Set FROM field on emails (#55)

Fixes #54

Reviewed-on: data.coop/membersystem#55
Co-authored-by: Benjamin Bach <benjamin@overtag.dk>
Co-committed-by: Benjamin Bach <benjamin@overtag.dk>

.env.example

@@ -6,3 +6,5 @@ DATABASE_URL=postgres://postgres:postgres@postgres:5432/postgres
 # Use something along the the following if you are not using docker
 # DATABASE_URL=postgres://postgres:postgres@localhost:5432/datacoop_membersystem
 DEBUG=True
+STRIPE_API_KEY=sk_test_
+STRIPE_ENDPOINT_SECRET=whsec_

.gitignore

@@ -8,3 +8,7 @@ db.sqlite3
 .env
 venv/
 .venv/
+
+
+# collectstatic
+src/static/

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim-bullseye
+FROM python:3.12-slim-bookworm
 
 # PYTHONFAULTHANDLER: Propagate tracebacks from all threads.
 # PYTHONUNBUFFERED: Write terminal output straight to docker (to not confuse Docker Compose).
@@ -13,14 +13,18 @@ ENV PYTHONFAULTHANDLER=1 \
   PIP_DISABLE_PIP_VERSION_CHECK=on \
   PIP_DEFAULT_TIMEOUT=100
 ARG BUILD
-ENV BUILD ${BUILD}
+ENV BUILD=${BUILD}
 ARG REQUIREMENTS_FILE=requirements.txt
 
 WORKDIR /app
 
 RUN groupadd -g 1000 www && useradd -u 1000 -ms /bin/bash -g www www
-COPY --chown=www:www . .
-RUN mkdir /app/src/static && \
+
+# Only copy the requirements file first to leverage Docker cache
+RUN mkdir requirements/
+COPY $REQUIREMENTS_FILE $REQUIREMENTS_FILE
+
+RUN mkdir -p /app/src/static && \
     chown www:www /app/src/static && \
     apt-get update && \
     apt-get install -y \
@@ -35,8 +39,12 @@ RUN mkdir /app/src/static && \
      libffi-dev \
      shared-mime-info \
      gettext && \
-    pip install --no-cache-dir -r $REQUIREMENTS_FILE && \
-    django-admin compilemessages
+    pip install --no-cache-dir -r $REQUIREMENTS_FILE
+
+# Copy the rest of the application
+COPY . .
+
+RUN django-admin compilemessages
 
 ENTRYPOINT ["./entrypoint.sh"]
 

Makefile

@@ -1,6 +1,6 @@
+.PHONY: run makemigrations migrate createsuperuser shell manage_command build requirements
 DOCKER_COMPOSE = COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 docker compose
 DOCKER_RUN = ${DOCKER_COMPOSE} run -u `id -u`
-DOCKER_BUILD = DOCKER_BUILDKIT=1 docker build
 MANAGE_EXEC = python /app/src/manage.py
 MANAGE_COMMAND = ${DOCKER_RUN} app ${MANAGE_EXEC}
 
@@ -21,3 +21,9 @@ shell:
 
 manage_command:
 	${MANAGE_COMMAND} ${ARGS}
+
+build:
+	${DOCKER_COMPOSE} build
+
+requirements:
+	hatch run requirements

README.md

@@ -7,7 +7,6 @@ There are two ways to setup the development environment.
 - Using the Docker Compose setup provided in this repository.
 - Using [hatch](https://hatch.pypa.io/) in your host OS.
 
-
 ### Using Docker Compose
 
 Working with the Docker Compose setup is made easy with the `Makefile` provided in the repository.
@@ -21,24 +20,37 @@ Working with the Docker Compose setup is made easy with the `Makefile` provided
 
 1. Setup .env file
 
-An example .env file is provided in the repository. You can copy it to .env file using the following command:
+    An example .env file is provided in the repository. You can copy it to .env file using the following command:
 
-```bash
-cp .env.example .env
-```
+    ```bash
+    cp .env.example .env
+    ```
 
-The default values in the .env file are suitable for the docker-compose setup.
+    The default values in the .env file are suitable for the docker-compose setup.
 
 2. Migrate
 
-```bash
-make migrate
-```
+    ```bash
+    make migrate
+    ```
 
 3. Run the development server
 
+    ```bash
+    make run
+    ```
+
+#### Building and running other things
+
 ```bash
-make run
+# Build the containers
+make build
+
+# Create a superuser
+make createsuperuser
+
+# Create Django migrations (after this, maybe you need to change file permissions in volume)
+make makemigrations
 ```
 
 ### Using hatch
@@ -53,22 +65,41 @@ make run
 
 1. Setup .env file
 
-An example .env file is provided in the repository. You can copy it to .env file using the following command:
+    An example .env file is provided in the repository. You can copy it to .env file using the following command:
 
-```bash
-cp .env.example .env
-```
+    ```bash
+    cp .env.example .env
+    ```
 
-Edit the .env file and set the values for the environment variables, especially the database variables.
+    Edit the .env file and set the values for the environment variables, especially the database variables.
 
 2. Run migrate
 
-```bash
-hatch run dev:migrate
-```
+    ```bash
+    hatch run dev:migrate
+    ```
 
 3. Run the development server
 
+   ```bash
+   hatch run dev:server
+   ```
+
+### Updating requirements
+
+We use hatch-pip-compile. That means we have a set of loosely defined `dependencies` in `pyproject.toml` and then we can keep the exactly pinned version in our `requirements.txt` (auto-generated).
+
+To generate `requirements.txt` and `requirements/requirements-dev.txt`, run the following command:
+
 ```bash
-hatch run dev:server
+# Build requirements.txt etc
+make requirements
+
+# Build Docker image with new Python requirements
+make build
 ```
+
+## Important notes
+
+* This project uses [django-zen-queries](https://github.com/dabapps/django-zen-queries), which will sometimes raise a `QueriesDisabledError` in your templates. You can find a difference of opinion about that, but you can find a difference of opinion about many things, right?
+* If a linting error annoys you, please feel free to strike back by adding a `noqa` to the line that has displeased the linter and move on with life.

pyproject.toml

@@ -12,17 +12,21 @@ authors = [
     { name = "Víðir Valberg Guðmundsson", email = "valberg@orn.li" },
 ]
 dependencies = [
-    "Django~=5.0",
-    "django-money~=3.5",
+    "Django~=5.1",
     "django-allauth~=0.63",
-    "psycopg[binary]~=3.2",
-    "environs[django]>=11,<12",
-    "uvicorn~=0.30",
-    "whitenoise~=6.7",
-    "django-zen-queries~=2.1",
+    "django-money~=3.5",
+    "django-oauth-toolkit~=2.4",
     "django-registries==0.0.3",
     "django-view-decorator==0.0.4",
     "django-oauth-toolkit~=2.4",
+    "django-ratelimit~=4.1",
+    "django-zen-queries~=2.1",
+    "django_stubs_ext~=5.0",
+    "environs[django]>=11,<12",
+    "psycopg[binary]~=3.2",
+    "stripe~=10.5",
+    "uvicorn~=0.30",
+    "whitenoise~=6.7",
 ]
 version = "0.0.1"
 
@@ -34,9 +38,11 @@ requires = ["hatch-pip-compile"]
 
 [tool.hatch.envs.default]
 type = "pip-compile"
+pip-compile-resolver = "uv"
 
 [tool.hatch.envs.dev]
 type = "pip-compile"
+pip-compile-resolver = "uv"
 dependencies = [
     "coverage[toml]==7.3.0",
     "pytest==7.2.2",
@@ -52,26 +58,25 @@ dependencies = [
 
 [[tool.hatch.envs.tests.matrix]]
 python = ["3.12"]
-django = ["5.0"]
+django = ["5.1"]
 
 [tool.hatch.envs.tests.overrides]
 matrix.django.dependencies = [
     { value = "django~={matrix:django}" },
 ]
-matrix.python.dependencies = [
-    { value = "typing_extensions==4.5.0", if = ["3.10"]},
-]
 
-[tool.hatch.envs.dev.scripts]
+[tool.hatch.envs.default.scripts]
 cov = "pytest --cov-report=term-missing --cov-config=pyproject.toml --cov=src --cov=tests --cov=append {args}"
 no-cov = "cov --no-cov {args}"
 typecheck = "mypy --config-file=pyproject.toml ."
-requirements = "pip-compile --output-file requirements/base.txt pyproject.toml"
+requirements = "hatch env run --env default -- python --version; hatch env run --env dev -- python --version"
 server = "./src/manage.py runserver 0.0.0.0:8000"
 migrate = "./src/manage.py migrate"
 makemigrations = "./src/manage.py makemigrations"
 createsuperuser = "./src/manage.py createsuperuser"
 shell = "./src/manage.py shell"
+# You need to install Stripe CLI from here to run this: https://github.com/stripe/stripe-cli/releases
+stripe_cli = "stripe listen --forward-to 0.0.0.0:8000/order/stripe/webhook/"
 
 [tool.pytest.ini_options]
 DJANGO_SETTINGS_MODULE="tests.settings"
@@ -104,10 +109,10 @@ show_error_codes = true
 strict = true
 warn_unreachable = true
 follow_imports = "normal"
-#plugins = ["mypy_django_plugin.main"]
+plugins = ["mypy_django_plugin.main"]
 
 [tool.django-stubs]
-#django_settings_module = "tests.settings"
+django_settings_module = "project.settings"
 
 [[tool.mypy.overrides]]
 module = "tests.*"
@@ -134,12 +139,19 @@ ignore = [
     "EM102", # Exception must not use a f-string literal, assign to variable first
     "COM812", # missing-trailing-comma (https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules)
     "ISC001", # single-line-implicit-string-concatenation (https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules)
+    "D100", # Missing docstring in public module
+    "D101", # Missing docstring in public class
+    "D102", # Missing docstring in public method
     "D105", # Missing docstring in magic method
     "D106", # Missing docstring in public nested class
+    "D107", # Missing docstring in `__init__`
     "FIX", # TODO, FIXME, XXX
     "TD", # TODO, FIXME, XXX
     "ANN002", # Missing type annotation for `*args`
     "ANN003", # Missing type annotation for `**kwargs`
+    "FBT001", # Misbehaves: Boolean-typed positional argument in function definition
+    "FBT002", # Misbehaves: Boolean-typed positional argument in function definition
+    "TRY003", # Avoid specifying long messages outside the exception class
 ]
 
 [tool.ruff.lint.isort]

requirements.txt

@@ -1,17 +1,20 @@
 #
 # This file is autogenerated by hatch-pip-compile with Python 3.12
 #
-# - django-allauth==0.63.6
-# - django-money==3.5.2
-# - django-oauth-toolkit==2.4.0
+# - django-allauth~=0.63
+# - django-money~=3.5
+# - django-oauth-toolkit~=2.4
+# - django-ratelimit~=4.1
 # - django-registries==0.0.3
+# - django-stubs-ext~=5.0
 # - django-view-decorator==0.0.4
-# - django-zen-queries==2.1.0
-# - django==5.0.7
-# - environs[django]==11.0.0
-# - psycopg[binary]==3.2.1
-# - uvicorn==0.30.1
-# - whitenoise==6.7.0
+# - django-zen-queries~=2.1
+# - django<5.2,>=5.1b1
+# - environs[django]<12,>=11
+# - psycopg[binary]~=3.2
+# - stripe~=10.5
+# - uvicorn~=0.30
+# - whitenoise~=6.7
 #
 
 asgiref==3.8.1
@@ -26,13 +29,13 @@ charset-normalizer==3.3.2
     # via requests
 click==8.1.7
     # via uvicorn
-cryptography==42.0.8
+cryptography==43.0.0
     # via jwcrypto
 dj-database-url==2.2.0
     # via environs
 dj-email-url==1.0.6
     # via environs
-django==5.0.7
+django==5.1rc1
     # via
     #   hatch.envs.default
     #   dj-database-url
@@ -40,18 +43,23 @@ django==5.0.7
     #   django-money
     #   django-oauth-toolkit
     #   django-registries
+    #   django-stubs-ext
     #   django-view-decorator
     #   django-zen-queries
 django-allauth==0.63.6
     # via hatch.envs.default
 django-cache-url==3.4.5
     # via environs
-django-money==3.5.2
+django-money==3.5.3
     # via hatch.envs.default
 django-oauth-toolkit==2.4.0
     # via hatch.envs.default
+django-ratelimit==4.1.0
+    # via hatch.envs.default
 django-registries==0.0.3
     # via hatch.envs.default
+django-stubs-ext==5.0.4
+    # via hatch.envs.default
 django-view-decorator==0.0.4
     # via hatch.envs.default
 django-zen-queries==2.1.0
@@ -83,21 +91,26 @@ python-dotenv==1.0.1
 pytz==2024.1
     # via django-oauth-toolkit
 requests==2.32.3
-    # via django-oauth-toolkit
+    # via
+    #   django-oauth-toolkit
+    #   stripe
+setuptools==72.1.0
+    # via django-money
 sqlparse==0.5.1
     # via django
+stripe==10.6.0
+    # via hatch.envs.default
 typing-extensions==4.12.2
     # via
     #   dj-database-url
+    #   django-stubs-ext
     #   jwcrypto
     #   psycopg
     #   py-moneyed
+    #   stripe
 urllib3==2.2.2
     # via requests
-uvicorn==0.30.1
+uvicorn==0.30.5
     # via hatch.envs.default
 whitenoise==6.7.0
     # via hatch.envs.default
-
-# The following packages are considered to be unsafe in a requirements file:
-# setuptools

requirements/base.txt

@@ -1,97 +0,0 @@
-#
-# This file is autogenerated by pip-compile with Python 3.12
-# by the following command:
-#
-#    pip-compile --output-file=requirements/base.txt pyproject.toml
-#
-asgiref==3.8.1
-    # via django
-babel==2.15.0
-    # via py-moneyed
-certifi==2024.7.4
-    # via requests
-cffi==1.16.0
-    # via cryptography
-charset-normalizer==3.3.2
-    # via requests
-click==8.1.7
-    # via uvicorn
-cryptography==43.0.0
-    # via jwcrypto
-dj-database-url==2.2.0
-    # via environs
-dj-email-url==1.0.6
-    # via environs
-django==5.0.7
-    # via
-    #   dj-database-url
-    #   django-allauth
-    #   django-money
-    #   django-oauth-toolkit
-    #   django-registries
-    #   django-view-decorator
-    #   django-zen-queries
-    #   membersystem (pyproject.toml)
-django-allauth==0.63.6
-    # via membersystem (pyproject.toml)
-django-cache-url==3.4.5
-    # via environs
-django-money==3.5.2
-    # via membersystem (pyproject.toml)
-django-oauth-toolkit==2.4.0
-    # via membersystem (pyproject.toml)
-django-registries==0.0.3
-    # via membersystem (pyproject.toml)
-django-view-decorator==0.0.4
-    # via membersystem (pyproject.toml)
-django-zen-queries==2.1.0
-    # via membersystem (pyproject.toml)
-environs[django]==11.0.0
-    # via
-    #   environs
-    #   membersystem (pyproject.toml)
-h11==0.14.0
-    # via uvicorn
-idna==3.7
-    # via requests
-jwcrypto==1.5.6
-    # via django-oauth-toolkit
-marshmallow==3.21.3
-    # via environs
-oauthlib==3.2.2
-    # via django-oauth-toolkit
-packaging==24.1
-    # via marshmallow
-psycopg[binary]==3.2.1
-    # via
-    #   membersystem (pyproject.toml)
-    #   psycopg
-psycopg-binary==3.2.1
-    # via psycopg
-py-moneyed==3.0
-    # via django-money
-pycparser==2.22
-    # via cffi
-python-dotenv==1.0.1
-    # via environs
-pytz==2024.1
-    # via django-oauth-toolkit
-requests==2.32.3
-    # via django-oauth-toolkit
-sqlparse==0.5.1
-    # via django
-typing-extensions==4.12.2
-    # via
-    #   dj-database-url
-    #   jwcrypto
-    #   psycopg
-    #   py-moneyed
-urllib3==2.2.2
-    # via requests
-uvicorn==0.30.3
-    # via membersystem (pyproject.toml)
-whitenoise==6.7.0
-    # via membersystem (pyproject.toml)
-
-# The following packages are considered to be unsafe in a requirements file:
-# setuptools

requirements/requirements-dev.txt

@@ -14,12 +14,15 @@
 # - django-allauth~=0.63
 # - django-money~=3.5
 # - django-oauth-toolkit~=2.4
+# - django-ratelimit~=4.1
 # - django-registries==0.0.3
+# - django-stubs-ext~=5.0
 # - django-view-decorator==0.0.4
 # - django-zen-queries~=2.1
-# - django~=5.0
+# - django<5.2,>=5.1b1
 # - environs[django]<12,>=11
 # - psycopg[binary]~=3.2
+# - stripe~=10.5
 # - uvicorn~=0.30
 # - whitenoise~=6.7
 #
@@ -45,15 +48,14 @@ click==8.1.7
 coverage==7.3.0
     # via
     #   hatch.envs.dev
-    #   coverage
     #   pytest-cov
-cryptography==42.0.8
+cryptography==43.0.0
     # via jwcrypto
 dj-database-url==2.2.0
     # via environs
 dj-email-url==1.0.6
     # via environs
-django==5.0.7
+django==5.1rc1
     # via
     #   hatch.envs.dev
     #   dj-database-url
@@ -76,24 +78,26 @@ django-cache-url==3.4.5
     # via environs
 django-debug-toolbar==4.2.0
     # via hatch.envs.dev
-django-money==3.5.2
+django-money==3.5.3
     # via hatch.envs.dev
 django-oauth-toolkit==2.4.0
     # via hatch.envs.dev
+django-ratelimit==4.1.0
+    # via hatch.envs.dev
 django-registries==0.0.3
     # via hatch.envs.dev
 django-stubs==1.16.0
     # via hatch.envs.dev
-django-stubs-ext==5.0.2
-    # via django-stubs
+django-stubs-ext==5.0.4
+    # via
+    #   hatch.envs.dev
+    #   django-stubs
 django-view-decorator==0.0.4
     # via hatch.envs.dev
 django-zen-queries==2.1.0
     # via hatch.envs.dev
 environs==11.0.0
-    # via
-    #   hatch.envs.dev
-    #   environs
+    # via hatch.envs.dev
 h11==0.14.0
     # via uvicorn
 idna==3.7
@@ -119,14 +123,14 @@ packaging==24.1
     #   build
     #   marshmallow
     #   pytest
+pip==24.2
+    # via pip-tools
 pip-tools==7.3.0
     # via hatch.envs.dev
 pluggy==1.5.0
     # via pytest
 psycopg==3.2.1
-    # via
-    #   hatch.envs.dev
-    #   psycopg
+    # via hatch.envs.dev
 psycopg-binary==3.2.1
     # via psycopg
 py-moneyed==3.0
@@ -149,16 +153,24 @@ python-dotenv==1.0.1
 pytz==2024.1
     # via django-oauth-toolkit
 requests==2.32.3
-    # via django-oauth-toolkit
+    # via
+    #   django-oauth-toolkit
+    #   stripe
+setuptools==72.1.0
+    # via
+    #   django-money
+    #   pip-tools
 sqlparse==0.5.1
     # via
     #   django
     #   django-debug-toolbar
+stripe==10.6.0
+    # via hatch.envs.dev
 tomli==2.0.1
     # via django-stubs
 types-pytz==2024.1.0.20240417
     # via django-stubs
-types-pyyaml==6.0.12.20240311
+types-pyyaml==6.0.12.20240724
     # via django-stubs
 typing-extensions==4.12.2
     # via
@@ -169,15 +181,12 @@ typing-extensions==4.12.2
     #   mypy
     #   psycopg
     #   py-moneyed
+    #   stripe
 urllib3==2.2.2
     # via requests
-uvicorn==0.30.1
+uvicorn==0.30.5
     # via hatch.envs.dev
 wheel==0.43.0
     # via pip-tools
 whitenoise==6.7.0
     # via hatch.envs.dev
-
-# The following packages are considered to be unsafe in a requirements file:
-# pip
-# setuptools

src/accounting/admin.py

@@ -1,36 +1,94 @@
 """Admin for the accounting app."""
 
+from django import forms
 from django.contrib import admin
+from django.contrib import messages
+from django.db.models import QuerySet
+from django.http import HttpRequest
 from django.utils.translation import gettext_lazy as _
+from membership.emails import OrderEmail
 
-from .models import Order
-from .models import Payment
+from . import models
 
 
-@admin.register(Order)
+class OrderProductInline(admin.TabularInline):
+    """Administer contents of an order inline."""
+
+    model = models.OrderProduct
+
+
+class OrderAdminForm(forms.ModelForm):
+    """Special Form for the OrderAdmin so we don't need to require the account field."""
+
+    account = forms.ModelChoiceField(
+        required=False,
+        queryset=models.Account.objects.all(),
+        help_text=_("Leave empty to auto-choose the member's own account or to create one."),
+    )
+
+    class Meta:
+        model = models.Order
+        exclude = ()  # noqa: DJ006
+
+    def clean(self):  # noqa: ANN201
+        cd = super().clean()
+        if not cd["account"] and cd["member"]:
+            try:
+                cd["account"] = models.Account.objects.get_or_create(owner=cd["member"])[0]
+            except models.Account.MultipleObjectsReturned:
+                cd["account"] = models.Account.objects.filter(owner=cd["member"]).first()
+        return cd
+
+
+@admin.register(models.Order)
 class OrderAdmin(admin.ModelAdmin):
     """Admin for the Order model."""
 
-    list_display = ("who", "description", "created", "is_paid")
+    inlines = (OrderProductInline,)
+    form = OrderAdminForm
 
-    @admin.display(description=_("Customer"))
-    def who(self, instance: Order) -> str:
-        """Return the full name of the user who made the order."""
-        return instance.user.get_full_name()
+    actions = ("send_order",)
+
+    list_display = ("member", "description", "created", "is_paid", "total_with_vat")
+    search_fields = ("member__email", "membership__membership_type__name", "description")
+    list_filter = ("is_paid", "membership__membership_type")
+
+    @admin.action(description="Send order link to selected unpaid orders")
+    def send_order(self, request: HttpRequest, queryset: QuerySet[models.Order]) -> None:
+        for order in queryset:
+            if order.is_paid:
+                messages.error(
+                    request,
+                    f"Order pk={order.id} is already marked paid, not sending email to: {order.member.email}",
+                )
+                continue
+            email = OrderEmail(order, request)
+            email.send()
+            messages.success(request, f"Sent an order for order pk={order.id} link to: {order.member.email}")
 
 
-@admin.register(Payment)
+@admin.register(models.Payment)
 class PaymentAdmin(admin.ModelAdmin):
     """Admin for the Payment model."""
 
-    list_display = ("who", "description", "order_id", "created")
-
-    @admin.display(description=_("Customer"))
-    def who(self, instance: Payment) -> str:
-        """Return the full name of the user who made the payment."""
-        return instance.order.user.get_full_name()
+    list_display = ("order__member", "description", "order_id", "created")
 
     @admin.display(description=_("Order ID"))
-    def order_id(self, instance: Payment) -> int:
+    def order_id(self, instance: models.Payment) -> int:
         """Return the ID of the order."""
         return instance.order.id
+
+
+@admin.register(models.Product)
+class ProductAdmin(admin.ModelAdmin):
+    list_display = ("name", "price", "vat")
+
+
+class TransactionInline(admin.TabularInline):
+    model = models.Transaction
+
+
+@admin.register(models.Account)
+class AccountAdmin(admin.ModelAdmin):
+    list_display = ("owner", "balance")
+    inlines = (TransactionInline,)

src/accounting/apps.py

@@ -7,3 +7,7 @@ class AccountingConfig(AppConfig):
     """Accounting app config."""
 
     name = "accounting"
+
+    def ready(self) -> None:
+        """Implicitly connect a signal handlers decorated with @receiver."""
+        from . import signals  # noqa: F401

src/accounting/migrations/0004_paymenttype_product_payment_external_transaction_id_and_more.py

@@ -0,0 +1,78 @@
+# Generated by Django 5.0.7 on 2024-07-21 14:12
+
+import django.db.models.deletion
+import djmoney.models.fields
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounting', '0003_alter_payment_stripe_charge_id'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='PaymentType',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='oprettet')),
+                ('name', models.CharField(max_length=1024, verbose_name='description')),
+                ('description', models.TextField(blank=True, max_length=2048)),
+                ('enabled', models.BooleanField(default=True)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='Product',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='oprettet')),
+                ('name', models.CharField(max_length=512)),
+                ('price_currency', djmoney.models.fields.CurrencyField(choices=[('DKK', 'DKK')], default=None, editable=False, max_length=3)),
+                ('price', djmoney.models.fields.MoneyField(decimal_places=2, max_digits=16)),
+                ('vat_currency', djmoney.models.fields.CurrencyField(choices=[('DKK', 'DKK')], default=None, editable=False, max_length=3)),
+                ('vat', djmoney.models.fields.MoneyField(decimal_places=2, max_digits=16)),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+        migrations.AddField(
+            model_name='payment',
+            name='external_transaction_id',
+            field=models.CharField(blank=True, default='', max_length=255),
+        ),
+        migrations.AlterField(
+            model_name='payment',
+            name='stripe_charge_id',
+            field=models.CharField(blank=True, default='', max_length=255),
+        ),
+        migrations.AddField(
+            model_name='payment',
+            name='payment_type',
+            field=models.ForeignKey(default=1, on_delete=django.db.models.deletion.PROTECT, to='accounting.paymenttype'),
+            preserve_default=False,
+        ),
+        migrations.CreateModel(
+            name='OrderProduct',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='oprettet')),
+                ('price_currency', djmoney.models.fields.CurrencyField(choices=[('DKK', 'DKK')], default=None, editable=False, max_length=3)),
+                ('price', djmoney.models.fields.MoneyField(decimal_places=2, max_digits=16)),
+                ('vat_currency', djmoney.models.fields.CurrencyField(choices=[('DKK', 'DKK')], default=None, editable=False, max_length=3)),
+                ('vat', djmoney.models.fields.MoneyField(decimal_places=2, max_digits=16)),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='ordered_products', to='accounting.order')),
+                ('product', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='ordered_products', to='accounting.product')),
+            ],
+            options={
+                'abstract': False,
+            },
+        ),
+    ]

src/accounting/migrations/0005_remove_order_price_remove_order_price_currency_and_more.py

@@ -0,0 +1,40 @@
+# Generated by Django 5.0.7 on 2024-07-21 14:53
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounting', '0004_paymenttype_product_payment_external_transaction_id_and_more'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='order',
+            name='price',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='price_currency',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='vat',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='vat_currency',
+        ),
+        migrations.AlterField(
+            model_name='orderproduct',
+            name='order',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='order_products', to='accounting.order'),
+        ),
+        migrations.AlterField(
+            model_name='orderproduct',
+            name='product',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='order_products', to='accounting.product'),
+        ),
+    ]

src/accounting/migrations/0006_alter_account_owner_alter_order_user.py

@@ -0,0 +1,25 @@
+# Generated by Django 5.0.7 on 2024-07-21 15:17
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounting', '0005_remove_order_price_remove_order_price_currency_and_more'),
+        ('membership', '0006_waitinglistentry_alter_membership_options'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='account',
+            name='owner',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='membership.member'),
+        ),
+        migrations.AlterField(
+            model_name='order',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='membership.member'),
+        ),
+    ]

src/accounting/migrations/0007_alter_orderproduct_options_rename_user_order_member_and_more.py

@@ -0,0 +1,42 @@
+# Generated by Django 5.1b1 on 2024-08-01 10:50
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounting', '0006_alter_account_owner_alter_order_user'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='orderproduct',
+            options={'verbose_name': 'ordered product', 'verbose_name_plural': 'ordered products'},
+        ),
+        migrations.RenameField(
+            model_name='order',
+            old_name='user',
+            new_name='member',
+        ),
+        migrations.RemoveField(
+            model_name='payment',
+            name='stripe_charge_id',
+        ),
+        migrations.AddField(
+            model_name='orderproduct',
+            name='quantity',
+            field=models.PositiveSmallIntegerField(default=1),
+        ),
+        migrations.AlterField(
+            model_name='orderproduct',
+            name='order',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='items', to='accounting.order'),
+        ),
+        migrations.AlterField(
+            model_name='orderproduct',
+            name='product',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='accounting.product'),
+        ),
+    ]

src/accounting/models.py

@@ -4,6 +4,7 @@ from hashlib import md5
 from typing import Self
 
 from django.conf import settings
+from django.contrib import admin
 from django.db import models
 from django.db.models.aggregates import Sum
 from django.utils.translation import gettext as _
@@ -29,10 +30,10 @@ class Account(CreatedModifiedAbstract):
     can decide which account to use to pay for something.
     """
 
-    owner = models.ForeignKey("auth.User", on_delete=models.PROTECT)
+    owner = models.ForeignKey("membership.Member", on_delete=models.PROTECT)
 
     def __str__(self) -> str:
-        return f"Account of {self.owner.get_full_name()}"
+        return f"Account of {self.owner}"
 
     @property
     def balance(self) -> Money:
@@ -67,36 +68,43 @@ class Transaction(CreatedModifiedAbstract):
 class Order(CreatedModifiedAbstract):
     """An order.
 
-    Scoped out: Contents of invoices will have to be tracked either here or in
-    a separate Invoice model. This is undecided because we are not generating
-    invoices at the moment.
+    We assemble the order from a number of products. Once an order is paid, the contents should be
+    considered locked.
     """
 
-    user = models.ForeignKey("auth.User", on_delete=models.PROTECT)
+    member = models.ForeignKey("membership.Member", on_delete=models.PROTECT)
     account = models.ForeignKey(Account, on_delete=models.PROTECT)
 
     description = models.CharField(max_length=1024, verbose_name=_("description"))
 
-    price = MoneyField(
-        verbose_name=_("price (excl. VAT)"),
-        max_digits=16,
-        decimal_places=2,
-    )
-    vat = MoneyField(verbose_name=_("VAT"), max_digits=16, decimal_places=2)
-
     is_paid = models.BooleanField(default=False, verbose_name=_("is paid"))
 
     class Meta:
-        verbose_name = pgettext_lazy("accounting term", "Order")
-        verbose_name_plural = pgettext_lazy("accounting term", "Orders")
+        verbose_name = pgettext_lazy("accounting", "Order")
+        verbose_name_plural = pgettext_lazy("accounting", "Orders")
 
     def __str__(self) -> str:
         return f"Order ID {self.display_id}"
 
     @property
     def total(self) -> Money:
-        """Return the total price of the order."""
-        return self.price + self.vat
+        """Return the total price of the order (excl VAT)."""
+        return sum(item.price * item.quantity for item in self.items.all())
+
+    @property
+    def total_vat(self) -> Money:
+        """Return the total VAT of the order."""
+        return sum(item.vat * item.quantity for item in self.items.all())
+
+    @property
+    @admin.display(
+        ordering=None,
+        description="Total (incl. VAT)",
+        boolean=False,
+    )
+    def total_with_vat(self) -> Money:
+        """Return the TOTAL amount WITH VAT."""
+        return self.total + self.total_vat
 
     @property
     def display_id(self) -> str:
@@ -114,6 +122,42 @@ class Order(CreatedModifiedAbstract):
         return x.hexdigest()
 
 
+class Product(CreatedModifiedAbstract):
+    """A generic product, for instance a membership or a service fee."""
+
+    name = models.CharField(max_length=512)
+    price = MoneyField(max_digits=16, decimal_places=2)
+    vat = MoneyField(max_digits=16, decimal_places=2)
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class OrderProduct(CreatedModifiedAbstract):
+    """When a product is ordered, we store the product on the order.
+
+    This includes pricing information.
+    """
+
+    order = models.ForeignKey(Order, on_delete=models.CASCADE, related_name="items")
+    product = models.ForeignKey(Product, on_delete=models.PROTECT)
+    price = MoneyField(max_digits=16, decimal_places=2)
+    vat = MoneyField(max_digits=16, decimal_places=2)
+    quantity = models.PositiveSmallIntegerField(default=1)
+
+    class Meta:
+        verbose_name = _("ordered product")
+        verbose_name_plural = _("ordered products")
+
+    def __str__(self) -> str:
+        return f"{self.product.name}"
+
+    @property
+    def total_with_vat(self) -> Money:
+        """Total price of this item."""
+        return (self.price + self.vat) * self.quantity
+
+
 class Payment(CreatedModifiedAbstract):
     """A payment is a transaction that is made to pay for an order."""
 
@@ -122,7 +166,8 @@ class Payment(CreatedModifiedAbstract):
 
     description = models.CharField(max_length=1024, verbose_name=_("description"))
 
-    stripe_charge_id = models.CharField(max_length=255, blank=True)
+    payment_type = models.ForeignKey("PaymentType", on_delete=models.PROTECT)
+    external_transaction_id = models.CharField(max_length=255, default="", blank=True)
 
     class Meta:
         verbose_name = _("payment")
@@ -137,11 +182,28 @@ class Payment(CreatedModifiedAbstract):
         return str(self.id).zfill(6)
 
     @classmethod
-    def from_order(cls, order: Order) -> Self:
+    def from_order(cls, order: Order, payment_type: "PaymentType") -> Self:
         """Create a payment from an order."""
         return cls.objects.create(
             order=order,
             user=order.user,
-            amount=order.total,
+            amount=order.total + order.total_vat,
             description=order.description,
+            payment_type=payment_type,
         )
+
+
+class PaymentType(CreatedModifiedAbstract):
+    """Types of payments available in the system.
+
+    - bank transfer
+    - card payment (specific provider)
+    """
+
+    name = models.CharField(max_length=1024, verbose_name=_("description"))
+    description = models.TextField(max_length=2048, blank=True)
+
+    enabled = models.BooleanField(default=True)
+
+    def __str__(self) -> str:
+        return f"{self.name}"

src/accounting/signals.py

@@ -0,0 +1,36 @@
+"""Loaded with the AppConfig.ready() method."""
+
+from django.core.mail import mail_admins
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+from django.utils import timezone
+from membership.models import Membership
+
+from . import models
+
+
+# method for updating
+@receiver(post_save, sender=models.Payment)
+def check_total_amount(sender: models.Payment, instance: models.Payment, **kwargs: dict) -> None:  # noqa: ARG001
+    """Check that we receive Payments with the correct amount."""
+    if instance.amount != instance.order.total_with_vat:
+        mail_admins(
+            "Payment received: wrong amount",
+            f"Please check payment ID {instance.pk}",
+        )
+
+
+@receiver(post_save, sender=models.Payment)
+def mark_order_paid(sender: models.Payment, instance: models.Payment, **kwargs: dict) -> None:  # noqa: ARG001
+    """Mark an order as paid when payment is received."""
+    instance.order.is_paid = True
+    instance.order.save()
+
+
+@receiver(post_save, sender=models.Order)
+def activate_membership(sender: models.Order, instance: models.Order, **kwargs: dict) -> None:  # noqa: ARG001
+    """Mark a membership as activated when its order is marked as paid."""
+    if instance.is_paid:
+        Membership.objects.filter(order=instance, activated=False, activated_on=None).update(
+            activated=True, activated_on=timezone.now()
+        )

src/accounting/templates/accounting/order/cancel.html

@@ -0,0 +1,18 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% block head_title %}
+    {% trans "Payment cancelled" %}
+{% endblock %}
+
+{% block content %}
+
+    <div class="content-view">
+        <h2>{% trans "Payment canceled" %}</h2>
+
+        <p>
+            <a href="{% order:detail order_id=order.id %}">{% trans "Return to order page" %}</a>
+        </p>
+
+    </div>
+{% endblock %}

src/accounting/templates/accounting/order/detail.html

@@ -0,0 +1,49 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% block head_title %}
+    {% trans "Order" context "accounting" %}
+{% endblock %}
+
+{% block content %}
+
+    <div class="content-view">
+        <h2>Order: {{ order.id }}</h2>
+
+        <p>
+          {% trans "Ordered" context "accounting" %}: {{ order.created }}<br>
+          {% trans "Status" context "accounting" %}: {{ order.is_paid|yesno:_("paid,unpaid") }}
+        </p>
+
+        <table class="table">
+            <thead>
+            <tr>
+                <th>{% trans "Item" context "accounting" %}</th>
+                <th>{% trans "Quantity" %}</th>
+                <th>{% trans "Price" %}</th>
+                <th>{% trans "VAT" %}</th>
+                <th>{% trans "Total" %}</th>
+            </tr>
+            </thead>
+            <tbody>
+            {% for item in order.items.all %}
+                <tr>
+                    <td>{{ item.product.name }}</td>
+                    <td>{{ item.quantity }}</td>
+                    <td>{{ item.price }}</td>
+                    <td>{{ item.vat }}</td>
+                    <td>{{ item.total_with_vat }}</td>
+                </tr>
+            {% endfor %}
+            </tbody>
+        </table>
+
+        <h2>{% trans "Total price" %}: {{ order.total_with_vat }}</h2>
+
+        {% if not order.is_paid %}
+        <p>
+          <a href="{% url "order:pay" order_id=order.pk %}" class="button">{% trans "Pay now" %}</a>
+        </p>
+        {% endif %}
+    </div>
+{% endblock %}

src/accounting/templates/accounting/order/success.html

@@ -0,0 +1,20 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% block head_title %}
+    {% trans "Payment received" %}
+{% endblock %}
+
+{% block content %}
+
+    <div class="content-view">
+        <h2>{% trans "Payment received" %}</h2>
+
+        <p>
+        {% blocktrans trimmed with order.id as order_id %}
+            Thanks fellow member! We received your payment for Order {{ order_id }}. We're adding more features to the site, so expect to see a confirmation email (receipt) for the order soon.
+        {% endblocktrans %}
+        </p>
+
+    </div>
+{% endblock %}

src/accounting/views.py

@@ -0,0 +1,177 @@
+"""Views for the membership app."""
+
+import stripe
+from django.conf import settings
+from django.contrib.sites.models import Site
+from django.core.mail import mail_admins
+from django.db import transaction
+from django.http import HttpRequest
+from django.http import HttpResponse
+from django.shortcuts import get_object_or_404
+from django.shortcuts import redirect
+from django.shortcuts import render
+from django.urls import reverse
+from django.views.decorators.csrf import csrf_exempt
+from django_view_decorator import namespaced_decorator_factory
+from djmoney.money import Money
+
+from . import models
+
+order_view = namespaced_decorator_factory(namespace="order", base_path="order")
+
+stripe.api_key = settings.STRIPE_API_KEY
+
+
+@order_view(
+    paths="<int:order_id>/",
+    name="detail",
+    login_required=True,
+)
+def order_detail(request: HttpRequest, order_id: int) -> HttpResponse:
+    """View to show the details of a member."""
+    user = request.user  # People just need to login to pay something, not necessarily be a member
+    order = models.Order.objects.get(pk=order_id, member=user)
+
+    context = {
+        "order": order,
+    }
+
+    return render(
+        request=request,
+        template_name="accounting/order/detail.html",
+        context=context,
+    )
+
+
+@order_view(
+    paths="<int:order_id>/pay/",
+    name="pay",
+    login_required=True,
+)
+def order_pay(request: HttpRequest, order_id: int) -> HttpResponse:
+    """Create a Stripe session and redirects to Stripe Checkout."""
+    user = request.user  # People just need to login to pay something, not necessarily be a member
+    order = models.Order.objects.get(pk=order_id, member=user)
+    current_site = Site.objects.get_current(request)
+    base_domain = f"https://{current_site.domain}"
+    if settings.DEBUG:
+        f"http://{current_site.domain}"
+
+    try:
+        line_items = []
+        for item in order.items.all():
+            line_items.append(  # noqa: PERF401
+                {
+                    "price_data": {
+                        "currency": item.total_with_vat.currency,
+                        "unit_amount": int((item.price + item.vat).amount * 100),
+                        "product_data": {
+                            "name": item.product.name,
+                        },
+                    },
+                    "quantity": item.quantity,
+                }
+            )
+        checkout_session = stripe.checkout.Session.create(
+            line_items=line_items,
+            metadata={"order_id": order.id},
+            mode="payment",
+            success_url=base_domain + reverse("order:success", kwargs={"order_id": order.id}),
+            cancel_url=base_domain + "/cancel",
+        )
+    except Exception as e:
+        mail_admins("Error in checkout", str(e))
+        raise
+
+    # TODO: Redirect with status=303
+    return redirect(checkout_session.url)
+
+
+@transaction.atomic
+@order_view(
+    paths="<int:order_id>/pay/success/",
+    name="success",
+    login_required=True,
+)
+def success(request: HttpRequest, order_id: int) -> HttpResponse:
+    """Create a Stripe session and redirects to Stripe Checkout.
+
+    From Stripe docs: When you have a webhook endpoint set up to listen for checkout.session.completed events and
+    you set a success_url, Checkout waits for your server to respond to the webhook event delivery before redirecting
+    your customer. If you use this approach, make sure your server responds to checkout.session.completed events as
+    quickly as possible.
+    """
+    user = request.user  # People just need to login to pay something, not necessarily be a member
+    order = get_object_or_404(models.Order, pk=order_id, member=user)
+
+    context = {
+        "order": order,
+    }
+
+    return render(
+        request=request,
+        template_name="accounting/order/success.html",
+        context=context,
+    )
+
+
+@transaction.atomic
+@order_view(
+    paths="<int:order_id>/pay/cancel/",
+    name="cancel",
+    login_required=True,
+)
+def cancel(request: HttpRequest, order_id: int) -> HttpResponse:
+    """Page to display when a payment is canceled."""
+    user = request.user  # People just need to login to pay something, not necessarily be a member
+    order = models.Order.objects.get(pk=order_id, member=user)
+
+    context = {
+        "order": order,
+    }
+
+    return render(
+        request=request,
+        template_name="accounting/order/cancel.html",
+        context=context,
+    )
+
+
+@transaction.atomic
+@order_view(
+    paths="stripe/webhook/",
+    name="webhook",
+)
+@csrf_exempt
+def stripe_webhook(request: HttpRequest) -> HttpResponse:
+    """Handle Stripe webhook.
+
+    https://docs.stripe.com/metadata/use-cases
+    """
+    payload = request.body
+    sig_header = request.headers["stripe-signature"]
+    event = None
+
+    try:
+        event = stripe.Webhook.construct_event(payload, sig_header, settings.STRIPE_ENDPOINT_SECRET)
+    except ValueError:
+        # Invalid payload
+        return HttpResponse(status=400)
+    except stripe.error.SignatureVerificationError:
+        # Invalid signature
+        return HttpResponse(status=400)
+
+    if event["type"] == "checkout.session.completed" or event["type"] == "checkout.session.async_payment_succeeded":
+        # Order is marked paid via signals, Membership is activated via signals.
+        order_id = event["data"]["object"]["metadata"]["order_id"]
+        order = get_object_or_404(models.Order, pk=order_id)
+        if not models.Payment.objects.filter(order=order).exists():
+            models.Payment.objects.create(
+                order=order,
+                amount=Money(event["data"]["object"]["amount_total"] / 100.0, event["data"]["object"]["currency"]),
+                description="Paid via Stripe",
+                payment_type=models.PaymentType.objects.get_or_create(name="Stripe")[0],
+                external_transaction_id=event["id"],
+            )
+
+    return HttpResponse(status=200)

src/membership/admin.py

@@ -1,16 +1,40 @@
 """Admin configuration for membership app."""
 
-from django.contrib import admin
+from collections.abc import Callable
 
+from accounting.models import Account
+from accounting.models import Order
+from accounting.models import OrderProduct
+from django.contrib import admin
+from django.contrib import messages
+from django.contrib.admin import ModelAdmin
+from django.contrib.auth.admin import UserAdmin
+from django.contrib.auth.models import User
+from django.db import transaction
+from django.db.models import QuerySet
+from django.http import HttpRequest
+from django.http import HttpResponse
+from django.utils.text import slugify
+
+from .emails import InviteEmail
+from .models import Member
 from .models import Membership
 from .models import MembershipType
 from .models import SubscriptionPeriod
+from .models import WaitingListEntry
+
+# Do not use existing user admin
+admin.site.unregister(User)
 
 
 @admin.register(Membership)
 class MembershipAdmin(admin.ModelAdmin):
     """Admin for Membership model."""
 
+    list_display = ("user", "period", "membership_type", "activated", "revoked")
+    list_filter = ("period", "membership_type", "activated", "revoked")
+    search_fields = ("membership_type__name", "user__email", "user__first_name", "user__last_name")
+
 
 @admin.register(MembershipType)
 class MembershipTypeAdmin(admin.ModelAdmin):
@@ -20,3 +44,125 @@ class MembershipTypeAdmin(admin.ModelAdmin):
 @admin.register(SubscriptionPeriod)
 class SubscriptionPeriodAdmin(admin.ModelAdmin):
     """Admin for SubscriptionPeriod model."""
+
+
+class MembershipInlineAdmin(admin.TabularInline):
+    """Inline admin."""
+
+    model = Membership
+
+
+def decorate_ensure_membership_type_exists(membership_type: MembershipType, label: str) -> Callable:
+    """Generate an admin action for given membership type and label."""
+
+    @admin.action(description=label)
+    def admin_action(modeladmin: ModelAdmin, request: HttpRequest, queryset: QuerySet) -> HttpResponse:  # noqa: ARG001
+        return ensure_membership_type_exists(request, queryset, membership_type)
+
+    return admin_action
+
+
+@transaction.atomic
+def ensure_membership_type_exists(
+    request: HttpRequest,
+    queryset: QuerySet[Member],
+    membership_type: MembershipType,
+) -> HttpResponse:
+    """Inner function that ensures that a membership exists for a given queryset of Member objects."""
+    for member in queryset:
+        if member.memberships.filter(membership_type=membership_type).current():
+            messages.info(request, f"{member} already has a membership {membership_type}")
+        else:
+            # Get the default account of the member. We don't really know what to do if a person owns multiple accounts.
+            account, __ = Account.objects.get_or_create(owner=member)
+            # Create an Order for the products in the membership
+            order = Order.objects.create(member=member, account=account, description=membership_type.name)
+            # Add stuff to the order
+            for product in membership_type.products.all():
+                OrderProduct.objects.create(order=order, product=product, price=product.price, vat=product.vat)
+            # Create the Membership
+            Membership.objects.create(
+                membership_type=membership_type,
+                user=member,
+                period=SubscriptionPeriod.objects.current(),
+                order=order,
+            )
+
+            # Associate the order with that membership
+            messages.success(request, f"{member} has ordered a '{membership_type}' (unpaid)")
+
+
+@admin.register(Member)
+class MemberAdmin(UserAdmin):
+    """Member admin is actually an admin for User objects."""
+
+    inlines = (MembershipInlineAdmin,)
+    actions: list[str | Callable] = ["send_invite"]  # noqa: RUF012
+    list_display = ("email", "current_membership", "username", "is_staff", "is_active", "date_joined")
+
+    @admin.display(description="membership")
+    def current_membership(self, instance: Member) -> Membership | None:
+        return instance.memberships.current()
+
+    def get_actions(self, request: HttpRequest) -> dict:
+        """Populate actions with dynamic data (MembershipType)."""
+        current_period = SubscriptionPeriod.objects.current()
+
+        super_dict = super().get_actions(request)
+
+        if current_period:
+            for i, mtype in enumerate(MembershipType.objects.filter(active=True)):
+                action_label = f"Ensure membership {mtype.name}, {current_period.period}, {mtype.total_including_vat}"
+                action_func = decorate_ensure_membership_type_exists(mtype, action_label)
+                # Django ModelAdmin uses the non-unique __name__ property, so we need to suffix it to make it unique
+                action_func.__name__ += f"_{i}"
+                self.actions.append(action_func)
+
+        return super_dict
+
+    @admin.action(description="Send invite email to selected inactive accounts")
+    def send_invite(self, request: HttpRequest, queryset: QuerySet[Member]) -> None:
+        for member in queryset:
+            if member.is_active:
+                messages.error(
+                    request,
+                    f"Computer says no! This member will not receive an invite because the account is marked "
+                    f"as active: {member.email}. That means the member has probably created a password and a username "
+                    f"already, please tell them to use the password reminder function.",
+                )
+                continue
+            if not member.memberships.current():
+                messages.error(
+                    request,
+                    f"Computer says no! This member will not receive an invite because it has no current "
+                    f"membership: {member.email}. You need to create a current membership before sending the invite.",
+                )
+                continue
+            membership = member.memberships.current()
+            email = InviteEmail(membership, request)
+            email.send()
+            messages.success(request, f"Sent an invitation to: {member.email}")
+
+
+@admin.register(WaitingListEntry)
+class WaitingListEntryAdmin(admin.ModelAdmin):
+    """Admin for WaitingList model."""
+
+    list_display = ("email", "member")
+    actions = ("create_member",)
+
+    @admin.action(description="Create member account for entries")
+    def create_member(self, request: HttpRequest, queryset: QuerySet[WaitingListEntry]) -> None:
+        """Create a user account for this entry.
+
+        Note that actions can soon be made available from the edit page, too:
+        https://github.com/django/django/pull/16012
+        """
+        for entry in queryset:
+            member = Member.objects.create_user(email=entry.email, username=slugify(entry.email), is_active=False)
+            entry.member = member
+            entry.save()
+            messages.info(
+                request,
+                f"Added user for {entry.email} - ensure they have a membership and send an invite email.",
+            )

src/membership/emails.py

@@ -0,0 +1,128 @@
+"""Send email to members, using templates and contexts for the emails.
+
+* We keep everything as plain text for now.
+* Notice that emails can be multilingual
+* Generally, an email consists of templates (for body and subject) and a get_context() method.
+"""
+
+from accounting.models import Order
+from django.contrib import messages
+from django.contrib.auth.tokens import default_token_generator
+from django.contrib.sites.shortcuts import get_current_site
+from django.core.mail.message import EmailMessage
+from django.http import HttpRequest
+from django.template import loader
+from django.utils import translation
+from django.utils.translation import gettext_lazy as _
+
+from .models import Membership
+
+
+class BaseEmail(EmailMessage):
+    """Send emails via templated body and subjects.
+
+    This base class is extended for all email functionality.
+    Because all emails are sent to the Member object, we can keep them gathered here, even when they are generated by
+    other apps (like the accounting app).
+    """
+
+    template = "membership/email/base.txt"
+    # Optional: Set to a template path for subject
+    template_subject = None
+    default_subject = "SET SUBJECT HERE"
+
+    def __init__(self, request: HttpRequest, *args, **kwargs) -> None:
+        self.context = kwargs.pop("context", {})
+        self.user = kwargs.pop("user", None)
+        if self.user:
+            kwargs["to"] = [self.user.email]
+            self.context["user"] = self.user
+            self.context["recipient_name"] = self.user.get_display_name()
+
+        # Necessary to set request before instantiating body and subject
+        self.request = request
+        kwargs.setdefault("subject", self.get_subject())
+        kwargs.setdefault("body", self.get_body())
+
+        super().__init__(*args, **kwargs)
+
+    def get_context_data(self) -> dict:
+        """Resolve common context for sending emails.
+
+        When overwriting, remember to call this via super().
+        """
+        c = self.context
+        site = get_current_site(self.request)
+        c["request"] = self.request
+        c["domain"] = site.domain
+        c["site_name"] = site.name
+        c["protocol"] = "https"  # if self.request and not self.request.is_secure() else "https"
+        return c
+
+    def get_body(self) -> str:
+        """Build the email body from template and context."""
+        if self.user and self.user.language_code:
+            with translation.override(self.user.language_code):
+                body = loader.render_to_string(self.template, self.get_context_data())
+        else:
+            body = loader.render_to_string(self.template, self.get_context_data())
+        return body
+
+    def get_subject(self) -> str:
+        """Build the email subject from template or self.default_subject."""
+        if self.user and self.user.language_code:
+            with translation.override(self.user.language_code):
+                if self.template_subject:
+                    subject = loader.render_to_string(self.template_subject, self.get_context_data()).strip()
+                else:
+                    subject = str(self.default_subject)
+        elif self.template_subject:
+            subject = loader.render_to_string(self.template_subject, self.get_context_data()).strip()
+        else:
+            subject = str(self.default_subject)
+        return subject
+
+    def send_with_feedback(self, *, success_msg: str | None = None, no_message: bool = False) -> None:
+        """Send email, possibly adding feedback via django.contrib.messages."""
+        if not success_msg:
+            success_msg = _("Email successfully sent to {}").format(", ".join(self.to))
+        try:
+            self.send(fail_silently=False)
+            if not no_message:
+                messages.success(self.request, success_msg)
+        except RuntimeError:
+            messages.error(self.request, _("Not sent, something wrong with the mail server."))
+
+
+class InviteEmail(BaseEmail):
+    template = "membership/emails/invite.txt"
+    default_subject = _("Invite to data.coop membership")
+
+    def __init__(self, membership: Membership, request: HttpRequest, *args, **kwargs) -> None:
+        self.membership = membership
+        kwargs["user"] = membership.user
+        kwargs["from_email"] = "kasserer@data.coop"
+        super().__init__(request, *args, **kwargs)
+
+    def get_context_data(self) -> dict:
+        c = super().get_context_data()
+        c["membership"] = self.membership
+        c["token"] = default_token_generator.make_token(self.membership.user)
+        c["referral_code"] = self.membership.referral_code
+        return c
+
+
+class OrderEmail(BaseEmail):
+    template = "membership/emails/order.txt"
+    default_subject = _("Your data.coop order and payment")
+
+    def __init__(self, order: Order, request: HttpRequest, *args, **kwargs) -> None:
+        self.order = order
+        kwargs["user"] = order.member
+        kwargs["from_email"] = "kasserer@data.coop"
+        super().__init__(request, *args, **kwargs)
+
+    def get_context_data(self) -> dict:
+        c = super().get_context_data()
+        c["order"] = self.order
+        return c

src/membership/forms.py

@@ -0,0 +1,39 @@
+from allauth.account.adapter import get_adapter as get_allauth_adapter
+from allauth.account.forms import SetPasswordForm
+from django import forms
+from django.utils.translation import gettext_lazy as _
+
+
+class InviteForm(SetPasswordForm):
+    """Create a new password for a user account that is created through an invite."""
+
+    username = forms.CharField(
+        label=_("Username"),
+        widget=forms.TextInput(attrs={"placeholder": _("Username"), "autocomplete": "username"}),
+    )
+
+    def __init__(self, *args, **kwargs) -> None:
+        self.membership = kwargs.pop("membership")
+        kwargs["user"] = self.membership.user
+        super().__init__(*args, **kwargs)
+
+    def clean_username(self) -> str:
+        """Clean the username value.
+
+        Taken from the allauth Signup form - we should consider that data can be leaked here.
+        """
+        value = self.cleaned_data["username"]
+        # The allauth adapter ensures the username is unique.
+        return get_allauth_adapter().clean_username(value)
+
+    def save(self) -> None:
+        """Save instance to db.
+
+        Note: You can hack a re-activation of a deactivated account
+        by getting a valid token before deactivation (from the reset password form).
+        We can block this by also setting Membership.revoked=False when deactivating someone's account.
+        """
+        self.user.username = self.cleaned_data["username"]
+        self.user.is_active = True
+        self.user.save()
+        super().save()

src/membership/migrations/0006_waitinglistentry_alter_membership_options.py

@@ -0,0 +1,32 @@
+# Generated by Django 5.0.7 on 2024-07-20 20:45
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('membership', '0005_member'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='WaitingListEntry',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('modified', models.DateTimeField(auto_now=True, verbose_name='modified')),
+                ('created', models.DateTimeField(auto_now_add=True, verbose_name='created')),
+                ('email', models.EmailField(max_length=254)),
+                ('geography', models.CharField(blank=True, default='', verbose_name='geography')),
+                ('comment', models.TextField(blank=True)),
+            ],
+            options={
+                'verbose_name': 'waiting list entry',
+                'verbose_name_plural': 'waiting list entries',
+            },
+        ),
+        migrations.AlterModelOptions(
+            name='membership',
+            options={'verbose_name': 'medlemskab', 'verbose_name_plural': 'medlemskaber'},
+        ),
+    ]

src/membership/migrations/0007_membership_activated_membership_activated_on_and_more.py

@@ -0,0 +1,62 @@
+# Generated by Django 5.1b1 on 2024-08-01 10:50
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounting', '0007_alter_orderproduct_options_rename_user_order_member_and_more'),
+        ('membership', '0006_waitinglistentry_alter_membership_options'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='membership',
+            name='activated',
+            field=models.BooleanField(default=False, help_text='Membership was activated.', verbose_name='activated'),
+        ),
+        migrations.AddField(
+            model_name='membership',
+            name='activated_on',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='membership',
+            name='order',
+            field=models.ForeignKey(blank=True, help_text='The order filled in for paying this membership.', null=True, on_delete=django.db.models.deletion.PROTECT, to='accounting.order', verbose_name='order'),
+        ),
+        migrations.AddField(
+            model_name='membership',
+            name='revoked',
+            field=models.BooleanField(default=False, help_text='Membership has explicitly been revoked. Revoking a membership is not associated with regular expiration of the membership period.', verbose_name='revoked'),
+        ),
+        migrations.AddField(
+            model_name='membership',
+            name='revoked_on',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='membership',
+            name='revoked_reason',
+            field=models.TextField(blank=True),
+        ),
+        migrations.AddField(
+            model_name='membershiptype',
+            name='active',
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name='membershiptype',
+            name='products',
+            field=models.ManyToManyField(to='accounting.product'),
+        ),
+        migrations.AlterField(
+            model_name='membership',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='memberships', to=settings.AUTH_USER_MODEL),
+        ),
+    ]

src/membership/migrations/0008_alter_membership_membership_type.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.1b1 on 2024-08-04 10:26
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('membership', '0007_membership_activated_membership_activated_on_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='membership',
+            name='membership_type',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='memberships', to='membership.membershiptype', verbose_name='membership type'),
+        ),
+    ]

src/membership/migrations/0009_membership_referral_code.py

@@ -0,0 +1,32 @@
+# Generated by Django 5.1rc1 on 2024-08-07 22:32
+
+import uuid
+from django.db import migrations, models
+
+
+def create_uuid(apps, schema_editor):
+    Membership = apps.get_model('membership', 'Membership')
+    for membership in Membership.objects.all():
+        membership.referral_code = uuid.uuid4()
+        membership.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('membership', '0008_alter_membership_membership_type'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='membership',
+            name='referral_code',
+            field=models.UUIDField(blank=True, null=True, default=uuid.uuid4, editable=False),
+        ),
+        migrations.RunPython(create_uuid),
+        migrations.AlterField(
+            model_name='membership',
+            name='referral_code',
+            field=models.UUIDField(unique=True, default=uuid.uuid4, editable=False),
+        ),
+    ]

src/membership/migrations/0010_waitinglistentry_member.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.1rc1 on 2024-08-14 08:05
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('membership', '0009_membership_referral_code'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='waitinglistentry',
+            name='member',
+            field=models.ForeignKey(help_text='Once a member account is generated (use the admin action), this field will be marked.', null=True, blank=True, on_delete=django.db.models.deletion.CASCADE, to='membership.member', verbose_name='has member'),
+        ),
+    ]

src/membership/models.py

@@ -1,15 +1,18 @@
 """Models for the membership app."""
 
+import uuid
 from typing import ClassVar
 from typing import Self
 
 from django.contrib.auth.models import User
+from django.contrib.auth.models import UserManager
 from django.contrib.postgres.constraints import ExclusionConstraint
 from django.contrib.postgres.fields import DateRangeField
 from django.contrib.postgres.fields import RangeOperators
 from django.db import models
 from django.utils import timezone
 from django.utils.translation import gettext as _
+from djmoney.money import Money
 from utils.mixins import CreatedModifiedAbstract
 
 
@@ -41,7 +44,23 @@ class Member(User):
                 ),
             )
 
-    objects = QuerySet.as_manager()
+    objects = UserManager.from_queryset(QuerySet)()
+
+    def get_display_name(self) -> str:
+        """Choose how to display the user in emails and UI and ultimately to other users.
+
+        It's crucial that we currently don't have a good solution for this.
+        We should allow the user to define their own nick.
+        """
+        return self.username
+
+    @property
+    def language_code(self) -> str:
+        """Returns the user's preferred language code.
+
+        We don't have an actual setting for this... because this is a proxy table.
+        """
+        return "da-dk"
 
     class Meta:
         proxy = True
@@ -53,6 +72,22 @@ class SubscriptionPeriod(CreatedModifiedAbstract):
     Denotes a period for which members should pay their membership fee for.
     """
 
+    class QuerySet(models.QuerySet):
+        """QuerySet for the Membership model."""
+
+        def _current(self) -> Self:
+            """Filter memberships for the current period."""
+            return self.filter(period__contains=timezone.now())
+
+        def current(self) -> "Membership | None":
+            """Get the current membership."""
+            try:
+                return self._current().get()
+            except self.model.DoesNotExist:
+                return None
+
+    objects = QuerySet.as_manager()
+
     period = DateRangeField(verbose_name=_("period"))
 
     class Meta:
@@ -82,16 +117,17 @@ class Membership(CreatedModifiedAbstract):
             """Filter memberships for a given member."""
             return self.filter(user=member)
 
+        def active(self) -> Self:
+            """Get only activated, non-revoked memberships (may have expired so use also current())."""
+            return self.filter(activated=True, revoked=False)
+
         def _current(self) -> Self:
             """Filter memberships for the current period."""
             return self.filter(period__period__contains=timezone.now())
 
         def current(self) -> "Membership | None":
             """Get the current membership."""
-            try:
-                return self._current().get()
-            except self.model.DoesNotExist:
-                return None
+            return self._current().first()
 
         def previous(self) -> list["Membership"]:
             """Get previous memberships."""
@@ -102,12 +138,15 @@ class Membership(CreatedModifiedAbstract):
 
     objects = QuerySet.as_manager()
 
-    user = models.ForeignKey("auth.User", on_delete=models.PROTECT)
+    user = models.ForeignKey("auth.User", on_delete=models.PROTECT, related_name="memberships")
+
+    # This code is used for inviting a user to create an account for this membership.
+    referral_code = models.UUIDField(unique=True, default=uuid.uuid4, editable=False)
 
     membership_type = models.ForeignKey(
         "membership.MembershipType",
         related_name="memberships",
-        verbose_name=_("subscription type"),
+        verbose_name=_("membership type"),
         on_delete=models.PROTECT,
     )
 
@@ -116,6 +155,31 @@ class Membership(CreatedModifiedAbstract):
         on_delete=models.PROTECT,
     )
 
+    order = models.ForeignKey(
+        "accounting.Order",
+        null=True,
+        blank=True,
+        verbose_name=_("order"),
+        help_text=_("The order filled in for paying this membership."),
+        on_delete=models.PROTECT,
+    )
+
+    activated = models.BooleanField(
+        default=False, verbose_name=_("activated"), help_text=_("Membership was activated.")
+    )
+    activated_on = models.DateTimeField(null=True, blank=True)
+
+    revoked = models.BooleanField(
+        default=False,
+        verbose_name=_("revoked"),
+        help_text=_(
+            "Membership has explicitly been revoked. Revoking a membership is not associated with regular expiration "
+            "of the membership period."
+        ),
+    )
+    revoked_reason = models.TextField(blank=True)
+    revoked_on = models.DateTimeField(null=True, blank=True)
+
     class Meta:
         verbose_name = _("membership")
         verbose_name_plural = _("memberships")
@@ -133,9 +197,51 @@ class MembershipType(CreatedModifiedAbstract):
 
     name = models.CharField(verbose_name=_("name"), max_length=64)
 
+    products = models.ManyToManyField("accounting.Product")
+
+    active = models.BooleanField(default=True)
+
     class Meta:
         verbose_name = _("membership type")
         verbose_name_plural = _("membership types")
 
     def __str__(self) -> str:
         return self.name
+
+    def create_membership(self, user: User) -> Membership:
+        """Create a current membership for this type."""
+        from .selectors import get_current_subscription_period
+
+        return Membership.objects.create(
+            membership_type=self,
+            user=user,
+            period=get_current_subscription_period(),
+        )
+
+    @property
+    def total_including_vat(self) -> Money:
+        """Calculate the total price of this membership (including VAT)."""
+        return sum(product.price + product.vat for product in self.products.all())
+
+
+class WaitingListEntry(CreatedModifiedAbstract):
+    """People who for some reason could want to be added to a waiting list and invited to join later."""
+
+    email = models.EmailField()
+    geography = models.CharField(verbose_name=_("geography"), blank=True, default="")
+    comment = models.TextField(blank=True)
+    member = models.ForeignKey(
+        Member,
+        null=True,
+        blank=True,
+        verbose_name=_("has member"),
+        help_text=_("Once a member account is generated (use the admin action), this field will be marked."),
+        on_delete=models.CASCADE,
+    )
+
+    def __str__(self) -> str:
+        return self.email
+
+    class Meta:
+        verbose_name = _("waiting list entry")
+        verbose_name_plural = _("waiting list entries")

src/membership/templates/membership/emails/base.txt

@@ -0,0 +1,9 @@
+{% load i18n %}{% block greeting %}{% blocktrans %}Dear {{ recipient_name }},{% endblocktrans %}{% endblock %}
+
+{% block content %}{% endblock %}
+
+
+{% trans "Cooperatively yours," %}
+{{ site_name }}
+
+{{ protocol }}://{{ domain }}

src/membership/templates/membership/emails/invite.txt

@@ -0,0 +1,7 @@
+{% extends "membership/emails/base.txt" %}{% load i18n %}
+
+{% block content %}{% url 'member:membership-invite' token=token referral_code=referral_code as invite_url %}{% blocktrans %}Here is your secret URL for creating an account with us:
+
+{{ protocol }}://{{ domain }}{{ invite_url }}
+
+If you did not request this account, get in touch with us.{% endblocktrans %}{% endblock %}

src/membership/templates/membership/emails/order.txt

@@ -0,0 +1,17 @@
+{% extends "membership/emails/base.txt" %}{% load i18n %}
+
+{% block content %}{% url 'order:detail' order_id=order.id as order_url %}{% blocktrans %}You have an order in our system, which you can pay here:
+
+{{ protocol }}://{{ domain }}{{ order_url }}
+
+We used to handle membership stuff in a spreadsheet and via bank transfers. This is now all handled with our custom-made membership system. We hope you like it.
+
+If you received this email and no longer want a membership, you can ignore it. But please let us know by writing board@data.coop, so we can erase any personal data we have about your previous membership.
+
+Dansk:
+
+Hej! Så kører medlemsystemet endeligt! Det er mega-fedt, fordi vi længe har haft besvær med manuelle procedurer. Nu har vi flyttet medlemsdata over på member.data.coop, og betalingen fungerer. Vi kan dermed fremover arbejde stille og roligt på at integrere systemet, så man kan styre sine services via medlemssystemet.
+
+Hvis du ikke længere vil være medlem, kan du ignorere mailen her; men du må meget gerne informere os via board@data.coop, så vi kan slette evt. personlige data og services, du har kørende på dit tidligere medlemskab.
+
+{% endblocktrans %}{% endblock %}

src/membership/templates/membership/invite.html

@@ -0,0 +1,21 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% block head_title %}
+    {% trans "Membership" %}
+{% endblock %}
+
+{% block content %}
+
+    <div class="content-view">
+        <h2>{% trans "Create account" %}</h2>
+        <p>{% trans "Congratulations! You've been invited to create an account with us:" %}</p>
+        <p>Email: <strong>{{ membership.user.email }}</strong></p>
+        <form method="POST">
+            {% csrf_token %}
+            {{ form.as_p }}
+            <button type="submit" class="btn">{% trans "Create account" %}</button>
+        </form>
+
+    </div>
+{% endblock %}

src/membership/views.py

@@ -4,12 +4,20 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from django.contrib import messages
+from django.contrib.auth.tokens import default_token_generator
+from django.http import HttpResponseForbidden
+from django.shortcuts import get_object_or_404
+from django.shortcuts import redirect
 from django.utils.translation import gettext_lazy as _
+from django_ratelimit.decorators import ratelimit
 from django_view_decorator import namespaced_decorator_factory
 from utils.view_utils import RenderConfig
 from utils.view_utils import RowAction
 from utils.view_utils import render
 
+from .forms import InviteForm
+from .models import Membership
 from .permissions import ADMINISTRATE_MEMBERS
 from .selectors import get_member
 from .selectors import get_members
@@ -113,3 +121,49 @@ def members_admin_detail(request: HttpRequest, member_id: int) -> HttpResponse:
         template_name="membership/members_admin_detail.html",
         context=context,
     )
+
+
+@ratelimit(group="membership", key="ip", rate="10/d", method="ALL", block=True)
+@member_view(
+    paths="invite/<str:referral_code>/<str:token>/",
+    name="membership-invite",
+    login_required=False,
+)
+def invite(request: HttpRequest, referral_code: str, token: str) -> HttpResponse:
+    """View to invite a member to create a membership.
+
+    The token belongs to a non-active Member object. If the token is valid,
+    the caller is allowed to create a membership.
+
+    We ratelimit this view so it's not possible to brute-force tokens.
+    """
+    if request.user.is_authenticated:
+        return HttpResponseForbidden("You're already logged in. So you cannot receive an invite.")
+
+    # Firstly, we get the membership by the referral code.
+    membership = get_object_or_404(Membership, referral_code=referral_code, user__is_active=False, revoked=False)
+
+    token_valid = default_token_generator.check_token(membership.user, token)
+
+    if not token_valid:
+        raise HttpResponseForbidden("Token not valid - maybe it expired?")
+
+    if request.method == "POST":
+        form = InviteForm(membership=membership, data=request.POST)
+        if form.is_valid():
+            form.save()
+            messages.info(request, _("Password is set for your account and you can now login."))
+            return redirect("account_login")
+    else:
+        form = InviteForm(membership=membership)
+
+    context = {
+        "token": token,
+        "membership": membership,
+        "form": form,
+    }
+    return render(
+        request=request,
+        template_name="membership/invite.html",
+        context=context,
+    )

src/project/settings.py

@@ -2,9 +2,12 @@
 
 from pathlib import Path
 
+import django_stubs_ext
 from django.utils.translation import gettext_lazy as _
 from environs import Env
 
+django_stubs_ext.monkeypatch()
+
 env = Env()
 env.read_env()
 
@@ -124,6 +127,7 @@ EMAIL_BACKEND = env.str(
     default="django.core.mail.backends.console.EmailBackend",
 )
 DEFAULT_FROM_EMAIL = env.str("DEFAULT_FROM_EMAIL", default="")
+SERVER_EMAIL = env.str("SERVER_EMAIL", default=DEFAULT_FROM_EMAIL)
 # Parse email URLs, e.g. "smtp://"
 email = env.dj_email_url("EMAIL_URL", default="smtp://")
 EMAIL_HOST = email["EMAIL_HOST"]
@@ -175,6 +179,12 @@ LOGGING = {
     },
 }
 
+STRIPE_API_KEY = env.str("STRIPE_API_KEY")
+STRIPE_ENDPOINT_SECRET = env.str("STRIPE_ENDPOINT_SECRET")
+
+# The number of seconds a password reset link is valid for (default: 3 days).
+# We've extended this to 7 days because invites then last for 1 week.
+PASSWORD_RESET_TIMEOUT = 60 * 60 * 24 * 7
 
 if DEBUG:
     INSTALLED_APPS += ["debug_toolbar", "django_browser_reload"]

src/project/static/css/style.css

@@ -504,6 +504,11 @@ footer {
   opacity: 0.8;
 }
 
+footer a, footer a:visited, footer a:active {
+  color: var(--dust);
+  text-decoration: underline;
+}
+
 span.time_remaining {
   color: var(--fade);
 }

src/project/templates/base.html

@@ -102,11 +102,21 @@
                 </ol>
             </nav>
             <article>
+                {% if messages %}
+                  <div class="content-view">
+                  {% for message in messages %}
+                    <p>📨</p>
+                    <p><strong>{{ message }}</strong></p>
+                  {% endfor %}
+                  </div>
+
+                {% endif %}
+
                 {% block content %}{% endblock %}
             </article>
         </main>
         <footer>
-            data.coop membersystem version 0.0.1
+            data.coop membersystem alpha - report issues on <a href="https://git.data.coop/data.coop/membersystem/">git</a>
         </footer>
         <script>
           const themeSwitcher = document.getElementById('theme-switcher');

src/project/templates/index.html

@@ -14,6 +14,10 @@
             It is very much under construction.
         </p>
 
+        {% for order in unpaid_orders %}
+          <p>You have an unpaid order: <a href="{% url "order:detail" order_id=order.id %}">View Order ID {{ order.id }}</a></p>
+        {% endfor %}
+
         {% comment %}
         <hr>
         <br>

src/project/views.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from accounting.models import Order
 from django_view_decorator import view
 from utils.view_utils import render
 
@@ -19,7 +20,11 @@ if TYPE_CHECKING:
 )
 def index(request: HttpRequest) -> HttpResponse:
     """View to show the index page."""
-    return render(request, "index.html")
+    unpaid_orders = Order.objects.filter(member=request.user, is_paid=False)
+
+    context = {"unpaid_orders": list(unpaid_orders)}
+
+    return render(request, "index.html", context=context)
 
 
 @view(

src/pytest.ini

@@ -1,5 +0,0 @@
-[pytest]
-testpaths = .
-python_files = tests.py test_*.py *_tests.py
-DJANGO_SETTINGS_MODULE = project.settings
-#norecursedirs = dist tmp* .svn .*