Merge 889576a114 into 61ea1f54d2

Updates the requirements on [psycopg2-binary](https://github.com/psycopg/psycopg2) to permit the latest version.
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](https://github.com/psycopg/psycopg2/compare/2.9.6...2.9.10)

---
updated-dependencies:
- dependency-name: psycopg2-binary
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

ihatemoney/models.py

@@ -752,6 +752,22 @@ class Bill(db.Model):
         else:
             return 0
 
+    @property
+    def involves_deactivated_members(self):
+        """Check whether the bill contains deactivated member.
+        Return:
+        True if it contains deactivated member,
+        False if not.
+        """
+        owers_id = [int(m.id) for m in self.owers]
+        bill_member_id_list = owers_id + [self.payer_id]
+        deactivated_member_number = (
+            Person.query.filter(Person.id.in_(bill_member_id_list))
+            .filter(Person.activated.is_(False))
+            .count()
+        )
+        return deactivated_member_number != 0
+
     def __str__(self):
         return self.what
 

ihatemoney/templates/list_bills.html

@@ -148,10 +148,22 @@
                     </span>
                 </td>
                 <td class="bill-actions d-flex align-items-center">
-                    <a class="edit" href="{{ url_for(".edit_bill", bill_id=bill.id) }}" title="{{ _("edit") }}">{{ _('edit') }}</a>
+                    <a class="edit" href="{{ url_for(".edit_bill", bill_id=bill.id) }}" data-toggle="tooltip"
+                        {% if bill.involves_deactivated_members %}
+                            title="Cannot be edited as deactivated members involved"
+                        {% else %}
+                            title="Click to edit this bill"
+                        {% endif %}
+                    >{{ _('edit') }}</a>
                     <form class="delete-bill" action="{{ url_for(".delete_bill", bill_id=bill.id) }}" method="POST">
                         {{ csrf_form.csrf_token }}
-                        <button class="action delete" type="submit" title="{{ _("delete") }}"></button>
+                        <button class="action delete" type="submit" data-toggle="tooltip"
+                            {% if bill.involves_deactivated_members %}
+                                title="Cannot be deleted as deactivated members involved"
+                            {% else %}
+                                title="Click to delete this bill"
+                            {% endif %}
+                        ></button>
                     </form>
                     {% if bill.external_link %}
                     <a class="show" href="{{ bill.external_link }}" ref="noopener" target="_blank" title="{{ _("show") }}">{{ _('show') }} </a>

ihatemoney/tests/budget_test.py

@@ -872,6 +872,122 @@ class TestBudget(IhatemoneyTestCase):
         balance = self.get_project("raclette").balance
         assert set(balance.values()) == set([6, -6])
 
+    def test_edit_bill_with_deactivated_member(self):
+        """
+        Bills involving deactivated members should not allowed to be edited or deleted.
+        """
+        self.post_project("raclette")
+
+        # add two participants
+        self.client.post("/raclette/members/add", data={"name": "zorglub"})
+        self.client.post("/raclette/members/add", data={"name": "fred"})
+
+        members_ids = [m.id for m in self.get_project("raclette").members]
+
+        # create one bill
+        self.client.post(
+            "/raclette/add",
+            data={
+                "date": "2011-08-10",
+                "what": "fromage à raclette",
+                "payer": members_ids[0],
+                "payed_for": members_ids,
+                "amount": "25",
+            },
+        )
+        bill = models.Bill.query.one()
+        self.assertEqual(bill.amount, 25)
+
+        # deactivate one user
+        self.client.post(
+            "/raclette/members/%s/delete" % self.get_project("raclette").members[-1].id
+        )
+        self.assertEqual(len(self.get_project("raclette").members), 2)
+        self.assertEqual(len(self.get_project("raclette").active_members), 1)
+
+        # editing would fail because the bill involves deactivated user
+        self.client.post(
+            f"/raclette/edit/{bill.id}",
+            data={
+                "date": "2011-08-10",
+                "what": "fromage à raclette",
+                "payer": members_ids[0],
+                "payed_for": members_ids,
+                "amount": "10",
+            },
+        )
+        bill = models.Bill.query.one()
+        self.assertNotEqual(bill.amount, 10, "bill edition")
+
+        # reactivate the user
+        self.client.post(
+            "/raclette/members/%s/reactivate"
+            % self.get_project("raclette").members[-1].id
+        )
+        self.assertEqual(len(self.get_project("raclette").active_members), 2)
+
+        # try to edit the bill again. It should succeed
+        self.client.post(
+            f"/raclette/edit/{bill.id}",
+            data={
+                "date": "2011-08-10",
+                "what": "fromage à raclette",
+                "payer": members_ids[0],
+                "payed_for": members_ids,
+                "amount": "10",
+            },
+        )
+        bill = models.Bill.query.one()
+        self.assertEqual(bill.amount, 10, "bill edition")
+
+    def test_delete_bill_with_deactivated_member(self):
+        """
+        Bills involving deactivated members should not allowed to be edited or deleted.
+        """
+        self.post_project("raclette")
+
+        # add two participants
+        self.client.post("/raclette/members/add", data={"name": "zorglub"})
+        self.client.post("/raclette/members/add", data={"name": "fred"})
+
+        members_ids = [m.id for m in self.get_project("raclette").members]
+
+        # create one bill
+        self.client.post(
+            "/raclette/add",
+            data={
+                "date": "2011-08-10",
+                "what": "fromage à raclette",
+                "payer": members_ids[0],
+                "payed_for": members_ids,
+                "amount": "25",
+            },
+        )
+        bill = models.Bill.query.one()
+        self.assertEqual(bill.amount, 25)
+
+        # deactivate one user
+        self.client.post(
+            "/raclette/members/%s/delete" % self.get_project("raclette").members[-1].id
+        )
+        self.assertEqual(len(self.get_project("raclette").active_members), 1)
+
+        # deleting should fail because the bill involves deactivated user
+        response = self.client.get(f"/raclette/delete/{bill.id}")
+        self.assertEqual(response.status_code, 405)
+        self.assertEqual(1, len(models.Bill.query.all()), "bill deletion")
+
+        # reactivate the user
+        self.client.post(
+            "/raclette/members/%s/reactivate"
+            % self.get_project("raclette").members[-1].id
+        )
+        self.assertEqual(len(self.get_project("raclette").active_members), 2)
+
+        # try to delete the bill again. It should succeed
+        self.client.post(f"/raclette/delete/{bill.id}")
+        self.assertEqual(0, len(models.Bill.query.all()), "bill deletion")
+
     def test_trimmed_members(self):
         self.post_project("raclette")
 

ihatemoney/web.py

@@ -806,6 +806,10 @@ def delete_bill(bill_id):
     if not bill:
         return redirect(url_for(".list_bills"))
 
+    # Check if the bill contains deactivated member. If yes, stop deleting.
+    if bill.involves_deactivated_members:
+        return redirect(url_for(".list_bills"))
+
     db.session.delete(bill)
     db.session.commit()
     flash(_("The bill has been deleted"))
@@ -820,6 +824,10 @@ def edit_bill(bill_id):
     if not bill:
         raise NotFound()
 
+    # Check if the bill contains deactivated member. If yes, stop editing.
+    if bill.involves_deactivated_members:
+        return redirect(url_for(".list_bills"))
+
     form = get_billform_for(g.project, set_default=False)
 
     if request.method == "POST" and form.validate():

pyproject.toml

@@ -27,7 +27,7 @@ classifiers = [
 
 dependencies = [
     "blinker>=1.4,<2",
-    "cachetools>=4.1,<5",
+    "cachetools>=4.1,<6",
     "debts>=0.5,<1",
     "email_validator>=1.0,<3",
     "Flask>=2,<4",
@@ -43,7 +43,7 @@ dependencies = [
     "itsdangerous>=2,<3",
     "Jinja2>=3,<4",
     "python-dateutil",
-    "qrcode>=7.1,<8",
+    "qrcode>=7.1,<9",
     "requests>=2.25,<3",
     "SQLAlchemy>=1.3.0,<1.5",
     "SQLAlchemy-Continuum>=1.3.12,<2", # New 1.4 changes API, see #728
@@ -53,11 +53,11 @@ dependencies = [
 [project.optional-dependencies]
 database = [
     # Python 3.11 support starts in 2.9.2
-    "psycopg2-binary>=2.9.2,<2.9.9",
+    "psycopg2-binary>=2.9.2,<2.9.11",
     "PyMySQL>=0.9,<1.2",
 ]
 dev = [
-    "ruff==0.6.8",
+    "ruff==0.8.4",
     "flake8==5.0.4",
     "isort==5.11.5",
     "vermin==1.6.0",