Commit graph

59 commits

Author SHA1 Message Date
Baptiste Jonglez
01d515c07f Add security-related test to the new settle endpoint 2024-03-31 19:55:43 +02:00
Baptiste Jonglez
9a848588c8 tests: add more validation against cross-project access 2024-03-31 19:55:43 +02:00
Baptiste Jonglez
278a976501 Change settle endpoint to use POST instead of GET
This is necessary to avoid XSS.  State-changing actions should never be
done with a GET.
2024-03-31 19:55:43 +02:00
Tom Roussel
a5f83de5ce Chore: ran black 2024-03-31 19:21:56 +02:00
Tom Roussel
a74cd97286 Removed reference to transfer billtype in test 2024-03-31 19:21:56 +02:00
Tom Roussel
a3009126dc Removed test for removed transfer billtype 2024-03-31 19:21:56 +02:00
Baptiste Jonglez
178fc94cef Fix duplicate unit tests 2024-03-25 20:46:39 +01:00
Baptiste Jonglez
312dfef14b Reformat code with black and isort 2024-03-25 20:46:39 +01:00
TomRoussel
720f0e52dd
Adding bill types and automatic settling between people (#1290)
* Bill types added in Bill and Project Model, Implemented in BillForm
* import and export bill feature updated with bill type, tests modified to reflect the behavior
* eliminating unnecessary bill type
* typo fixed, test cases fixed for the current bill types
* button added
* settle button added
* new changes
* test cases added
* bchen-reimbursement
* tests for different bill types
* test cases fixed
* fixed reimbursement test case
* Replaced assertEqual with assert
* Fixed missing bill_type in unit tests
* Removed commented code
* Reverted unnecessary string edit
* Changed bill_type to an Enum
* Added test checking correct bill_type validation
* Fixed  billtype displaying in all caps
* Removed 'Transfer' bill type
* Added migration rule and set default bill_type in alembic
* bill_type is now an optional parameter in the BillForm
* Use enum name instead of value as SQL server_default

SQLAlchemy uses the Enum names in the database, as the values could be
generic python objects.
https://docs.sqlalchemy.org/en/20/core/type_basics.html#sqlalchemy.types.Enum

* Removed bill type from the Bills html table
* Replaced string bill type with enum
* Made "Settlement" translatable
* Manually handle the new Enum creation

Alembic does not handle postgres Enums correctly, so we need to manually
generate the new enum type.
See https://github.com/sqlalchemy/alembic/issues/278

---------

Co-authored-by: Ruitao Li <ruital@andrew.cmu.edu>
Co-authored-by: MelodyZhangYiqun <98992024+MelodyZhangYiqun@users.noreply.github.com>
Co-authored-by: Ruitao Li <49292515+FlowingCloudRTL@users.noreply.github.com>
Co-authored-by: MelodyZhangYiqun <yiqunz@andrew.cmu.edu>
Co-authored-by: Brandan Chen <bychen@andrew.cmu.edu>
Co-authored-by: Emilie Zhou <54161959+ez157@users.noreply.github.com>
Co-authored-by: Tom <tom.roussel@esat.kuleuven.be>
2024-03-16 12:20:48 +01:00
Éloi Rivard
8bce025c15 chore: support for python 3.12 2023-11-23 23:08:39 +01:00
aab32a2c3b
Swapping Out 'Fred' for 'Jeanne' in Docs/API – Personal Peacekeeping 😊 (#1260) 2023-11-13 00:47:24 +01:00
Éloi Rivard
ee7289f5d2
chore: update to flask 2.3 (#1244)
Co-authored-by: Alexis Métaireau <alexis@notmyidea.org>
2023-11-06 17:53:58 +01:00
zorun
1a2fa0476b
Currency hotfixes (#1240)
* hotfix: hardcode list of currencies to workaround failing API calls

See https://github.com/spiral-project/ihatemoney/issues/1232 for a discussion on currencies

* Temporarily disable some currency operations to prevent crashes

Here is what is disabled:

- setting or changing the default currency on an existing project

- adding or editing a bill with a currency that differs from the default
  currency of the project

---------

Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
2023-10-04 00:05:10 +02:00
Jojo144
c5c8dba631
Default owers when adding a bill (#1222)
* Remember last owers for next new bill

* Add a test for last_selected_payed_for
2023-10-03 20:20:58 +02:00
Jojo144
d4b178ed66 Add a test for last_selected_payer_per_project 2023-10-02 23:50:25 +02:00
Éloi Rivard
21408f8bc9 tests: migrate to pytest
- replace setUp/tearDown with pytest fixtures
- rename test classes to use the pytest convention
- use pytest assertions

Co-authored-by: Glandos <bugs-github@antipoul.fr>
2023-10-01 23:33:36 +02:00
Éloi Rivard
857ca2d5b0
tests: speed up unit tests (#1215)
Adds two configuration parameters that are passed to
generate_password_hash:

- PASSWORD_HASH_METHOD
- PASSWORD_HASH_SALT_LENGTH

The unit tests use high-speed low-security values and
gain 50% speed.
2023-08-13 00:04:06 +02:00
Baptiste Jonglez
73c8a31dd2 Invite page: document the security implication of all options
Also move the "invitation link" option first, because it's the preferred
way to give access to people that only need to handle participants and
bills.

Sharing the identifier and private becomes the last option, because it
gives full access to changing settings.
2023-07-29 14:02:49 +02:00
Baptiste Jonglez
68e1dac75c Require private code to edit a project settings
This is something we had documented in our security documentation [1], but
we didn't actually do it...

As mentioned in [1], this has good security properties: you can invite
somebody with an invitation link, and they will be able to access the
project but not change the private code (because they don't know the
current private code).

This new check also applies to all other settings (email address, history
settings, currency), which is desirable.  Only somebody with knowledge of
the private code can now change these settings.

[1] https://ihatemoney.readthedocs.io/en/latest/security.html#giving-access-to-a-project
2023-07-29 14:02:49 +02:00
Baptiste Jonglez
db04f68652 translations: Avoid splitting strings to make translator's life easier 2023-07-28 17:20:11 +02:00
Éloi Rivard
8d4584d660 feat: project RSS feed. 2023-07-28 15:22:55 +02:00
Glandos
23d912b703
Migrate existing sessions after conversion to dict (#1194)
Migrate existing session after #1082

fix #1188
2023-07-22 19:55:45 +02:00
Glandos
d09d19af45 add test to make it fail 2023-07-15 15:27:34 +02:00
Baptiste Jonglez
081f8dcf49 Allow bills with an amount of zero
Bills with an amount of zero may be useful to remember that a transaction
happened on a specific date, while the amount doesn't matter.

I use that with per-year projects when a reimbursement happens in year N
but is relative to year N-1: I record it with an amount of zero in the
project of year N, and with the real amount in the project of year N-1.

Besides, it's already possible to create such bills: while "0" is refused,
"0.0" is accepted.  There are no visible issues with this kind of bills.
2023-02-03 20:35:15 +01:00
Baptiste Jonglez
e185a157fb tests: Avoid plain "assert" and use unittest helper functions 2023-01-31 18:36:30 +01:00
Glandos
d477b41d9a add test case 2023-01-29 23:03:14 +01:00
Glandos
3a984ee206 fix test after code reformatting 2023-01-29 23:03:14 +01:00
Glandos
923a7c41c1 black formatting, since last black changed 2023-01-28 17:06:33 +01:00
Glandos
9a8cc16a0b unused import 2022-12-10 18:22:41 +01:00
Glandos
4d7e966f7f fix tests 2022-12-10 18:22:41 +01:00
Glandos
24614b2c1d format doc 2022-10-22 23:02:27 +02:00
Glandos
d97123bf6b reformat 2022-10-22 23:02:27 +02:00
Glandos
cc18986b76 add test for multiple join 2022-10-22 23:02:27 +02:00
Glandos
667b65b9cc
Surround email in case of error (#1044)
fix https://huntr.dev/bounties/441cc44c-6837-46ec-9b30-52455aa71a2f/
2022-07-16 23:26:51 +02:00
Glandos
31fef4f4d6
Fix CSRF on logout (#1040)
fix for https://huntr.dev/bounties/a3045614-1125-4901-bb7a-9d51be4beeed/
2022-07-14 15:45:32 +02:00
Glandos
e355894cee
Check for too high values (#989)
* check for too high values

see https://github.com/python-babel/babel/issues/821

fix #957

* black & isort

* add API test
2022-02-02 10:09:49 +01:00
Glandos
07e1eac0a9
Null amount validator was broken (#990) 2022-01-30 16:33:18 +01:00
zorun
c8cbe43ee2
Display monthly statistics for the range of months where the project was active (#885)
* Change the way we import datetime

This makes it easier to use datetime.date later.

* Display monthly statistics for the range of months where the project was active

Currently, we display a hard-coded "one year" range of monthly statistics
starting from today.  This generally is not the intended behaviour: for
instance, on an archived project, the bills might all be older than one
year, so the table only displays months without any operation.

Instead, display all months between the first and last bills.  There might
be empty months in the middle, but that's intended, because we want all
months to be consecutive.

If there are no bills, simply display an empty table.

Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
2022-01-18 14:32:43 +01:00
Youe Graillot
747824a298
CSV bills import (cospend compatible) (#951)
* proper import form (fix messy errors)
* csv compatible import
* cospend compatible import
* localization (best effort)
* refactoring
* revert localization (best effort)
* import return 400 on error
* fix Person.query.get_by_ids calls
* Bill explicit init parameters
* fix tests
* refacto tests with self.get_project
* separate import tests
* fix tests
* csv import test case
* fix import csv parsing
* revert DestructiveActionProjectForm renaming
* fix csv import test
* fix error redirection on import
* fix lint
* import file input type hint
* various fixes from review

Co-authored-by: Youe Graillot <youe.graillot@gmail.com>
2021-12-22 00:00:34 +01:00
ef3944ccad
Send an email when the project is created via the API. (#938) 2021-11-25 00:49:17 +01:00
68552a6034
Allow connecting to upper-case project IDs. (#934)
Fix #933.
2021-11-23 19:09:50 +01:00
beac10be0b
Always authentify projects using a lowercase ID. (#925)
Fixes #920
2021-11-21 17:13:26 +01:00
35a74100cb
Rename all strings to "participants", clean old and small weird stuff (#871)
* Rename all strings to "participants".
* Update the tests with the new strings
* Update tests
2021-11-01 18:25:57 +01:00
Glandos
7d9226745f
Change token path authentication to /PROJECT/join/TOKEN (#843) 2021-10-13 22:00:38 +02:00
zorun
7554842b1f
Add URL validation to external link to prevent XSS (#846)
Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
2021-10-10 18:39:03 +02:00
Glandos
bbe00ebb57
Include project code into project authentication token (#802)
Fix #780 

This a breaking change, the API for authentication is different, as it now requires `project_id`. Token is generated with only the project_id (so it's shorter than before), and signature is done by mixing password with secret key. Thus, it expires on every project code change.
2021-10-10 14:43:40 +02:00
Daniel Neto
60149cd486 Formatting changes after running make black 2021-09-19 19:04:49 +02:00
Daniel Neto
7bf7db24bd #838: Add decima weight round test cases 2021-09-19 19:04:49 +02:00
Baptiste Jonglez
011df29913 Simplify exception checking in import test 2021-09-07 23:15:40 +02:00
Baptiste Jonglez
7ad83c7e79 Add more import test cases related to currencies 2021-09-07 23:15:40 +02:00