chore: rebrand ClubManager -> RosterChief, add lucide icons
The clubmanager.app domain was taken, so the platform is now RosterChief (rosterchief.app). Renames the Django project package clubmanager/ -> rosterchief/ (git tracks it as a move, so history follows), every `from rosterchief.base import ...`, the settings/wsgi/asgi module paths, env vars (ROSTERCHIEF_BASE_DOMAIN / ROSTERCHIEF_RP_NAME), the MFA adapter (RosterChiefMFAAdapter), brand text, and the docs. Two things were deliberately NOT swept: - club.models.ClubManager stays: it is the Django manager *for Club*, not the brand. A blind rename would have silently broken it. - Migrations are untouched (history is not rewritten). The only reference was a cosmetic help_text, so a normal AlterField migration carries the new domain. Note the WebAuthn RP ID is the base domain, so moving to rosterchief.app cryptographically invalidates any passkey enrolled under the old one; they cannot be migrated and must be re-enrolled. Nothing is in production, so the real cost is zero. Add django-lucide (from bsiebens/lucide) for icons: the theme toggle now swaps sun/moon against the effective theme, and the control panel gets icons on its tabs, actions and stat groups. Its classifiers stop at Django 5.0, but that is stale metadata — verified rendering on Django 6 / Python 3.14. Also add formbuilder, shop and controlpanel to ruff's known-first-party list, which had drifted behind the apps that landed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
0
rosterchief/__init__.py
Normal file
0
rosterchief/__init__.py
Normal file
16
rosterchief/asgi.py
Normal file
16
rosterchief/asgi.py
Normal file
@@ -0,0 +1,16 @@
|
||||
"""
|
||||
ASGI config for rosterchief project.
|
||||
|
||||
It exposes the ASGI callable as a module-level variable named ``application``.
|
||||
|
||||
For more information on this file, see
|
||||
https://docs.djangoproject.com/en/6.0/howto/deployment/asgi/
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
from django.core.asgi import get_asgi_application
|
||||
|
||||
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rosterchief.settings")
|
||||
|
||||
application = get_asgi_application()
|
||||
100
rosterchief/base.py
Normal file
100
rosterchief/base.py
Normal file
@@ -0,0 +1,100 @@
|
||||
import uuid
|
||||
from typing import TYPE_CHECKING
|
||||
|
||||
from django.core.exceptions import ValidationError
|
||||
from django.db import models
|
||||
from django.utils.text import slugify
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
|
||||
from club.tenancy import require_current_club
|
||||
|
||||
if TYPE_CHECKING:
|
||||
from club.models import Club
|
||||
|
||||
|
||||
def validate_club_scope(instance, owning_club_id, *, same_club_fields=(), member_fields=()):
|
||||
"""Reject FKs that leak across clubs.
|
||||
|
||||
``same_club_fields`` are FKs to club-scoped models that must share
|
||||
``owning_club_id``; ``member_fields`` are Member FKs whose target must have
|
||||
a ClubMembership in that club. Unset (None) FKs are skipped. Call from a
|
||||
model's ``clean()``.
|
||||
"""
|
||||
errors = {}
|
||||
for field in same_club_fields:
|
||||
if getattr(instance, f"{field}_id") is not None and getattr(instance, field).club_id != owning_club_id:
|
||||
errors[field] = _("Must belong to the same club.")
|
||||
|
||||
if member_fields:
|
||||
from club.models import ClubMembership
|
||||
|
||||
for field in member_fields:
|
||||
if getattr(instance, f"{field}_id") is not None and not ClubMembership.objects.filter(club_id=owning_club_id, member=getattr(instance, field)).exists():
|
||||
errors[field] = _("Must be a member of this club.")
|
||||
|
||||
if errors:
|
||||
raise ValidationError(errors)
|
||||
|
||||
|
||||
def unique_slugify(instance, value, *, slug_field="slug", scope=None):
|
||||
"""Return a slug derived from ``value``, unique within ``scope``.
|
||||
|
||||
Truncates to the slug field's ``max_length`` and appends ``-2``, ``-3``, …
|
||||
on collision. ``scope`` is a dict of field lookups the uniqueness is
|
||||
checked within (e.g. ``{"club": club}`` for per-club, ``{}``/``None`` for
|
||||
global).
|
||||
"""
|
||||
max_length = instance._meta.get_field(slug_field).max_length
|
||||
base = slugify(value)[:max_length] or "item"
|
||||
|
||||
queryset = type(instance)._default_manager.exclude(pk=instance.pk)
|
||||
if scope:
|
||||
queryset = queryset.filter(**scope)
|
||||
|
||||
slug = base
|
||||
suffix = 2
|
||||
while queryset.filter(**{slug_field: slug}).exists():
|
||||
tail = f"-{suffix}"
|
||||
slug = f"{base[: max_length - len(tail)]}{tail}"
|
||||
suffix += 1
|
||||
return slug
|
||||
|
||||
|
||||
class TenantQuerySet(models.QuerySet):
|
||||
def for_club(self, club: Club):
|
||||
return self.filter(club=club)
|
||||
|
||||
def current_club(self):
|
||||
return self.filter(club=require_current_club())
|
||||
|
||||
|
||||
class UUIDModel(models.Model):
|
||||
"""Abstract base class giving every model a UUID primary key"""
|
||||
|
||||
id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
|
||||
|
||||
class Meta:
|
||||
abstract = True
|
||||
|
||||
|
||||
class ClubScopedModel(UUIDModel):
|
||||
"""Abstract base for entities owned by a single club (tenant root)."""
|
||||
|
||||
club = models.ForeignKey("club.Club", on_delete=models.CASCADE, related_name="%(class)ss")
|
||||
objects = TenantQuerySet.as_manager()
|
||||
|
||||
# Subclasses with a ``slug`` field set this to the source field name (e.g.
|
||||
# "name"/"title") to auto-populate the slug — unique per club — on save.
|
||||
slug_source = None
|
||||
|
||||
class Meta:
|
||||
abstract = True
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
if self.club_id is None:
|
||||
self.club = require_current_club()
|
||||
|
||||
if self.slug_source and not self.slug:
|
||||
self.slug = unique_slugify(self, getattr(self, self.slug_source), scope={"club": self.club})
|
||||
|
||||
super().save(*args, **kwargs)
|
||||
206
rosterchief/settings.py
Normal file
206
rosterchief/settings.py
Normal file
@@ -0,0 +1,206 @@
|
||||
"""
|
||||
Django settings for rosterchief project.
|
||||
|
||||
Generated by 'django-admin startproject' using Django 6.0.6.
|
||||
|
||||
For more information on this file, see
|
||||
https://docs.djangoproject.com/en/6.0/topics/settings/
|
||||
|
||||
For the full list of settings and their values, see
|
||||
https://docs.djangoproject.com/en/6.0/ref/settings/
|
||||
"""
|
||||
|
||||
from pathlib import Path
|
||||
|
||||
from decouple import Csv, config
|
||||
from dj_database_url import parse as db_url
|
||||
|
||||
# Build paths inside the project like this: BASE_DIR / 'subdir'.
|
||||
BASE_DIR = Path(__file__).resolve().parent.parent
|
||||
|
||||
|
||||
# Quick-start development settings - unsuitable for production
|
||||
# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
|
||||
|
||||
# SECURITY WARNING: keep the secret key used in production secret!
|
||||
SECRET_KEY = config("DJANGO_SECRET_KEY")
|
||||
|
||||
# SECURITY WARNING: don't run with debug turned on in production!
|
||||
DEBUG = config("DJANGO_DEBUG", default=False, cast=bool)
|
||||
|
||||
ALLOWED_HOSTS = config("DJANGO_ALLOWED_HOSTS", cast=Csv(), default="")
|
||||
INTERNAL_IPS = config("DJANGO_INTERNAL_IPS", cast=Csv(), default="127.0.0.1")
|
||||
|
||||
CSRF_TRUSTED_ORIGINS = config("DJANGO_CSRF_TRUSTED_ORIGINS", cast=Csv(), default="")
|
||||
|
||||
|
||||
# Application definition
|
||||
|
||||
INSTALLED_APPS = [
|
||||
"django.contrib.admin",
|
||||
"django.contrib.auth",
|
||||
"django.contrib.contenttypes",
|
||||
"django.contrib.sessions",
|
||||
"django.contrib.messages",
|
||||
"django.contrib.staticfiles",
|
||||
"phonenumber_field",
|
||||
"lucide",
|
||||
# Auth: allauth deliberately WITHOUT django.contrib.sites — it is optional in
|
||||
# allauth 65+, and ARCHITECTURE.md §2.4 rejects the Sites framework (Club is
|
||||
# the tenant root, not Site).
|
||||
"allauth",
|
||||
"allauth.account",
|
||||
"allauth.mfa",
|
||||
"club.apps.ClubConfig",
|
||||
"authentication.apps.AuthenticationConfig",
|
||||
"members.apps.MembersConfig",
|
||||
"teams.apps.TeamsConfig",
|
||||
"events.apps.EventsConfig",
|
||||
"formbuilder.apps.FormbuilderConfig",
|
||||
"shop.apps.ShopConfig",
|
||||
"controlpanel.apps.ControlpanelConfig",
|
||||
]
|
||||
|
||||
MIDDLEWARE = [
|
||||
"django.middleware.security.SecurityMiddleware",
|
||||
"django.contrib.sessions.middleware.SessionMiddleware",
|
||||
"django.middleware.common.CommonMiddleware",
|
||||
"django.middleware.csrf.CsrfViewMiddleware",
|
||||
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
||||
"allauth.account.middleware.AccountMiddleware",
|
||||
"authentication.middleware.RequireMFAMiddleware",
|
||||
"club.tenancy.ClubTenantMiddleware",
|
||||
"django.contrib.messages.middleware.MessageMiddleware",
|
||||
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
||||
]
|
||||
|
||||
AUTHENTICATION_BACKENDS = [
|
||||
"django.contrib.auth.backends.ModelBackend",
|
||||
"allauth.account.auth_backends.AuthenticationBackend",
|
||||
]
|
||||
|
||||
# Multi-tenancy: base domain whose subdomains resolve to a club, e.g.
|
||||
# "ajax-united.rosterchief.app" -> the club with slug "ajax-united". Leave
|
||||
# unset to fall back to generic "slug.example.com" (3+ label) resolution.
|
||||
ROSTERCHIEF_BASE_DOMAIN = config("ROSTERCHIEF_BASE_DOMAIN", default="")
|
||||
|
||||
ROOT_URLCONF = "rosterchief.urls"
|
||||
|
||||
AUTH_USER_MODEL = "authentication.User"
|
||||
|
||||
|
||||
# Authentication (django-allauth)
|
||||
|
||||
LOGIN_URL = "account_login"
|
||||
LOGIN_REDIRECT_URL = "/"
|
||||
|
||||
# The User model logs in by email and has no username field.
|
||||
ACCOUNT_USER_MODEL_USERNAME_FIELD = None
|
||||
ACCOUNT_LOGIN_METHODS = {"email"}
|
||||
ACCOUNT_SIGNUP_FIELDS = ["email*", "password1*", "password2*"]
|
||||
ACCOUNT_EMAIL_VERIFICATION = "none"
|
||||
|
||||
|
||||
# Two-factor authentication (allauth.mfa)
|
||||
|
||||
MFA_SUPPORTED_TYPES = ["totp", "webauthn", "recovery_codes"]
|
||||
|
||||
# Passkeys are a first factor: sign in with Touch ID / a security key alone.
|
||||
MFA_PASSKEY_LOGIN_ENABLED = True
|
||||
MFA_PASSKEY_SIGNUP_ENABLED = False
|
||||
|
||||
# WebAuthn needs a secure context. Browsers treat *.localhost as secure, but the
|
||||
# dev server is plain HTTP, so allow the insecure origin while DEBUG.
|
||||
MFA_WEBAUTHN_ALLOW_INSECURE_ORIGIN = DEBUG
|
||||
|
||||
# A passkey is bound to a Relying Party ID (a domain). Our adapter pins it to
|
||||
# ROSTERCHIEF_BASE_DOMAIN so that ONE passkey works across every club subdomain
|
||||
# — allauth's default (the request host) would bind it to a single club.
|
||||
MFA_ADAPTER = "authentication.adapters.RosterChiefMFAAdapter"
|
||||
MFA_WEBAUTHN_RP_NAME = config("ROSTERCHIEF_RP_NAME", default="RosterChief")
|
||||
|
||||
# Where RequireMFAMiddleware sends privileged users who haven't enrolled yet.
|
||||
MFA_ENROLMENT_URL_NAME = "mfa_index"
|
||||
|
||||
|
||||
# Sessions are shared across club subdomains: log in once and you're authenticated
|
||||
# on every club (matching the one-passkey-everywhere model). Tenancy still scopes
|
||||
# what you can *see* — that is the access service's job, not the cookie's.
|
||||
# Browsers reject a Domain attribute on localhost, so it stays host-only in dev.
|
||||
SHARED_COOKIE_DOMAIN = f".{ROSTERCHIEF_BASE_DOMAIN}" if ROSTERCHIEF_BASE_DOMAIN and ROSTERCHIEF_BASE_DOMAIN != "localhost" else None
|
||||
|
||||
SESSION_COOKIE_DOMAIN = config("DJANGO_SESSION_COOKIE_DOMAIN", default=SHARED_COOKIE_DOMAIN)
|
||||
CSRF_COOKIE_DOMAIN = config("DJANGO_CSRF_COOKIE_DOMAIN", default=SHARED_COOKIE_DOMAIN)
|
||||
|
||||
TEMPLATES = [
|
||||
{
|
||||
"BACKEND": "django.template.backends.django.DjangoTemplates",
|
||||
"DIRS": [BASE_DIR / "templates"],
|
||||
"APP_DIRS": True,
|
||||
"OPTIONS": {
|
||||
"context_processors": [
|
||||
"django.template.context_processors.request",
|
||||
"django.contrib.auth.context_processors.auth",
|
||||
"django.contrib.messages.context_processors.messages",
|
||||
],
|
||||
},
|
||||
},
|
||||
]
|
||||
|
||||
WSGI_APPLICATION = "rosterchief.wsgi.application"
|
||||
|
||||
|
||||
# Database
|
||||
# https://docs.djangoproject.com/en/6.0/ref/settings/#databases
|
||||
|
||||
DATABASES = {
|
||||
"default": config("DJANGO_DATABASE_URL", default="sqlite:///db.sqlite3", cast=db_url),
|
||||
}
|
||||
|
||||
|
||||
# Password validation
|
||||
# https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
|
||||
|
||||
AUTH_PASSWORD_VALIDATORS = [
|
||||
{
|
||||
"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
|
||||
},
|
||||
{
|
||||
"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
|
||||
},
|
||||
{
|
||||
"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
|
||||
},
|
||||
{
|
||||
"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
|
||||
},
|
||||
]
|
||||
|
||||
|
||||
# Internationalization
|
||||
# https://docs.djangoproject.com/en/6.0/topics/i18n/
|
||||
|
||||
LANGUAGE_CODE = "en-us"
|
||||
|
||||
TIME_ZONE = config("DJANGO_TIME_ZONE", default="Europe/Brussels", cast=str)
|
||||
|
||||
USE_I18N = True
|
||||
|
||||
USE_TZ = True
|
||||
|
||||
|
||||
# Static files (CSS, JavaScript, Images)
|
||||
# https://docs.djangoproject.com/en/6.0/howto/static-files/
|
||||
|
||||
STATIC_URL = "static/"
|
||||
STATIC_ROOT = BASE_DIR / "staticfiles"
|
||||
STATICFILES_DIRS = [BASE_DIR / "static"]
|
||||
|
||||
MEDIA_URL = "media/"
|
||||
MEDIA_ROOT = BASE_DIR / "media"
|
||||
|
||||
|
||||
# Phone numbers (django-phonenumber-field)
|
||||
|
||||
PHONENUMBER_DEFAULT_REGION = "BE"
|
||||
PHONENUMBER_DB_FORMAT = "E164"
|
||||
19
rosterchief/urls.py
Normal file
19
rosterchief/urls.py
Normal file
@@ -0,0 +1,19 @@
|
||||
"""URL configuration for rosterchief.
|
||||
|
||||
``/admin/login/`` is deliberately intercepted *before* ``admin.site.urls`` and
|
||||
redirected to the allauth login, so Django staff go through the same MFA
|
||||
challenge as everyone else — Django's own admin login form knows nothing about
|
||||
second factors. ``RequireMFAMiddleware`` then blocks any staff user who has not
|
||||
enrolled.
|
||||
"""
|
||||
|
||||
from django.contrib import admin
|
||||
from django.urls import include, path
|
||||
from django.views.generic import RedirectView
|
||||
|
||||
urlpatterns = [
|
||||
path("admin/login/", RedirectView.as_view(pattern_name="account_login", query_string=True), name="admin_login_redirect"),
|
||||
path("admin/", admin.site.urls),
|
||||
path("accounts/", include("allauth.urls")),
|
||||
path("controlpanel/", include("controlpanel.urls")),
|
||||
]
|
||||
16
rosterchief/wsgi.py
Normal file
16
rosterchief/wsgi.py
Normal file
@@ -0,0 +1,16 @@
|
||||
"""
|
||||
WSGI config for rosterchief project.
|
||||
|
||||
It exposes the WSGI callable as a module-level variable named ``application``.
|
||||
|
||||
For more information on this file, see
|
||||
https://docs.djangoproject.com/en/6.0/howto/deployment/wsgi/
|
||||
"""
|
||||
|
||||
import os
|
||||
|
||||
from django.core.wsgi import get_wsgi_application
|
||||
|
||||
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "rosterchief.settings")
|
||||
|
||||
application = get_wsgi_application()
|
||||
Reference in New Issue
Block a user