Merge 34d9253f9f into 19ecdb5052

Co-authored-by: Baptiste Jonglez <git@bitsofnetworks.org>
Co-authored-by: Alexis Métaireau <alexis@notmyidea.org>

.isort.cfg

@@ -1,13 +0,0 @@
-[settings]
-# Needed for black compatibility
-multi_line_output=3
-include_trailing_comma=True
-force_grid_wrap=0
-line_length=88
-combine_as_imports=True
-
-# If set, imports will be sorted within their section independent to the import_type.
-force_sort_within_sections=True
-
-# skip
-skip_glob=.local,**/migrations/**,**/node_modules/**,**/node-forge/**

ihatemoney/default_settings.py

@@ -48,3 +48,4 @@ SUPPORTED_LANGUAGES = [
     "uk",
     "zh_Hans",
 ]
+SHOWCASE_LANGUAGES = ["en", "fr"]

ihatemoney/forms.py

@@ -14,6 +14,8 @@ from wtforms.fields import (
     BooleanField,
     DateField,
     DecimalField,
+    HiddenField,
+    IntegerField,
     Label,
     PasswordField,
     SelectField,
@@ -437,6 +439,22 @@ class BillForm(FlaskForm):
             raise ValidationError(msg)
 
 
+class HiddenCommaDecimalField(HiddenField, CommaDecimalField):
+    pass
+
+
+class HiddenIntegerField(HiddenField, IntegerField):
+    pass
+
+
+class SettlementForm(FlaskForm):
+    """Used internally for validation, not directly visible to users"""
+
+    amount = HiddenCommaDecimalField("Amount", validators=[DataRequired()])
+    sender_id = HiddenIntegerField("Sender", validators=[DataRequired()])
+    receiver_id = HiddenIntegerField("Receiver", validators=[DataRequired()])
+
+
 class MemberForm(FlaskForm):
     name = StringField(_("Name"), validators=[DataRequired()], filters=[strip_filter])
 

ihatemoney/models.py

@@ -447,6 +447,10 @@ class Project(db.Model):
             db.session.commit()
         return person
 
+    def has_member(self, member_id):
+        person = Person.query.get(member_id, self)
+        return person is not None
+
     def remove_project(self):
         # We can't import at top level without circular dependencies
         from ihatemoney.history import purge_history

ihatemoney/templates/home.html

@@ -1,90 +1,81 @@
 {% extends "layout.html" %}
-
 {% block body %}
   <header id="header" class="row">
     <div class="col-xs-12 col-sm-5 offset-md-2">
-    <h2>{{ _("Manage your shared <br />expenses, easily") }}</h2>
+      <h2>
+        {{ _("Manage your shared <br />expenses, easily") }}
+      </h2>
       {% if is_demo_project_activated %}
-        <a href="{{ url_for('.demo') }}" class="tryout btn">
-            {{ _("Try out the demo") }}
-        </a>
+        <a href="{{ url_for(".demo") }}" class="tryout btn">{{ _("Try out the demo") }}</a>
       {% endif %}
-    {% if g.lang == 'fr' %}
-        ou
+      {% if g.lang == 'fr' or g.lang == 'en' %}
+        {{ _("or") }}
         <span class="side-to-side">
-          <a class="showcase btn" onclick="javascript:showGallery(); return false;">Voir la BD explicative</a>
-          <img class="showcaseimg" src="{{ url_for("static", filename='images/indicate.svg') }}" />
+          <a class="showcase btn"
+             onclick="javascript:showGallery(); return false;">{{ _("See the explanatory comics") }}</a>
+          <img class="showcaseimg"
+               src="{{ url_for("static", filename='images/indicate.svg') }}" />
         </span>
       {% endif %}
     </div>
     <div class="col-xs-12 col-sm-4">
-    <table class="additional-content"><tr>
+      <table class="additional-content">
+        <tr>
           <td>
-        {{ _("You're sharing a house?") }}<br />
-        {{ _("Going on holidays with friends?") }}<br />
-        {{ _("Simply sharing money with others?") }} <br />
+            {{ _("You're sharing a house?") }}
+            <br />
+            {{ _("Going on holidays with friends?") }}
+            <br />
+            {{ _("Simply sharing money with others?") }}
+            <br />
             <strong>{{ _("We can help!") }}</strong>
           </td>
           <td>
-        <img class="shareimg" src="{{ url_for("static", filename='images/share.svg') }}" />
+            <img class="shareimg"
+                 src="{{ url_for("static", filename='images/share.svg') }}" />
           </td>
-    </tr></table>
+        </tr>
+      </table>
     </div>
   </header>
   <main class="row home">
     <div class="card-deck ml-auto mr-auto">
       <div class="card">
-      <div class="card-header">
-        {{ _("Log in to an existing project") }}
-      </div>
+        <div class="card-header">{{ _("Log in to an existing project") }}</div>
         <div class="card-body">
-        <form
-          id="authentication-form"
+          <form id="authentication-form"
                 class="form-horizontal"
-          action="{{ url_for('.authenticate') }}"
+                action="{{ url_for(".authenticate") }}"
                 method="post">
             <fieldset class="form-group">
               <legend></legend>
               {{ forms.authenticate(auth_form, home=True) }}
             </fieldset>
             <div class="controls">
-            <button class="btn btn-primary btn-block" type="submit">
-              {{ _("Log in") }}
-            </button>
-            <a
-              class="password-reminder btn btn-link"
-              href="{{ url_for('.remind_password') }}"
-              >{{ _("can't remember your password?") }}</a
-            >
+              <button class="btn btn-primary btn-block" type="submit">{{ _("Log in") }}</button>
+              <a class="password-reminder btn btn-link"
+                 href="{{ url_for(".remind_password") }}">{{ _("can't remember your password?") }}</a>
             </div>
           </form>
         </div>
       </div>
       <div class="card">
-      <div class="card-header">
-        {{ _("Create a new project") }}
-      </div>
+        <div class="card-header">{{ _("Create a new project") }}</div>
         <div class="card-body">
           {% if is_public_project_creation_allowed %}
-            <form
-            id="creation-form"
+            <form id="creation-form"
                   class="form-horizontal"
-            action="{{ url_for('.create_project') }}"
-            method="post"
-            >
+                  action="{{ url_for(".create_project") }}"
+                  method="post">
               <fieldset class="form-group">
                 {{ forms.create_project(project_form, home=True) }}
               </fieldset>
               <div class="controls">
-                <button class="btn btn-primary btn-block" type="submit">
-                {{ _("Create") }}
-                </button>
+                <button class="btn btn-primary btn-block" type="submit">{{ _("Create") }}</button>
               </div>
             </form>
           {% else %}
-            <a href="{{ url_for('.create_project') }}">
-                {{ _("Create a new project") }}
-            </a>
+            <a href="{{ url_for(".create_project") }}">{{ _("Create a new project") }}</a>
           {% endif %}
         </div>
       </div>

ihatemoney/templates/layout.html

@@ -46,7 +46,7 @@
     </script>
 </head>
 <body class="d-flex flex-column h-100">
-  {% if g.lang == 'fr' %}{% include "showcase.html" %}{% endif %}
+  {% if display_showcase %}{% include "showcase.html" %}{% endif %}
   <nav class="navbar navbar-expand-lg fixed-top navbar-dark bg-dark">
     <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarToggler" aria-controls="navbarToggler" aria-expanded="false" aria-label="Toggle navigation">
       <span class="navbar-toggler-icon"></span>

ihatemoney/templates/list_bills.html

@@ -64,10 +64,10 @@
         </div>
     </div>
     <div class="identifier">
-	{% if g.lang == 'fr' %}
+	{% if display_showcase %}
         <a class="btn btn-secondary btn-block" href=""  onclick="javascript:showGallery(); return false;">
             <i class="icon icon-white high before-text">{{ static_include("images/read.svg") | safe }}</i>
-	    Voir la BD explicative
+            {{ _("See the explanatory comics") }}
         </a>
 	{% endif %}
         <a class="btn btn-secondary btn-block" href="{{ url_for('.invite') }}">

ihatemoney/templates/settle_bills.html

@@ -1,25 +1,41 @@
-{% extends "sidebar_table_layout.html" %}
-
-{% block sidebar %}
-    <div id="table_overflow">
-        {{ balance_table(show_weight=False) }}
-    </div>
-{% endblock %}
-
-
-{% block content %}
+{% extends "sidebar_table_layout.html" %} {% block sidebar %}
+<div id="table_overflow">{{ balance_table(show_weight=False) }}</div>
+{% endblock %} {% block content %}
 <table id="bill_table" class="split_bills table table-striped">
-        <thead><tr><th>{{ _("Who pays?") }}</th><th>{{ _("To whom?") }}</th><th>{{ _("How much?") }}</th><th>{{ _("Settled?") }}</th></tr></thead>
+  <thead>
+    <tr>
+      <th>{{ _("Who pays?") }}</th>
+      <th>{{ _("To whom?") }}</th>
+      <th>{{ _("How much?") }}</th>
+      <th>{{ _("Settled?") }}</th>
+    </tr>
+  </thead>
   <tbody>
-    {% for bill in bills %}
-    <tr receiver={{bill.receiver.id}}>
-            <td>{{ bill.ower }}</td>
-            <td>{{ bill.receiver }}</td>
-            <td>{{ bill.amount|currency }}</td>
+    {% for transaction in transactions %}
+    <tr receiver="{{transaction.receiver.id}}">
+      <td>{{ transaction.ower }}</td>
+      <td>{{ transaction.receiver }}</td>
+      <td>{{ transaction.amount|currency }}</td>
       <td>
         <span id="settle-bill" class="ml-auto pb-2">
-                    <a href="{{ url_for('.settle', amount = bill.amount, ower_id = bill.ower.id, payer_id = bill.receiver.id) }}" class="btn btn-primary">
-                      <div data-toggle="tooltip" title='{{ _("Click here to record that the money transfer has been done") }}'>
+          <form class="" action="{{ url_for(".add_settlement_bill") }}" method="POST">
+              {{ settlement_form.csrf_token }}
+              {{ settlement_form.amount(value=transaction.amount) }}
+              {{ settlement_form.sender_id(value=transaction.ower.id) }}
+              {{ settlement_form.receiver_id(value=transaction.receiver.id) }}
+              <button class="btn btn-primary" type="submit" title="{{ _("Settle") }}">
+                <div
+                  data-toggle="tooltip"
+                  title='{{ _("Click here to record that the money transfer has been done") }}'
+                >
+                {{ _("Settle") }}
+                </div>
+              </button>
+          </form>
+          <a
+            href="{{ url_for('.add_settlement_bill', amount = transaction.amount, sender_id = transaction.ower.id, receiver_id = transaction.receiver.id) }}"
+            class="btn btn-primary"
+          >
               {{ ("Settle") }}
             </div>
           </a>

ihatemoney/templates/showcase.html

@@ -1,4 +1,8 @@
-<div id="pswp" class="hiddenpswp" tabindex="-1" role="dialog" aria-hidden="true">
+<div id="pswp"
+     class="hiddenpswp"
+     tabindex="-1"
+     role="dialog"
+     aria-hidden="true">
   <div class="pswp__bg"></div>
   <div class="pswp__scroll-wrap">
     <div class="pswp__container">
@@ -9,7 +13,7 @@
     <div class="pswp__ui pswp__ui--hidden">
       <div class="pswp__top-bar">
         <div class="pswp__counter"></div>
-                <button class="pswp__button pswp__button--close" title="Fermer (Esc)"></button>
+        <button class="pswp__button pswp__button--close" title="{{ _("Close (Esc)") }}">
         <div class="pswp__preloader">
           <div class="pswp__preloader__icn">
             <div class="pswp__preloader__cut">
@@ -18,13 +22,10 @@
           </div>
         </div>
       </div>
-
-            <button class="pswp__button pswp__button--arrow--left" title="Suivant (flèche droite)">
-            </button>
-
-            <button class="pswp__button pswp__button--arrow--right" title="Précédent (flèche gauche)">
-            </button>
-
+      <button class="pswp__button pswp__button--arrow--left"
+              title="{{ _("Next (right arrow)") }}"></button>
+      <button class="pswp__button pswp__button--arrow--right"
+              title="{{ _("Previous (left arrow)") }}"></button>
       <div class="pswp__caption">
         <div class="pswp__caption__center"></div>
       </div>
@@ -32,18 +33,26 @@
   </div>
 </div>
 <script type="text/javascript">
-var pswpElement = document.getElementById('pswp');
-var items = JSON.parse('[{"h": 2450, "src": "{{ url_for("static", filename="showcase/1.webp") }}", "w": 2450}, {"h": 2509, "src": "{{ url_for("static", filename="showcase/2.webp") }}", "w": 2221}, {"h": 2536, "src": "{{ url_for("static", filename="showcase/3.webp") }}", "w": 2101}, {"h": 2722, "src": "{{ url_for("static", filename="showcase/4.webp") }}", "w": 2348}, {"h": 2745, "src": "{{ url_for("static", filename="showcase/5.webp") }}", "w": 1804}, {"h": 3307, "src": "{{ url_for("static", filename="showcase/6.webp") }}", "w": 2897}, {"h": 2321, "src": "{{ url_for("static", filename="showcase/7.webp") }}", "w": 2239}, {"h": 2470, "src": "{{ url_for("static", filename="showcase/8.webp") }}", "w": 2419}, {"h": 3307, "src": "{{ url_for("static", filename="showcase/9.webp") }}", "w": 2602}]');
+var pswpElement = document.getElementById("pswp");
 var options = {
   index: 0,
   loop: false,
 };
 
 function showGallery(){
+  let items = [
+    {"h": 2450, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/1.webp') }}", "w": 2450},
+    {"h": 2509, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/2.webp') }}", "w": 2221},
+    {"h": 2536, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/3.webp') }}", "w": 2101},
+    {"h": 2722, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/4.webp') }}", "w": 2348},
+    {"h": 2745, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/5.webp') }}", "w": 1804},
+    {"h": 3307, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/6.webp') }}", "w": 2897},
+    {"h": 2321, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/7.webp') }}", "w": 2239},
+    {"h": 2470, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/8.webp') }}", "w": 2419},
+    {"h": 3307, "src": "{{ url_for('static', filename='showcase/' + g.lang + '/9.webp') }}", "w": 2602}
+  ];
 
-   /* the CSS and JS for photoswipe is loaded dynamically
-    * so that they are not loaded if the gallery is not open */
-
+  // CSS and JS are loaded dynamically when the gallery opens
   $('head').append('<link rel="stylesheet" type="text/css" href="{{ url_for("static", filename="photoswipe/default-skin/default-skin.css") }}">');
   $('head').append('<link rel="stylesheet" type="text/css" href="{{ url_for("static", filename="photoswipe/photoswipe.css") }}">');
 
@@ -63,5 +72,4 @@ function showGallery(){
   };
   document.body.appendChild(script);
 }
-
 </script>

ihatemoney/tests/budget_test.py

@@ -1358,23 +1358,25 @@ class TestBudget(IhatemoneyTestCase):
         count = 0
         for t in transactions:
             count += 1
-            self.client.get(
-                "/raclette/settle"
-                + "/"
-                + str(t["amount"])
-                + "/"
-                + str(t["ower"].id)
-                + "/"
-                + str(t["receiver"].id)
+            self.client.post(
+                "/raclette/settle",
+                data={
+                    "amount": t["amount"],
+                    "sender_id": t["ower"].id,
+                    "receiver_id": t["receiver"].id,
+                },
             )
             temp_transactions = project.get_transactions_to_settle_bill()
             # test if the one has disappeared
             assert len(temp_transactions) == len(transactions) - count
 
-            # test if theres a new one with bill_type reimbursement
+            # test if there is a new one with bill_type reimbursement
             bill = project.get_newest_bill()
             assert bill.bill_type == models.BillType.REIMBURSEMENT
-        return
+
+        # There should be no more settlement to do at the end
+        transactions = project.get_transactions_to_settle_bill()
+        assert len(transactions) == 0
 
     def test_settle_zero(self):
         self.post_project("raclette")
@@ -1463,6 +1465,78 @@ class TestBudget(IhatemoneyTestCase):
         # Create and log in as another project
         self.post_project("tartiflette")
 
+        # Add a participant in this second project
+        self.client.post("/tartiflette/members/add", data={"name": "pirate"})
+        pirate = models.Person.query.filter(models.Person.id == 5).one()
+        assert pirate.name == "pirate"
+
+        # Try to add a new bill to another project
+        resp = self.client.post(
+            "/raclette/add",
+            data={
+                "date": "2017-01-01",
+                "what": "fromage frelaté",
+                "payer": 2,
+                "payed_for": [2, 3, 4],
+                "bill_type": "Expense",
+                "amount": "100.0",
+            },
+        )
+        # Ensure it has not been created
+        raclette = self.get_project("raclette")
+        assert raclette.get_bills().count() == 1
+
+        # Try to add a new bill in our project that references members of another project.
+        # First with invalid payed_for IDs.
+        resp = self.client.post(
+            "/tartiflette/add",
+            data={
+                "date": "2017-01-01",
+                "what": "soupe",
+                "payer": 5,
+                "payed_for": [3],
+                "bill_type": "Expense",
+                "amount": "5000.0",
+            },
+        )
+        # Ensure it has not been created
+        piratebill = models.Bill.query.filter(models.Bill.what == "soupe").one_or_none()
+        assert piratebill is None, "piratebill 1 should not exist"
+
+        # Then with invalid payer ID
+        self.client.post(
+            "/tartiflette/add",
+            data={
+                "date": "2017-02-01",
+                "what": "pain",
+                "payer": 3,
+                "payed_for": [5],
+                "bill_type": "Expense",
+                "amount": "5000.0",
+            },
+        )
+        # Ensure it has not been created
+        piratebill = models.Bill.query.filter(models.Bill.what == "pain").one_or_none()
+        assert piratebill is None, "piratebill 2 should not exist"
+
+        # Make sure we can actually create valid bills
+        self.client.post(
+            "/tartiflette/add",
+            data={
+                "date": "2017-03-01",
+                "what": "baguette",
+                "payer": 5,
+                "payed_for": [5],
+                "bill_type": "Expense",
+                "amount": "5.0",
+            },
+        )
+        # Ensure it has been created
+        okbill = models.Bill.query.filter(models.Bill.what == "baguette").one_or_none()
+        assert okbill is not None, "Bill baguette should exist"
+        assert okbill.what == "baguette"
+
+        # Now try to access and modify existing bills
         modified_bill = {
             "date": "2018-12-31",
             "what": "roblochon",
@@ -1556,6 +1630,24 @@ class TestBudget(IhatemoneyTestCase):
         member = models.Person.query.filter(models.Person.id == 1).one_or_none()
         assert member is None
 
+        # test new settle endpoint to add bills with wrong ids
+        self.client.post("/exit")
+        self.client.post(
+            "/authenticate", data={"id": "tartiflette", "password": "tartiflette"}
+        )
+        self.client.post(
+            "/tartiflette/settle",
+            data={
+                "sender_id": 4,
+                "receiver_id": 5,
+                "amount": "42.0",
+            },
+        )
+        piratebill = models.Bill.query.filter(
+            models.Bill.bill_type == models.BillType.REIMBURSEMENT
+        ).one_or_none()
+        assert piratebill is None, "piratebill 3 should not exist"
+
     @pytest.mark.skip(reason="Currency conversion is broken")
     def test_currency_switch(self):
         # A project should be editable

ihatemoney/utils.py

@@ -452,7 +452,9 @@ def format_form_errors(form, prefix):
         )
     else:
         error_list = "</li><li>".join(
-            str(error) for (field, errors) in form.errors.items() for error in errors
+            f"<strong>{field}</strong> {error}"
+            for (field, errors) in form.errors.items()
+            for error in errors
         )
         errors = f"<ul><li>{error_list}</li></ul>"
         # I18N: Form error with a list of errors

ihatemoney/web.py

@@ -56,6 +56,7 @@ from ihatemoney.forms import (
     ProjectForm,
     ProjectFormWithCaptcha,
     ResetPasswordForm,
+    SettlementForm,
     get_billform_for,
 )
 from ihatemoney.history import get_history, get_history_queries, purge_history
@@ -302,12 +303,14 @@ def home():
     is_public_project_creation_allowed = current_app.config[
         "ALLOW_PUBLIC_PROJECT_CREATION"
     ]
+    display_showcase = g.lang in current_app.config["SHOWCASE_LANGUAGES"]
 
     return render_template(
         "home.html",
         project_form=project_form,
         is_demo_project_activated=is_demo_project_activated,
         is_public_project_creation_allowed=is_public_project_creation_allowed,
+        display_showcase=display_showcase,
         auth_form=auth_form,
         session=session,
     )
@@ -684,6 +687,7 @@ def list_bills():
         csrf_form=csrf_form,
         add_bill=request.values.get("add_bill", False),
         current_view="list_bills",
+        display_showcase=g.lang in current_app.config["SHOWCASE_LANGUAGES"],
     )
 
 
@@ -852,24 +856,46 @@ def change_lang(lang):
 @main.route("/<project_id>/settle_bills")
 def settle_bill():
     """Compute the sum each one have to pay to each other and display it"""
-    bills = g.project.get_transactions_to_settle_bill()
-    return render_template("settle_bills.html", bills=bills, current_view="settle_bill")
+    transactions = g.project.get_transactions_to_settle_bill()
+    settlement_form = SettlementForm()
+    return render_template(
+        "settle_bills.html",
+        transactions=transactions,
+        settlement_form=settlement_form,
+        current_view="settle_bill",
+    )
 
 
-@main.route("/<project_id>/settle/<amount>/<int:ower_id>/<int:payer_id>")
-def settle(amount, ower_id, payer_id):
-    new_reinbursement = Bill(
-        amount=float(amount),
+@main.route("/<project_id>/settle", methods=["POST"])
+def add_settlement_bill():
+    """Create a bill to register a settlement"""
+    form = SettlementForm(id=g.project.id)
+    if not form.validate():
+        flash(
+            format_form_errors(form, _("Error creating settlement bill")),
+            category="danger",
+        )
+        return redirect(url_for(".settle_bill"))
+
+    # Ensure that the sender and receiver ID are valid and part of this project
+    receiver_id = form.receiver_id.data
+    sender_id = form.sender_id.data
+
+    if not g.project.has_member(sender_id):
+        return redirect(url_for(".settle_bill"))
+
+    settlement = Bill(
+        amount=form.amount.data,
         date=datetime.datetime.today(),
-        owers=[Person.query.get(payer_id)],
-        payer_id=ower_id,
+        owers=[Person.query.get(receiver_id, g.project)],
+        payer_id=sender_id,
         project_default_currency=g.project.default_currency,
         bill_type=BillType.REIMBURSEMENT,
         what=_("Settlement"),
     )
     session.update()
 
-    db.session.add(new_reinbursement)
+    db.session.add(settlement)
     db.session.commit()
 
     flash(_("Settlement bill has been successfully added"), category="success")