From b3795977ed2df37ed06d9ce9140fc102a0a55cd9 Mon Sep 17 00:00:00 2001
From: Benjamin Bach
Date: Wed, 14 Aug 2024 09:17:29 +0000
Subject: [PATCH] Membership invitations and order emails (#47)
* [x] Create invite emails from admin
* [x] Sign up on special invite form (create password and username)
* [x] Create email with unpaid orders and payment links
* [x] Lodge unpaid orders somewhere in UI for visibility
Reviewed-on: https://git.data.coop/data.coop/membersystem/pulls/47
Reviewed-by: valberg
Co-authored-by: Benjamin Bach
Co-committed-by: Benjamin Bach
---
Dockerfile | 1 +
README.md | 5 +
pyproject.toml | 9 ++
requirements.txt | 3 +
requirements/requirements-dev.txt | 3 +
src/accounting/admin.py | 27 +++-
src/membership/admin.py | 53 +++++++-
src/membership/emails.py | 126 ++++++++++++++++++
src/membership/forms.py | 39 ++++++
.../0009_membership_referral_code.py | 32 +++++
.../0010_waitinglistentry_member.py | 19 +++
src/membership/models.py | 31 ++++-
.../templates/membership/emails/base.txt | 9 ++
.../templates/membership/emails/invite.txt | 7 +
.../templates/membership/emails/order.txt | 6 +
.../templates/membership/invite.html | 21 +++
src/membership/views.py | 54 ++++++++
src/project/settings.py | 4 +
src/project/templates/base.html | 10 ++
src/project/templates/index.html | 4 +
src/project/views.py | 7 +-
21 files changed, 462 insertions(+), 8 deletions(-)
create mode 100644 src/membership/emails.py
create mode 100644 src/membership/forms.py
create mode 100644 src/membership/migrations/0009_membership_referral_code.py
create mode 100644 src/membership/migrations/0010_waitinglistentry_member.py
create mode 100644 src/membership/templates/membership/emails/base.txt
create mode 100644 src/membership/templates/membership/emails/invite.txt
create mode 100644 src/membership/templates/membership/emails/order.txt
create mode 100644 src/membership/templates/membership/invite.html
diff --git a/Dockerfile b/Dockerfile
index 8fd7552..920c448 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,6 +21,7 @@ WORKDIR /app
RUN groupadd -g 1000 www && useradd -u 1000 -ms /bin/bash -g www www
# Only copy the requirements file first to leverage Docker cache
+RUN mkdir requirements/
COPY $REQUIREMENTS_FILE $REQUIREMENTS_FILE
RUN mkdir -p /app/src/static && \
diff --git a/README.md b/README.md
index 7a0256d..671414d 100644
--- a/README.md
+++ b/README.md
@@ -98,3 +98,8 @@ make requirements
# Build Docker image with new Python requirements
make build
```
+
+## Important notes
+
+* This project uses [django-zen-queries](https://github.com/dabapps/django-zen-queries), which will sometimes raise a `QueriesDisabledError` in your templates. You can find a difference of opinion about that, but you can find a difference of opinion about many things, right?
+* If a linting error annoys you, please feel free to strike back by adding a `noqa` to the line that has displeased the linter and move on with life.
diff --git a/pyproject.toml b/pyproject.toml
index 88e3fbc..20d5163 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,6 +18,8 @@ dependencies = [
"django-oauth-toolkit~=2.4",
"django-registries==0.0.3",
"django-view-decorator==0.0.4",
+ "django-oauth-toolkit~=2.4",
+ "django-ratelimit~=4.1",
"django-zen-queries~=2.1",
"django_stubs_ext~=5.0",
"environs[django]>=11,<12",
@@ -137,12 +139,19 @@ ignore = [
"EM102", # Exception must not use a f-string literal, assign to variable first
"COM812", # missing-trailing-comma (https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules)
"ISC001", # single-line-implicit-string-concatenation (https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules)
+ "D100", # Missing docstring in public module
+ "D101", # Missing docstring in public class
+ "D102", # Missing docstring in public method
"D105", # Missing docstring in magic method
"D106", # Missing docstring in public nested class
+ "D107", # Missing docstring in `__init__`
"FIX", # TODO, FIXME, XXX
"TD", # TODO, FIXME, XXX
"ANN002", # Missing type annotation for `*args`
"ANN003", # Missing type annotation for `**kwargs`
+ "FBT001", # Misbehaves: Boolean-typed positional argument in function definition
+ "FBT002", # Misbehaves: Boolean-typed positional argument in function definition
+ "TRY003", # Avoid specifying long messages outside the exception class
]
[tool.ruff.lint.isort]
diff --git a/requirements.txt b/requirements.txt
index 418b0bc..1ea4268 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,6 +4,7 @@
# - django-allauth~=0.63
# - django-money~=3.5
# - django-oauth-toolkit~=2.4
+# - django-ratelimit~=4.1
# - django-registries==0.0.3
# - django-stubs-ext~=5.0
# - django-view-decorator==0.0.4
@@ -53,6 +54,8 @@ django-money==3.5.3
# via hatch.envs.default
django-oauth-toolkit==2.4.0
# via hatch.envs.default
+django-ratelimit==4.1.0
+ # via hatch.envs.default
django-registries==0.0.3
# via hatch.envs.default
django-stubs-ext==5.0.4
diff --git a/requirements/requirements-dev.txt b/requirements/requirements-dev.txt
index 0617412..ff3a26a 100644
--- a/requirements/requirements-dev.txt
+++ b/requirements/requirements-dev.txt
@@ -14,6 +14,7 @@
# - django-allauth~=0.63
# - django-money~=3.5
# - django-oauth-toolkit~=2.4
+# - django-ratelimit~=4.1
# - django-registries==0.0.3
# - django-stubs-ext~=5.0
# - django-view-decorator==0.0.4
@@ -81,6 +82,8 @@ django-money==3.5.3
# via hatch.envs.dev
django-oauth-toolkit==2.4.0
# via hatch.envs.dev
+django-ratelimit==4.1.0
+ # via hatch.envs.dev
django-registries==0.0.3
# via hatch.envs.dev
django-stubs==1.16.0
diff --git a/src/accounting/admin.py b/src/accounting/admin.py
index 11d2219..1b09077 100644
--- a/src/accounting/admin.py
+++ b/src/accounting/admin.py
@@ -2,7 +2,11 @@
from django import forms
from django.contrib import admin
+from django.contrib import messages
+from django.db.models import QuerySet
+from django.http import HttpRequest
from django.utils.translation import gettext_lazy as _
+from membership.emails import OrderEmail
from . import models
@@ -26,7 +30,7 @@ class OrderAdminForm(forms.ModelForm):
model = models.Order
exclude = () # noqa: DJ006
- def clean(self): # noqa: D102, ANN201
+ def clean(self): # noqa: ANN201
cd = super().clean()
if not cd["account"] and cd["member"]:
try:
@@ -43,10 +47,25 @@ class OrderAdmin(admin.ModelAdmin):
inlines = (OrderProductInline,)
form = OrderAdminForm
+ actions = ("send_order",)
+
list_display = ("member", "description", "created", "is_paid", "total_with_vat")
search_fields = ("member__email", "membership__membership_type__name", "description")
list_filter = ("is_paid", "membership__membership_type")
+ @admin.action(description="Send order link to selected unpaid orders")
+ def send_order(self, request: HttpRequest, queryset: QuerySet[models.Order]) -> None:
+ for order in queryset:
+ if order.is_paid:
+ messages.error(
+ request,
+ f"Order pk={order.id} is already marked paid, not sending email to: {order.member.email}",
+ )
+ continue
+ email = OrderEmail(order, request)
+ email.send()
+ messages.success(request, f"Sent an order for order pk={order.id} link to: {order.member.email}")
+
@admin.register(models.Payment)
class PaymentAdmin(admin.ModelAdmin):
@@ -61,15 +80,15 @@ class PaymentAdmin(admin.ModelAdmin):
@admin.register(models.Product)
-class ProductAdmin(admin.ModelAdmin): # noqa: D101
+class ProductAdmin(admin.ModelAdmin):
list_display = ("name", "price", "vat")
-class TransactionInline(admin.TabularInline): # noqa: D101
+class TransactionInline(admin.TabularInline):
model = models.Transaction
@admin.register(models.Account)
-class AccountAdmin(admin.ModelAdmin): # noqa: D101
+class AccountAdmin(admin.ModelAdmin):
list_display = ("owner", "balance")
inlines = (TransactionInline,)
diff --git a/src/membership/admin.py b/src/membership/admin.py
index 6ccb55e..69e2c22 100644
--- a/src/membership/admin.py
+++ b/src/membership/admin.py
@@ -14,7 +14,9 @@ from django.db import transaction
from django.db.models import QuerySet
from django.http import HttpRequest
from django.http import HttpResponse
+from django.utils.text import slugify
+from .emails import InviteEmail
from .models import Member
from .models import Membership
from .models import MembershipType
@@ -63,7 +65,7 @@ def decorate_ensure_membership_type_exists(membership_type: MembershipType, labe
@transaction.atomic
def ensure_membership_type_exists(
request: HttpRequest,
- queryset: QuerySet,
+ queryset: QuerySet[Member],
membership_type: MembershipType,
) -> HttpResponse:
"""Inner function that ensures that a membership exists for a given queryset of Member objects."""
@@ -95,7 +97,12 @@ class MemberAdmin(UserAdmin):
"""Member admin is actually an admin for User objects."""
inlines = (MembershipInlineAdmin,)
- actions: list[Callable] = [] # noqa: RUF012
+ actions: list[str | Callable] = ["send_invite"] # noqa: RUF012
+ list_display = ("email", "current_membership", "username", "is_staff", "is_active", "date_joined")
+
+ @admin.display(description="membership")
+ def current_membership(self, instance: Member) -> Membership | None:
+ return instance.memberships.current()
def get_actions(self, request: HttpRequest) -> dict:
"""Populate actions with dynamic data (MembershipType)."""
@@ -113,7 +120,49 @@ class MemberAdmin(UserAdmin):
return super_dict
+ @admin.action(description="Send invite email to selected inactive accounts")
+ def send_invite(self, request: HttpRequest, queryset: QuerySet[Member]) -> None:
+ for member in queryset:
+ if member.is_active:
+ messages.error(
+ request,
+ f"Computer says no! This member will not receive an invite because the account is marked "
+ f"as active: {member.email}. That means the member has probably created a password and a username "
+ f"already, please tell them to use the password reminder function.",
+ )
+ continue
+ if not member.memberships.current():
+ messages.error(
+ request,
+ f"Computer says no! This member will not receive an invite because it has no current "
+ f"membership: {member.email}. You need to create a current membership before sending the invite.",
+ )
+ continue
+ membership = member.memberships.current()
+ email = InviteEmail(membership, request)
+ email.send()
+ messages.success(request, f"Sent an invitation to: {member.email}")
+
@admin.register(WaitingListEntry)
class WaitingListEntryAdmin(admin.ModelAdmin):
"""Admin for WaitingList model."""
+
+ list_display = ("email", "member")
+ actions = ("create_member",)
+
+ @admin.action(description="Create member account for entries")
+ def create_member(self, request: HttpRequest, queryset: QuerySet[WaitingListEntry]) -> None:
+ """Create a user account for this entry.
+
+ Note that actions can soon be made available from the edit page, too:
+ https://github.com/django/django/pull/16012
+ """
+ for entry in queryset:
+ member = Member.objects.create_user(email=entry.email, username=slugify(entry.email), is_active=False)
+ entry.member = member
+ entry.save()
+ messages.info(
+ request,
+ f"Added user for {entry.email} - ensure they have a membership and send an invite email.",
+ )
diff --git a/src/membership/emails.py b/src/membership/emails.py
new file mode 100644
index 0000000..6a57718
--- /dev/null
+++ b/src/membership/emails.py
@@ -0,0 +1,126 @@
+"""Send email to members, using templates and contexts for the emails.
+
+* We keep everything as plain text for now.
+* Notice that emails can be multilingual
+* Generally, an email consists of templates (for body and subject) and a get_context() method.
+"""
+
+from accounting.models import Order
+from django.contrib import messages
+from django.contrib.auth.tokens import default_token_generator
+from django.contrib.sites.shortcuts import get_current_site
+from django.core.mail.message import EmailMessage
+from django.http import HttpRequest
+from django.template import loader
+from django.utils import translation
+from django.utils.translation import gettext_lazy as _
+
+from .models import Membership
+
+
+class BaseEmail(EmailMessage):
+ """Send emails via templated body and subjects.
+
+ This base class is extended for all email functionality.
+ Because all emails are sent to the Member object, we can keep them gathered here, even when they are generated by
+ other apps (like the accounting app).
+ """
+
+ template = "membership/email/base.txt"
+ # Optional: Set to a template path for subject
+ template_subject = None
+ default_subject = "SET SUBJECT HERE"
+
+ def __init__(self, request: HttpRequest, *args, **kwargs) -> None:
+ self.context = kwargs.pop("context", {})
+ self.user = kwargs.pop("user", None)
+ if self.user:
+ kwargs["to"] = [self.user.email]
+ self.context["user"] = self.user
+ self.context["recipient_name"] = self.user.get_display_name()
+
+ # Necessary to set request before instantiating body and subject
+ self.request = request
+ kwargs.setdefault("subject", self.get_subject())
+ kwargs.setdefault("body", self.get_body())
+
+ super().__init__(*args, **kwargs)
+
+ def get_context_data(self) -> dict:
+ """Resolve common context for sending emails.
+
+ When overwriting, remember to call this via super().
+ """
+ c = self.context
+ site = get_current_site(self.request)
+ c["request"] = self.request
+ c["domain"] = site.domain
+ c["site_name"] = site.name
+ c["protocol"] = "http" if self.request and not self.request.is_secure() else "https"
+ return c
+
+ def get_body(self) -> str:
+ """Build the email body from template and context."""
+ if self.user and self.user.language_code:
+ with translation.override(self.user.language_code):
+ body = loader.render_to_string(self.template, self.get_context_data())
+ else:
+ body = loader.render_to_string(self.template, self.get_context_data())
+ return body
+
+ def get_subject(self) -> str:
+ """Build the email subject from template or self.default_subject."""
+ if self.user and self.user.language_code:
+ with translation.override(self.user.language_code):
+ if self.template_subject:
+ subject = loader.render_to_string(self.template_subject, self.get_context_data()).strip()
+ else:
+ subject = str(self.default_subject)
+ elif self.template_subject:
+ subject = loader.render_to_string(self.template_subject, self.get_context_data()).strip()
+ else:
+ subject = str(self.default_subject)
+ return subject
+
+ def send_with_feedback(self, *, success_msg: str | None = None, no_message: bool = False) -> None:
+ """Send email, possibly adding feedback via django.contrib.messages."""
+ if not success_msg:
+ success_msg = _("Email successfully sent to {}").format(", ".join(self.to))
+ try:
+ self.send(fail_silently=False)
+ if not no_message:
+ messages.success(self.request, success_msg)
+ except RuntimeError:
+ messages.error(self.request, _("Not sent, something wrong with the mail server."))
+
+
+class InviteEmail(BaseEmail):
+ template = "membership/emails/invite.txt"
+ default_subject = _("Invite to data.coop membership")
+
+ def __init__(self, membership: Membership, request: HttpRequest, *args, **kwargs) -> None:
+ self.membership = membership
+ kwargs["user"] = membership.user
+ super().__init__(request, *args, **kwargs)
+
+ def get_context_data(self) -> dict:
+ c = super().get_context_data()
+ c["membership"] = self.membership
+ c["token"] = default_token_generator.make_token(self.membership.user)
+ c["referral_code"] = self.membership.referral_code
+ return c
+
+
+class OrderEmail(BaseEmail):
+ template = "membership/emails/order.txt"
+ default_subject = _("Your data.coop order and payment")
+
+ def __init__(self, order: Order, request: HttpRequest, *args, **kwargs) -> None:
+ self.order = order
+ kwargs["user"] = order.member
+ super().__init__(request, *args, **kwargs)
+
+ def get_context_data(self) -> dict:
+ c = super().get_context_data()
+ c["order"] = self.order
+ return c
diff --git a/src/membership/forms.py b/src/membership/forms.py
new file mode 100644
index 0000000..71afaaa
--- /dev/null
+++ b/src/membership/forms.py
@@ -0,0 +1,39 @@
+from allauth.account.adapter import get_adapter as get_allauth_adapter
+from allauth.account.forms import SetPasswordForm
+from django import forms
+from django.utils.translation import gettext_lazy as _
+
+
+class InviteForm(SetPasswordForm):
+ """Create a new password for a user account that is created through an invite."""
+
+ username = forms.CharField(
+ label=_("Username"),
+ widget=forms.TextInput(attrs={"placeholder": _("Username"), "autocomplete": "username"}),
+ )
+
+ def __init__(self, *args, **kwargs) -> None:
+ self.membership = kwargs.pop("membership")
+ kwargs["user"] = self.membership.user
+ super().__init__(*args, **kwargs)
+
+ def clean_username(self) -> str:
+ """Clean the username value.
+
+ Taken from the allauth Signup form - we should consider that data can be leaked here.
+ """
+ value = self.cleaned_data["username"]
+ # The allauth adapter ensures the username is unique.
+ return get_allauth_adapter().clean_username(value)
+
+ def save(self) -> None:
+ """Save instance to db.
+
+ Note: You can hack a re-activation of a deactivated account
+ by getting a valid token before deactivation (from the reset password form).
+ We can block this by also setting Membership.revoked=False when deactivating someone's account.
+ """
+ self.user.username = self.cleaned_data["username"]
+ self.user.is_active = True
+ self.user.save()
+ super().save()
diff --git a/src/membership/migrations/0009_membership_referral_code.py b/src/membership/migrations/0009_membership_referral_code.py
new file mode 100644
index 0000000..4fcf65a
--- /dev/null
+++ b/src/membership/migrations/0009_membership_referral_code.py
@@ -0,0 +1,32 @@
+# Generated by Django 5.1rc1 on 2024-08-07 22:32
+
+import uuid
+from django.db import migrations, models
+
+
+def create_uuid(apps, schema_editor):
+ Membership = apps.get_model('membership', 'Membership')
+ for membership in Membership.objects.all():
+ membership.referral_code = uuid.uuid4()
+ membership.save()
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ ('membership', '0008_alter_membership_membership_type'),
+ ]
+
+ operations = [
+ migrations.AddField(
+ model_name='membership',
+ name='referral_code',
+ field=models.UUIDField(blank=True, null=True, unique=True, default=uuid.uuid4, editable=False),
+ ),
+ migrations.RunPython(create_uuid),
+ migrations.AlterField(
+ model_name='membership',
+ name='referral_code',
+ field=models.UUIDField(unique=True, default=uuid.uuid4, editable=False),
+ ),
+ ]
diff --git a/src/membership/migrations/0010_waitinglistentry_member.py b/src/membership/migrations/0010_waitinglistentry_member.py
new file mode 100644
index 0000000..3bc2e08
--- /dev/null
+++ b/src/membership/migrations/0010_waitinglistentry_member.py
@@ -0,0 +1,19 @@
+# Generated by Django 5.1rc1 on 2024-08-14 08:05
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+ dependencies = [
+ ('membership', '0009_membership_referral_code'),
+ ]
+
+ operations = [
+ migrations.AddField(
+ model_name='waitinglistentry',
+ name='member',
+ field=models.ForeignKey(help_text='Once a member account is generated (use the admin action), this field will be marked.', null=True, blank=True, on_delete=django.db.models.deletion.CASCADE, to='membership.member', verbose_name='has member'),
+ ),
+ ]
diff --git a/src/membership/models.py b/src/membership/models.py
index 9483d0f..f9e5ddd 100644
--- a/src/membership/models.py
+++ b/src/membership/models.py
@@ -1,9 +1,11 @@
"""Models for the membership app."""
+import uuid
from typing import ClassVar
from typing import Self
from django.contrib.auth.models import User
+from django.contrib.auth.models import UserManager
from django.contrib.postgres.constraints import ExclusionConstraint
from django.contrib.postgres.fields import DateRangeField
from django.contrib.postgres.fields import RangeOperators
@@ -42,7 +44,23 @@ class Member(User):
),
)
- objects = QuerySet.as_manager()
+ objects = UserManager.from_queryset(QuerySet)()
+
+ def get_display_name(self) -> str:
+ """Choose how to display the user in emails and UI and ultimately to other users.
+
+ It's crucial that we currently don't have a good solution for this.
+ We should allow the user to define their own nick.
+ """
+ return self.username
+
+ @property
+ def language_code(self) -> str:
+ """Returns the user's preferred language code.
+
+ We don't have an actual setting for this... because this is a proxy table.
+ """
+ return "da-dk"
class Meta:
proxy = True
@@ -122,6 +140,9 @@ class Membership(CreatedModifiedAbstract):
user = models.ForeignKey("auth.User", on_delete=models.PROTECT, related_name="memberships")
+ # This code is used for inviting a user to create an account for this membership.
+ referral_code = models.UUIDField(unique=True, default=uuid.uuid4, editable=False)
+
membership_type = models.ForeignKey(
"membership.MembershipType",
related_name="memberships",
@@ -209,6 +230,14 @@ class WaitingListEntry(CreatedModifiedAbstract):
email = models.EmailField()
geography = models.CharField(verbose_name=_("geography"), blank=True, default="")
comment = models.TextField(blank=True)
+ member = models.ForeignKey(
+ Member,
+ null=True,
+ blank=True,
+ verbose_name=_("has member"),
+ help_text=_("Once a member account is generated (use the admin action), this field will be marked."),
+ on_delete=models.CASCADE,
+ )
def __str__(self) -> str:
return self.email
diff --git a/src/membership/templates/membership/emails/base.txt b/src/membership/templates/membership/emails/base.txt
new file mode 100644
index 0000000..636aee0
--- /dev/null
+++ b/src/membership/templates/membership/emails/base.txt
@@ -0,0 +1,9 @@
+{% load i18n %}{% block greeting %}{% blocktrans %}Dear {{ recipient_name }},{% endblocktrans %}{% endblock %}
+
+{% block content %}{% endblock %}
+
+
+{% trans "Cooperatively yours," %}
+{{ site_name }}
+
+{{ protocol }}://{{ domain }}
diff --git a/src/membership/templates/membership/emails/invite.txt b/src/membership/templates/membership/emails/invite.txt
new file mode 100644
index 0000000..216ba0e
--- /dev/null
+++ b/src/membership/templates/membership/emails/invite.txt
@@ -0,0 +1,7 @@
+{% extends "membership/emails/base.txt" %}{% load i18n %}
+
+{% block content %}{% url 'member:membership-invite' token=token referral_code=referral_code as invite_url %}{% blocktrans %}Here is your secret URL for creating an account with us:
+
+{{ protocol }}://{{ domain }}{{ invite_url }}
+
+If you did not request this account, get in touch with us.{% endblocktrans %}{% endblock %}
diff --git a/src/membership/templates/membership/emails/order.txt b/src/membership/templates/membership/emails/order.txt
new file mode 100644
index 0000000..e976444
--- /dev/null
+++ b/src/membership/templates/membership/emails/order.txt
@@ -0,0 +1,6 @@
+{% extends "membership/emails/base.txt" %}{% load i18n %}
+
+{% block content %}{% url 'order:detail' order_id=order.id as order_url %}{% blocktrans %}You have an order in our system, you can pay it here:
+
+{{ protocol }}://{{ domain }}{{ order_url }}
+{% endblocktrans %}{% endblock %}
diff --git a/src/membership/templates/membership/invite.html b/src/membership/templates/membership/invite.html
new file mode 100644
index 0000000..a36ca35
--- /dev/null
+++ b/src/membership/templates/membership/invite.html
@@ -0,0 +1,21 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% block head_title %}
+ {% trans "Membership" %}
+{% endblock %}
+
+{% block content %}
+
+
+
{% trans "Create account" %}
+
{% trans "Congratulations! You've been invited to create an account with us:" %}
+
Email: {{ membership.user.email }}
+
+
+
+{% endblock %}
diff --git a/src/membership/views.py b/src/membership/views.py
index eeb2e58..c82cf5b 100644
--- a/src/membership/views.py
+++ b/src/membership/views.py
@@ -4,12 +4,20 @@ from __future__ import annotations
from typing import TYPE_CHECKING
+from django.contrib import messages
+from django.contrib.auth.tokens import default_token_generator
+from django.http import HttpResponseForbidden
+from django.shortcuts import get_object_or_404
+from django.shortcuts import redirect
from django.utils.translation import gettext_lazy as _
+from django_ratelimit.decorators import ratelimit
from django_view_decorator import namespaced_decorator_factory
from utils.view_utils import RenderConfig
from utils.view_utils import RowAction
from utils.view_utils import render
+from .forms import InviteForm
+from .models import Membership
from .permissions import ADMINISTRATE_MEMBERS
from .selectors import get_member
from .selectors import get_members
@@ -113,3 +121,49 @@ def members_admin_detail(request: HttpRequest, member_id: int) -> HttpResponse:
template_name="membership/members_admin_detail.html",
context=context,
)
+
+
+@ratelimit(group="membership", key="ip", rate="10/d", method="ALL", block=True)
+@member_view(
+ paths="invite///",
+ name="membership-invite",
+ login_required=False,
+)
+def invite(request: HttpRequest, referral_code: str, token: str) -> HttpResponse:
+ """View to invite a member to create a membership.
+
+ The token belongs to a non-active Member object. If the token is valid,
+ the caller is allowed to create a membership.
+
+ We ratelimit this view so it's not possible to brute-force tokens.
+ """
+ if request.user.is_authenticated:
+ return HttpResponseForbidden("You're already logged in. So you cannot receive an invite.")
+
+ # Firstly, we get the membership by the referral code.
+ membership = get_object_or_404(Membership, referral_code=referral_code, user__is_active=False, revoked=False)
+
+ token_valid = default_token_generator.check_token(membership.user, token)
+
+ if not token_valid:
+ raise HttpResponseForbidden("Token not valid - maybe it expired?")
+
+ if request.method == "POST":
+ form = InviteForm(membership=membership, data=request.POST)
+ if form.is_valid():
+ form.save()
+ messages.info(request, _("Password is set for your account and you can now login."))
+ return redirect("account_login")
+ else:
+ form = InviteForm(membership=membership)
+
+ context = {
+ "token": token,
+ "membership": membership,
+ "form": form,
+ }
+ return render(
+ request=request,
+ template_name="membership/invite.html",
+ context=context,
+ )
diff --git a/src/project/settings.py b/src/project/settings.py
index 4f558a1..d6a800c 100644
--- a/src/project/settings.py
+++ b/src/project/settings.py
@@ -182,6 +182,10 @@ LOGGING = {
STRIPE_API_KEY = env.str("STRIPE_API_KEY")
STRIPE_ENDPOINT_SECRET = env.str("STRIPE_ENDPOINT_SECRET")
+# The number of seconds a password reset link is valid for (default: 3 days).
+# We've extended this to 7 days because invites then last for 1 week.
+PASSWORD_RESET_TIMEOUT = 60 * 60 * 24 * 7
+
if DEBUG:
INSTALLED_APPS += ["debug_toolbar", "django_browser_reload"]
MIDDLEWARE += [
diff --git a/src/project/templates/base.html b/src/project/templates/base.html
index 7194c4d..1bcdab5 100644
--- a/src/project/templates/base.html
+++ b/src/project/templates/base.html
@@ -102,6 +102,16 @@
+ {% if messages %}
+
+ {% for message in messages %}
+
📨
+
{{ message }}
+ {% endfor %}
+
+
+ {% endif %}
+
{% block content %}{% endblock %}
diff --git a/src/project/templates/index.html b/src/project/templates/index.html
index 2cc3490..1cc49e6 100644
--- a/src/project/templates/index.html
+++ b/src/project/templates/index.html
@@ -14,6 +14,10 @@
It is very much under construction.
+ {% for order in unpaid_orders %}
+ You have an unpaid order: View Order ID {{ order.id }}
+ {% endfor %}
+
{% comment %}
diff --git a/src/project/views.py b/src/project/views.py
index 7fbde77..affd1e7 100644
--- a/src/project/views.py
+++ b/src/project/views.py
@@ -4,6 +4,7 @@ from __future__ import annotations
from typing import TYPE_CHECKING
+from accounting.models import Order
from django_view_decorator import view
from utils.view_utils import render
@@ -19,7 +20,11 @@ if TYPE_CHECKING:
)
def index(request: HttpRequest) -> HttpResponse:
"""View to show the index page."""
- return render(request, "index.html")
+ unpaid_orders = Order.objects.filter(member=request.user, is_paid=False)
+
+ context = {"unpaid_orders": list(unpaid_orders)}
+
+ return render(request, "index.html", context=context)
@view(