
-        queryset=ServiceProvider.objects.all(), many=True, required=False
-    )
-
-    class Meta:
-        model = models.Team
-        fields = [
-            "id",
-            "abilities",
-            "accesses",
-            "created_at",
-            "depth",
-            "is_visible_all_services",
-            "name",
-            "numchild",
-            "path",
-            "service_providers",
-            "updated_at",
-        ]
-        read_only_fields = [
-            "id",
-            "abilities",
-            "accesses",
-            "created_at",
-            "depth",
-            "numchild",
-            "path",
-            "updated_at",
-        ]
-
-    def create(self, validated_data):
-        """Create a new team with organization enforcement."""
-        # When called as a resource server, we enforce the team service provider
-        if sp_audience := self.context.get("from_service_provider_audience", None):
-            service_provider, _created = models.ServiceProvider.objects.get_or_create(
-                audience_id=sp_audience
-            )
-            validated_data["service_providers"] = [service_provider]
-
-        # Note: this is not the purpose of this API to check the user has an organization
-        return super().create(
-            validated_data=validated_data
-            | {"organization_id": self.context["request"].user.organization_id}
-        )
-
-    def get_abilities(self, team) -> dict:
-        """Return abilities of the logged-in user on the instance."""
-        request = self.context.get("request")
-        if request:
-            return team.get_abilities(request.user)
-        return {}
-
-
-class InvitationSerializer(serializers.ModelSerializer):
-    """Serialize invitations."""
-
-    class Meta:
-        model = models.Invitation
-        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
-        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
-
-    def validate(self, attrs):
-        """Validate and restrict invitation to new user based on email."""
-
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-
-        try:
-            team_id = self.context["team_id"]
-        except KeyError as exc:
-            raise exceptions.ValidationError(
-                "You must set a team ID in kwargs to create a new team invitation."
-            ) from exc
-
-        if not models.TeamAccess.objects.filter(
-            team=team_id,
-            user=user,
-            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-        ).exists():
-            raise exceptions.PermissionDenied(
-                "You are not allowed to manage invitation for this team."
-            )
-
-        attrs["team_id"] = team_id
-        attrs["issuer"] = user
-        return attrs
-
-
-class ServiceProviderSerializer(serializers.ModelSerializer):
-    """Serialize service providers."""
-
-    class Meta:
-        model = models.ServiceProvider
-        fields = ["id", "audience_id", "name"]
-        read_only_fields = ["id", "audience_id"]

src/backend/core/api/client/viewsets.py

@@ -1,673 +0,0 @@
-"""API endpoints"""
-
-import datetime
-import operator
-from functools import reduce
-
-from django.conf import settings
-from django.db.models import OuterRef, Q, Subquery, Value
-from django.db.models.functions import Coalesce
-from django.utils import timezone
-from django.utils.decorators import method_decorator
-from django.views.decorators.cache import cache_page
-
-from rest_framework import (
-    decorators,
-    exceptions,
-    filters,
-    mixins,
-    pagination,
-    response,
-    throttling,
-    views,
-    viewsets,
-)
-from rest_framework.permissions import AllowAny
-
-from core import models
-from core.api import permissions
-from core.api.client import serializers
-from core.utils.raw_sql import gen_sql_filter_json_array
-
-from mailbox_manager import enums
-from mailbox_manager import models as domains_models
-
-
-class NestedGenericViewSet(viewsets.GenericViewSet):
-    """
-    A generic Viewset aims to be used in a nested route context.
-    e.g: `/api/v1.0/resource_1/<resource_1_pk>/resource_2/<resource_2_pk>/`
-
-    It allows to define all url kwargs and lookup fields to perform the lookup.
-    """
-
-    lookup_fields: list[str] = ["pk"]
-    lookup_url_kwargs: list[str] = []
-
-    def __getattribute__(self, item):
-        """
-        This method is overridden to allow to get the last lookup field or lookup url kwarg
-        when accessing the `lookup_field` or `lookup_url_kwarg` attribute. This is useful
-        to keep compatibility with all methods used by the parent class `GenericViewSet`.
-        """
-        if item in ["lookup_field", "lookup_url_kwarg"]:
-            return getattr(self, item + "s", [None])[-1]
-
-        return super().__getattribute__(item)
-
-    def get_queryset(self):
-        """
-        Get the list of items for this view.
-
-        `lookup_fields` attribute is enumerated here to perform the nested lookup.
-        """
-        queryset = super().get_queryset()
-
-        # The last lookup field is removed to perform the nested lookup as it corresponds
-        # to the object pk, it is used within get_object method.
-        lookup_url_kwargs = (
-            self.lookup_url_kwargs[:-1]
-            if self.lookup_url_kwargs
-            else self.lookup_fields[:-1]
-        )
-
-        filter_kwargs = {}
-        for index, lookup_url_kwarg in enumerate(lookup_url_kwargs):
-            if lookup_url_kwarg not in self.kwargs:
-                raise KeyError(
-                    f"Expected view {self.__class__.__name__} to be called with a URL "
-                    f'keyword argument named "{lookup_url_kwarg}". Fix your URL conf, or '
-                    "set the `.lookup_fields` attribute on the view correctly."
-                )
-
-            filter_kwargs.update(
-                {self.lookup_fields[index]: self.kwargs[lookup_url_kwarg]}
-            )
-
-        return queryset.filter(**filter_kwargs)
-
-
-class SerializerPerActionMixin:
-    """
-    A mixin to allow to define serializer classes for each action.
-
-    This mixin is useful to avoid to define a serializer class for each action in the
-    `get_serializer_class` method.
-
-    Example:
-    ```
-    class MyViewSet(SerializerPerActionMixin, viewsets.GenericViewSet):
-        serializer_class = MySerializer
-        list_serializer_class = MyListSerializer
-        retrieve_serializer_class = MyRetrieveSerializer
-    ```
-    """
-
-    def get_serializer_class(self):
-        """
-        Return the serializer class to use depending on the action.
-        """
-        if serializer_class := getattr(self, f"{self.action}_serializer_class", None):
-            return serializer_class
-        return super().get_serializer_class()
-
-
-class Pagination(pagination.PageNumberPagination):
-    """Pagination to display no more than 100 objects per page sorted by creation date."""
-
-    max_page_size = 100
-    page_size_query_param = "page_size"
-
-
-class BurstRateThrottle(throttling.UserRateThrottle):
-    """
-    Throttle rate for minutes. See DRF section in settings for default value.
-    """
-
-    scope = "burst"
-
-
-class SustainedRateThrottle(throttling.UserRateThrottle):
-    """
-    Throttle rate for hours. See DRF section in settings for default value.
-    """
-
-    scope = "sustained"
-
-
-# pylint: disable=too-many-ancestors
-class ContactViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """Contact ViewSet"""
-
-    permission_classes = [permissions.AccessPermission]
-    queryset = models.Contact.objects.select_related("user", "owner").all()
-    serializer_class = serializers.ContactSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    ordering_fields = ["full_name", "short_name", "created_at"]
-    ordering = ["full_name"]
-
-    def list(self, request, *args, **kwargs):
-        """Limit listed users by a query with throttle protection."""
-        user = self.request.user
-        queryset = self.filter_queryset(self.get_queryset())
-
-        # List only contacts that:
-        queryset = queryset.filter(
-            # - is public (owner is None)
-            Q(owner__isnull=True)
-            # - are owned by the user
-            | Q(owner=user)
-            # - are profile contacts for a user from the same organization
-            | Q(user__organization_id=user.organization_id),
-            # - are not overriden by another contact
-            overridden_by__isnull=True,
-        )
-
-        # Search by case-insensitive and accent-insensitive on:
-        # - full name
-        # - short name
-        # - email (from data `emails` field)
-        if query := self.request.GET.get("q", ""):
-            queryset = queryset.filter(
-                Q(full_name__unaccent__icontains=query)
-                | Q(short_name__unaccent__icontains=query)
-                | Q(
-                    id__in=gen_sql_filter_json_array(
-                        queryset.model,
-                        "data->'emails'",
-                        "value",
-                        query,
-                    )
-                )
-            )
-
-        serializer = self.get_serializer(queryset, many=True)
-        return response.Response(serializer.data)
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created contact."""
-        user = self.request.user
-        serializer.validated_data["owner"] = user
-        return super().perform_create(serializer)
-
-
-class OrganizationViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    Organization ViewSet
-
-    GET /api/organizations/<organization_id>/
-        Return the organization details for the given id.
-
-    PUT /api/organizations/<organization_id>/
-        Update the organization details for the given id.
-
-    PATCH /api/organizations/<organization_id>/
-        Partially update the organization details for the given id.
-    """
-
-    permission_classes = [permissions.AccessPermission]
-    queryset = models.Organization.objects.all()
-    serializer_class = serializers.OrganizationSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-
-    def get_queryset(self):
-        """Limit listed organizations to the one the user belongs to."""
-        return (
-            super()
-            .get_queryset()
-            .filter(pk=self.request.user.organization_id)
-            .annotate(
-                user_role=Subquery(
-                    models.OrganizationAccess.objects.filter(
-                        user=self.request.user, organization=OuterRef("pk")
-                    ).values("role")[:1]
-                )
-            )
-        )
-
-
-class UserViewSet(
-    SerializerPerActionMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-    mixins.ListModelMixin,
-):
-    """
-    User viewset for all interactions with user infos and teams.
-
-    GET /api/users/&q=query
-        Return a list of users whose email or name matches the query.
-    """
-
-    permission_classes = [permissions.IsSelf]
-    queryset = (
-        models.User.objects.select_related("organization").all().order_by("-created_at")
-    )
-    serializer_class = serializers.UserSerializer
-    get_me_serializer_class = serializers.UserMeSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    pagination_class = Pagination
-
-    def get_queryset(self):
-        """Limit listed users by a query. Pagination and throttle protection apply."""
-        queryset = self.queryset
-
-        if self.action == "list":
-            # Filter active users
-            # and users from same organization
-            queryset = queryset.filter(
-                is_active=True, organization_id=self.request.user.organization_id
-            )
-
-            # Exclude all users already in the given team
-            if team_id := self.request.GET.get("team_id", ""):
-                queryset = queryset.exclude(teams__id=team_id)
-
-            # Search by case-insensitive and accent-insensitive
-            if query := self.request.GET.get("q", ""):
-                queryset = queryset.filter(
-                    Q(name__unaccent__icontains=query)
-                    | Q(email__unaccent__icontains=query)
-                )
-
-        return queryset
-
-    @decorators.action(
-        detail=False,
-        methods=["get"],
-        url_name="me",
-        url_path="me",
-    )
-    def get_me(self, request):
-        """
-        Return information on currently logged user
-        """
-        user = request.user
-        return response.Response(self.get_serializer(user).data)
-
-
-class TeamViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """Team ViewSet"""
-
-    permission_classes = [permissions.TeamPermission, permissions.AccessPermission]
-    serializer_class = serializers.TeamSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at", "name", "path"]
-    ordering = ["-created_at"]
-    queryset = models.Team.objects.all()
-    pagination_class = None
-
-    def get_queryset(self):
-        """Custom queryset to get user related teams."""
-        teams_queryset = models.Team.objects.filter(
-            accesses__user=self.request.user,
-        )
-        depth_path = teams_queryset.values("depth", "path")
-
-        if not depth_path:
-            return models.Team.objects.none()
-
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=OuterRef("pk")
-        ).values("role")[:1]
-
-        return (
-            models.Team.objects.prefetch_related("accesses", "service_providers")
-            .filter(
-                reduce(
-                    operator.or_,
-                    (
-                        Q(
-                            # The team the user has access to
-                            depth=d["depth"],
-                            path=d["path"],
-                        )
-                        | Q(
-                            # The parent team the user has access to
-                            depth__lt=d["depth"],
-                            path__startswith=d["path"][: models.Team.steplen],
-                            organization_id=self.request.user.organization_id,
-                        )
-                        for d in depth_path
-                    ),
-                ),
-            )
-            # Abilities are computed based on logged-in user's role for the team
-            # and if the user does not have access, it's ok to consider them as a member
-            # because it's a parent team.
-            .annotate(
-                user_role=Coalesce(
-                    Subquery(user_role_query), Value(models.RoleChoices.MEMBER.value)
-                )
-            )
-        )
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created team."""
-        team = serializer.save()
-        models.TeamAccess.objects.create(
-            team=team,
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-        )
-
-
-class TeamAccessViewSet(
-    mixins.CreateModelMixin,
-    mixins.DestroyModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    API ViewSet for all interactions with team accesses.
-
-    GET /api/v1.0/teams/<team_id>/accesses/:<team_access_id>
-        Return list of all team accesses related to the logged-in user or one
-        team access if an id is provided.
-
-    POST /api/v1.0/teams/<team_id>/accesses/ with expected data:
-        - user: str
-        - role: str [owner|admin|member]
-        Return newly created team access
-
-    PUT /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
-        - role: str [owner|admin|member]
-        Return updated team access
-
-    PATCH /api/v1.0/teams/<team_id>/accesses/<team_access_id>/ with expected data:
-        - role: str [owner|admin|member]
-        Return partially updated team access
-
-    DELETE /api/v1.0/teams/<team_id>/accesses/<team_access_id>/
-        Delete targeted team access
-    """
-
-    lookup_field = "pk"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    queryset = (
-        models.TeamAccess.objects.all().select_related("user").order_by("-created_at")
-    )
-    list_serializer_class = serializers.TeamAccessReadOnlySerializer
-    detail_serializer_class = serializers.TeamAccessSerializer
-
-    filter_backends = [filters.OrderingFilter]
-    ordering = ["role"]
-    ordering_fields = ["role", "user__email", "user__name"]
-
-    def get_permissions(self):
-        """User only needs to be authenticated to list team accesses"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_serializer_class(self):
-        """Chooses list or detail serializer according to the action."""
-        if self.action in {"list", "retrieve"}:
-            return self.list_serializer_class
-        return self.detail_serializer_class
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(team=self.kwargs["team_id"])
-
-        if self.action in {"list", "retrieve"}:
-            if query := self.request.GET.get("q", ""):
-                queryset = queryset.filter(
-                    Q(user__email__unaccent__icontains=query)
-                    | Q(user__name__unaccent__icontains=query)
-                )
-
-            # Determine which role the logged-in user has in the team
-            user_role_query = models.TeamAccess.objects.filter(
-                user=self.request.user, team=self.kwargs["team_id"]
-            ).values("role")[:1]
-
-            queryset = (
-                # The logged-in user should be part of a team to see its accesses
-                queryset.filter(
-                    team__accesses__user=self.request.user,
-                )
-                # Abilities are computed based on logged-in user's role and
-                # the user role on each team access
-                .annotate(
-                    user_role=Subquery(user_role_query),
-                )
-                .select_related("user")
-                .distinct()
-            )
-        return queryset
-
-    def destroy(self, request, *args, **kwargs):
-        """Forbid deleting the last owner access"""
-        instance = self.get_object()
-        team = instance.team
-
-        # Check if the access being deleted is the last owner access for the team
-        if instance.role == "owner" and team.accesses.filter(role="owner").count() == 1:
-            return response.Response(
-                {"detail": "Cannot delete the last owner access for the team."},
-                status=400,
-            )
-
-        return super().destroy(request, *args, **kwargs)
-
-    def perform_update(self, serializer):
-        """Check that we don't change the role if it leads to losing the last owner."""
-        instance = serializer.instance
-
-        # Check if the role is being updated and the new role is not "owner"
-        if (
-            "role" in self.request.data
-            and self.request.data["role"] != models.RoleChoices.OWNER
-        ):
-            team = instance.team
-            # Check if the access being updated is the last owner access for the team
-            if (
-                instance.role == models.RoleChoices.OWNER
-                and team.accesses.filter(role=models.RoleChoices.OWNER).count() == 1
-            ):
-                message = "Cannot change the role to a non-owner role for the last owner access."
-                raise exceptions.ValidationError({"role": message})
-
-        serializer.save()
-
-
-class InvitationViewset(
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """API ViewSet for user invitations to team.
-
-    GET /api/v1.0/teams/<team_id>/invitations/:<invitation_id>/
-        Return list of invitations related to that team or or one
-        team access if an id is provided.
-
-    POST /api/v1.0/teams/<team_id>/invitations/ with expected data:
-        - email: str
-        - role: str [owner|admin|member]
-        - issuer : User, automatically added from user making query, if allowed
-        - team : Team, automatically added from requested URI
-        Return newly created invitation
-
-    PUT / PATCH : Not permitted. Instead of updating your invitation,
-        delete and create a new one.
-
-    DELETE  /api/v1.0/teams/<team_id>/invitations/<invitation_id>/
-        Delete targeted invitation
-    """
-
-    lookup_field = "id"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    queryset = (
-        models.Invitation.objects.all().select_related("team").order_by("-created_at")
-    )
-    serializer_class = serializers.InvitationSerializer
-
-    def get_permissions(self):
-        """User only needs to be authenticated to list invitations"""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        else:
-            return super().get_permissions()
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(team=self.kwargs["team_id"])
-
-        if self.action == "list":
-            # Determine which role the logged-in user has in the team
-            user_role_query = models.TeamAccess.objects.filter(
-                user=self.request.user, team=self.kwargs["team_id"]
-            ).values("role")[:1]
-
-            queryset = (
-                # The logged-in user should be part of a team to see its accesses
-                queryset.filter(
-                    team__accesses__user=self.request.user,
-                )
-                # Abilities are computed based on logged-in user's role and
-                # the user role on each team access
-                .annotate(user_role=Subquery(user_role_query))
-                .distinct()
-            )
-        return queryset
-
-
-class ConfigView(views.APIView):
-    """API ViewSet for sharing some public settings."""
-
-    permission_classes = [AllowAny]
-
-    def get(self, request):
-        """
-        GET /api/v1.0/config/
-            Return a dictionary of public settings.
-        """
-        array_settings = [
-            "LANGUAGES",
-            "FEATURES",
-            "RELEASE",
-            "COMMIT",
-            "CRISP_WEBSITE_ID",
-        ]
-        dict_settings = {}
-        for setting in array_settings:
-            dict_settings[setting] = getattr(settings, setting)
-
-        return response.Response(dict_settings)
-
-
-class StatView(views.APIView):
-    """API ViewSet for sharing some public metrics."""
-
-    permission_classes = [AllowAny]
-
-    @method_decorator(cache_page(3600))
-    def get(self, request):
-        """
-        GET /api/v1.0/stats/
-            Return a dictionary of public metrics.
-        """
-        context = {
-            "total_users": models.User.objects.count(),
-            "mau": models.User.objects.filter(
-                last_login__gte=timezone.now() - datetime.timedelta(30)
-            ).count(),
-            "teams": models.Team.objects.count(),
-            "active_domains": domains_models.MailDomain.objects.filter(
-                status=enums.MailDomainStatusChoices.ENABLED
-            ).count(),
-            "mailboxes": domains_models.Mailbox.objects.count(),
-            "aliases": domains_models.Alias.objects.count(),
-        }
-        return response.Response(context)
-
-
-class ServiceProviderFilter(filters.BaseFilterBackend):
-    """
-    Filter service providers.
-    """
-
-    def filter_queryset(self, request, queryset, view):
-        """
-        Filter service providers by audience or name.
-        """
-        if name := request.GET.get("name"):
-            queryset = queryset.filter(name__icontains=name)
-        if audience_id := request.GET.get("audience_id"):
-            queryset = queryset.filter(audience_id=audience_id)
-        return queryset
-
-
-class ServiceProviderViewSet(
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    API ViewSet for all interactions with service providers.
-
-    GET /api/v1.0/service-providers/
-        Return a list of service providers.
-
-    GET /api/v1.0/service-providers/<service_provider_id>/
-        Return a service provider.
-    """
-
-    permission_classes = [permissions.IsAuthenticated]
-    queryset = models.ServiceProvider.objects.all()
-    serializer_class = serializers.ServiceProviderSerializer
-    throttle_classes = [BurstRateThrottle, SustainedRateThrottle]
-    pagination_class = Pagination
-    filter_backends = [filters.OrderingFilter, ServiceProviderFilter]
-    ordering = ["name"]
-    ordering_fields = ["name", "created_at"]
-
-    def get_queryset(self):
-        """Filter the queryset to limit results to user's organization."""
-        queryset = super().get_queryset()
-        queryset = queryset.filter(organizations__id=self.request.user.organization_id)
-        return queryset

src/backend/core/api/permissions.py

@@ -1,97 +0,0 @@
-"""Permission handlers for the People core app."""
-
-from django.core import exceptions
-
-from rest_framework import permissions
-
-from core import models
-
-
-class IsAuthenticated(permissions.BasePermission):
-    """
-    Allows access only to authenticated users. Alternative method checking the presence
-    of the auth token to avoid hitting the database.
-    """
-
-    def has_permission(self, request, view):
-        """Check auth token first."""
-        return bool(request.auth) if request.auth else request.user.is_authenticated
-
-
-class IsSelf(IsAuthenticated):
-    """
-    Allows access only to user's own data.
-    """
-
-    def has_object_permission(self, request, view, obj):
-        """Write permissions are only allowed to the user itself."""
-        return obj == request.user
-
-
-class IsOwnedOrPublic(IsAuthenticated):
-    """
-    Allows access to authenticated users only for objects that are owned or not related
-    to any user via the "owner" field.
-    """
-
-    def has_object_permission(self, request, view, obj):
-        """Unsafe permissions are only allowed for the owner of the object."""
-        if obj.owner == request.user:
-            return True
-
-        if request.method in permissions.SAFE_METHODS and obj.owner is None:
-            return True
-
-        try:
-            return obj.user == request.user
-        except exceptions.ObjectDoesNotExist:
-            return False
-
-
-class AccessPermission(IsAuthenticated):
-    """Permission class for access objects."""
-
-    def has_object_permission(self, request, view, obj):
-        """Check permission for a given object."""
-        abilities = obj.get_abilities(request.user)
-        return abilities.get(request.method.lower(), False)
-
-
-class TeamPermission(IsAuthenticated):
-    """Permission class for team objects viewset."""
-
-    def has_permission(self, request, view):
-        """Check permission only when the user tries to create a new team."""
-        if not super().has_permission(request, view):
-            return False
-
-        if request.method != "POST":
-            return True
-
-        abilities = request.user.get_abilities()
-        return abilities["teams"]["can_create"]
-
-
-class TeamInvitationCreationPermission(IsAuthenticated):
-    """Permission class that allows only team owners and admins to perform actions."""
-
-    def has_permission(self, request, view):
-        """Check if user is authenticated and has required role for the team."""
-        if not super().has_permission(request, view):
-            return False
-
-        # Only check roles for edition operations
-        if request.method in permissions.SAFE_METHODS:
-            return True
-
-        team_id = view.kwargs.get("team_id")
-        if not team_id:
-            return False
-
-        team_access = models.TeamAccess.objects.filter(
-            team_id=team_id,
-            user=request.user,
-            role__in=[models.RoleChoices.OWNER, models.RoleChoices.ADMIN],
-        ).exists()
-
-        return team_access

src/backend/core/api/resource_server/__init__.py

@@ -1 +0,0 @@
-"""People core resource server API endpoints"""

src/backend/core/api/resource_server/scim/__init__.py

@@ -1 +0,0 @@
-"""SCIM compliant API for resource server"""

src/backend/core/api/resource_server/scim/exceptions.py

@@ -1,16 +0,0 @@
-"""Exceptions for SCIM API."""
-
-from django.conf import settings
-
-from core.api.resource_server.scim.response import ScimJsonResponse
-
-
-def scim_exception_handler(exc, _context):
-    """Handle SCIM exceptions and return them in the correct format."""
-    data = {
-        "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
-        "status": str(exc.status_code),
-        "detail": str(exc.detail) if settings.DEBUG else "",
-    }
-
-    return ScimJsonResponse(data, status=exc.status_code)

src/backend/core/api/resource_server/scim/response.py

@@ -1,16 +0,0 @@
-"""SCIM API response classes."""
-
-from rest_framework.response import Response
-
-
-class ScimJsonResponse(Response):
-    """
-    Custom JSON response class for SCIM API.
-
-    This class sets the content type to "application/json+scim" for SCIM
-    responses.
-    """
-
-    def __init__(self, *args, **kwargs):
-        """JSON response with enforced SCIM content type."""
-        super().__init__(*args, content_type="application/json+scim", **kwargs)

src/backend/core/api/resource_server/scim/serializers.py

@@ -1,90 +0,0 @@
-"""SCIM serializers for resource server API."""
-
-from django.urls import reverse
-
-from rest_framework import serializers
-
-from core import models
-
-
-class SCIMUserSerializer(serializers.ModelSerializer):
-    """Serialize users in SCIM format."""
-
-    schemas = serializers.SerializerMethodField()
-    userName = serializers.CharField(source="sub")
-    displayName = serializers.CharField(source="name")
-    emails = serializers.SerializerMethodField()
-    meta = serializers.SerializerMethodField()
-    groups = serializers.SerializerMethodField()
-    active = serializers.BooleanField(source="is_active")
-
-    class Meta:
-        model = models.User
-        fields = [
-            "id",
-            "schemas",
-            "active",
-            "userName",
-            "displayName",
-            "emails",
-            "groups",
-            "meta",
-        ]
-        read_only_fields = [
-            "id",
-            "schemas",
-            "active",
-            "userName",
-            "displayName",
-            "emails",
-            "groups",
-            "meta",
-        ]
-
-    def get_schemas(self, _obj):
-        """Return the SCIM schemas for the user."""
-        return ["urn:ietf:params:scim:schemas:core:2.0:User"]
-
-    def get_emails(self, obj):
-        """Return the user's email as a list of email objects."""
-        if obj.email:
-            return [
-                {
-                    "value": obj.email,
-                    "primary": True,
-                    "type": "work",
-                }
-            ]
-        return []
-
-    def get_groups(self, obj):
-        """
-        Return the groups the user belongs to.
-
-        WARNING: you need to prefetch the team accesses in the
-        viewset to avoid N+1 queries.
-        """
-        return [
-            {
-                "value": str(team_access.team.external_id),
-                "display": team_access.team.name,
-                "type": "direct",
-            }
-            for team_access in obj.accesses.all()
-        ]
-
-    def get_meta(self, obj):
-        """Return metadata about the user."""
-        request = self.context.get("request")
-        location = (
-            f"{request.build_absolute_uri('/').rstrip('/')}{reverse('scim-me-list')}"
-            if request
-            else None
-        )
-
-        return {
-            "resourceType": "User",
-            "created": obj.created_at.isoformat(),
-            "lastModified": obj.updated_at.isoformat(),
-            "location": location,
-        }

src/backend/core/api/resource_server/scim/viewsets.py

@@ -1,62 +0,0 @@
-"""Resource server SCIM API endpoints"""
-
-from django.contrib.auth import get_user_model
-from django.db.models import Prefetch, Q
-
-from lasuite.oidc_resource_server.mixins import ResourceServerMixin
-from rest_framework import (
-    viewsets,
-)
-
-from core.api import permissions
-from core.models import TeamAccess
-
-from . import serializers
-from .exceptions import scim_exception_handler
-from .response import ScimJsonResponse
-
-User = get_user_model()
-
-
-class MeViewSet(ResourceServerMixin, viewsets.ViewSet):
-    """
-    SCIM-compliant ViewSet for the /Me endpoint.
-
-    This endpoint provides information about the currently authenticated user
-    in SCIM (System for Cross-domain Identity Management) format.
-
-    Features:
-    - Returns user details in SCIM format.
-    - Includes the user's teams, restricted to the audience.
-
-    Limitations:
-    - Does not currently support managing Team hierarchies.
-
-    Endpoint:
-    GET /resource-server/v1.0/scim/Me/
-        Retrieves the authenticated user's details and associated teams.
-    """
-
-    permission_classes = [permissions.IsAuthenticated]
-    serializer_class = serializers.SCIMUserSerializer
-
-    def get_exception_handler(self):
-        """Override the default exception handler to use SCIM-specific handling."""
-        return scim_exception_handler
-
-    def list(self, request, *args, **kwargs):
-        """Return the current user's details in SCIM format."""
-        service_provider_audience = self._get_service_provider_audience()
-
-        user = User.objects.prefetch_related(
-            Prefetch(
-                "accesses",
-                queryset=TeamAccess.objects.select_related("team").filter(
-                    Q(team__service_providers__audience_id=service_provider_audience)
-                    | Q(team__is_visible_all_services=True)
-                ),
-            )
-        ).get(pk=request.user.pk)
-
-        serializer = self.serializer_class(user, context={"request": request})
-        return ScimJsonResponse(serializer.data)

src/backend/core/api/resource_server/serializers.py

@@ -1,78 +0,0 @@
-"""Client serializers for the People core app resource server API."""
-
-from rest_framework import serializers
-
-from core import models
-
-
-class TeamSerializer(serializers.ModelSerializer):
-    """Serialize teams."""
-
-    class Meta:
-        model = models.Team
-        fields = [
-            "id",
-            "created_at",
-            "depth",
-            "is_visible_all_services",
-            "name",
-            "numchild",
-            "path",
-            "updated_at",
-        ]
-        read_only_fields = [
-            "id",
-            "created_at",
-            "depth",
-            "numchild",
-            "path",
-            "updated_at",
-        ]
-
-    def create(self, validated_data):
-        """
-        Create a new team with organization enforcement.
-
-        In this context, called as a resource server,
-        the team service provider is enforced.
-
-        When the service provider audience is unknown it is created on the fly.
-        """
-        sp_audience = self.context["from_service_provider_audience"]
-        service_provider, _created = models.ServiceProvider.objects.get_or_create(
-            audience_id=sp_audience
-        )
-
-        # Note: this is not the purpose of this API to check the user has an organization
-        return super().create(
-            validated_data=validated_data
-            | {
-                "organization_id": self.context["request"].user.organization_id,
-                "service_providers": [service_provider],
-            },
-        )
-
-
-class InvitationSerializer(serializers.ModelSerializer):
-    """Serialize invitations."""
-
-    class Meta:
-        model = models.Invitation
-        fields = ["id", "created_at", "email", "team", "role", "issuer", "is_expired"]
-        read_only_fields = ["id", "created_at", "team", "issuer", "is_expired"]
-
-    def validate(self, attrs):
-        """Fill team and issuer from request."""
-        is_team_available_for_service_provider = models.Team.objects.filter(
-            id=self.context["team_id"],
-            service_providers__audience_id=self.context[
-                "from_service_provider_audience"
-            ],
-        ).exists()
-        if not is_team_available_for_service_provider:
-            raise serializers.ValidationError({"team": "Team not found."})
-
-        attrs["team_id"] = self.context["team_id"]
-        attrs["issuer"] = self.context["request"].user  # User is authenticated
-
-        return attrs

src/backend/core/api/resource_server/viewsets.py

@@ -1,202 +0,0 @@
-"""Resource server API endpoints"""
-
-import operator
-from functools import reduce
-
-from django.db.models import OuterRef, Prefetch, Q, Subquery, Value
-from django.db.models.functions import Coalesce
-
-from lasuite.oidc_resource_server.mixins import ResourceServerMixin
-from rest_framework import (
-    filters,
-    mixins,
-    viewsets,
-)
-
-from core import models
-from core.api import permissions
-from core.api.client.viewsets import Pagination
-
-from . import serializers
-
-
-class TeamViewSet(  # pylint: disable=too-many-ancestors
-    ResourceServerMixin,
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    viewsets.GenericViewSet,
-):
-    """
-    Team ViewSet dedicated to the resource server.
-
-    The DELETE method is not allowed for now, because the use case is
-    not clear yet and it comes with complexity to know if we can delete
-    a team or not (eg. if a team has other SP, it might not be deleted
-    but what do we do then, only remove the current SP?).
-
-    GET /resource-server/v1.0/teams/
-        Return list of Teams of the user and available for the audience.
-
-    POST /resource-server/v1.0/teams/
-        Create a new Team for the user for the audience.
-
-    GET /resource-server/v1.0/teams/{team_id}/
-        Return the Team details if available for the audience.
-
-    PUT /resource-server/v1.0/teams/{team_id}/
-        Update the Team details (only name for now).
-
-    """
-
-    permission_classes = [permissions.AccessPermission]
-    serializer_class = serializers.TeamSerializer
-    filter_backends = [filters.OrderingFilter]
-    ordering_fields = ["created_at"]
-    ordering = ["-created_at"]
-    queryset = models.Team.objects.all()
-    pagination_class = Pagination
-
-    def get_queryset(self):
-        """Custom queryset to get user related teams."""
-        teams_queryset = models.Team.objects.filter(
-            accesses__user=self.request.user,
-        )
-        depth_path = teams_queryset.values("depth", "path")
-
-        if not depth_path:
-            return models.Team.objects.none()
-
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=OuterRef("pk")
-        ).values("role")[:1]
-
-        service_provider_audience = self._get_service_provider_audience()
-        service_provider_prefetch = Prefetch(
-            "service_providers",
-            queryset=models.ServiceProvider.objects.filter(
-                audience_id=service_provider_audience
-            ),
-        )
-
-        return (
-            models.Team.objects.prefetch_related(
-                "accesses",
-                service_provider_prefetch,
-            )
-            .filter(
-                reduce(
-                    operator.or_,
-                    (
-                        Q(
-                            # The team the user has access to
-                            depth=d["depth"],
-                            path=d["path"],
-                        )
-                        | Q(
-                            # The parent team the user has access to
-                            depth__lt=d["depth"],
-                            path__startswith=d["path"][: models.Team.steplen],
-                            organization_id=self.request.user.organization_id,
-                        )
-                        for d in depth_path
-                    ),
-                ),
-                Q(service_providers__audience_id=service_provider_audience)
-                | Q(is_visible_all_services=True),
-            )
-            # Abilities are computed based on logged-in user's role for the team
-            # and if the user does not have access, it's ok to consider them as a member
-            # because it's a parent team.
-            .annotate(
-                user_role=Coalesce(
-                    Subquery(user_role_query), Value(models.RoleChoices.MEMBER.value)
-                )
-            )
-        )
-
-    def perform_create(self, serializer):
-        """Set the current user as owner of the newly created team."""
-        team = serializer.save()
-        models.TeamAccess.objects.create(
-            team=team,
-            user=self.request.user,
-            role=models.RoleChoices.OWNER,
-        )
-
-
-class InvitationViewset(  # pylint: disable=too-many-ancestors
-    ResourceServerMixin,
-    mixins.CreateModelMixin,
-    mixins.ListModelMixin,
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    viewsets.GenericViewSet,
-):
-    """API ViewSet for user invitations to team via resource server.
-
-    GET /resource-server/v1.0/teams/<team_id>/invitations/:<invitation_id>/
-        Return list of invitations related to that team or one
-        team access if an id is provided.
-
-    POST /resource-server/v1.0/teams/<team_id>/invitations/ with expected data:
-        - email: str
-        - role: str [owner|admin|member]
-        - issuer : User, automatically added from user making query, if allowed
-        - team : Team, automatically added from requested URI
-        Return newly created invitation
-
-    PUT / PATCH : Not permitted. Instead of updating your invitation,
-        delete and create a new one.
-
-    DELETE  /resource-server/v1.0/teams/<team_id>/invitations/<invitation_id>/
-        Delete targeted invitation
-    """
-
-    lookup_field = "id"
-    pagination_class = Pagination
-    permission_classes = [permissions.AccessPermission]
-    serializer_class = serializers.InvitationSerializer
-
-    def get_permissions(self):
-        """Set specific permissions based on the action."""
-        if self.action == "list":
-            permission_classes = [permissions.IsAuthenticated]
-        elif self.action == "create":
-            permission_classes = [permissions.TeamInvitationCreationPermission]
-        else:
-            permission_classes = [permissions.AccessPermission]
-
-        return [permission() for permission in permission_classes]
-
-    def get_serializer_context(self):
-        """Extra context provided to the serializer class."""
-        context = super().get_serializer_context()
-        context["team_id"] = self.kwargs["team_id"]
-        return context
-
-    def get_queryset(self):
-        """Return the queryset according to the action."""
-        service_provider_audience = self._get_service_provider_audience()
-
-        # Determine which role the logged-in user has in the team
-        user_role_query = models.TeamAccess.objects.filter(
-            user=self.request.user, team=self.kwargs["team_id"]
-        ).values("role")[:1]
-
-        queryset = (
-            models.Invitation.objects.select_related("team")
-            .filter(
-                team=self.kwargs["team_id"],
-                # The logged-in user should be part of a team to see its accesses
-                team__accesses__user=self.request.user,
-                # The team should be accessible by the service provider audience
-                team__service_providers__audience_id=service_provider_audience,
-            )
-            .annotate(user_role=Subquery(user_role_query))
-            .order_by("-created_at")
-            .distinct()
-        )
-
-        return queryset

src/backend/core/apps.py

@@ -1,69 +0,0 @@
-"""People Core application"""
-
-import logging
-
-from django.apps import AppConfig
-from django.conf import settings
-from django.core.management import call_command, get_commands
-from django.utils.translation import gettext_lazy as _
-
-from core.utils.io import TeeStringIO
-
-from people.celery_app import app as celery_app
-
-logger = logging.getLogger(__name__)
-
-
-def _register_management_commands_as_task():
-    """
-    Register management command which are enabled via MANAGEMENT_COMMAND_AS_TASK setting.
-    """
-    for command_name in settings.MANAGEMENT_COMMAND_AS_TASK:
-        # Check if the command is a valid management command
-        try:
-            app_name = get_commands()[command_name]
-        except KeyError:
-            logging.error("Command %s is not a valid management command.", command_name)
-            continue
-
-        command_full_name = ".".join([app_name, command_name])
-
-        # Create a closure to capture the current value of command_full_name and command_name
-        def create_task(cmd_name, cmd_full_name):
-            @celery_app.task(name=cmd_full_name)
-            def task_wrapper(*command_args, **command_options):
-                stdout = TeeStringIO(logging.getLogger(cmd_full_name).info)
-                stderr = TeeStringIO(logging.getLogger(cmd_full_name).error)
-
-                call_command(
-                    cmd_name,
-                    *command_args,
-                    no_color=True,
-                    stdout=stdout,
-                    stderr=stderr,
-                    **command_options,
-                )
-
-                stdout.seek(0)
-                stderr.seek(0)
-                return {
-                    "stdout": str(stdout.read()),
-                    "stderr": str(stderr.read()),
-                }
-
-            return task_wrapper
-
-        # Create the task with the current values
-        create_task(command_name, command_full_name)
-
-
-class CoreConfig(AppConfig):
-    """Configuration class for the People core app."""
-
-    name = "core"
-    app_label = "core"
-    verbose_name = _("People core application")
-
-    def ready(self):
-        """Run when the application is ready."""
-        _register_management_commands_as_task()

src/backend/core/authentication/__init__.py

@@ -1 +0,0 @@
-"""Authentication module."""

src/backend/core/authentication/backends.py

@@ -1,186 +0,0 @@
-"""Authentication Backends for the People core app."""
-
-import logging
-
-from django.conf import settings
-from django.core.exceptions import SuspiciousOperation
-from django.utils.translation import gettext_lazy as _
-
-from lasuite.oidc_login.backends import (
-    OIDCAuthenticationBackend as LaSuiteOIDCAuthenticationBackend,
-)
-from lasuite.tools.email import get_domain_from_email
-from rest_framework.authentication import BaseAuthentication
-from rest_framework.exceptions import AuthenticationFailed
-
-from core.models import (
-    AccountService,
-    Contact,
-    Organization,
-)
-
-logger = logging.getLogger(__name__)
-
-
-class OIDCAuthenticationBackend(LaSuiteOIDCAuthenticationBackend):
-    """Custom OpenID Connect (OIDC) Authentication Backend.
-
-    This class overrides the default OIDC Authentication Backend to accommodate differences
-    in the User model, and handles signed and/or encrypted UserInfo response.
-    """
-
-    def get_extra_claims(self, user_info):
-        """
-        Return extra claims from user_info.
-
-        Args:
-          user_info (dict): The user information dictionary.
-
-        Returns:
-          dict: A dictionary of extra claims.
-
-        """
-        extra_claims = super().get_extra_claims(user_info)
-        if settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD:
-            extra_claims[settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD] = (
-                user_info.get(settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD)
-            )
-        return extra_claims
-
-    def post_get_or_create_user(self, user, claims, is_new_user):
-        """
-        Post-processing after user creation or retrieval.
-
-        Args:
-          user (User): The user instance.
-          claims (dict): The claims dictionary.
-          is_new_user (bool): Indicates if the user was newly created.
-
-        Returns:
-        - None
-
-        """
-        # Data cleaning, to be removed when user organization is null=False
-        # or all users have an organization.
-        # See https://github.com/suitenumerique/people/issues/504
-        if not user.organization_id:
-            organization_registration_id = claims.get(
-                settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD
-            )
-            domain = get_domain_from_email(claims["email"])
-            try:
-                organization, organization_created = (
-                    Organization.objects.get_or_create_from_user_claims(
-                        registration_id=organization_registration_id,
-                        domain=domain,
-                    )
-                )
-                if organization_created:
-                    logger.info("Organization %s created", organization)
-                    # For this case, we don't create an OrganizationAccess we will
-                    # manage this manually later, because we don't want the first
-                    # user who log in after the release to be the admin of their
-                    # organization. We will keep organization without admin, and
-                    # we will have to manually clean things up (while there is
-                    # not that much organization in the database).
-            except ValueError as exc:
-                # Raised when there is no recognizable organization
-                # identifier (domain or registration_id)
-                logger.warning("Unable to update user organization: %s", exc)
-            else:
-                user.organization = organization
-                user.save()
-                logger.info(
-                    "User %s updated with organization %s", user.pk, organization
-                )
-
-    def create_user(self, claims):
-        """Return a newly created User instance."""
-        sub = claims.get("sub")
-        if sub is None:
-            raise SuspiciousOperation(
-                _("Claims contained no recognizable user identification")
-            )
-        email = claims.get("email")
-        name = claims.get("name")
-
-        # Extract or create the organization from the data
-        organization_registration_id = claims.pop(
-            settings.OIDC_ORGANIZATION_REGISTRATION_ID_FIELD,
-            None,
-        )
-        domain = get_domain_from_email(email)
-        try:
-            organization, organization_created = (
-                Organization.objects.get_or_create_from_user_claims(
-                    registration_id=organization_registration_id,
-                    domain=domain,
-                )
-            )
-        except ValueError as exc:
-            raise SuspiciousOperation(
-                _("Claims contained no recognizable organization identification")
-            ) from exc
-
-        if organization_created:
-            logger.info("Organization %s created", organization)
-
-        logger.info("Creating user %s / %s", sub, email)
-
-        user = super().create_user(claims | {"organization": organization})
-
-        # Initiate the user's profile
-        Contact.objects.create(
-            owner=user,
-            user=user,
-            full_name=name or email,
-            data={
-                "emails": [
-                    {"type": "Work", "value": email},
-                ],
-            },
-        )
-
-        return user
-
-
-class AccountServiceAuthentication(BaseAuthentication):
-    """Authentication backend for account services using Authorization header.
-    The Authorization header is used to authenticate the request.
-    The api key is stored in the AccountService model.
-
-    Header format:
-        Authorization: ApiKey <api_key>
-    """
-
-    def authenticate(self, request):
-        """Authenticate the request. Find the account service and check the api key.
-
-        Should return either:
-        - a tuple of (account_service, api_key) if allowed,
-        - None to pass on other authentication backends
-        - raise an AuthenticationFailed exception to stop propagation.
-        """
-        auth_header = request.headers.get("Authorization", "")
-        if not auth_header:
-            return None
-        try:
-            auth_mode, api_key = auth_header.split(" ")
-        except (IndexError, ValueError) as err:
-            raise AuthenticationFailed(_("Invalid authorization header.")) from err
-        if auth_mode.lower() != "apikey" or not api_key:
-            raise AuthenticationFailed(_("Invalid authorization header."))
-        try:
-            account_service = AccountService.objects.get(api_key=api_key)
-        except AccountService.DoesNotExist as err:
-            logger.warning("Invalid api_key: %s", api_key)
-            raise AuthenticationFailed(_("Invalid api key.")) from err
-        return (account_service, account_service.api_key)
-
-    def authenticate_header(self, request):
-        """
-        Return a string to be used as the value of the `WWW-Authenticate`
-        header in a `401 Unauthenticated` response, or `None` if the
-        authentication scheme should return `403 Permission Denied` responses.
-        """
-        return "apikey"

src/backend/core/enums.py

@@ -1,33 +0,0 @@
-# pylint: disable=too-many-ancestors
-"""
-Core application enums declaration
-"""
-
-from django.conf import global_settings, settings
-from django.db import models
-from django.utils.translation import gettext_lazy as _
-
-# Django sets `LANGUAGES` by default with all supported languages. We can use it for
-# the choice of languages which should not be limited to the few languages active in
-# the app.
-# pylint: disable=no-member
-ALL_LANGUAGES = getattr(
-    settings,
-    "ALL_LANGUAGES",
-    [(language, _(name)) for language, name in global_settings.LANGUAGES],
-)
-
-
-class WebhookStatusChoices(models.TextChoices):
-    """Defines the possible statuses in which a webhook can be."""
-
-    FAILURE = "failure", _("Failure")
-    PENDING = "pending", _("Pending")
-    SUCCESS = "success", _("Success")
-
-
-class WebhookProtocolChoices(models.TextChoices):
-    """Defines the possible protocols of webhook."""
-
-    SCIM = "scim"
-    MATRIX = "matrix"

src/backend/core/exceptions.py

@@ -1,18 +0,0 @@
-"""
-Custom exceptions for mailbox manager app
-"""
-
-from django.utils.translation import gettext_lazy as _
-
-from rest_framework import status
-from rest_framework.exceptions import APIException
-
-
-class EmailAlreadyKnownException(APIException):
-    """Exception raised when trying to create a user with an already existing email address."""
-
-    status_code = status.HTTP_201_CREATED
-    default_detail = _(
-        "Email already known. Invitation not sent but access created instead."
-    )
-    default_code = "email already known"

src/backend/core/factories.py

@@ -1,288 +0,0 @@
-"""
-Core application factories
-"""
-
-from django.conf import settings
-from django.contrib.auth.hashers import make_password
-
-import factory.fuzzy
-from faker import Faker
-
-from core import models
-
-fake = Faker()
-
-
-class BaseContactFactory(factory.django.DjangoModelFactory):
-    """A factory to create contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    full_name = factory.Faker("name")
-    short_name = factory.LazyAttributeSequence(
-        lambda o, n: o.full_name.split()[0] if o.full_name else f"user{n!s}"
-    )
-
-    data = factory.Dict(
-        {
-            "emails": factory.LazyAttribute(
-                lambda x: [
-                    {
-                        "type": fake.random_element(["Home", "Work", "Other"]),
-                        "value": fake.email(),
-                    }
-                    for _ in range(fake.random_int(1, 3))
-                ]
-            ),
-            "phones": factory.LazyAttribute(
-                lambda x: [
-                    {
-                        "type": fake.random_element(
-                            [
-                                "Mobile",
-                                "Home",
-                                "Work",
-                                "Main",
-                                "Work Fax",
-                                "Home Fax",
-                                "Pager",
-                                "Other",
-                            ]
-                        ),
-                        "value": fake.phone_number(),
-                    }
-                    for _ in range(fake.random_int(1, 3))
-                ]
-            ),
-            "addresses": factory.LazyAttribute(
-                lambda x: [
-                    {
-                        "type": fake.random_element(["Home", "Work", "Other"]),
-                        "street": fake.street_address(),
-                        "city": fake.city(),
-                        "state": fake.state(),
-                        "zip": fake.zipcode(),
-                        "country": fake.country(),
-                    }
-                    for _ in range(fake.random_int(1, 3))
-                ]
-            ),
-            "links": factory.LazyAttribute(
-                lambda x: [
-                    {
-                        "type": fake.random_element(
-                            [
-                                "Profile",
-                                "Blog",
-                                "Website",
-                                "Twitter",
-                                "Facebook",
-                                "Instagram",
-                                "LinkedIn",
-                                "Other",
-                            ]
-                        ),
-                        "value": fake.url(),
-                    }
-                    for _ in range(fake.random_int(1, 3))
-                ]
-            ),
-            "customFields": factory.LazyAttribute(
-                lambda x: {
-                    f"custom_field_{i:d}": fake.word()
-                    for i in range(fake.random_int(1, 3))
-                },
-            ),
-            "organizations": factory.LazyAttribute(
-                lambda x: [
-                    {
-                        "name": fake.company(),
-                        "department": fake.word(),
-                        "jobTitle": fake.job(),
-                    }
-                    for _ in range(fake.random_int(1, 3))
-                ]
-            ),
-        }
-    )
-
-
-class ContactFactory(BaseContactFactory):
-    """A factory to create contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    owner = factory.SubFactory("core.factories.UserFactory")
-
-
-class ProfileContactFactory(BaseContactFactory):
-    """A factory to create profile contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    owner = factory.SelfAttribute(".user")
-    user = factory.SubFactory("core.factories.UserFactory")
-
-
-class OverrideContactFactory(BaseContactFactory):
-    """A factory to create contacts for a user"""
-
-    class Meta:
-        model = models.Contact
-
-    override = factory.SubFactory("core.factories.ContactFactory", owner=None)
-    owner = factory.SubFactory("core.factories.UserFactory")
-
-
-class OrganizationFactory(factory.django.DjangoModelFactory):
-    """Factory to create organizations for testing purposes."""
-
-    name = factory.Faker("company")
-
-    class Meta:
-        model = models.Organization
-
-    class Params:  # pylint: disable=missing-class-docstring
-        with_registration_id = factory.Trait(
-            registration_id_list=factory.List(
-                [factory.Sequence(lambda n: f"{n:014d}")]
-            ),
-        )
-        with_domain = factory.Trait(
-            domain_list=factory.List([factory.Faker("domain_name")]),
-        )
-
-
-class OrganizationAccessFactory(factory.django.DjangoModelFactory):
-    """Factory to create organization accesses for testing purposes."""
-
-    class Meta:
-        model = models.OrganizationAccess
-
-    user = factory.SubFactory(
-        "core.factories.UserFactory",
-        organization=factory.SelfAttribute("..organization"),
-    )
-    organization = factory.SubFactory(
-        "core.factories.OrganizationFactory", with_registration_id=True
-    )
-    role = factory.fuzzy.FuzzyChoice(models.OrganizationRoleChoices.values)
-
-
-class UserFactory(factory.django.DjangoModelFactory):
-    """A factory to create random users for testing purposes."""
-
-    class Meta:
-        model = models.User
-        django_get_or_create = ("sub",)
-
-    class Params:
-        with_organization = factory.Trait(
-            organization=factory.SubFactory(
-                OrganizationFactory, with_registration_id=True
-            ),
-        )
-
-    sub = factory.Sequence(lambda n: f"user{n!s}")
-    email = factory.Faker("email")
-    name = factory.Faker("name")
-    language = factory.fuzzy.FuzzyChoice([lang[0] for lang in settings.LANGUAGES])
-    password = make_password("password")
-
-
-class TeamFactory(factory.django.DjangoModelFactory):
-    """A factory to create teams"""
-
-    class Meta:
-        model = models.Team
-        skip_postgeneration_save = True
-
-    name = factory.Sequence(lambda n: f"team{n}")
-
-    @factory.post_generation
-    def users(self, create, extracted, **kwargs):
-        """Add users to team from a given list of users with or without roles."""
-        if not create or not extracted:
-            return
-        for user_entry in extracted:
-            if isinstance(user_entry, models.User):
-                TeamAccessFactory(team=self, user=user_entry)
-            else:
-                TeamAccessFactory(team=self, user=user_entry[0], role=user_entry[1])
-
-    @factory.post_generation
-    def service_providers(self, create, extracted, **kwargs):
-        """Add service providers to team from a given list of service providers."""
-        if not create or not extracted:
-            return
-        self.service_providers.set(extracted)
-
-
-class TeamAccessFactory(factory.django.DjangoModelFactory):
-    """Create fake team user accesses for testing."""
-
-    class Meta:
-        model = models.TeamAccess
-
-    team = factory.SubFactory(TeamFactory)
-    user = factory.SubFactory(UserFactory)
-    role = factory.fuzzy.FuzzyChoice([r[0] for r in models.RoleChoices.choices])
-
-
-class TeamWebhookFactory(factory.django.DjangoModelFactory):
-    """Create fake team webhooks for testing."""
-
-    class Meta:
-        model = models.TeamWebhook
-
-    team = factory.SubFactory(TeamFactory)
-    url = factory.Sequence(lambda n: f"https://nosuchdomain.xyz/Groups/{n!s}")
-
-
-class InvitationFactory(factory.django.DjangoModelFactory):
-    """A factory to create invitations for a user"""
-
-    class Meta:
-        model = models.Invitation
-
-    team = factory.SubFactory(TeamFactory)
-    email = factory.Faker("email")
-    role = factory.fuzzy.FuzzyChoice([role[0] for role in models.RoleChoices.choices])
-    issuer = factory.SubFactory(UserFactory)
-
-
-class ServiceProviderFactory(factory.django.DjangoModelFactory):
-    """A factory to create service providers for testing purposes."""
-
-    class Meta:
-        model = models.ServiceProvider
-        skip_postgeneration_save = True
-
-    audience_id = factory.Faker("uuid4")
-
-    @factory.post_generation
-    def teams(self, create, extracted, **kwargs):
-        """Add teams to service provider from a given list."""
-        if not create or not extracted:
-            return
-        self.teams.set(extracted)
-
-    @factory.post_generation
-    def organizations(self, create, extracted, **kwargs):
-        """Add organization to service provider from a given list."""
-        if not create or not extracted:
-            return
-        self.organizations.set(extracted)
-
-
-class AccountServiceFactory(factory.django.DjangoModelFactory):
-    """A factory to create account services for testing purposes."""
-
-    class Meta:
-        model = models.AccountService
-
-    name = factory.Sequence(lambda n: f"Account Service {n!s}")
-    api_key = factory.Faker("uuid4")

src/backend/core/jsonschema/contact_data.json

@@ -1,130 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "type": "object",
-  "title": "Contact Information",
-  "properties": {
-    "emails": {
-      "type": "array",
-      "title": "Emails",
-      "items": {
-        "type": "object",
-        "properties": {
-          "type": {
-            "type": "string",
-            "title": "Type",
-            "enum": ["Work", "Home", "Other"]
-          },
-          "value": {
-            "type": "string",
-            "title": "Email Address",
-            "format": "email"
-          }
-        },
-        "required": ["type", "value"]
-      }
-    },
-    "phones": {
-      "type": "array",
-      "title": "Phones",
-      "items": {
-        "type": "object",
-        "properties": {
-          "type": {
-            "type": "string",
-            "title": "Type",
-            "enum": ["Mobile", "Home", "Work", "Main", "Work Fax", "Home Fax", "Pager", "Other"]
-          },
-          "value": {
-            "type": "string",
-            "title": "Phone Number"
-          }
-        },
-        "required": ["type", "value"]
-      }
-    },
-    "addresses": {
-      "type": "array",
-      "title": "Addresses",
-      "items": {
-        "type": "object",
-        "properties": {
-          "type": {
-            "type": "string",
-            "title": "Type",
-            "enum": ["Home", "Work", "Other"]
-          },
-          "street": {
-            "type": "string",
-            "title": "Street"
-          },
-          "city": {
-            "type": "string",
-            "title": "City"
-          },
-          "state": {
-            "type": "string",
-            "title": "State"
-          },
-          "zip": {
-            "type": "string",
-            "title": "ZIP Code"
-          },
-          "country": {
-            "type": "string",
-            "title": "Country"
-          }
-        }
-      }
-    },
-    "links": {
-      "type": "array",
-      "title": "Links",
-      "items": {
-        "type": "object",
-        "properties": {
-          "type": {
-            "type": "string",
-            "title": "Type",
-            "enum": ["Profile", "Blog", "Website", "Twitter", "Facebook", "Instagram", "LinkedIn", "Other"]
-          },
-          "value": {
-            "type": "string",
-            "title": "URL",
-            "format": "uri"
-          }
-        },
-        "required": ["type", "value"]
-      }
-    },
-    "customFields": {
-      "type": "object",
-      "title": "Custom Fields",
-      "additionalProperties": {
-        "type": "string"
-      }
-    },
-    "organizations": {
-      "type": "array",
-      "title": "Organizations",
-      "items": {
-        "type": "object",
-        "properties": {
-          "name": {
-            "type": "string",
-            "title": "Organization Name"
-          },
-          "department": {
-            "type": "string",
-            "title": "Department"
-          },
-          "jobTitle": {
-            "type": "string",
-            "title": "Job Title"
-          }
-        },
-        "required": ["name"]
-      }
-    }
-  },
-  "additionalProperties": false
-}

src/backend/core/jsonschema/fr/organization_metadata.json

@@ -1,15 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "type": "object",
-  "title": "Organization Metadata",
-  "properties": {
-    "is_public_service": {
-      "type": "boolean",
-      "title": "Is public service"
-    },
-    "is_commune": {
-      "type": "boolean",
-      "title": "Is commune"
-    }
-  }
-}

src/backend/core/management/__init__.py

@@ -1 +0,0 @@
-"""Management commands for core app."""