Version Bump 2.13.0

fixed attribute error

See merge request allianceauth/allianceauth!1421

.gitignore

@@ -76,3 +76,4 @@ celerybeat-schedule
 .flake8
 .pylintrc
 Makefile
+.isort.cfg

.gitlab-ci.yml

@@ -54,7 +54,9 @@ test-3.7-core:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.8-core:
   <<: *only-default
@@ -64,7 +66,9 @@ test-3.8-core:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.9-core:
   <<: *only-default
@@ -74,7 +78,9 @@ test-3.9-core:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.10-core:
   <<: *only-default
@@ -84,7 +90,22 @@ test-3.10-core:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
+
+test-3.11-core:
+  <<: *only-default
+  image: python:3.11-rc-bullseye
+  script:
+  - tox -e py311-core
+  artifacts:
+    when: always
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
+  allow_failure: true
 
 test-3.7-all:
   <<: *only-default
@@ -94,7 +115,9 @@ test-3.7-all:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.8-all:
   <<: *only-default
@@ -104,7 +127,9 @@ test-3.8-all:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.9-all:
   <<: *only-default
@@ -114,7 +139,9 @@ test-3.9-all:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
 
 test-3.10-all:
   <<: *only-default
@@ -124,7 +151,28 @@ test-3.10-all:
   artifacts:
     when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
+
+test-3.11-all:
+  <<: *only-default
+  image: python:3.11-rc-bullseye
+  script:
+  - tox -e py311-all
+  artifacts:
+    when: always
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
+  allow_failure: true
+
+test-docs:
+  <<: *only-default
+  image: python:3.9-bullseye
+  script:
+  - tox -e docs
 
 deploy_production:
   stage: deploy

allianceauth/__init__.py

@@ -1,7 +1,7 @@
 # This will make sure the app is always imported when
 # Django starts so that shared_task will use this app.
 
-__version__ = '2.9.3'
+__version__ = '2.13.0'
 __title__ = 'Alliance Auth'
 __url__ = 'https://gitlab.com/allianceauth/allianceauth'
 NAME = f'{__title__} v{__version__}'

allianceauth/analytics/middleware.py

@@ -1,5 +1,6 @@
 from bs4 import BeautifulSoup
 
+from django.conf import settings
 from django.utils.deprecation import MiddlewareMixin
 from .models import AnalyticsTokens, AnalyticsIdentifier
 from .tasks import send_ga_tracking_web_view
@@ -10,6 +11,8 @@ import re
 class AnalyticsMiddleware(MiddlewareMixin):
     def process_response(self, request, response):
         """Django Middleware: Process Page Views and creates Analytics Celery Tasks"""
+        if getattr(settings, "ANALYTICS_DISABLED", False):
+            return response
         analyticstokens = AnalyticsTokens.objects.all()
         client_id = AnalyticsIdentifier.objects.get(id=1).identifier.hex
         try:

allianceauth/analytics/migrations/0004_auto_20211015_0502.py

@@ -1,11 +1,11 @@
 # Generated by Django 3.1.13 on 2021-10-15 05:02
 
+from django.core.exceptions import ObjectDoesNotExist
 from django.db import migrations
 
 
 def modify_aa_team_token_add_page_ignore_paths(apps, schema_editor):
-    # We can't import the Person model directly as it may be a newer
-    # version than this migration expects. We use the historical version.
+    # Add /admin/ and /user_notifications_count/ path to ignore
 
     AnalyticsPath = apps.get_model('analytics', 'AnalyticsPath')
     admin = AnalyticsPath.objects.create(ignore_path=r"^\/admin\/.*")
@@ -17,8 +17,19 @@ def modify_aa_team_token_add_page_ignore_paths(apps, schema_editor):
 
 
 def undo_modify_aa_team_token_add_page_ignore_paths(apps, schema_editor):
-    # nothing should need to migrate away here?
-    return True
+    #
+    AnalyticsPath = apps.get_model('analytics', 'AnalyticsPath')
+    Tokens = apps.get_model('analytics', 'AnalyticsTokens')
+
+    token = Tokens.objects.get(token="UA-186249766-2")
+    try:
+        admin = AnalyticsPath.objects.get(ignore_path=r"^\/admin\/.*", analyticstokens=token)
+        user_notifications_count = AnalyticsPath.objects.get(ignore_path=r"^\/user_notifications_count\/.*", analyticstokens=token)
+        admin.delete()
+        user_notifications_count.delete()
+    except ObjectDoesNotExist:
+        # Its fine if it doesnt exist, we just dont want them building up when re-migrating
+        pass
 
 
 class Migration(migrations.Migration):

allianceauth/analytics/migrations/0006_more_ignore_paths.py

@@ -0,0 +1,40 @@
+# Generated by Django 3.2.8 on 2021-10-19 01:47
+
+from django.core.exceptions import ObjectDoesNotExist
+from django.db import migrations
+
+
+def modify_aa_team_token_add_page_ignore_paths(apps, schema_editor):
+    # Add the /account/activate path to ignore
+
+    AnalyticsPath = apps.get_model('analytics', 'AnalyticsPath')
+    account_activate = AnalyticsPath.objects.create(ignore_path=r"^\/account\/activate\/.*")
+
+    Tokens = apps.get_model('analytics', 'AnalyticsTokens')
+    token = Tokens.objects.get(token="UA-186249766-2")
+    token.ignore_paths.add(account_activate)
+
+
+def undo_modify_aa_team_token_add_page_ignore_paths(apps, schema_editor):
+    #
+    AnalyticsPath = apps.get_model('analytics', 'AnalyticsPath')
+    Tokens = apps.get_model('analytics', 'AnalyticsTokens')
+
+    token = Tokens.objects.get(token="UA-186249766-2")
+
+    try:
+        account_activate = AnalyticsPath.objects.get(ignore_path=r"^\/account\/activate\/.*", analyticstokens=token)
+        account_activate.delete()
+    except ObjectDoesNotExist:
+        # Its fine if it doesnt exist, we just dont want them building up when re-migrating
+        pass
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('analytics', '0005_alter_analyticspath_ignore_path'),
+    ]
+
+    operations = [
+        migrations.RunPython(modify_aa_team_token_add_page_ignore_paths, undo_modify_aa_team_token_add_page_ignore_paths)
+    ]

allianceauth/analytics/signals.py

@@ -1,7 +1,8 @@
-from allianceauth.analytics.tasks import analytics_event
-from celery.signals import task_failure, task_success
-
 import logging
+from celery.signals import task_failure, task_success
+from django.conf import settings
+from allianceauth.analytics.tasks import analytics_event
+
 logger = logging.getLogger(__name__)
 
 
@@ -11,6 +12,8 @@ def process_failure_signal(
                         sender, task_id, signal,
                         args, kwargs, einfo, **kw):
     logger.debug("Celery task_failure signal %s" % sender.__class__.__name__)
+    if getattr(settings, "ANALYTICS_DISABLED", False):
+        return
 
     category = sender.__module__
 
@@ -30,6 +33,8 @@ def process_failure_signal(
 @task_success.connect
 def celery_success_signal(sender, result=None, **kw):
     logger.debug("Celery task_success signal %s" % sender.__class__.__name__)
+    if getattr(settings, "ANALYTICS_DISABLED", False):
+        return
 
     category = sender.__module__
 

allianceauth/analytics/tasks.py

@@ -21,8 +21,8 @@ if getattr(settings, "ANALYTICS_ENABLE_DEBUG", False) and settings.DEBUG:
     # Force sending of analytics data during in a debug/test environemt
     # Usefull for developers working on this feature.
     logger.warning(
-                "You have 'ANALYTICS_ENABLE_DEBUG' Enabled! "
-                "This debug instance will send analytics data!")
+        "You have 'ANALYTICS_ENABLE_DEBUG' Enabled! "
+        "This debug instance will send analytics data!")
     DEBUG_URL = COLLECTION_URL
 
 ANALYTICS_URL = COLLECTION_URL
@@ -40,13 +40,12 @@ def analytics_event(category: str,
     Send a Google Analytics Event for each token stored
     Includes check for if its enabled/disabled
 
-    Parameters
-    -------
-    `category` (str): Celery Namespace
-    `action` (str): Task Name
-    `label` (str): Optional, Task Success/Exception
-    `value` (int): Optional, If bulk, Query size, can be a binary True/False
-    `event_type` (str): Optional, Celery or Stats only, Default to Celery
+    Args:
+        `category` (str): Celery Namespace
+        `action` (str): Task Name
+        `label` (str): Optional, Task Success/Exception
+        `value` (int): Optional, If bulk, Query size, can be a binary True/False
+        `event_type` (str): Optional, Celery or Stats only, Default to Celery
     """
     analyticstokens = AnalyticsTokens.objects.all()
     client_id = AnalyticsIdentifier.objects.get(id=1).identifier.hex
@@ -60,20 +59,21 @@ def analytics_event(category: str,
 
         if allowed is True:
             tracking_id = token.token
-            send_ga_tracking_celery_event.s(tracking_id=tracking_id,
-                                            client_id=client_id,
-                                            category=category,
-                                            action=action,
-                                            label=label,
-                                            value=value).\
-                apply_async(priority=9)
+            send_ga_tracking_celery_event.s(
+                tracking_id=tracking_id,
+                client_id=client_id,
+                category=category,
+                action=action,
+                label=label,
+                value=value).apply_async(priority=9)
 
 
 @shared_task()
 def analytics_daily_stats():
     """Celery Task: Do not call directly
 
-    Gathers a series of daily statistics and sends analytics events containing them"""
+    Gathers a series of daily statistics and sends analytics events containing them
+    """
     users = install_stat_users()
     tokens = install_stat_tokens()
     addons = install_stat_addons()

allianceauth/analytics/tests/test_integration.py

@@ -0,0 +1,108 @@
+from unittest.mock import patch
+from urllib.parse import parse_qs
+
+import requests_mock
+
+from django.test import TestCase, override_settings
+
+from allianceauth.analytics.tasks import ANALYTICS_URL
+from allianceauth.eveonline.tasks import update_character
+from allianceauth.tests.auth_utils import AuthUtils
+
+
+@override_settings(CELERY_ALWAYS_EAGER=True)
+@requests_mock.mock()
+class TestAnalyticsForViews(TestCase):
+    @override_settings(ANALYTICS_DISABLED=False)
+    def test_should_run_analytics(self, requests_mocker):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        user = AuthUtils.create_user("Bruce Wayne")
+        self.client.force_login(user)
+        # when
+        response = self.client.get("/dashboard/")
+        # then
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(requests_mocker.called)
+
+    @override_settings(ANALYTICS_DISABLED=True)
+    def test_should_not_run_analytics(self, requests_mocker):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        user = AuthUtils.create_user("Bruce Wayne")
+        self.client.force_login(user)
+        # when
+        response = self.client.get("/dashboard/")
+        # then
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(requests_mocker.called)
+
+
+@override_settings(CELERY_ALWAYS_EAGER=True)
+@requests_mock.mock()
+class TestAnalyticsForTasks(TestCase):
+    @override_settings(ANALYTICS_DISABLED=False)
+    @patch("allianceauth.eveonline.models.EveCharacter.objects.update_character")
+    def test_should_run_analytics_for_successful_task(
+        self, requests_mocker, mock_update_character
+    ):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        user = AuthUtils.create_user("Bruce Wayne")
+        character = AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        # when
+        update_character.delay(character.character_id)
+        # then
+        self.assertTrue(mock_update_character.called)
+        self.assertTrue(requests_mocker.called)
+        payload = parse_qs(requests_mocker.last_request.text)
+        self.assertListEqual(payload["el"], ["Success"])
+
+    @override_settings(ANALYTICS_DISABLED=True)
+    @patch("allianceauth.eveonline.models.EveCharacter.objects.update_character")
+    def test_should_not_run_analytics_for_successful_task(
+        self, requests_mocker, mock_update_character
+    ):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        user = AuthUtils.create_user("Bruce Wayne")
+        character = AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        # when
+        update_character.delay(character.character_id)
+        # then
+        self.assertTrue(mock_update_character.called)
+        self.assertFalse(requests_mocker.called)
+
+    @override_settings(ANALYTICS_DISABLED=False)
+    @patch("allianceauth.eveonline.models.EveCharacter.objects.update_character")
+    def test_should_run_analytics_for_failed_task(
+        self, requests_mocker, mock_update_character
+    ):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        mock_update_character.side_effect = RuntimeError
+        user = AuthUtils.create_user("Bruce Wayne")
+        character = AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        # when
+        update_character.delay(character.character_id)
+        # then
+        self.assertTrue(mock_update_character.called)
+        self.assertTrue(requests_mocker.called)
+        payload = parse_qs(requests_mocker.last_request.text)
+        self.assertNotEqual(payload["el"], ["Success"])
+
+    @override_settings(ANALYTICS_DISABLED=True)
+    @patch("allianceauth.eveonline.models.EveCharacter.objects.update_character")
+    def test_should_not_run_analytics_for_failed_task(
+        self, requests_mocker, mock_update_character
+    ):
+        # given
+        requests_mocker.post(ANALYTICS_URL)
+        mock_update_character.side_effect = RuntimeError
+        user = AuthUtils.create_user("Bruce Wayne")
+        character = AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        # when
+        update_character.delay(character.character_id)
+        # then
+        self.assertTrue(mock_update_character.called)
+        self.assertFalse(requests_mocker.called)

allianceauth/authentication/admin.py

@@ -1,26 +1,44 @@
 from django.contrib import admin
 from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
-from django.contrib.auth.models import User as BaseUser, \
-    Permission as BasePermission, Group
+from django.contrib.auth.models import Group
+from django.contrib.auth.models import Permission as BasePermission
+from django.contrib.auth.models import User as BaseUser
 from django.db.models import Count, Q
-from allianceauth.services.hooks import ServicesHook
-from django.db.models.signals import pre_save, post_save, pre_delete, \
-    post_delete, m2m_changed
 from django.db.models.functions import Lower
+from django.db.models.signals import (
+    m2m_changed,
+    post_delete,
+    post_save,
+    pre_delete,
+    pre_save
+)
 from django.dispatch import receiver
-from django.forms import ModelForm
-from django.utils.html import format_html
 from django.urls import reverse
+from django.utils.html import format_html
 from django.utils.text import slugify
 
-from allianceauth.authentication.models import State, get_guest_state,\
-    CharacterOwnership, UserProfile, OwnershipRecord
-from allianceauth.hooks import get_hooks
-from allianceauth.eveonline.models import EveCharacter, EveCorporationInfo,\
-    EveAllianceInfo, EveFactionInfo
+from allianceauth.authentication.models import (
+    CharacterOwnership,
+    OwnershipRecord,
+    State,
+    UserProfile,
+    get_guest_state
+)
+from allianceauth.eveonline.models import (
+    EveAllianceInfo,
+    EveCharacter,
+    EveCorporationInfo,
+    EveFactionInfo
+)
 from allianceauth.eveonline.tasks import update_character
-from .app_settings import AUTHENTICATION_ADMIN_USERS_MAX_GROUPS, \
-    AUTHENTICATION_ADMIN_USERS_MAX_CHARS
+from allianceauth.hooks import get_hooks
+from allianceauth.services.hooks import ServicesHook
+
+from .app_settings import (
+    AUTHENTICATION_ADMIN_USERS_MAX_CHARS,
+    AUTHENTICATION_ADMIN_USERS_MAX_GROUPS
+)
+from .forms import UserChangeForm, UserProfileForm
 
 
 def make_service_hooks_update_groups_action(service):
@@ -59,19 +77,10 @@ def make_service_hooks_sync_nickname_action(service):
     return sync_nickname
 
 
-class QuerysetModelForm(ModelForm):
-    # allows specifying FK querysets through kwarg
-    def __init__(self, querysets=None, *args, **kwargs):
-        querysets = querysets or {}
-        super().__init__(*args, **kwargs)
-        for field, qs in querysets.items():
-            self.fields[field].queryset = qs
-
-
 class UserProfileInline(admin.StackedInline):
     model = UserProfile
     readonly_fields = ('state',)
-    form = QuerysetModelForm
+    form = UserProfileForm
     verbose_name = ''
     verbose_name_plural = 'Profile'
 
@@ -99,6 +108,7 @@ class UserProfileInline(admin.StackedInline):
         return False
 
 
+@admin.display(description="")
 def user_profile_pic(obj):
     """profile pic column data for user objects
 
@@ -111,13 +121,10 @@ def user_profile_pic(obj):
             '<img src="{}" class="img-circle">',
             user_obj.profile.main_character.portrait_url(size=32)
         )
-    else:
-        return None
-
-
-user_profile_pic.short_description = ''
+    return None
 
 
+@admin.display(description="user / main", ordering="username")
 def user_username(obj):
     """user column data for user objects
 
@@ -139,18 +146,17 @@ def user_username(obj):
             user_obj.username,
             user_obj.profile.main_character.character_name
         )
-    else:
-        return format_html(
-            '<strong><a href="{}">{}</a></strong>',
-            link,
-            user_obj.username,
-        )
-
-
-user_username.short_description = 'user / main'
-user_username.admin_order_field = 'username'
+    return format_html(
+        '<strong><a href="{}">{}</a></strong>',
+        link,
+        user_obj.username,
+    )
 
 
+@admin.display(
+    description="Corporation / Alliance (Main)",
+    ordering="profile__main_character__corporation_name"
+)
 def user_main_organization(obj):
     """main organization column data for user objects
 
@@ -159,21 +165,15 @@ def user_main_organization(obj):
     """
     user_obj = obj.user if hasattr(obj, 'user') else obj
     if not user_obj.profile.main_character:
-        result = ''
-    else:
-        result = user_obj.profile.main_character.corporation_name
-        if user_obj.profile.main_character.alliance_id:
-            result += f'<br>{user_obj.profile.main_character.alliance_name}'
-        elif user_obj.profile.main_character.faction_name:
-            result += f'<br>{user_obj.profile.main_character.faction_name}'
+        return ''
+    result = user_obj.profile.main_character.corporation_name
+    if user_obj.profile.main_character.alliance_id:
+        result += f'<br>{user_obj.profile.main_character.alliance_name}'
+    elif user_obj.profile.main_character.faction_name:
+        result += f'<br>{user_obj.profile.main_character.faction_name}'
     return format_html(result)
 
 
-user_main_organization.short_description = 'Corporation / Alliance (Main)'
-user_main_organization.admin_order_field = \
-    'profile__main_character__corporation_name'
-
-
 class MainCorporationsFilter(admin.SimpleListFilter):
     """Custom filter to filter on corporations from mains only
 
@@ -196,15 +196,13 @@ class MainCorporationsFilter(admin.SimpleListFilter):
     def queryset(self, request, qs):
         if self.value() is None:
             return qs.all()
-        else:
-            if qs.model == User:
-                return qs.filter(
-                    profile__main_character__corporation_id=self.value()
-                )
-            else:
-                return qs.filter(
-                    user__profile__main_character__corporation_id=self.value()
-                )
+        if qs.model == User:
+            return qs.filter(
+                profile__main_character__corporation_id=self.value()
+            )
+        return qs.filter(
+            user__profile__main_character__corporation_id=self.value()
+        )
 
 
 class MainAllianceFilter(admin.SimpleListFilter):
@@ -217,12 +215,14 @@ class MainAllianceFilter(admin.SimpleListFilter):
     parameter_name = 'main_alliance_id__exact'
 
     def lookups(self, request, model_admin):
-        qs = EveCharacter.objects\
-            .exclude(alliance_id=None)\
-            .exclude(userprofile=None)\
-            .values('alliance_id', 'alliance_name')\
-            .distinct()\
+        qs = (
+            EveCharacter.objects
+            .exclude(alliance_id=None)
+            .exclude(userprofile=None)
+            .values('alliance_id', 'alliance_name')
+            .distinct()
             .order_by(Lower('alliance_name'))
+        )
         return tuple(
             (x['alliance_id'], x['alliance_name']) for x in qs
         )
@@ -230,13 +230,11 @@ class MainAllianceFilter(admin.SimpleListFilter):
     def queryset(self, request, qs):
         if self.value() is None:
             return qs.all()
-        else:
-            if qs.model == User:
-                return qs.filter(profile__main_character__alliance_id=self.value())
-            else:
-                return qs.filter(
-                    user__profile__main_character__alliance_id=self.value()
-                )
+        if qs.model == User:
+            return qs.filter(profile__main_character__alliance_id=self.value())
+        return qs.filter(
+            user__profile__main_character__alliance_id=self.value()
+        )
 
 
 class MainFactionFilter(admin.SimpleListFilter):
@@ -249,12 +247,14 @@ class MainFactionFilter(admin.SimpleListFilter):
     parameter_name = 'main_faction_id__exact'
 
     def lookups(self, request, model_admin):
-        qs = EveCharacter.objects\
-            .exclude(faction_id=None)\
-            .exclude(userprofile=None)\
-            .values('faction_id', 'faction_name')\
-            .distinct()\
+        qs = (
+            EveCharacter.objects
+            .exclude(faction_id=None)
+            .exclude(userprofile=None)
+            .values('faction_id', 'faction_name')
+            .distinct()
             .order_by(Lower('faction_name'))
+        )
         return tuple(
             (x['faction_id'], x['faction_name']) for x in qs
         )
@@ -262,15 +262,14 @@ class MainFactionFilter(admin.SimpleListFilter):
     def queryset(self, request, qs):
         if self.value() is None:
             return qs.all()
-        else:
-            if qs.model == User:
-                return qs.filter(profile__main_character__faction_id=self.value())
-            else:
-                return qs.filter(
-                    user__profile__main_character__faction_id=self.value()
-                )
+        if qs.model == User:
+            return qs.filter(profile__main_character__faction_id=self.value())
+        return qs.filter(
+            user__profile__main_character__faction_id=self.value()
+        )
 
 
+@admin.display(description="Update main character model from ESI")
 def update_main_character_model(modeladmin, request, queryset):
     tasks_count = 0
     for obj in queryset:
@@ -279,21 +278,48 @@ def update_main_character_model(modeladmin, request, queryset):
             tasks_count += 1
 
     modeladmin.message_user(
-        request,
-        f'Update from ESI started for {tasks_count} characters'
+        request, f'Update from ESI started for {tasks_count} characters'
     )
 
 
-update_main_character_model.short_description = \
-    'Update main character model from ESI'
-
-
 class UserAdmin(BaseUserAdmin):
     """Extending Django's UserAdmin model
 
     Behavior of groups and characters columns can be configured via settings
     """
 
+    inlines = BaseUserAdmin.inlines + [UserProfileInline]
+    ordering = ('username', )
+    list_select_related = ('profile__state', 'profile__main_character')
+    show_full_result_count = True
+    list_display = (
+        user_profile_pic,
+        user_username,
+        '_state',
+        '_groups',
+        user_main_organization,
+        '_characters',
+        'is_active',
+        'date_joined',
+        '_role'
+    )
+    list_display_links = None
+    list_filter = (
+        'profile__state',
+        'groups',
+        MainCorporationsFilter,
+        MainAllianceFilter,
+        MainFactionFilter,
+        'is_active',
+        'date_joined',
+        'is_staff',
+        'is_superuser'
+    )
+    search_fields = ('username', 'character_ownerships__character__character_name')
+    readonly_fields = ('date_joined', 'last_login')
+    filter_horizontal = ('groups', 'user_permissions',)
+    form = UserChangeForm
+
     class Media:
         css = {
             "all": ("authentication/css/admin.css",)
@@ -303,9 +329,21 @@ class UserAdmin(BaseUserAdmin):
         qs = super().get_queryset(request)
         return qs.prefetch_related("character_ownerships__character", "groups")
 
-    def get_actions(self, request):
-        actions = super(BaseUserAdmin, self).get_actions(request)
+    def get_form(self, request, obj=None, **kwargs):
+        """Inject current request into change form object."""
 
+        MyForm = super().get_form(request, obj, **kwargs)
+        if obj:
+            class MyFormInjected(MyForm):
+                def __new__(cls, *args, **kwargs):
+                    kwargs['request'] = request
+                    return MyForm(*args, **kwargs)
+
+            return MyFormInjected
+        return MyForm
+
+    def get_actions(self, request):
+        actions = super().get_actions(request)
         actions[update_main_character_model.__name__] = (
             update_main_character_model,
             update_main_character_model.__name__,
@@ -349,38 +387,6 @@ class UserAdmin(BaseUserAdmin):
             )
         return result
 
-    inlines = BaseUserAdmin.inlines + [UserProfileInline]
-    ordering = ('username', )
-    list_select_related = ('profile__state', 'profile__main_character')
-    show_full_result_count = True
-    list_display = (
-        user_profile_pic,
-        user_username,
-        '_state',
-        '_groups',
-        user_main_organization,
-        '_characters',
-        'is_active',
-        'date_joined',
-        '_role'
-    )
-    list_display_links = None
-    list_filter = (
-        'profile__state',
-        'groups',
-        MainCorporationsFilter,
-        MainAllianceFilter,
-        MainFactionFilter,
-        'is_active',
-        'date_joined',
-        'is_staff',
-        'is_superuser'
-    )
-    search_fields = (
-        'username',
-        'character_ownerships__character__character_name'
-    )
-
     def _characters(self, obj):
         character_ownerships = list(obj.character_ownerships.all())
         characters = [obj.character.character_name for obj in character_ownerships]
@@ -389,22 +395,16 @@ class UserAdmin(BaseUserAdmin):
             AUTHENTICATION_ADMIN_USERS_MAX_CHARS
         )
 
-    _characters.short_description = 'characters'
-
+    @admin.display(ordering="profile__state")
     def _state(self, obj):
         return obj.profile.state.name
 
-    _state.short_description = 'state'
-    _state.admin_order_field = 'profile__state'
-
     def _groups(self, obj):
         my_groups = sorted(group.name for group in list(obj.groups.all()))
         return self._list_2_html_w_tooltips(
             my_groups, AUTHENTICATION_ADMIN_USERS_MAX_GROUPS
         )
 
-    _groups.short_description = 'groups'
-
     def _role(self, obj):
         if obj.is_superuser:
             role = 'Superuser'
@@ -414,8 +414,6 @@ class UserAdmin(BaseUserAdmin):
             role = 'User'
         return role
 
-    _role.short_description = 'role'
-
     def has_change_permission(self, request, obj=None):
         return request.user.has_perm('auth.change_user')
 
@@ -425,12 +423,28 @@ class UserAdmin(BaseUserAdmin):
     def has_delete_permission(self, request, obj=None):
         return request.user.has_perm('auth.delete_user')
 
+    def get_object(self, *args , **kwargs):
+        obj = super().get_object(*args , **kwargs)
+        self.obj = obj  # storing current object for use in formfield_for_manytomany
+        return obj
+
     def formfield_for_manytomany(self, db_field, request, **kwargs):
-        """overriding this formfield to have sorted lists in the form"""
         if db_field.name == "groups":
-            kwargs["queryset"] = Group.objects.all().order_by(Lower('name'))
+            groups_qs = Group.objects.filter(authgroup__states__isnull=True)
+            obj_state = self.obj.profile.state
+            if obj_state:
+                matching_groups_qs = Group.objects.filter(authgroup__states=obj_state)
+                groups_qs = groups_qs | matching_groups_qs
+            kwargs["queryset"] = groups_qs.order_by(Lower("name"))
         return super().formfield_for_manytomany(db_field, request, **kwargs)
 
+    def get_readonly_fields(self, request, obj=None):
+        if obj and not request.user.is_superuser:
+            return self.readonly_fields + (
+                "is_staff", "is_superuser", "user_permissions"
+            )
+        return self.readonly_fields
+
 
 @admin.register(State)
 class StateAdmin(admin.ModelAdmin):
@@ -441,10 +455,9 @@ class StateAdmin(admin.ModelAdmin):
         qs = super().get_queryset(request)
         return qs.annotate(user_count=Count("userprofile__id"))
 
+    @admin.display(description="Users", ordering="user_count")
     def _user_count(self, obj):
         return obj.user_count
-    _user_count.short_description = 'Users'
-    _user_count.admin_order_field = 'user_count'
 
     fieldsets = (
         (None, {
@@ -500,13 +513,13 @@ class StateAdmin(admin.ModelAdmin):
             )
         return super().get_fieldsets(request, obj=obj)
 
+    def get_readonly_fields(self, request, obj=None):
+        if not request.user.is_superuser:
+            return self.readonly_fields + ("permissions",)
+        return self.readonly_fields
+
 
 class BaseOwnershipAdmin(admin.ModelAdmin):
-    class Media:
-        css = {
-            "all": ("authentication/css/admin.css",)
-        }
-
     list_select_related = (
         'user__profile__state', 'user__profile__main_character', 'character')
     list_display = (
@@ -527,6 +540,11 @@ class BaseOwnershipAdmin(admin.ModelAdmin):
         MainAllianceFilter,
     )
 
+    class Media:
+        css = {
+            "all": ("authentication/css/admin.css",)
+        }
+
     def get_readonly_fields(self, request, obj=None):
         if obj and obj.pk:
             return 'owner_hash', 'character'

allianceauth/authentication/apps.py

@@ -3,10 +3,14 @@ from django.core.checks import register, Tags
 
 
 class AuthenticationConfig(AppConfig):
-    name = 'allianceauth.authentication'
-    label = 'authentication'
+    name = "allianceauth.authentication"
+    label = "authentication"
 
     def ready(self):
-        super().ready()
-        from allianceauth.authentication import checks, signals
+        from allianceauth.authentication import checks, signals  # noqa: F401
+        from allianceauth.authentication.task_statistics import (
+            signals as celery_signals,
+        )
+
         register(Tags.security)(checks.check_login_scopes_setting)
+        celery_signals.reset_counters()

allianceauth/authentication/forms.py

@@ -1,8 +1,66 @@
 from django import forms
-from django.utils.translation import ugettext_lazy as _
+from django.contrib.auth.forms import UserChangeForm as BaseUserChangeForm
+from django.contrib.auth.models import Group
+from django.core.exceptions import ValidationError
+from django.forms import ModelForm
+from django.utils.translation import gettext_lazy as _
+
 from allianceauth.authentication.models import User
+
+
 class RegistrationForm(forms.Form):
     email = forms.EmailField(label=_('Email'), max_length=254, required=True)
 
     class _meta:
         model = User
+
+
+class UserProfileForm(ModelForm):
+    """Allows specifying FK querysets through kwarg"""
+
+    def __init__(self, querysets=None, *args, **kwargs):
+        querysets = querysets or {}
+        super().__init__(*args, **kwargs)
+        for field, qs in querysets.items():
+            self.fields[field].queryset = qs
+
+
+class UserChangeForm(BaseUserChangeForm):
+    """Add custom cleaning to UserChangeForm"""
+
+    def __init__(self, *args, **kwargs):
+        self.request = kwargs.pop("request")  # Inject current request into form object
+        super().__init__(*args, **kwargs)
+
+    def clean(self):
+        cleaned_data = super().clean()
+        if not self.request.user.is_superuser:
+            if self.instance:
+                current_restricted = set(
+                    self.instance.groups.filter(
+                        authgroup__restricted=True
+                    ).values_list("pk", flat=True)
+                )
+            else:
+                current_restricted = set()
+            new_restricted = set(
+                cleaned_data["groups"].filter(
+                    authgroup__restricted=True
+                ).values_list("pk", flat=True)
+            )
+            if current_restricted != new_restricted:
+                restricted_removed = current_restricted - new_restricted
+                restricted_added = new_restricted - current_restricted
+                restricted_changed = restricted_removed | restricted_added
+                restricted_names_qs = Group.objects.filter(
+                    pk__in=restricted_changed
+                ).values_list("name", flat=True)
+                restricted_names = ",".join(list(restricted_names_qs))
+                raise ValidationError(
+                    {
+                        "groups": _(
+                            "You are not allowed to add or remove these "
+                            "restricted groups: %s" % restricted_names
+                        )
+                    }
+                )

allianceauth/authentication/task_statistics/counters.py

@@ -0,0 +1,40 @@
+from collections import namedtuple
+import datetime as dt
+
+from .event_series import EventSeries
+
+
+"""Global series for counting task events."""
+succeeded_tasks = EventSeries("SUCCEEDED_TASKS")
+retried_tasks = EventSeries("RETRIED_TASKS")
+failed_tasks = EventSeries("FAILED_TASKS")
+
+
+_TaskCounts = namedtuple(
+    "_TaskCounts", ["succeeded", "retried", "failed", "total", "earliest_task", "hours"]
+)
+
+
+def dashboard_results(hours: int) -> _TaskCounts:
+    """Counts of all task events within the given timeframe."""
+
+    def earliest_if_exists(events: EventSeries, earliest: dt.datetime) -> list:
+        my_earliest = events.first_event(earliest=earliest)
+        return [my_earliest] if my_earliest else []
+
+    earliest = dt.datetime.utcnow() - dt.timedelta(hours=hours)
+    earliest_events = list()
+    succeeded_count = succeeded_tasks.count(earliest=earliest)
+    earliest_events += earliest_if_exists(succeeded_tasks, earliest)
+    retried_count = retried_tasks.count(earliest=earliest)
+    earliest_events += earliest_if_exists(retried_tasks, earliest)
+    failed_count = failed_tasks.count(earliest=earliest)
+    earliest_events += earliest_if_exists(failed_tasks, earliest)
+    return _TaskCounts(
+        succeeded=succeeded_count,
+        retried=retried_count,
+        failed=failed_count,
+        total=succeeded_count + retried_count + failed_count,
+        earliest_task=min(earliest_events) if earliest_events else None,
+        hours=hours,
+    )

allianceauth/authentication/task_statistics/event_series.py

@@ -0,0 +1,130 @@
+import datetime as dt
+import logging
+from typing import List, Optional
+
+from pytz import utc
+from redis import Redis, RedisError
+
+from django.core.cache import cache
+
+logger = logging.getLogger(__name__)
+
+
+class _RedisStub:
+    """Stub of a Redis client.
+
+    It's purpose is to prevent EventSeries objects from trying to access Redis
+    when it is not available. e.g. when the Sphinx docs are rendered by readthedocs.org.
+    """
+
+    def delete(self, *args, **kwargs):
+        pass
+
+    def incr(self, *args, **kwargs):
+        return 0
+
+    def zadd(self, *args, **kwargs):
+        pass
+
+    def zcount(self, *args, **kwargs):
+        pass
+
+    def zrangebyscore(self, *args, **kwargs):
+        pass
+
+
+class EventSeries:
+    """API for recording and analyzing a series of events."""
+
+    _ROOT_KEY = "ALLIANCEAUTH_EVENT_SERIES"
+
+    def __init__(self, key_id: str, redis: Redis = None) -> None:
+        self._redis = cache.get_master_client() if not redis else redis
+        try:
+            if not self._redis.ping():
+                raise RuntimeError()
+        except (AttributeError, RedisError, RuntimeError):
+            logger.exception(
+                "Failed to establish a connection with Redis. "
+                "This EventSeries object is disabled.",
+            )
+            self._redis = _RedisStub()
+        self._key_id = str(key_id)
+        self.clear()
+
+    @property
+    def is_disabled(self):
+        """True when this object is disabled, e.g. Redis was not available at startup."""
+        return isinstance(self._redis, _RedisStub)
+
+    @property
+    def _key_counter(self):
+        return f"{self._ROOT_KEY}_{self._key_id}_COUNTER"
+
+    @property
+    def _key_sorted_set(self):
+        return f"{self._ROOT_KEY}_{self._key_id}_SORTED_SET"
+
+    def add(self, event_time: dt.datetime = None) -> None:
+        """Add event.
+
+        Args:
+        - event_time: timestamp of event. Will use current time if not specified.
+        """
+        if not event_time:
+            event_time = dt.datetime.utcnow()
+        id = self._redis.incr(self._key_counter)
+        self._redis.zadd(self._key_sorted_set, {id: event_time.timestamp()})
+
+    def all(self) -> List[dt.datetime]:
+        """List of all known events."""
+        return [
+            event[1]
+            for event in self._redis.zrangebyscore(
+                self._key_sorted_set,
+                "-inf",
+                "+inf",
+                withscores=True,
+                score_cast_func=self._cast_scores_to_dt,
+            )
+        ]
+
+    def clear(self) -> None:
+        """Clear all events."""
+        self._redis.delete(self._key_sorted_set)
+        self._redis.delete(self._key_counter)
+
+    def count(self, earliest: dt.datetime = None, latest: dt.datetime = None) -> int:
+        """Count of events, can be restricted to given timeframe.
+
+        Args:
+        - earliest: Date of first events to count(inclusive), or -infinite if not specified
+        - latest: Date of last events to count(inclusive), or +infinite if not specified
+        """
+        min = "-inf" if not earliest else earliest.timestamp()
+        max = "+inf" if not latest else latest.timestamp()
+        return self._redis.zcount(self._key_sorted_set, min=min, max=max)
+
+    def first_event(self, earliest: dt.datetime = None) -> Optional[dt.datetime]:
+        """Date/Time of first event. Returns `None` if series has no events.
+
+        Args:
+        - earliest: Date of first events to count(inclusive), or any if not specified
+        """
+        min = "-inf" if not earliest else earliest.timestamp()
+        event = self._redis.zrangebyscore(
+            self._key_sorted_set,
+            min,
+            "+inf",
+            withscores=True,
+            start=0,
+            num=1,
+            score_cast_func=self._cast_scores_to_dt,
+        )
+        if not event:
+            return None
+        return event[0][1]
+
+    @staticmethod
+    def _cast_scores_to_dt(score) -> dt.datetime:
+        return dt.datetime.fromtimestamp(float(score), tz=utc)

allianceauth/authentication/task_statistics/signals.py

@@ -0,0 +1,54 @@
+from celery.signals import (
+    task_failure,
+    task_internal_error,
+    task_retry,
+    task_success,
+    worker_ready
+)
+
+from django.conf import settings
+
+from .counters import failed_tasks, retried_tasks, succeeded_tasks
+
+
+def reset_counters():
+    """Reset all counters for the celery status."""
+    succeeded_tasks.clear()
+    failed_tasks.clear()
+    retried_tasks.clear()
+
+
+def is_enabled() -> bool:
+    return not bool(
+        getattr(settings, "ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED", False)
+    )
+
+
+@worker_ready.connect
+def reset_counters_when_celery_restarted(*args, **kwargs):
+    if is_enabled():
+        reset_counters()
+
+
+@task_success.connect
+def record_task_succeeded(*args, **kwargs):
+    if is_enabled():
+        succeeded_tasks.add()
+
+
+@task_retry.connect
+def record_task_retried(*args, **kwargs):
+    if is_enabled():
+        retried_tasks.add()
+
+
+@task_failure.connect
+def record_task_failed(*args, **kwargs):
+    if is_enabled():
+        failed_tasks.add()
+
+
+@task_internal_error.connect
+def record_task_internal_error(*args, **kwargs):
+    if is_enabled():
+        failed_tasks.add()

allianceauth/authentication/task_statistics/tests/test_counters.py

@@ -0,0 +1,51 @@
+import datetime as dt
+
+from django.test import TestCase
+from django.utils.timezone import now
+
+from allianceauth.authentication.task_statistics.counters import (
+    dashboard_results,
+    succeeded_tasks,
+    retried_tasks,
+    failed_tasks,
+)
+
+
+class TestDashboardResults(TestCase):
+    def test_should_return_counts_for_given_timeframe_only(self):
+        # given
+        earliest_task = now() - dt.timedelta(minutes=15)
+        succeeded_tasks.clear()
+        succeeded_tasks.add(now() - dt.timedelta(hours=1, seconds=1))
+        succeeded_tasks.add(earliest_task)
+        succeeded_tasks.add()
+        succeeded_tasks.add()
+        retried_tasks.clear()
+        retried_tasks.add(now() - dt.timedelta(hours=1, seconds=1))
+        retried_tasks.add(now() - dt.timedelta(seconds=30))
+        retried_tasks.add()
+        failed_tasks.clear()
+        failed_tasks.add(now() - dt.timedelta(hours=1, seconds=1))
+        failed_tasks.add()
+        # when
+        results = dashboard_results(hours=1)
+        # then
+        self.assertEqual(results.succeeded, 3)
+        self.assertEqual(results.retried, 2)
+        self.assertEqual(results.failed, 1)
+        self.assertEqual(results.total, 6)
+        self.assertEqual(results.earliest_task, earliest_task)
+
+    def test_should_work_with_no_data(self):
+        # given
+        succeeded_tasks.clear()
+        retried_tasks.clear()
+        failed_tasks.clear()
+        # when
+        results = dashboard_results(hours=1)
+        # then
+        self.assertEqual(results.succeeded, 0)
+        self.assertEqual(results.retried, 0)
+        self.assertEqual(results.failed, 0)
+        self.assertEqual(results.total, 0)
+        self.assertIsNone(results.earliest_task)

allianceauth/authentication/task_statistics/tests/test_event_series.py

@@ -0,0 +1,168 @@
+import datetime as dt
+from unittest.mock import patch
+
+from pytz import utc
+from redis import RedisError
+
+from django.test import TestCase
+from django.utils.timezone import now
+
+from allianceauth.authentication.task_statistics.event_series import (
+    EventSeries,
+    _RedisStub,
+)
+
+MODULE_PATH = "allianceauth.authentication.task_statistics.event_series"
+
+
+class TestEventSeries(TestCase):
+    def test_should_abort_without_redis_client(self):
+        # when
+        with patch(MODULE_PATH + ".cache.get_master_client") as mock:
+            mock.return_value = None
+            events = EventSeries("dummy")
+        # then
+        self.assertTrue(events._redis, _RedisStub)
+        self.assertTrue(events.is_disabled)
+
+    def test_should_disable_itself_if_redis_not_available_1(self):
+        # when
+        with patch(MODULE_PATH + ".cache.get_master_client") as mock_get_master_client:
+            mock_get_master_client.return_value.ping.side_effect = RedisError
+            events = EventSeries("dummy")
+        # then
+        self.assertIsInstance(events._redis, _RedisStub)
+        self.assertTrue(events.is_disabled)
+
+    def test_should_disable_itself_if_redis_not_available_2(self):
+        # when
+        with patch(MODULE_PATH + ".cache.get_master_client") as mock_get_master_client:
+            mock_get_master_client.return_value.ping.return_value = False
+            events = EventSeries("dummy")
+        # then
+        self.assertIsInstance(events._redis, _RedisStub)
+        self.assertTrue(events.is_disabled)
+
+    def test_should_add_event(self):
+        # given
+        events = EventSeries("dummy")
+        # when
+        events.add()
+        # then
+        result = events.all()
+        self.assertEqual(len(result), 1)
+        self.assertAlmostEqual(result[0], now(), delta=dt.timedelta(seconds=30))
+
+    def test_should_add_event_with_specified_time(self):
+        # given
+        events = EventSeries("dummy")
+        my_time = dt.datetime(2021, 11, 1, 12, 15, tzinfo=utc)
+        # when
+        events.add(my_time)
+        # then
+        result = events.all()
+        self.assertEqual(len(result), 1)
+        self.assertAlmostEqual(result[0], my_time, delta=dt.timedelta(seconds=30))
+
+    def test_should_count_events(self):
+        # given
+        events = EventSeries("dummy")
+        events.add()
+        events.add()
+        # when
+        result = events.count()
+        # then
+        self.assertEqual(result, 2)
+
+    def test_should_count_zero(self):
+        # given
+        events = EventSeries("dummy")
+        # when
+        result = events.count()
+        # then
+        self.assertEqual(result, 0)
+
+    def test_should_count_events_within_timeframe_1(self):
+        # given
+        events = EventSeries("dummy")
+        events.add(dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 15, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 30, tzinfo=utc))
+        # when
+        result = events.count(
+            earliest=dt.datetime(2021, 12, 1, 12, 8, tzinfo=utc),
+            latest=dt.datetime(2021, 12, 1, 12, 17, tzinfo=utc),
+        )
+        # then
+        self.assertEqual(result, 2)
+
+    def test_should_count_events_within_timeframe_2(self):
+        # given
+        events = EventSeries("dummy")
+        events.add(dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 15, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 30, tzinfo=utc))
+        # when
+        result = events.count(earliest=dt.datetime(2021, 12, 1, 12, 8))
+        # then
+        self.assertEqual(result, 3)
+
+    def test_should_count_events_within_timeframe_3(self):
+        # given
+        events = EventSeries("dummy")
+        events.add(dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 15, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 30, tzinfo=utc))
+        # when
+        result = events.count(latest=dt.datetime(2021, 12, 1, 12, 12))
+        # then
+        self.assertEqual(result, 2)
+
+    def test_should_clear_events(self):
+        # given
+        events = EventSeries("dummy")
+        events.add()
+        events.add()
+        # when
+        events.clear()
+        # then
+        self.assertEqual(events.count(), 0)
+
+    def test_should_return_date_of_first_event(self):
+        # given
+        events = EventSeries("dummy")
+        events.add(dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 15, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 30, tzinfo=utc))
+        # when
+        result = events.first_event()
+        # then
+        self.assertEqual(result, dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+
+    def test_should_return_date_of_first_event_with_range(self):
+        # given
+        events = EventSeries("dummy")
+        events.add(dt.datetime(2021, 12, 1, 12, 0, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 15, tzinfo=utc))
+        events.add(dt.datetime(2021, 12, 1, 12, 30, tzinfo=utc))
+        # when
+        result = events.first_event(
+            earliest=dt.datetime(2021, 12, 1, 12, 8, tzinfo=utc)
+        )
+        # then
+        self.assertEqual(result, dt.datetime(2021, 12, 1, 12, 10, tzinfo=utc))
+
+    def test_should_return_all_events(self):
+        # given
+        events = EventSeries("dummy")
+        events.add()
+        events.add()
+        # when
+        results = events.all()
+        # then
+        self.assertEqual(len(results), 2)

allianceauth/authentication/task_statistics/tests/test_signals.py

@@ -0,0 +1,93 @@
+from unittest.mock import patch
+
+from celery.exceptions import Retry
+
+from django.test import TestCase, override_settings
+
+from allianceauth.authentication.task_statistics.counters import (
+    failed_tasks,
+    retried_tasks,
+    succeeded_tasks,
+)
+from allianceauth.authentication.task_statistics.signals import (
+    reset_counters,
+    is_enabled,
+)
+from allianceauth.eveonline.tasks import update_character
+
+
+@override_settings(
+    CELERY_ALWAYS_EAGER=True,ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED=False
+)
+class TestTaskSignals(TestCase):
+    fixtures = ["disable_analytics"]
+
+    def test_should_record_successful_task(self):
+        # given
+        succeeded_tasks.clear()
+        retried_tasks.clear()
+        failed_tasks.clear()
+        # when
+        with patch(
+            "allianceauth.eveonline.tasks.EveCharacter.objects.update_character"
+        ) as mock_update:
+            mock_update.return_value = None
+            update_character.delay(1)
+        # then
+        self.assertEqual(succeeded_tasks.count(), 1)
+        self.assertEqual(retried_tasks.count(), 0)
+        self.assertEqual(failed_tasks.count(), 0)
+
+    def test_should_record_retried_task(self):
+        # given
+        succeeded_tasks.clear()
+        retried_tasks.clear()
+        failed_tasks.clear()
+        # when
+        with patch(
+            "allianceauth.eveonline.tasks.EveCharacter.objects.update_character"
+        ) as mock_update:
+            mock_update.side_effect = Retry
+            update_character.delay(1)
+        # then
+        self.assertEqual(succeeded_tasks.count(), 0)
+        self.assertEqual(failed_tasks.count(), 0)
+        self.assertEqual(retried_tasks.count(), 1)
+
+    def test_should_record_failed_task(self):
+        # given
+        succeeded_tasks.clear()
+        retried_tasks.clear()
+        failed_tasks.clear()
+        # when
+        with patch(
+            "allianceauth.eveonline.tasks.EveCharacter.objects.update_character"
+        ) as mock_update:
+            mock_update.side_effect = RuntimeError
+            update_character.delay(1)
+        # then
+        self.assertEqual(succeeded_tasks.count(), 0)
+        self.assertEqual(retried_tasks.count(), 0)
+        self.assertEqual(failed_tasks.count(), 1)
+
+    def test_should_reset_counters(self):
+        # given
+        succeeded_tasks.add()
+        retried_tasks.add()
+        failed_tasks.add()
+        # when
+        reset_counters()
+        # then
+        self.assertEqual(succeeded_tasks.count(), 0)
+        self.assertEqual(retried_tasks.count(), 0)
+        self.assertEqual(failed_tasks.count(), 0)
+
+
+class TestIsEnabled(TestCase):
+    @override_settings(ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED=False)
+    def test_enabled(self):
+        self.assertTrue(is_enabled())
+
+    @override_settings(ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED=True)
+    def test_disabled(self):
+        self.assertFalse(is_enabled())

allianceauth/authentication/tests/test_admin.py

@@ -1,6 +1,9 @@
+from bs4 import BeautifulSoup
 from urllib.parse import quote
 from unittest.mock import patch, MagicMock
 
+from django_webtest import WebTest
+
 from django.contrib.admin.sites import AdminSite
 from django.contrib.auth.models import Group
 from django.test import TestCase, RequestFactory, Client
@@ -188,7 +191,7 @@ class TestCaseWithTestData(TestCase):
             corporation_id=5432,
             corporation_name="Xavier's School for Gifted Youngsters",
             corporation_ticker='MUTNT',
-            alliance_id = None,
+            alliance_id=None,
             faction_id=999,
             faction_name='The X-Men',
         )
@@ -206,6 +209,7 @@ class TestCaseWithTestData(TestCase):
         cls.user_4.profile.save()
         EveFactionInfo.objects.create(faction_id=999, faction_name='The X-Men')
 
+
 def make_generic_search_request(ModelClass: type, search_term: str):
     User.objects.create_superuser(
         username='superuser', password='secret', email='admin@example.com'
@@ -218,6 +222,7 @@ def make_generic_search_request(ModelClass: type, search_term: str):
 
 
 class TestCharacterOwnershipAdmin(TestCaseWithTestData):
+    fixtures = ["disable_analytics"]
 
     def setUp(self):
         self.modeladmin = CharacterOwnershipAdmin(
@@ -244,6 +249,7 @@ class TestCharacterOwnershipAdmin(TestCaseWithTestData):
 
 
 class TestOwnershipRecordAdmin(TestCaseWithTestData):
+    fixtures = ["disable_analytics"]
 
     def setUp(self):
         self.modeladmin = OwnershipRecordAdmin(
@@ -270,11 +276,12 @@ class TestOwnershipRecordAdmin(TestCaseWithTestData):
 
 
 class TestStateAdmin(TestCaseWithTestData):
+    fixtures = ["disable_analytics"]
 
-    def setUp(self):
-        self.modeladmin = StateAdmin(
-            model=User, admin_site=AdminSite()
-        )
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.modeladmin = StateAdmin(model=User, admin_site=AdminSite())
 
     def test_change_view_loads_normally(self):
         User.objects.create_superuser(
@@ -299,6 +306,7 @@ class TestStateAdmin(TestCaseWithTestData):
 
 
 class TestUserAdmin(TestCaseWithTestData):
+    fixtures = ["disable_analytics"]
 
     def setUp(self):
         self.factory = RequestFactory()
@@ -344,7 +352,7 @@ class TestUserAdmin(TestCaseWithTestData):
         self.assertEqual(user_main_organization(self.user_3), expected)
 
     def test_user_main_organization_u4(self):
-        expected="Xavier's School for Gifted Youngsters<br>The X-Men"
+        expected = "Xavier's School for Gifted Youngsters<br>The X-Men"
         self.assertEqual(user_main_organization(self.user_4), expected)
 
     def test_characters_u1(self):
@@ -537,6 +545,229 @@ class TestUserAdmin(TestCaseWithTestData):
         self.assertEqual(response.status_code, expected)
 
 
+class TestStateAdminChangeFormSuperuserExclusiveEdits(WebTest):
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.super_admin = User.objects.create_superuser("super_admin")
+        cls.staff_admin = User.objects.create_user("staff_admin")
+        cls.staff_admin.is_staff = True
+        cls.staff_admin.save()
+        cls.staff_admin = AuthUtils.add_permissions_to_user_by_name(
+            [
+                "authentication.add_state",
+                "authentication.change_state",
+                "authentication.view_state",
+            ],
+            cls.staff_admin
+        )
+        cls.superuser_exclusive_fields = ["permissions",]
+
+    def test_should_show_all_fields_to_superuser_for_add(self):
+        # given
+        self.app.set_user(self.super_admin)
+        page = self.app.get("/admin/authentication/state/add/")
+        # when
+        form = page.forms["state_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertIn(field, form.fields)
+
+    def test_should_not_show_all_fields_to_staff_admins_for_add(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        page = self.app.get("/admin/authentication/state/add/")
+        # when
+        form = page.forms["state_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertNotIn(field, form.fields)
+
+    def test_should_show_all_fields_to_superuser_for_change(self):
+        # given
+        self.app.set_user(self.super_admin)
+        state = AuthUtils.get_member_state()
+        page = self.app.get(f"/admin/authentication/state/{state.pk}/change/")
+        # when
+        form = page.forms["state_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertIn(field, form.fields)
+
+    def test_should_not_show_all_fields_to_staff_admin_for_change(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        state = AuthUtils.get_member_state()
+        page = self.app.get(f"/admin/authentication/state/{state.pk}/change/")
+        # when
+        form = page.forms["state_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertNotIn(field, form.fields)
+
+
+class TestUserAdminChangeForm(TestCase):
+    fixtures = ["disable_analytics"]
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.modeladmin = UserAdmin(model=User, admin_site=AdminSite())
+
+    def test_should_show_groups_available_to_user_with_blue_state_only(self):
+        # given
+        superuser = User.objects.create_superuser("Super")
+        user = AuthUtils.create_user("bruce_wayne")
+        character = AuthUtils.add_main_character_2(
+            user,
+            name="Bruce Wayne",
+            character_id=1001,
+            corp_id=2001,
+            corp_name="Wayne Technologies"
+        )
+        blue_state = State.objects.get(name="Blue")
+        blue_state.member_characters.add(character)
+        member_state = AuthUtils.get_member_state()
+        group_1 = Group.objects.create(name="Group 1")
+        group_2 = Group.objects.create(name="Group 2")
+        group_2.authgroup.states.add(blue_state)
+        group_3 = Group.objects.create(name="Group 3")
+        group_3.authgroup.states.add(member_state)
+        self.client.force_login(superuser)
+        # when
+        response = self.client.get(f"/admin/authentication/user/{user.pk}/change/")
+        # then
+        self.assertEqual(response.status_code, 200)
+        soup = BeautifulSoup(response.rendered_content, features="html.parser")
+        groups_select = soup.find("select", {"id": "id_groups"}).find_all('option')
+        group_ids = {int(option["value"]) for option in groups_select}
+        self.assertSetEqual(group_ids, {group_1.pk, group_2.pk})
+
+
+class TestUserAdminChangeFormSuperuserExclusiveEdits(WebTest):
+    fixtures = ["disable_analytics"]
+
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.super_admin = User.objects.create_superuser("super_admin")
+        cls.staff_admin = User.objects.create_user("staff_admin")
+        cls.staff_admin.is_staff = True
+        cls.staff_admin.save()
+        cls.staff_admin = AuthUtils.add_permissions_to_user_by_name(
+            [
+                "auth.change_user",
+                "auth.view_user",
+                "authentication.change_user",
+                "authentication.change_userprofile",
+                "authentication.view_user"
+            ],
+            cls.staff_admin
+        )
+        cls.superuser_exclusive_fields = [
+            "is_staff", "is_superuser", "user_permissions"
+        ]
+
+    def setUp(self) -> None:
+        self.user = AuthUtils.create_user("bruce_wayne")
+
+    def test_should_show_all_fields_to_superuser_for_change(self):
+        # given
+        self.app.set_user(self.super_admin)
+
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        # when
+        form = page.forms["user_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertIn(field, form.fields)
+
+    def test_should_not_show_all_fields_to_staff_admin_for_change(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        # when
+        form = page.forms["user_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertNotIn(field, form.fields)
+
+    def test_should_allow_super_admin_to_add_restricted_group_to_user(self):
+        # given
+        self.app.set_user(self.super_admin)
+        group_restricted = Group.objects.create(name="restricted group")
+        group_restricted.authgroup.restricted = True
+        group_restricted.authgroup.save()
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        form = page.forms["user_form"]
+        # when
+        form["groups"].select_multiple(texts=["restricted group"])
+        response = form.submit("save")
+        # then
+        self.assertEqual(response.status_code, 302)
+        self.user.refresh_from_db()
+        self.assertIn(
+            "restricted group", self.user.groups.values_list("name", flat=True)
+        )
+
+    def test_should_not_allow_staff_admin_to_add_restricted_group_to_user(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        group_restricted = Group.objects.create(name="restricted group")
+        group_restricted.authgroup.restricted = True
+        group_restricted.authgroup.save()
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        form = page.forms["user_form"]
+        # when
+        form["groups"].select_multiple(texts=["restricted group"])
+        response = form.submit("save")
+        # then
+        self.assertEqual(response.status_code, 200)
+        self.assertIn(
+            "You are not allowed to add or remove these restricted groups",
+            response.text
+        )
+
+    def test_should_not_allow_staff_admin_to_remove_restricted_group_from_user(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        group_restricted = Group.objects.create(name="restricted group")
+        group_restricted.authgroup.restricted = True
+        group_restricted.authgroup.save()
+        self.user.groups.add(group_restricted)
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        form = page.forms["user_form"]
+        # when
+        form["groups"].select_multiple(texts=[])
+        response = form.submit("save")
+        # then
+        self.assertEqual(response.status_code, 200)
+        self.assertIn(
+            "You are not allowed to add or remove these restricted groups",
+            response.text
+        )
+
+    def test_should_allow_staff_admin_to_add_normal_group_to_user(self):
+        # given
+        self.app.set_user(self.super_admin)
+        Group.objects.create(name="normal group")
+        page = self.app.get(f"/admin/authentication/user/{self.user.pk}/change/")
+        form = page.forms["user_form"]
+        # when
+        form["groups"].select_multiple(texts=["normal group"])
+        response = form.submit("save")
+        # then
+        self.assertEqual(response.status_code, 302)
+        self.user.refresh_from_db()
+        self.assertIn("normal group", self.user.groups.values_list("name", flat=True))
+
+
 class TestMakeServicesHooksActions(TestCaseWithTestData):
 
     class MyServicesHookTypeA(ServicesHook):

allianceauth/authentication/tests/test_templatetags.py

@@ -55,7 +55,6 @@ TEST_VERSION = '2.6.5'
 
 
 class TestStatusOverviewTag(TestCase):
-
     @patch(MODULE_PATH + '.admin_status.__version__', TEST_VERSION)
     @patch(MODULE_PATH + '.admin_status._fetch_celery_queue_length')
     @patch(MODULE_PATH + '.admin_status._current_version_summary')
@@ -66,6 +65,7 @@ class TestStatusOverviewTag(TestCase):
         mock_current_version_info,
         mock_fetch_celery_queue_length
     ):
+        # given
         notifications = {
             'notifications': GITHUB_NOTIFICATION_ISSUES[:5]
         }
@@ -83,22 +83,20 @@ class TestStatusOverviewTag(TestCase):
         }
         mock_current_version_info.return_value = version_info
         mock_fetch_celery_queue_length.return_value = 3
-
+        # when
         result = status_overview()
-        expected = {
-            'notifications': GITHUB_NOTIFICATION_ISSUES[:5],
-            'latest_major': True,
-            'latest_minor': True,
-            'latest_patch': True,
-            'latest_beta': False,
-            'current_version': TEST_VERSION,
-            'latest_major_version': '2.4.5',
-            'latest_minor_version': '2.4.0',
-            'latest_patch_version': '2.4.5',
-            'latest_beta_version': '2.4.4a1',
-            'task_queue_length': 3,
-        }
-        self.assertEqual(result, expected)
+        # then
+        self.assertEqual(result["notifications"], GITHUB_NOTIFICATION_ISSUES[:5])
+        self.assertTrue(result["latest_major"])
+        self.assertTrue(result["latest_minor"])
+        self.assertTrue(result["latest_patch"])
+        self.assertFalse(result["latest_beta"])
+        self.assertEqual(result["current_version"], TEST_VERSION)
+        self.assertEqual(result["latest_major_version"], '2.4.5')
+        self.assertEqual(result["latest_minor_version"], '2.4.0')
+        self.assertEqual(result["latest_patch_version"], '2.4.5')
+        self.assertEqual(result["latest_beta_version"], '2.4.4a1')
+        self.assertEqual(result["task_queue_length"], 3)
 
 
 class TestNotifications(TestCase):

allianceauth/corputils/templates/corputils/corpstats.html

@@ -193,6 +193,8 @@
             "columnDefs": [
                 { "sortable": false, "targets": [1] },
             ],
+            "stateSave": true,
+            "stateDuration": 0
         });
         $('#table-members').DataTable({
             "columnDefs": [
@@ -200,6 +202,8 @@
                 { "sortable": false, "targets": [0, 2] },
             ],
             "order": [[ 1, "asc" ]],
+            "stateSave": true,
+            "stateDuration": 0
         });
         $('#table-unregistered').DataTable({
             "columnDefs": [
@@ -207,6 +211,8 @@
                 { "sortable": false, "targets": [0, 2] },
             ],
             "order": [[ 1, "asc" ]],
+            "stateSave": true,
+            "stateDuration": 0
         });
 
     });

allianceauth/corputils/templates/corputils/search.html

@@ -43,6 +43,9 @@
 {% endblock %}
 {% block extra_script %}
     $(document).ready(function(){
-        $('#table-search').DataTable();
+        $('#table-search').DataTable({
+            "stateSave": true,
+            "stateDuration": 0
+        });
     });
 {% endblock %}

allianceauth/eveonline/models.py

@@ -1,13 +1,27 @@
-from django.db import models
+import logging
 from typing import Union
 
-from .managers import EveCharacterManager, EveCharacterProviderManager
-from .managers import EveCorporationManager, EveCorporationProviderManager
-from .managers import EveAllianceManager, EveAllianceProviderManager
+from django.core.exceptions import ObjectDoesNotExist
+from django.db import models
+from esi.models import Token
+
+from allianceauth.notifications import notify
+
 from . import providers
 from .evelinks import eveimageserver
+from .managers import (
+    EveAllianceManager,
+    EveAllianceProviderManager,
+    EveCharacterManager,
+    EveCharacterProviderManager,
+    EveCorporationManager,
+    EveCorporationProviderManager,
+)
+
+logger = logging.getLogger(__name__)
 
 _DEFAULT_IMAGE_SIZE = 32
+DOOMHEIM_CORPORATION_ID = 1000001
 
 
 class EveFactionInfo(models.Model):
@@ -68,13 +82,12 @@ class EveAllianceInfo(models.Model):
         for corp_id in alliance.corp_ids:
             if not EveCorporationInfo.objects.filter(corporation_id=corp_id).exists():
                 EveCorporationInfo.objects.create_corporation(corp_id)
-        EveCorporationInfo.objects.filter(
-            corporation_id__in=alliance.corp_ids).update(alliance=self
+        EveCorporationInfo.objects.filter(corporation_id__in=alliance.corp_ids).update(
+            alliance=self
         )
-        EveCorporationInfo.objects\
-            .filter(alliance=self)\
-            .exclude(corporation_id__in=alliance.corp_ids)\
-            .update(alliance=None)
+        EveCorporationInfo.objects.filter(alliance=self).exclude(
+            corporation_id__in=alliance.corp_ids
+        ).update(alliance=None)
 
     def update_alliance(self, alliance: providers.Alliance = None):
         if alliance is None:
@@ -182,6 +195,7 @@ class EveCorporationInfo(models.Model):
 
 
 class EveCharacter(models.Model):
+    """Character in Eve Online"""
     character_id = models.PositiveIntegerField(unique=True)
     character_name = models.CharField(max_length=254, unique=True)
     corporation_id = models.PositiveIntegerField()
@@ -198,12 +212,20 @@ class EveCharacter(models.Model):
 
     class Meta:
         indexes = [
-                    models.Index(fields=['corporation_id',]),
-                    models.Index(fields=['alliance_id',]),
-                    models.Index(fields=['corporation_name',]),
-                    models.Index(fields=['alliance_name',]),
-                    models.Index(fields=['faction_id',]),
-                  ]
+            models.Index(fields=['corporation_id',]),
+            models.Index(fields=['alliance_id',]),
+            models.Index(fields=['corporation_name',]),
+            models.Index(fields=['alliance_name',]),
+            models.Index(fields=['faction_id',]),
+        ]
+
+    def __str__(self):
+        return self.character_name
+
+    @property
+    def is_biomassed(self) -> bool:
+        """Whether this character is dead or not."""
+        return self.corporation_id == DOOMHEIM_CORPORATION_ID
 
     @property
     def alliance(self) -> Union[EveAllianceInfo, None]:
@@ -249,10 +271,36 @@ class EveCharacter(models.Model):
         self.faction_id = character.faction.id
         self.faction_name = character.faction.name
         self.save()
+        if self.is_biomassed:
+            self._remove_tokens_of_biomassed_character()
         return self
 
-    def __str__(self):
-        return self.character_name
+    def _remove_tokens_of_biomassed_character(self) -> None:
+        """Remove tokens of this biomassed character."""
+        try:
+            user = self.character_ownership.user
+        except ObjectDoesNotExist:
+            return
+        tokens_to_delete = Token.objects.filter(character_id=self.character_id)
+        tokens_count = tokens_to_delete.count()
+        if not tokens_count:
+            return
+        tokens_to_delete.delete()
+        logger.info(
+            "%d tokens from user %s for biomassed character %s [id:%s] deleted.",
+            tokens_count,
+            user,
+            self,
+            self.character_id,
+        )
+        notify(
+            user=user,
+            title=f"Character {self} biomassed",
+            message=(
+                f"Your former character {self} has been biomassed "
+                "and has been removed from the list of your alts."
+            )
+        )
 
     @staticmethod
     def generic_portrait_url(
@@ -336,7 +384,6 @@ class EveCharacter(models.Model):
         """image URL for alliance of this character or empty string"""
         return self.alliance_logo_url(256)
 
-
     def faction_logo_url(self, size=_DEFAULT_IMAGE_SIZE) -> str:
         """image URL for alliance of this character or empty string"""
         if self.faction_id:

allianceauth/eveonline/providers.py

@@ -13,17 +13,18 @@ from allianceauth import __version__
 SWAGGER_SPEC_PATH = os.path.join(os.path.dirname(
     os.path.abspath(__file__)), 'swagger.json'
 )
-"""
-Swagger spec operations:
 
-get_alliances_alliance_id
-get_alliances_alliance_id_corporations
-get_corporations_corporation_id
-get_characters_character_id
-get_universe_types_type_id
-post_character_affiliation
-get_universe_factions
-"""
+# for the love of Bob please add operations you use here. I'm tired of breaking undocumented things.
+ESI_OPERATIONS=[
+    'get_alliances_alliance_id',
+    'get_alliances_alliance_id_corporations',
+    'get_corporations_corporation_id',
+    'get_characters_character_id',
+    'post_characters_affiliation',
+    'get_universe_types_type_id',
+    'get_universe_factions',
+    'post_universe_names',
+]
 
 
 logger = logging.getLogger(__name__)
@@ -169,7 +170,7 @@ class EveProvider:
         """
         :return: an ItemType object for the given ID
         """
-        raise NotImplemented()
+        raise NotImplementedError()
 
 
 class EveSwaggerProvider(EveProvider):
@@ -206,7 +207,8 @@ class EveSwaggerProvider(EveProvider):
     def __str__(self):
         return 'esi'
 
-    def get_alliance(self, alliance_id):
+    def get_alliance(self, alliance_id: int) -> Alliance:
+        """Fetch alliance from ESI."""
         try:
             data = self.client.Alliance.get_alliances_alliance_id(alliance_id=alliance_id).result()
             corps = self.client.Alliance.get_alliances_alliance_id_corporations(alliance_id=alliance_id).result()
@@ -222,7 +224,8 @@ class EveSwaggerProvider(EveProvider):
         except HTTPNotFound:
             raise ObjectNotFound(alliance_id, 'alliance')
 
-    def get_corp(self, corp_id):
+    def get_corp(self, corp_id: int) -> Corporation:
+        """Fetch corporation from ESI."""
         try:
             data = self.client.Corporation.get_corporations_corporation_id(corporation_id=corp_id).result()
             model = Corporation(
@@ -238,29 +241,43 @@ class EveSwaggerProvider(EveProvider):
         except HTTPNotFound:
             raise ObjectNotFound(corp_id, 'corporation')
 
-    def get_character(self, character_id):
+    def get_character(self, character_id: int) -> Character:
+        """Fetch character from ESI."""
         try:
-            data = self.client.Character.get_characters_character_id(character_id=character_id).result()
+            character_name = self._fetch_character_name(character_id)
             affiliation = self.client.Character.post_characters_affiliation(characters=[character_id]).result()[0]
-
             model = Character(
                 id=character_id,
-                name=data['name'],
+                name=character_name,
                 corp_id=affiliation['corporation_id'],
                 alliance_id=affiliation['alliance_id'] if 'alliance_id' in affiliation else None,
                 faction_id=affiliation['faction_id'] if 'faction_id' in affiliation else None,
             )
             return model
-        except (HTTPNotFound, HTTPUnprocessableEntity):
+        except (HTTPNotFound, HTTPUnprocessableEntity, ObjectNotFound):
             raise ObjectNotFound(character_id, 'character')
 
+    def _fetch_character_name(self, character_id: int) -> str:
+        """Fetch character name from ESI."""
+        data = self.client.Universe.post_universe_names(ids=[character_id]).result()
+        character = data.pop() if data else None
+        if (
+            not character
+            or character["category"] != "character"
+            or character["id"] != character_id
+        ):
+            raise ObjectNotFound(character_id, 'character')
+        return character["name"]
+
     def get_all_factions(self):
+        """Fetch all factions from ESI."""
         if not self._faction_list:
             self._faction_list = self.client.Universe.get_universe_factions().result()
         return self._faction_list
 
-    def get_faction(self, faction_id):
-        faction_id=int(faction_id)
+    def get_faction(self, faction_id: int):
+        """Fetch faction from ESI."""
+        faction_id = int(faction_id)
         try:
             if not self._faction_list:
                 _ = self.get_all_factions()
@@ -272,7 +289,8 @@ class EveSwaggerProvider(EveProvider):
         except (HTTPNotFound, HTTPUnprocessableEntity, KeyError):
             raise ObjectNotFound(faction_id, 'faction')
 
-    def get_itemtype(self, type_id):
+    def get_itemtype(self, type_id: int) -> ItemType:
+        """Fetch inventory item from ESI."""
         try:
             data = self.client.Universe.get_universe_types_type_id(type_id=type_id).result()
             return ItemType(id=type_id, name=data['name'])

allianceauth/eveonline/tasks.py

@@ -1,12 +1,11 @@
 import logging
 
 from celery import shared_task
-from .models import EveAllianceInfo
-from .models import EveCharacter
-from .models import EveCorporationInfo
 
+from .models import EveAllianceInfo, EveCharacter, EveCorporationInfo
 from . import providers
 
+
 logger = logging.getLogger(__name__)
 
 TASK_PRIORITY = 7
@@ -32,8 +31,8 @@ def update_alliance(alliance_id):
 
 
 @shared_task
-def update_character(character_id):
-    """Update given character from ESI"""
+def update_character(character_id: int) -> None:
+    """Update given character from ESI."""
     EveCharacter.objects.update_character(character_id)
 
 
@@ -65,17 +64,17 @@ def update_character_chunk(character_ids_chunk: list):
             .post_characters_affiliation(characters=character_ids_chunk).result()
         character_names = providers.provider.client.Universe\
             .post_universe_names(ids=character_ids_chunk).result()
-    except:
+    except OSError:
         logger.info("Failed to bulk update characters. Attempting single updates")
         for character_id in character_ids_chunk:
             update_character.apply_async(
-                        args=[character_id], priority=TASK_PRIORITY
-                    )
+                args=[character_id], priority=TASK_PRIORITY
+            )
         return
 
     affiliations = {
-            affiliation.get('character_id'): affiliation
-            for affiliation in affiliations_raw
+        affiliation.get('character_id'): affiliation
+        for affiliation in affiliations_raw
     }
     # add character names to affiliations
     for character in character_names:
@@ -108,5 +107,5 @@ def update_character_chunk(character_ids_chunk: list):
 
             if corp_changed or alliance_changed or name_changed:
                 update_character.apply_async(
-                        args=[character.get('character_id')], priority=TASK_PRIORITY
-                    )
+                    args=[character.get('character_id')], priority=TASK_PRIORITY
+                )

allianceauth/eveonline/tests/esi_client_stub.py

@@ -0,0 +1,168 @@
+from bravado.exception import HTTPNotFound
+
+
+class BravadoResponseStub:
+    """Stub for IncomingResponse in bravado, e.g. for HTTPError exceptions"""
+
+    def __init__(
+        self, status_code, reason="", text="", headers=None, raw_bytes=None
+    ) -> None:
+        self.reason = reason
+        self.status_code = status_code
+        self.text = text
+        self.headers = headers if headers else dict()
+        self.raw_bytes = raw_bytes
+
+    def __str__(self):
+        return f"{self.status_code} {self.reason}"
+
+
+class BravadoOperationStub:
+    """Stub to simulate the operation object return from bravado via django-esi"""
+
+    class RequestConfig:
+        def __init__(self, also_return_response):
+            self.also_return_response = also_return_response
+
+    class ResponseStub:
+        def __init__(self, headers):
+            self.headers = headers
+
+    def __init__(self, data, headers: dict = None, also_return_response: bool = False):
+        self._data = data
+        self._headers = headers if headers else {"x-pages": 1}
+        self.request_config = BravadoOperationStub.RequestConfig(also_return_response)
+
+    def result(self, **kwargs):
+        if self.request_config.also_return_response:
+            return [self._data, self.ResponseStub(self._headers)]
+        else:
+            return self._data
+
+    def results(self, **kwargs):
+        return self.result(**kwargs)
+
+
+class EsiClientStub:
+    """Stub for an ESI client."""
+    class Alliance:
+        @staticmethod
+        def get_alliances_alliance_id(alliance_id):
+            data = {
+                3001: {
+                    "name": "Wayne Enterprises",
+                    "ticker": "WYE",
+                    "executor_corporation_id": 2001
+                }
+            }
+            try:
+                return BravadoOperationStub(data[int(alliance_id)])
+            except KeyError:
+                response = BravadoResponseStub(
+                    404, f"Alliance with ID {alliance_id} not found"
+                )
+                raise HTTPNotFound(response)
+
+        @staticmethod
+        def get_alliances_alliance_id_corporations(alliance_id):
+            data = [2001, 2002, 2003]
+            return BravadoOperationStub(data)
+
+    class Character:
+        @staticmethod
+        def get_characters_character_id(character_id):
+            data = {
+                1001: {
+                    "corporation_id": 2001,
+                    "name": "Bruce Wayne",
+                },
+                1002: {
+                    "corporation_id": 2001,
+                    "name": "Peter Parker",
+                },
+                1011: {
+                    "corporation_id": 2011,
+                    "name": "Lex Luthor",
+                }
+            }
+            try:
+                return BravadoOperationStub(data[int(character_id)])
+            except KeyError:
+                response = BravadoResponseStub(
+                    404, f"Character with ID {character_id} not found"
+                )
+                raise HTTPNotFound(response)
+
+        @staticmethod
+        def post_characters_affiliation(characters: list):
+            data = [
+                {'character_id': 1001, 'corporation_id': 2001, 'alliance_id': 3001},
+                {'character_id': 1002, 'corporation_id': 2001, 'alliance_id': 3001},
+                {'character_id': 1011, 'corporation_id': 2011},
+                {'character_id': 1666, 'corporation_id': 1000001},
+            ]
+            return BravadoOperationStub(
+                [x for x in data if x['character_id'] in characters]
+            )
+
+    class Corporation:
+        @staticmethod
+        def get_corporations_corporation_id(corporation_id):
+            data = {
+                2001: {
+                    "ceo_id": 1091,
+                    "member_count": 10,
+                    "name": "Wayne Technologies",
+                    "ticker": "WTE",
+                    "alliance_id": 3001
+                },
+                2002: {
+                    "ceo_id": 1092,
+                    "member_count": 10,
+                    "name": "Wayne Food",
+                    "ticker": "WFO",
+                    "alliance_id": 3001
+                },
+                2003: {
+                    "ceo_id": 1093,
+                    "member_count": 10,
+                    "name": "Wayne Energy",
+                    "ticker": "WEG",
+                    "alliance_id": 3001
+                },
+                2011: {
+                    "ceo_id": 1,
+                    "member_count": 3,
+                    "name": "LexCorp",
+                    "ticker": "LC",
+                },
+                1000001: {
+                    "ceo_id": 3000001,
+                    "creator_id": 1,
+                    "description": "The internal corporation used for characters in graveyard.",
+                    "member_count": 6329026,
+                    "name": "Doomheim",
+                    "ticker": "666",
+                }
+            }
+            try:
+                return BravadoOperationStub(data[int(corporation_id)])
+            except KeyError:
+                response = BravadoResponseStub(
+                    404, f"Corporation with ID {corporation_id} not found"
+                )
+                raise HTTPNotFound(response)
+
+    class Universe:
+        @staticmethod
+        def post_universe_names(ids: list):
+            data = [
+                {"category": "character", "id": 1001, "name": "Bruce Wayne"},
+                {"category": "character", "id": 1002, "name": "Peter Parker"},
+                {"category": "character", "id": 1011, "name": "Lex Luthor"},
+                {"category": "character", "id": 1666, "name": "Hal Jordan"},
+                {"category": "corporation", "id": 2001, "name": "Wayne Technologies"},
+                {"category": "corporation","id": 2002, "name": "Wayne Food"},
+                {"category": "corporation","id": 1000001, "name": "Doomheim"},
+            ]
+            return BravadoOperationStub([x for x in data if x['id'] in ids])

allianceauth/eveonline/tests/test_models.py

@@ -1,12 +1,15 @@
 from unittest.mock import Mock, patch
 
+from django.core.exceptions import ObjectDoesNotExist
 from django.test import TestCase
+from esi.models import Token
+
+from allianceauth.tests.auth_utils import AuthUtils
 
-from ..models import (
-    EveCharacter, EveCorporationInfo, EveAllianceInfo, EveFactionInfo
-)
-from ..providers import Alliance, Corporation, Character
 from ..evelinks import eveimageserver
+from ..models import EveAllianceInfo, EveCharacter, EveCorporationInfo, EveFactionInfo
+from ..providers import Alliance, Character, Corporation
+from .esi_client_stub import EsiClientStub
 
 
 class EveCharacterTestCase(TestCase):
@@ -402,8 +405,8 @@ class EveAllianceTestCase(TestCase):
         my_alliance.save()
         my_alliance.populate_alliance()
 
-        for corporation in EveCorporationInfo.objects\
-            .filter(corporation_id__in=[2001, 2002]
+        for corporation in (
+            EveCorporationInfo.objects.filter(corporation_id__in=[2001, 2002])
         ):
             self.assertEqual(corporation.alliance, my_alliance)
 
@@ -587,3 +590,98 @@ class EveCorporationTestCase(TestCase):
             self.my_corp.logo_url_256,
             'https://images.evetech.net/corporations/2001/logo?size=256'
         )
+
+
+@patch('allianceauth.eveonline.providers.esi_client_factory')
+@patch("allianceauth.eveonline.models.notify")
+class TestCharacterUpdate(TestCase):
+    def test_should_update_normal_character(self, mock_notify, mock_esi_client_factory):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        my_character = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="not my name",
+            corporation_id=2002,
+            corporation_name="Wayne Food",
+            corporation_ticker="WYF",
+            alliance_id=None
+        )
+        # when
+        my_character.update_character()
+        # then
+        my_character.refresh_from_db()
+        self.assertEqual(my_character.character_name, "Bruce Wayne")
+        self.assertEqual(my_character.corporation_id, 2001)
+        self.assertEqual(my_character.corporation_name, "Wayne Technologies")
+        self.assertEqual(my_character.corporation_ticker, "WTE")
+        self.assertEqual(my_character.alliance_id, 3001)
+        self.assertEqual(my_character.alliance_name, "Wayne Enterprises")
+        self.assertEqual(my_character.alliance_ticker, "WYE")
+        self.assertFalse(mock_notify.called)
+
+    def test_should_update_dead_character_with_owner(
+        self, mock_notify, mock_esi_client_factory
+    ):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1666 = EveCharacter.objects.create(
+            character_id=1666,
+            character_name="Hal Jordan",
+            corporation_id=2002,
+            corporation_name="Wayne Food",
+            corporation_ticker="WYF",
+            alliance_id=None
+        )
+        user = AuthUtils.create_user("Bruce Wayne")
+        token_1666 = Token.objects.create(
+            user=user,
+            character_id=character_1666.character_id,
+            character_name=character_1666.character_name,
+            character_owner_hash="ABC123-1666",
+        )
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WYT",
+            alliance_id=None
+        )
+        token_1001 = Token.objects.create(
+            user=user,
+            character_id=character_1001.character_id,
+            character_name=character_1001.character_name,
+            character_owner_hash="ABC123-1001",
+        )
+        # when
+        character_1666.update_character()
+        # then
+        character_1666.refresh_from_db()
+        self.assertTrue(character_1666.is_biomassed)
+        self.assertNotIn(token_1666, user.token_set.all())
+        self.assertIn(token_1001, user.token_set.all())
+        with self.assertRaises(ObjectDoesNotExist):
+            self.assertTrue(character_1666.character_ownership)
+        user.profile.refresh_from_db()
+        self.assertIsNone(user.profile.main_character)
+        self.assertTrue(mock_notify.called)
+
+    def test_should_handle_dead_character_without_owner(
+        self, mock_notify, mock_esi_client_factory
+    ):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1666 = EveCharacter.objects.create(
+            character_id=1666,
+            character_name="Hal Jordan",
+            corporation_id=1011,
+            corporation_name="LexCorp",
+            corporation_ticker='LC',
+            alliance_id=None
+        )
+        # when
+        character_1666.update_character()
+        # then
+        character_1666.refresh_from_db()
+        self.assertTrue(character_1666.is_biomassed)
+        self.assertFalse(mock_notify.called)

allianceauth/eveonline/tests/test_providers.py

@@ -7,6 +7,7 @@ from jsonschema.exceptions import RefResolutionError
 from django.test import TestCase
 
 from . import set_logger
+from .esi_client_stub import EsiClientStub
 from ..providers import (
     ObjectNotFound,
     Entity,
@@ -632,13 +633,7 @@ class TestEveSwaggerProvider(TestCase):
 
     @patch(MODULE_PATH + '.esi_client_factory')
     def test_get_character(self, mock_esi_client_factory):
-        mock_esi_client_factory.return_value \
-            .Character.get_characters_character_id \
-            = TestEveSwaggerProvider.esi_get_characters_character_id
-        mock_esi_client_factory.return_value \
-            .Character.post_characters_affiliation \
-            = TestEveSwaggerProvider.esi_post_characters_affiliation
-
+        mock_esi_client_factory.return_value = EsiClientStub()
         my_provider = EveSwaggerProvider()
 
         # character with alliance
@@ -649,8 +644,8 @@ class TestEveSwaggerProvider(TestCase):
         self.assertEqual(my_character.alliance_id, 3001)
 
         # character wo/ alliance
-        my_character = my_provider.get_character(1002)
-        self.assertEqual(my_character.id, 1002)
+        my_character = my_provider.get_character(1011)
+        self.assertEqual(my_character.id, 1011)
         self.assertEqual(my_character.alliance_id, None)
 
         # character not found

allianceauth/eveonline/tests/test_tasks.py

@@ -1,245 +1,271 @@
-from unittest.mock import patch, Mock
+from unittest.mock import patch
 
-from django.test import TestCase
+from django.test import TestCase, TransactionTestCase, override_settings
 
-from ..models import EveCharacter, EveCorporationInfo, EveAllianceInfo
+from ..models import EveAllianceInfo, EveCharacter, EveCorporationInfo
 from ..tasks import (
+    run_model_update,
     update_alliance,
-    update_corp,
     update_character,
-    run_model_update
+    update_character_chunk,
+    update_corp,
 )
+from .esi_client_stub import EsiClientStub
 
 
-class TestTasks(TestCase):
-
-    @patch('allianceauth.eveonline.tasks.EveCorporationInfo')
-    def test_update_corp(self, mock_EveCorporationInfo):
-        update_corp(42)
-        self.assertEqual(
-            mock_EveCorporationInfo.objects.update_corporation.call_count, 1
-        )
-        self.assertEqual(
-            mock_EveCorporationInfo.objects.update_corporation.call_args[0][0], 42
+@patch('allianceauth.eveonline.providers.esi_client_factory')
+class TestUpdateTasks(TestCase):
+    def test_should_update_alliance(self, mock_esi_client_factory):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        my_alliance = EveAllianceInfo.objects.create(
+            alliance_id=3001,
+            alliance_name="Wayne Enterprises",
+            alliance_ticker="WYE",
+            executor_corp_id=2003
         )
+        # when
+        update_alliance(my_alliance.alliance_id)
+        # then
+        my_alliance.refresh_from_db()
+        self.assertEqual(my_alliance.executor_corp_id, 2001)
 
-    @patch('allianceauth.eveonline.tasks.EveAllianceInfo')
-    def test_update_alliance(self, mock_EveAllianceInfo):
-        update_alliance(42)
-        self.assertEqual(
-            mock_EveAllianceInfo.objects.update_alliance.call_args[0][0], 42
-        )
-        self.assertEqual(
-            mock_EveAllianceInfo.objects
-            .update_alliance.return_value.populate_alliance.call_count, 1
+    def test_should_update_character(self, mock_esi_client_factory):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        my_character = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2002,
+            corporation_name="Wayne Food",
+            corporation_ticker="WYF",
+            alliance_id=None
         )
+        # when
+        update_character(my_character.character_id)
+        # then
+        my_character.refresh_from_db()
+        self.assertEqual(my_character.corporation_id, 2001)
 
-    @patch('allianceauth.eveonline.tasks.EveCharacter')
-    def test_update_character(self, mock_EveCharacter):
-        update_character(42)
-        self.assertEqual(
-            mock_EveCharacter.objects.update_character.call_count, 1
+    def test_should_update_corp(self, mock_esi_client_factory):
+        # given
+        mock_esi_client_factory.return_value = EsiClientStub()
+        EveAllianceInfo.objects.create(
+            alliance_id=3001,
+            alliance_name="Wayne Enterprises",
+            alliance_ticker="WYE",
+            executor_corp_id=2003
         )
-        self.assertEqual(
-            mock_EveCharacter.objects.update_character.call_args[0][0], 42
+        my_corporation = EveCorporationInfo.objects.create(
+            corporation_id=2003,
+            corporation_name="Wayne Food",
+            corporation_ticker="WFO",
+            member_count=1,
+            alliance=None,
+            ceo_id=1999
         )
+        # when
+        update_corp(my_corporation.corporation_id)
+        # then
+        my_corporation.refresh_from_db()
+        self.assertEqual(my_corporation.alliance.alliance_id, 3001)
+
+    # @patch('allianceauth.eveonline.tasks.EveCharacter')
+    # def test_update_character(self, mock_EveCharacter):
+    #     update_character(42)
+    #     self.assertEqual(
+    #         mock_EveCharacter.objects.update_character.call_count, 1
+    #     )
+    #     self.assertEqual(
+    #         mock_EveCharacter.objects.update_character.call_args[0][0], 42
+    #     )
 
 
-@patch('allianceauth.eveonline.tasks.update_character')
-@patch('allianceauth.eveonline.tasks.update_alliance')
-@patch('allianceauth.eveonline.tasks.update_corp')
-@patch('allianceauth.eveonline.providers.provider')
+@override_settings(CELERY_ALWAYS_EAGER=True)
+@patch('allianceauth.eveonline.providers.esi_client_factory')
+@patch('allianceauth.eveonline.tasks.providers')
 @patch('allianceauth.eveonline.tasks.CHUNK_SIZE', 2)
-class TestRunModelUpdate(TestCase):
-
-    @classmethod
-    def setUpClass(cls):
-        super().setUpClass()
-        EveCorporationInfo.objects.all().delete()
-        EveAllianceInfo.objects.all().delete()
-        EveCharacter.objects.all().delete()
-
+class TestRunModelUpdate(TransactionTestCase):
+    def test_should_run_updates(self, mock_providers, mock_esi_client_factory):
+        # given
+        mock_providers.provider.client = EsiClientStub()
+        mock_esi_client_factory.return_value = EsiClientStub()
         EveCorporationInfo.objects.create(
-            corporation_id=2345,
-            corporation_name='corp.name',
-            corporation_ticker='c.c.t',
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
             member_count=10,
             alliance=None,
         )
-        EveAllianceInfo.objects.create(
-            alliance_id=3456,
-            alliance_name='alliance.name',
-            alliance_ticker='a.t',
-            executor_corp_id=5,
+        alliance_3001 = EveAllianceInfo.objects.create(
+            alliance_id=3001,
+            alliance_name="Wayne Enterprises",
+            alliance_ticker="WYE",
+            executor_corp_id=2003
         )
-        EveCharacter.objects.create(
-            character_id=1,
-            character_name='character.name1',
-            corporation_id=2345,
-            corporation_name='character.corp.name',
-            corporation_ticker='c.c.t',  # max 5 chars
+        corporation_2003 = EveCorporationInfo.objects.create(
+            corporation_id=2003,
+            corporation_name="Wayne Energy",
+            corporation_ticker="WEG",
+            member_count=99,
+            alliance=None,
+        )
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2002,
+            corporation_name="Wayne Food",
+            corporation_ticker="WYF",
             alliance_id=None
         )
-        EveCharacter.objects.create(
-            character_id=2,
-            character_name='character.name2',
-            corporation_id=9876,
-            corporation_name='character.corp.name',
-            corporation_ticker='c.c.t',  # max 5 chars
-            alliance_id=3456,
-            alliance_name='character.alliance.name',
-        )
-        EveCharacter.objects.create(
-            character_id=3,
-            character_name='character.name3',
-            corporation_id=9876,
-            corporation_name='character.corp.name',
-            corporation_ticker='c.c.t',  # max 5 chars
-            alliance_id=3456,
-            alliance_name='character.alliance.name',
-        )
-        EveCharacter.objects.create(
-            character_id=4,
-            character_name='character.name4',
-            corporation_id=9876,
-            corporation_name='character.corp.name',
-            corporation_ticker='c.c.t',  # max 5 chars
-            alliance_id=3456,
-            alliance_name='character.alliance.name',
-        )
-        """
-        EveCharacter.objects.create(
-            character_id=5,
-            character_name='character.name5',
-            corporation_id=9876,
-            corporation_name='character.corp.name',
-            corporation_ticker='c.c.t',  # max 5 chars
-            alliance_id=3456,
-            alliance_name='character.alliance.name',
-        )
-        """
-
-    def setUp(self):
-        self.affiliations = [
-            {'character_id': 1, 'corporation_id': 5},
-            {'character_id': 2, 'corporation_id': 9876, 'alliance_id': 3456},
-            {'character_id': 3, 'corporation_id': 9876, 'alliance_id': 7456},
-            {'character_id': 4, 'corporation_id': 9876, 'alliance_id': 3456}
-        ]
-        self.names = [
-            {'id': 1, 'name': 'character.name1'},
-            {'id': 2, 'name': 'character.name2'},
-            {'id': 3, 'name': 'character.name3'},
-            {'id': 4, 'name': 'character.name4_new'}
-        ]
-
-    def test_normal_run(
-        self,
-        mock_provider,
-        mock_update_corp,
-        mock_update_alliance,
-        mock_update_character,
-    ):
-        def get_affiliations(characters: list):
-            response = [x for x in self.affiliations if x['character_id'] in characters]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
-
-        def get_names(ids: list):
-            response = [x for x in self.names if x['id'] in ids]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
-
-        mock_provider.client.Character.post_characters_affiliation.side_effect \
-            = get_affiliations
-
-        mock_provider.client.Universe.post_universe_names.side_effect = get_names
-
+        # when
         run_model_update()
-
+        # then
+        character_1001.refresh_from_db()
         self.assertEqual(
-            mock_provider.client.Character.post_characters_affiliation.call_count, 2
+            character_1001.corporation_id, 2001  # char has new corp
         )
+        corporation_2003.refresh_from_db()
         self.assertEqual(
-            mock_provider.client.Universe.post_universe_names.call_count, 2
+            corporation_2003.alliance.alliance_id, 3001  # corp has new alliance
+        )
+        alliance_3001.refresh_from_db()
+        self.assertEqual(
+            alliance_3001.executor_corp_id, 2001  # alliance has been updated
         )
 
-        # character 1 has changed corp
-        # character 2 no change
-        # character 3 has changed alliance
-        # character 4 has changed name
-        self.assertEqual(mock_update_corp.apply_async.call_count, 1)
-        self.assertEqual(
-            int(mock_update_corp.apply_async.call_args[1]['args'][0]), 2345
-        )
-        self.assertEqual(mock_update_alliance.apply_async.call_count, 1)
-        self.assertEqual(
-            int(mock_update_alliance.apply_async.call_args[1]['args'][0]), 3456
-        )
-        characters_updated = {
-            x[1]['args'][0] for x in mock_update_character.apply_async.call_args_list
+
+@override_settings(CELERY_ALWAYS_EAGER=True)
+@patch('allianceauth.eveonline.tasks.update_character', wraps=update_character)
+@patch('allianceauth.eveonline.providers.esi_client_factory')
+@patch('allianceauth.eveonline.tasks.providers')
+@patch('allianceauth.eveonline.tasks.CHUNK_SIZE', 2)
+class TestUpdateCharacterChunk(TestCase):
+    @staticmethod
+    def _updated_character_ids(spy_update_character) -> set:
+        """Character IDs passed to update_character task for update."""
+        return {
+            x[1]["args"][0] for x in spy_update_character.apply_async.call_args_list
         }
-        excepted = {1, 3, 4}
-        self.assertSetEqual(characters_updated, excepted)
 
-    def test_ignore_character_not_in_affiliations(
-        self,
-        mock_provider,
-        mock_update_corp,
-        mock_update_alliance,
-        mock_update_character,
+    def test_should_update_corp_change(
+        self, mock_providers, mock_esi_client_factory, spy_update_character
     ):
-        def get_affiliations(characters: list):
-            response = [x for x in self.affiliations if x['character_id'] in characters]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
+        # given
+        mock_providers.provider.client = EsiClientStub()
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2003,
+            corporation_name="Wayne Energy",
+            corporation_ticker="WEG",
+            alliance_id=3001,
+            alliance_name="Wayne Enterprises",
+            alliance_ticker="WYE",
+        )
+        character_1002 = EveCharacter.objects.create(
+            character_id=1002,
+            character_name="Peter Parker",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
+            alliance_id=3001,
+            alliance_name="Wayne Enterprises",
+            alliance_ticker="WYE",
+        )
+        # when
+        update_character_chunk([
+            character_1001.character_id, character_1002.character_id
+        ])
+        # then
+        character_1001.refresh_from_db()
+        self.assertEqual(character_1001.corporation_id, 2001)
+        self.assertSetEqual(self._updated_character_ids(spy_update_character), {1001})
 
-        def get_names(ids: list):
-            response = [x for x in self.names if x['id'] in ids]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
-
-        del self.affiliations[0]
-
-        mock_provider.client.Character.post_characters_affiliation.side_effect \
-            = get_affiliations
-
-        mock_provider.client.Universe.post_universe_names.side_effect = get_names
-
-        run_model_update()
-        characters_updated = {
-            x[1]['args'][0] for x in mock_update_character.apply_async.call_args_list
-        }
-        excepted = {3, 4}
-        self.assertSetEqual(characters_updated, excepted)
-
-    def test_ignore_character_not_in_names(
-        self,
-        mock_provider,
-        mock_update_corp,
-        mock_update_alliance,
-        mock_update_character,
+    def test_should_update_name_change(
+        self, mock_providers, mock_esi_client_factory, spy_update_character
     ):
-        def get_affiliations(characters: list):
-            response = [x for x in self.affiliations if x['character_id'] in characters]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
+        # given
+        mock_providers.provider.client = EsiClientStub()
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Batman",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
+            alliance_id=3001,
+            alliance_name="Wayne Technologies",
+            alliance_ticker="WYT",
+        )
+        # when
+        update_character_chunk([character_1001.character_id])
+        # then
+        character_1001.refresh_from_db()
+        self.assertEqual(character_1001.character_name, "Bruce Wayne")
+        self.assertSetEqual(self._updated_character_ids(spy_update_character), {1001})
 
-        def get_names(ids: list):
-            response = [x for x in self.names if x['id'] in ids]
-            mock_operator = Mock(**{'result.return_value': response})
-            return mock_operator
+    def test_should_update_alliance_change(
+        self, mock_providers, mock_esi_client_factory, spy_update_character
+    ):
+        # given
+        mock_providers.provider.client = EsiClientStub()
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
+            alliance_id=None,
+        )
+        # when
+        update_character_chunk([character_1001.character_id])
+        # then
+        character_1001.refresh_from_db()
+        self.assertEqual(character_1001.alliance_id, 3001)
+        self.assertSetEqual(self._updated_character_ids(spy_update_character), {1001})
 
-        del self.names[3]
+    def test_should_not_update_when_not_changed(
+        self, mock_providers, mock_esi_client_factory, spy_update_character
+    ):
+        # given
+        mock_providers.provider.client = EsiClientStub()
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
+            alliance_id=3001,
+            alliance_name="Wayne Technologies",
+            alliance_ticker="WYT",
+        )
+        # when
+        update_character_chunk([character_1001.character_id])
+        # then
+        self.assertSetEqual(self._updated_character_ids(spy_update_character), set())
 
-        mock_provider.client.Character.post_characters_affiliation.side_effect \
-            = get_affiliations
-
-        mock_provider.client.Universe.post_universe_names.side_effect = get_names
-
-        run_model_update()
-        characters_updated = {
-            x[1]['args'][0] for x in mock_update_character.apply_async.call_args_list
-        }
-        excepted = {1, 3}
-        self.assertSetEqual(characters_updated, excepted)
+    def test_should_fall_back_to_single_updates_when_bulk_update_failed(
+        self, mock_providers, mock_esi_client_factory, spy_update_character
+    ):
+        # given
+        mock_providers.provider.client.Character.post_characters_affiliation\
+            .side_effect = OSError
+        mock_esi_client_factory.return_value = EsiClientStub()
+        character_1001 = EveCharacter.objects.create(
+            character_id=1001,
+            character_name="Bruce Wayne",
+            corporation_id=2001,
+            corporation_name="Wayne Technologies",
+            corporation_ticker="WTE",
+            alliance_id=3001,
+            alliance_name="Wayne Technologies",
+            alliance_ticker="WYT",
+        )
+        # when
+        update_character_chunk([character_1001.character_id])
+        # then
+        self.assertSetEqual(self._updated_character_ids(spy_update_character), {1001})

allianceauth/fleetactivitytracking/views.py

@@ -212,7 +212,14 @@ def fatlink_monthly_personal_statistics_view(request, year, month, char_id=None)
     start_of_previous_month = first_day_of_previous_month(year, month)
 
     if request.user.has_perm('auth.fleetactivitytracking_statistics') and char_id:
-        user = EveCharacter.objects.get(character_id=char_id).user
+        try:
+            user = EveCharacter.objects.get(character_id=char_id).character_ownership.user
+        except EveCharacter.DoesNotExist:
+            messages.error(request, _('Character does not exist'))
+            return redirect('fatlink:view')
+        except AttributeError:
+            messages.error(request, _('User does not exist'))
+            return redirect('fatlink:view')
     else:
         user = request.user
     logger.debug(f"Personal monthly statistics view for user {user} called by {request.user}")

allianceauth/groupmanagement/admin.py

@@ -1,19 +1,21 @@
-from django import forms
 from django.apps import apps
-from django.contrib.auth.models import Permission
 from django.contrib import admin
-from django.contrib.auth.models import Group as BaseGroup, User
-from django.core.exceptions import ValidationError
-from django.db.models import Count
-from django.db.models.functions import Lower
-from django.db.models.signals import pre_save, post_save, pre_delete, \
-    post_delete, m2m_changed
-from django.dispatch import receiver
-from django.utils.timezone import now
-from django.utils.translation import gettext_lazy as _
 
-from .models import AuthGroup, ReservedGroupName
-from .models import GroupRequest
+from django.contrib.auth.models import Group as BaseGroup, Permission, User
+from django.db.models import Count, Exists, OuterRef
+from django.db.models.functions import Lower
+from django.db.models.signals import (
+    m2m_changed,
+    post_delete,
+    post_save,
+    pre_delete,
+    pre_save
+)
+from django.dispatch import receiver
+
+from .forms import GroupAdminForm, ReservedGroupNameAdminForm
+from .models import AuthGroup, GroupRequest, ReservedGroupName
+from .tasks import remove_users_not_matching_states_from_group
 
 if 'eve_autogroups' in apps.app_configs:
     _has_auto_groups = True
@@ -28,10 +30,12 @@ class AuthGroupInlineAdmin(admin.StackedInline):
         'description',
         'group_leaders',
         'group_leader_groups',
-        'states', 'internal',
+        'states',
+        'internal',
         'hidden',
         'open',
-        'public'
+        'public',
+        'restricted',
     )
     verbose_name_plural = 'Auth Settings'
     verbose_name = ''
@@ -50,6 +54,11 @@ class AuthGroupInlineAdmin(admin.StackedInline):
     def has_change_permission(self, request, obj=None):
         return request.user.has_perm('auth.change_group')
 
+    def get_readonly_fields(self, request, obj=None):
+        if not request.user.is_superuser:
+            return self.readonly_fields + ("restricted",)
+        return self.readonly_fields
+
 
 if _has_auto_groups:
     class IsAutoGroupFilter(admin.SimpleListFilter):
@@ -96,27 +105,15 @@ class HasLeaderFilter(admin.SimpleListFilter):
         return queryset
 
 
-class GroupAdminForm(forms.ModelForm):
-    def clean_name(self):
-        my_name = self.cleaned_data['name']
-        if ReservedGroupName.objects.filter(name__iexact=my_name).exists():
-            raise ValidationError(
-                _("This name has been reserved and can not be used for groups."),
-                code='reserved_name'
-            )
-        return my_name
-
-
 class GroupAdmin(admin.ModelAdmin):
     form = GroupAdminForm
-    list_select_related = ('authgroup',)
     ordering = ('name',)
     list_display = (
         'name',
         '_description',
         '_properties',
         '_member_count',
-        'has_leader'
+        'has_leader',
     )
     list_filter = [
         'authgroup__internal',
@@ -132,34 +129,51 @@ class GroupAdmin(admin.ModelAdmin):
 
     def get_queryset(self, request):
         qs = super().get_queryset(request)
-        if _has_auto_groups:
-            qs = qs.prefetch_related('managedalliancegroup_set', 'managedcorpgroup_set')
-        qs = qs.prefetch_related('authgroup__group_leaders').select_related('authgroup')
-        qs = qs.annotate(
-            member_count=Count('user', distinct=True),
+        has_leader_qs = (
+            AuthGroup.objects.filter(group=OuterRef('pk'), group_leaders__isnull=False)
         )
+        has_leader_groups_qs = (
+            AuthGroup.objects.filter(
+                group=OuterRef('pk'), group_leader_groups__isnull=False
+            )
+        )
+        qs = (
+            qs.select_related('authgroup')
+            .annotate(member_count=Count('user', distinct=True))
+            .annotate(has_leader=Exists(has_leader_qs))
+            .annotate(has_leader_groups=Exists(has_leader_groups_qs))
+        )
+        if _has_auto_groups:
+            is_autogroup_corp = (
+                Group.objects.filter(
+                    pk=OuterRef('pk'), managedcorpgroup__isnull=False
+                )
+            )
+            is_autogroup_alliance = (
+                Group.objects.filter(
+                    pk=OuterRef('pk'), managedalliancegroup__isnull=False
+                )
+            )
+            qs = (
+                qs.annotate(is_autogroup_corp=Exists(is_autogroup_corp))
+                .annotate(is_autogroup_alliance=Exists(is_autogroup_alliance))
+            )
         return qs
 
     def _description(self, obj):
         return obj.authgroup.description
 
+    @admin.display(description='Members', ordering='member_count')
     def _member_count(self, obj):
         return obj.member_count
 
-    _member_count.short_description = 'Members'
-    _member_count.admin_order_field = 'member_count'
-
+    @admin.display(boolean=True)
     def has_leader(self, obj):
-        return obj.authgroup.group_leaders.exists() or obj.authgroup.group_leader_groups.exists()
-
-    has_leader.boolean = True
+        return obj.has_leader or obj.has_leader_groups
 
     def _properties(self, obj):
         properties = list()
-        if _has_auto_groups and (
-            obj.managedalliancegroup_set.exists()
-            or obj.managedcorpgroup_set.exists()
-        ):
+        if _has_auto_groups and (obj.is_autogroup_corp or obj.is_autogroup_alliance):
             properties.append('Auto Group')
         elif obj.authgroup.internal:
             properties.append('Internal')
@@ -172,11 +186,10 @@ class GroupAdmin(admin.ModelAdmin):
                 properties.append('Public')
         if not properties:
             properties.append('Default')
-
+        if obj.authgroup.restricted:
+            properties.append('Restricted')
         return properties
 
-    _properties.short_description = "properties"
-
     filter_horizontal = ('permissions',)
     inlines = (AuthGroupInlineAdmin,)
 
@@ -190,8 +203,15 @@ class GroupAdmin(admin.ModelAdmin):
             ag_instance = inline_form.save(commit=False)
             ag_instance.group = form.instance
             ag_instance.save()
+            if ag_instance.states.exists():
+                remove_users_not_matching_states_from_group.delay(ag_instance.group.pk)
         formset.save()
 
+    def get_readonly_fields(self, request, obj=None):
+        if not request.user.is_superuser:
+            return self.readonly_fields + ("permissions",)
+        return self.readonly_fields
+
 
 class Group(BaseGroup):
     class Meta:
@@ -216,33 +236,10 @@ class GroupRequestAdmin(admin.ModelAdmin):
         'leave_request',
     )
 
+    @admin.display(boolean=True, description="is leave request")
     def _leave_request(self, obj) -> True:
         return obj.leave_request
 
-    _leave_request.short_description = 'is leave request'
-    _leave_request.boolean = True
-
-
-class ReservedGroupNameAdminForm(forms.ModelForm):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields['created_by'].initial = self.current_user.username
-        self.fields['created_at'].initial = _("(auto)")
-
-    created_by = forms.CharField(disabled=True)
-    created_at = forms.CharField(disabled=True)
-
-    def clean_name(self):
-        my_name = self.cleaned_data['name'].lower()
-        if Group.objects.filter(name__iexact=my_name).exists():
-            raise ValidationError(
-                _("There already exists a group with that name."), code='already_exists'
-            )
-        return my_name
-
-    def clean_created_at(self):
-        return now()
-
 
 @admin.register(ReservedGroupName)
 class ReservedGroupNameAdmin(admin.ModelAdmin):

allianceauth/groupmanagement/forms.py

@@ -0,0 +1,39 @@
+from django import forms
+from django.contrib.auth.models import Group
+from django.core.exceptions import ValidationError
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _
+
+from .models import ReservedGroupName
+
+
+class GroupAdminForm(forms.ModelForm):
+    def clean_name(self):
+        my_name = self.cleaned_data['name']
+        if ReservedGroupName.objects.filter(name__iexact=my_name).exists():
+            raise ValidationError(
+                _("This name has been reserved and can not be used for groups."),
+                code='reserved_name'
+            )
+        return my_name
+
+
+class ReservedGroupNameAdminForm(forms.ModelForm):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['created_by'].initial = self.current_user.username
+        self.fields['created_at'].initial = _("(auto)")
+
+    created_by = forms.CharField(disabled=True)
+    created_at = forms.CharField(disabled=True)
+
+    def clean_name(self):
+        my_name = self.cleaned_data['name'].lower()
+        if Group.objects.filter(name__iexact=my_name).exists():
+            raise ValidationError(
+                _("There already exists a group with that name."), code='already_exists'
+            )
+        return my_name
+
+    def clean_created_at(self):
+        return now()

allianceauth/groupmanagement/migrations/0019_adding_restricted_to_groups.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.10 on 2022-04-08 19:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('groupmanagement', '0018_reservedgroupname'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='authgroup',
+            name='restricted',
+            field=models.BooleanField(default=False, help_text='Group is restricted. This means that adding or removing users for this group requires a superuser admin.'),
+        ),
+    ]

allianceauth/groupmanagement/models.py

@@ -13,6 +13,7 @@ from allianceauth.notifications import notify
 
 class GroupRequest(models.Model):
     """Request from a user for joining or leaving a group."""
+
     leave_request = models.BooleanField(default=0)
     user = models.ForeignKey(User, on_delete=models.CASCADE)
     group = models.ForeignKey(Group, on_delete=models.CASCADE)
@@ -44,6 +45,7 @@ class GroupRequest(models.Model):
 
 class RequestLog(models.Model):
     """Log entry about who joined and left a group and who approved it."""
+
     request_type = models.BooleanField(null=True)
     group = models.ForeignKey(Group, on_delete=models.CASCADE)
     request_info = models.CharField(max_length=254)
@@ -95,6 +97,7 @@ class AuthGroup(models.Model):
         Open - Users are automatically accepted into the group
         Not Open - Users requests must be approved before they are added to the group
     """
+
     group = models.OneToOneField(Group, on_delete=models.CASCADE, primary_key=True)
     internal = models.BooleanField(
         default=True,
@@ -126,6 +129,13 @@ class AuthGroup(models.Model):
             "are no longer authenticated."
         )
     )
+    restricted = models.BooleanField(
+        default=False,
+        help_text=_(
+            "Group is restricted. This means that adding or removing users "
+            "for this group requires a superuser admin."
+        )
+    )
     group_leaders = models.ManyToManyField(
         User,
         related_name='leads_groups',
@@ -179,12 +189,22 @@ class AuthGroup(models.Model):
             | User.objects.filter(groups__in=list(self.group_leader_groups.all()))
         )
 
+    def remove_users_not_matching_states(self):
+        """Remove users not matching defined states from related group."""
+        states_qs = self.states.all()
+        if states_qs.exists():
+            states = list(states_qs)
+            non_compliant_users = self.group.user_set.exclude(profile__state__in=states)
+            for user in non_compliant_users:
+                self.group.user_set.remove(user)
+
 
 class ReservedGroupName(models.Model):
     """Name that can not be used for groups.
 
     This enables AA to ignore groups on other services (e.g. Discord) with that name.
     """
+
     name = models.CharField(
         _('name'),
         max_length=150,

allianceauth/groupmanagement/tasks.py

@@ -0,0 +1,10 @@
+from celery import shared_task
+
+from django.contrib.auth.models import Group
+
+
+@shared_task
+def remove_users_not_matching_states_from_group(group_pk: int) -> None:
+    """Remove users not matching defined states from related group."""
+    group = Group.objects.get(pk=group_pk)
+    group.authgroup.remove_users_not_matching_states()

allianceauth/groupmanagement/templates/groupmanagement/audit.html

@@ -127,6 +127,8 @@
                 ],
                 bootstrap: true
             },
+            "stateSave": true,
+            "stateDuration": 0
         });
     });
 {% endblock %}

allianceauth/groupmanagement/templates/groupmanagement/groupmembers.html

@@ -104,7 +104,9 @@
                     "sortable": false,
                     "targets": [2]
                 },
-            ]
+            ],
+            "stateSave": true,
+            "stateDuration": 0
         });
     });
 {% endblock %}

allianceauth/groupmanagement/templates/groupmanagement/index.html

@@ -29,15 +29,18 @@
                     {% endif %}
                 </a>
             </li>
-            <li>
-                <a data-toggle="tab" href="#leave">
-                    {% translate "Leave Requests" %}
 
-                    {% if leaverequests %}
-                        <span class="badge">{{ leaverequests|length }}</span>
-                    {% endif %}
-                </a>
-            </li>
+            {%  if not auto_leave %}
+                <li>
+                    <a data-toggle="tab" href="#leave">
+                        {% translate "Leave Requests" %}
+
+                        {% if leaverequests %}
+                            <span class="badge">{{ leaverequests|length }}</span>
+                        {% endif %}
+                    </a>
+                </li>
+            {% endif %}
         </ul>
 
         <div class="panel panel-default panel-tabs-aa">
@@ -100,61 +103,63 @@
                         {% endif %}
                     </div>
 
-                    <div id="leave" class="tab-pane">
-                        {% if leaverequests %}
-                            <div class="table-responsive">
-                                <table class="table table-aa">
-                                    <thead>
-                                        <tr>
-                                            <th>{% translate "Character" %}</th>
-                                            <th>{% translate "Organization" %}</th>
-                                            <th>{% translate "Group" %}</th>
-                                            <th></th>
-                                        </tr>
-                                    </thead>
-
-                                    <tbody>
-                                        {% for leaverequest in leaverequests %}
+                    {%  if not auto_leave %}
+                        <div id="leave" class="tab-pane">
+                            {% if leaverequests %}
+                                <div class="table-responsive">
+                                    <table class="table table-aa">
+                                        <thead>
                                             <tr>
-                                                <td>
-                                                    <img src="{{ leaverequest.main_char|character_portrait_url:32 }}" class="img-circle" style="margin-right: 1rem;">
-                                                    {% if leaverequest.main_char %}
-                                                        <a href="{{ leaverequest.main_char|evewho_character_url }}" target="_blank">
-                                                            {{ leaverequest.main_char.character_name }}
-                                                        </a>
-                                                    {% else %}
-                                                        {{ leaverequest.user.username }}
-                                                    {% endif %}
-                                                </td>
-                                                <td>
-                                                    {% if leaverequest.main_char %}
-                                                        <a href="{{ leaverequest.main_char|dotlan_corporation_url }}" target="_blank">
-                                                            {{ leaverequest.main_char.corporation_name }}
-                                                        </a><br>
-                                                        {{ leaverequest.main_char.alliance_name|default_if_none:"" }}
-                                                    {% else %}
-                                                        {% translate "(unknown)" %}
-                                                    {% endif %}
-                                                </td>
-                                                <td>{{ leaverequest.group.name }}</td>
-                                                <td class="text-right">
-                                                    <a href="{% url 'groupmanagement:leave_accept_request' leaverequest.id %}" class="btn btn-success">
-                                                        {% translate "Accept" %}
-                                                    </a>
-
-                                                    <a href="{% url 'groupmanagement:leave_reject_request' leaverequest.id %}" class="btn btn-danger">
-                                                        {% translate "Reject" %}
-                                                    </a>
-                                                </td>
+                                                <th>{% translate "Character" %}</th>
+                                                <th>{% translate "Organization" %}</th>
+                                                <th>{% translate "Group" %}</th>
+                                                <th></th>
                                             </tr>
-                                        {% endfor %}
-                                    </tbody>
-                                </table>
-                            </div>
-                        {% else %}
-                            <div class="alert alert-warning text-center">{% translate "No group leave requests." %}</div>
-                        {% endif %}
-                    </div>
+                                        </thead>
+
+                                        <tbody>
+                                            {% for leaverequest in leaverequests %}
+                                                <tr>
+                                                    <td>
+                                                        <img src="{{ leaverequest.main_char|character_portrait_url:32 }}" class="img-circle" style="margin-right: 1rem;">
+                                                        {% if leaverequest.main_char %}
+                                                            <a href="{{ leaverequest.main_char|evewho_character_url }}" target="_blank">
+                                                                {{ leaverequest.main_char.character_name }}
+                                                            </a>
+                                                        {% else %}
+                                                            {{ leaverequest.user.username }}
+                                                        {% endif %}
+                                                    </td>
+                                                    <td>
+                                                        {% if leaverequest.main_char %}
+                                                            <a href="{{ leaverequest.main_char|dotlan_corporation_url }}" target="_blank">
+                                                                {{ leaverequest.main_char.corporation_name }}
+                                                            </a><br>
+                                                            {{ leaverequest.main_char.alliance_name|default_if_none:"" }}
+                                                        {% else %}
+                                                            {% translate "(unknown)" %}
+                                                        {% endif %}
+                                                    </td>
+                                                    <td>{{ leaverequest.group.name }}</td>
+                                                    <td class="text-right">
+                                                        <a href="{% url 'groupmanagement:leave_accept_request' leaverequest.id %}" class="btn btn-success">
+                                                            {% translate "Accept" %}
+                                                        </a>
+
+                                                        <a href="{% url 'groupmanagement:leave_reject_request' leaverequest.id %}" class="btn btn-danger">
+                                                            {% translate "Reject" %}
+                                                        </a>
+                                                    </td>
+                                                </tr>
+                                            {% endfor %}
+                                        </tbody>
+                                    </table>
+                                </div>
+                            {% else %}
+                                <div class="alert alert-warning text-center">{% translate "No group leave requests." %}</div>
+                            {% endif %}
+                        </div>
+                    {% endif %}
                 </div>
             </div>
         </div>

allianceauth/groupmanagement/tests/test_admin.py

@@ -1,17 +1,21 @@
 from unittest.mock import patch
 
+from django_webtest import WebTest
+
 from django.conf import settings
 from django.contrib import admin
 from django.contrib.admin.sites import AdminSite
 from django.contrib.auth.models import User
-from django.test import TestCase, RequestFactory, Client
+from django.test import TestCase, RequestFactory, Client, override_settings
 
 from allianceauth.authentication.models import CharacterOwnership, State
 from allianceauth.eveonline.models import (
     EveCharacter, EveCorporationInfo, EveAllianceInfo
 )
-from ..admin import HasLeaderFilter, GroupAdmin, Group
+from allianceauth.tests.auth_utils import AuthUtils
+
 from . import get_admin_change_view_url
+from ..admin import HasLeaderFilter, GroupAdmin, Group
 from ..models import ReservedGroupName
 
 
@@ -33,7 +37,6 @@ class MockRequest:
 
 
 class TestGroupAdmin(TestCase):
-
     @classmethod
     def setUpClass(cls):
         super().setUpClass()
@@ -233,60 +236,104 @@ class TestGroupAdmin(TestCase):
         self.assertEqual(result, expected)
 
     def test_member_count(self):
-        expected = 1
-        obj = self.modeladmin.get_queryset(MockRequest(user=self.user_1))\
-            .get(pk=self.group_1.pk)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_1.pk)
+        # when
         result = self.modeladmin._member_count(obj)
-        self.assertEqual(result, expected)
+        # then
+        self.assertEqual(result, 1)
 
     def test_has_leader_user(self):
-        result = self.modeladmin.has_leader(self.group_1)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_1.pk)
+        # when
+        result = self.modeladmin.has_leader(obj)
+        # then
         self.assertTrue(result)
 
     def test_has_leader_group(self):
-        result = self.modeladmin.has_leader(self.group_2)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_2.pk)
+        # when
+        result = self.modeladmin.has_leader(obj)
+        # then
         self.assertTrue(result)
 
     def test_properties_1(self):
-        expected = ['Default']
-        result = self.modeladmin._properties(self.group_1)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_1.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Default'])
 
     def test_properties_2(self):
-        expected = ['Internal']
-        result = self.modeladmin._properties(self.group_2)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_2.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Internal'])
 
     def test_properties_3(self):
-        expected = ['Hidden']
-        result = self.modeladmin._properties(self.group_3)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_3.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Hidden'])
 
     def test_properties_4(self):
-        expected = ['Open']
-        result = self.modeladmin._properties(self.group_4)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_4.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Open'])
 
     def test_properties_5(self):
-        expected = ['Public']
-        result = self.modeladmin._properties(self.group_5)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_5.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Public'])
 
     def test_properties_6(self):
-        expected = ['Hidden', 'Open', 'Public']
-        result = self.modeladmin._properties(self.group_6)
-        self.assertListEqual(result, expected)
+        # given
+        request = MockRequest(user=self.user_1)
+        obj = self.modeladmin.get_queryset(request).get(pk=self.group_6.pk)
+        # when
+        result = self.modeladmin._properties(obj)
+        self.assertListEqual(result, ['Hidden', 'Open', 'Public'])
 
     if _has_auto_groups:
         @patch(MODULE_PATH + '._has_auto_groups', True)
-        def test_properties_7(self):
+        def test_should_show_autogroup_for_corporation(self):
+            # given
             self._create_autogroups()
-            expected = ['Auto Group']
-            my_group = Group.objects\
-                .filter(managedcorpgroup__isnull=False)\
-                .first()
-            result = self.modeladmin._properties(my_group)
-            self.assertListEqual(result, expected)
+            request = MockRequest(user=self.user_1)
+            queryset = self.modeladmin.get_queryset(request)
+            obj = queryset.filter(managedcorpgroup__isnull=False).first()
+            # when
+            result = self.modeladmin._properties(obj)
+            # then
+            self.assertListEqual(result, ['Auto Group'])
+
+        @patch(MODULE_PATH + '._has_auto_groups', True)
+        def test_should_show_autogroup_for_alliance(self):
+            # given
+            self._create_autogroups()
+            request = MockRequest(user=self.user_1)
+            queryset = self.modeladmin.get_queryset(request)
+            obj = queryset.filter(managedalliancegroup__isnull=False).first()
+            # when
+            result = self.modeladmin._properties(obj)
+            # then
+            self.assertListEqual(result, ['Auto Group'])
 
     # actions
 
@@ -468,6 +515,136 @@ class TestGroupAdmin(TestCase):
         self.assertFalse(Group.objects.filter(name="new group").exists())
 
 
+class TestGroupAdminChangeFormSuperuserExclusiveEdits(WebTest):
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.super_admin = User.objects.create_superuser("super_admin")
+        cls.staff_admin = User.objects.create_user("staff_admin")
+        cls.staff_admin.is_staff = True
+        cls.staff_admin.save()
+        cls.staff_admin = AuthUtils.add_permissions_to_user_by_name(
+            [
+                "auth.add_group",
+                "auth.change_group",
+                "auth.view_group",
+                "groupmanagement.add_group",
+                "groupmanagement.change_group",
+                "groupmanagement.view_group",
+            ],
+            cls.staff_admin
+        )
+        cls.superuser_exclusive_fields = ["permissions", "authgroup-0-restricted"]
+
+    def test_should_show_all_fields_to_superuser_for_add(self):
+        # given
+        self.app.set_user(self.super_admin)
+        page = self.app.get("/admin/groupmanagement/group/add/")
+        # when
+        form = page.forms["group_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertIn(field, form.fields)
+
+    def test_should_not_show_all_fields_to_staff_admins_for_add(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        page = self.app.get("/admin/groupmanagement/group/add/")
+        # when
+        form = page.forms["group_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertNotIn(field, form.fields)
+
+    def test_should_show_all_fields_to_superuser_for_change(self):
+        # given
+        self.app.set_user(self.super_admin)
+        group = Group.objects.create(name="Dummy group")
+        page = self.app.get(f"/admin/groupmanagement/group/{group.pk}/change/")
+        # when
+        form = page.forms["group_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertIn(field, form.fields)
+
+    def test_should_not_show_all_fields_to_staff_admin_for_change(self):
+        # given
+        self.app.set_user(self.staff_admin)
+        group = Group.objects.create(name="Dummy group")
+        page = self.app.get(f"/admin/groupmanagement/group/{group.pk}/change/")
+        # when
+        form = page.forms["group_form"]
+        # then
+        for field in self.superuser_exclusive_fields:
+            with self.subTest(field=field):
+                self.assertNotIn(field, form.fields)
+
+
+@override_settings(CELERY_ALWAYS_EAGER=True, CELERY_EAGER_PROPAGATES_EXCEPTIONS=True)
+class TestGroupAdmin2(TestCase):
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.superuser = User.objects.create_superuser("super")
+
+    def test_should_remove_users_from_state_groups(self):
+        # given
+        user_member = AuthUtils.create_user("Bruce Wayne")
+        character_member = AuthUtils.add_main_character_2(
+            user_member,
+            name="Bruce Wayne",
+            character_id=1001,
+            corp_id=2001,
+            corp_name="Wayne Technologies",
+        )
+        user_guest = AuthUtils.create_user("Lex Luthor")
+        AuthUtils.add_main_character_2(
+            user_guest,
+            name="Lex Luthor",
+            character_id=1011,
+            corp_id=2011,
+            corp_name="Luthor Corp",
+        )
+        member_state = AuthUtils.get_member_state()
+        member_state.member_characters.add(character_member)
+        user_member.refresh_from_db()
+        user_guest.refresh_from_db()
+        group = Group.objects.create(name="dummy")
+        user_member.groups.add(group)
+        user_guest.groups.add(group)
+        group.authgroup.states.add(member_state)
+        self.client.force_login(self.superuser)
+        # when
+        response = self.client.post(
+            f"/admin/groupmanagement/group/{group.pk}/change/",
+            data={
+                "name": f"{group.name}",
+                "authgroup-TOTAL_FORMS": "1",
+                "authgroup-INITIAL_FORMS": "1",
+                "authgroup-MIN_NUM_FORMS": "0",
+                "authgroup-MAX_NUM_FORMS": "1",
+                "authgroup-0-description": "",
+                "authgroup-0-states": f"{member_state.pk}",
+                "authgroup-0-internal": "on",
+                "authgroup-0-hidden": "on",
+                "authgroup-0-group": f"{group.pk}",
+                "authgroup-__prefix__-description": "",
+                "authgroup-__prefix__-internal": "on",
+                "authgroup-__prefix__-hidden": "on",
+                "authgroup-__prefix__-group": f"{group.pk}",
+                "_save": "Save"
+            }
+        )
+        # then
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.url, "/admin/groupmanagement/group/")
+        self.assertIn(group, user_member.groups.all())
+        self.assertNotIn(group, user_guest.groups.all())
+
+
 class TestReservedGroupNameAdmin(TestCase):
     @classmethod
     def setUpClass(cls):

allianceauth/groupmanagement/tests/test_models.py

@@ -232,6 +232,38 @@ class TestAuthGroup(TestCase):
         expected = 'Superheros'
         self.assertEqual(str(group.authgroup), expected)
 
+    def test_should_remove_guests_from_group_when_restricted_to_members_only(self):
+        # given
+        user_member = AuthUtils.create_user("Bruce Wayne")
+        character_member = AuthUtils.add_main_character_2(
+            user_member,
+            name="Bruce Wayne",
+            character_id=1001,
+            corp_id=2001,
+            corp_name="Wayne Technologies",
+        )
+        user_guest = AuthUtils.create_user("Lex Luthor")
+        AuthUtils.add_main_character_2(
+            user_guest,
+            name="Lex Luthor",
+            character_id=1011,
+            corp_id=2011,
+            corp_name="Luthor Corp",
+        )
+        member_state = AuthUtils.get_member_state()
+        member_state.member_characters.add(character_member)
+        user_member.refresh_from_db()
+        user_guest.refresh_from_db()
+        group = Group.objects.create(name="dummy")
+        user_member.groups.add(group)
+        user_guest.groups.add(group)
+        group.authgroup.states.add(member_state)
+        # when
+        group.authgroup.remove_users_not_matching_states()
+        # then
+        self.assertIn(group, user_member.groups.all())
+        self.assertNotIn(group, user_guest.groups.all())
+
 
 class TestAuthGroupRequestApprovers(TestCase):
     def setUp(self) -> None:

allianceauth/groupmanagement/tests/test_views.py

@@ -1,4 +1,4 @@
-from django.test import RequestFactory, TestCase
+from django.test import RequestFactory, TestCase, override_settings
 from django.urls import reverse
 
 from allianceauth.tests.auth_utils import AuthUtils
@@ -6,14 +6,80 @@ from allianceauth.tests.auth_utils import AuthUtils
 from .. import views
 
 
+def response_content_to_str(response) -> str:
+    return response.content.decode(response.charset)
+
+
 class TestViews(TestCase):
 
     def setUp(self):
         self.factory = RequestFactory()
-        self.user = AuthUtils.create_user('Bruce Wayne')
+        self.user = AuthUtils.create_user('Peter Parker')
+        self.user_with_manage_permission = AuthUtils.create_user('Bruce Wayne')
+
+        # set permissions
+        AuthUtils.add_permission_to_user_by_name(
+            'auth.group_management', self.user_with_manage_permission
+        )
 
     def test_groups_view_can_load(self):
         request = self.factory.get(reverse('groupmanagement:groups'))
         request.user = self.user
         response = views.groups_view(request)
         self.assertEqual(response.status_code, 200)
+
+    def test_management_view_can_load_for_user_with_permissions(self):
+        """
+        Test if user with management permissions can access the management view
+        :return:
+        """
+
+        request = self.factory.get(reverse('groupmanagement:management'))
+        request.user = self.user_with_manage_permission
+        response = views.group_management(request)
+        self.assertEqual(response.status_code, 200)
+
+    def test_management_view_doesnt_load_for_user_without_permissions(self):
+        """
+        Test if user without management permissions can't access the management view
+        :return:
+        """
+
+        request = self.factory.get(reverse('groupmanagement:management'))
+        request.user = self.user
+        response = views.group_management(request)
+        self.assertEqual(response.status_code, 302)
+
+    @override_settings(GROUPMANAGEMENT_AUTO_LEAVE=False)
+    def test_leave_requests_tab_visible(self):
+        """
+        Test if the leave requests tab is visible when GROUPMANAGEMENT_AUTO_LEAVE = False
+        :return:
+        """
+
+        request = self.factory.get(reverse('groupmanagement:management'))
+        request.user = self.user_with_manage_permission
+        response = views.group_management(request)
+
+        content = response_content_to_str(response)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIn('<a data-toggle="tab" href="#leave">', content)
+        self.assertIn('<div id="leave" class="tab-pane">', content)
+
+    @override_settings(GROUPMANAGEMENT_AUTO_LEAVE=True)
+    def test_leave_requests_tab_hidden(self):
+        """
+        Test if the leave requests tab is hidden when GROUPMANAGEMENT_AUTO_LEAVE = True
+        :return:
+        """
+
+        request = self.factory.get(reverse('groupmanagement:management'))
+        request.user = self.user_with_manage_permission
+        response = views.group_management(request)
+
+        content = response_content_to_str(response)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertNotIn('<a data-toggle="tab" href="#leave">', content)
+        self.assertNotIn('<div id="leave" class="tab-pane">', content)

allianceauth/groupmanagement/views.py

@@ -45,7 +45,11 @@ def group_management(request):
     logger.debug("Providing user {} with {} acceptrequests and {} leaverequests.".format(
         request.user, len(acceptrequests), len(leaverequests)))
 
-    render_items = {'acceptrequests': acceptrequests, 'leaverequests': leaverequests}
+    render_items = {
+        'acceptrequests': acceptrequests,
+        'leaverequests': leaverequests,
+        'auto_leave': getattr(settings, 'GROUPMANAGEMENT_AUTO_LEAVE', False),
+    }
 
     return render(request, 'groupmanagement/index.html', context=render_items)
 

allianceauth/notifications/__init__.py

@@ -1,9 +1,3 @@
+from .core import notify  # noqa: F401
+
 default_app_config = 'allianceauth.notifications.apps.NotificationsConfig'
-
-
-def notify(
-    user: object, title: str, message: str = None, level: str = 'info'
-) -> None:
-    """Sends a new notification to user. Convenience function to manager pendant."""
-    from .models import Notification
-    Notification.objects.notify_user(user, title, message, level)

allianceauth/notifications/core.py

@@ -0,0 +1,33 @@
+class NotifyApiWrapper:
+    """Wrapper to create notify API."""
+
+    def __call__(self, *args, **kwargs):  # provide old API for backwards compatibility
+        return self._add_notification(*args, **kwargs)
+
+    def danger(self, user: object, title: str, message: str = None) -> None:
+        """Add danger notification for user."""
+        self._add_notification(user, title, message, level="danger")
+
+    def info(self, user: object, title: str, message: str = None) -> None:
+        """Add info notification for user."""
+        self._add_notification(user=user, title=title, message=message, level="info")
+
+    def success(self, user: object, title: str, message: str = None) -> None:
+        """Add success notification for user."""
+        self._add_notification(user, title, message, level="success")
+
+    def warning(self, user: object, title: str, message: str = None) -> None:
+        """Add warning notification for user."""
+        self._add_notification(user, title, message, level="warning")
+
+    def _add_notification(
+        self, user: object, title: str, message: str = None, level: str = "info"
+    ) -> None:
+        from .models import Notification
+
+        Notification.objects.notify_user(
+            user=user, title=title, message=message, level=level
+        )
+
+
+notify = NotifyApiWrapper()

allianceauth/notifications/managers.py

@@ -49,19 +49,22 @@ class NotificationManager(models.Manager):
         logger.info("Created notification %s", obj)
         return obj
 
-    def _max_notifications_per_user(self):
-        """return the maximum number of notifications allowed per user"""
-        max_notifications = getattr(settings, 'NOTIFICATIONS_MAX_PER_USER', None)
-        if (
-            max_notifications is None
-            or not isinstance(max_notifications, int)
-            or max_notifications < 0
-        ):
+    def _max_notifications_per_user(self) -> int:
+        """Maximum number of notifications allowed per user."""
+        max_notifications = getattr(
+            settings,
+            "NOTIFICATIONS_MAX_PER_USER",
+            self.model.NOTIFICATIONS_MAX_PER_USER_DEFAULT
+        )
+        try:
+            max_notifications = int(max_notifications)
+        except ValueError:
+            max_notifications = None
+        if max_notifications is None or max_notifications < 0:
             logger.warning(
-                'NOTIFICATIONS_MAX_PER_USER setting is invalid. Using default.'
+                "NOTIFICATIONS_MAX_PER_USER setting is invalid. Using default."
             )
             max_notifications = self.model.NOTIFICATIONS_MAX_PER_USER_DEFAULT
-
         return max_notifications
 
     def user_unread_count(self, user_pk: int) -> int:

allianceauth/notifications/templates/notifications/list.html

@@ -5,91 +5,34 @@
 {% block page_title %}{% translate "Notifications" %}{% endblock %}
 
 {% block content %}
-    <div class="col-lg-12">
-        <h1 class="page-header text-center">{% translate "Notifications" %}</h1>
-        <div class="col-lg-12 container" id="example">
-            <div class="row">
-                <div class="col-lg-12">
-                    <div class="panel panel-default">
-                        <div class="panel-heading">
-                            <ul class="nav nav-pills">
-                                <li class="active"><a data-toggle="pill" href="#unread">{% translate "Unread" %}
-                                    <b>({{ unread|length }})</b></a></li>
-                                <li><a data-toggle="pill" href="#read">{% translate "Read" %} <b>({{ read|length }})</b></a>
-                                </li>
-                                <div class="pull-right">
-                                    <a href="{% url 'notifications:mark_all_read' %}" class="btn btn-primary">{% translate "Mark All Read" %}</a>
-                                    <a href="{% url 'notifications:delete_all_read' %}" class="btn btn-danger">{% translate "Delete All Read" %}</a>
-                                </div>
-                            </ul>
-                        </div>
-                        <div class="panel-body">
-                            <div class="tab-content">
-                                <div id="unread" class="tab-pane fade in active">
-                                    <div class="table-responsive">
-                                        {% if unread %}
-                                            <table class="table table-condensed table-hover table-striped">
-                                                <tr>
-                                                    <th class="text-center">{% translate "Timestamp" %}</th>
-                                                    <th class="text-center">{% translate "Title" %}</th>
-                                                    <th class="text-center">{% translate "Action" %}</th>
-                                                </tr>
-                                                {% for notif in unread %}
-                                                    <tr class="{{ notif.level }}">
-                                                        <td class="text-center">{{ notif.timestamp }}</td>
-                                                        <td class="text-center">{{ notif.title }}</td>
-                                                        <td class="text-center">
-                                                            <a href="{% url 'notifications:view' notif.id %}" class="btn btn-success" title="View">
-                                                                <span class="glyphicon glyphicon-eye-open"></span>
-                                                            </a>
-                                                            <a href="{% url 'notifications:remove' notif.id %}" class="btn btn-danger" title="Remove">
-                                                                <span class="glyphicon glyphicon-remove"></span>
-                                                            </a>
-                                                        </td>
-                                                    </tr>
-                                                {% endfor %}
-                                            </table>
-                                        {% else %}
-                                            <div class="alert alert-warning text-center">{% translate "No unread notifications." %}</div>
-                                        {% endif %}
-                                    </div>
-                                </div>
-                                <div id="read" class="tab-pane fade">
-                                    <div class="panel-body">
-                                        <div class="table-responsive">
-                                            {% if read %}
-                                                <table class="table table-condensed table-hover table-striped">
-                                                    <tr>
-                                                        <th class="text-center">{% translate "Timestamp" %}</th>
-                                                        <th class="text-center">{% translate "Title" %}</th>
-                                                        <th class="text-center">{% translate "Action" %}</th>
-                                                    </tr>
-                                                    {% for notif in read %}
-                                                        <tr class="{{ notif.level }}">
-                                                            <td class="text-center">{{ notif.timestamp }}</td>
-                                                            <td class="text-center">{{ notif.title }}</td>
-                                                            <td class="text-center">
-                                                                <a href="{% url 'notifications:view' notif.id %}" class="btn btn-success" title="View">
-                                                                    <span class="glyphicon glyphicon-eye-open"></span>
-                                                                </a>
-                                                                <a href="{% url 'notifications:remove' notif.id %}" class="btn btn-danger" title="remove">
-                                                                    <span class="glyphicon glyphicon-remove"></span>
-                                                                </a>
-                                                            </td>
-                                                        </tr>
-                                                    {% endfor %}
-                                                </table>
-                                            {% else %}
-                                                <div class="alert alert-warning text-center">{% translate "No read notifications." %}</div>
-                                            {% endif %}
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
+    <h1 class="page-header text-center">{% translate "Notifications" %}</h1>
+
+    <div class="panel panel-default">
+
+        <div class="panel-heading">
+            <ul class="nav nav-pills">
+                <li class="active"><a data-toggle="tab" href="#unread">{% translate "Unread" %}<b>({{ unread|length }})</b></a></li>
+                <li><a data-toggle="tab" href="#read">{% translate "Read" %} <b>({{ read|length }})</b></a></li>
+                <div class="pull-right">
+                    <a href="{% url 'notifications:mark_all_read' %}" class="btn btn-warning">{% translate "Mark All Read" %}</a>
+                    <a href="{% url 'notifications:delete_all_read' %}" class="btn btn-danger">{% translate "Delete All Read" %}</a>
                 </div>
+            </ul>
+        </div>
+
+        <div class="panel-body">
+            <div class="tab-content">
+
+                <div id="unread" class="tab-pane fade in active">
+                    {% include "notifications/list_partial.html" with notifications=unread %}
+                </div>
+
+                <div id="read" class="tab-pane fade">
+                    {% include "notifications/list_partial.html" with notifications=read %}
+                </div>
+
             </div>
         </div>
+
     </div>
 {% endblock %}

allianceauth/notifications/templates/notifications/list_partial.html

@@ -0,0 +1,29 @@
+{% load i18n %}
+
+{% if notifications %}
+    <div class="table-responsive">
+        <table class="table table-condensed table-hover table-striped">
+            <tr>
+                <th class="text-center">{% translate "Timestamp" %}</th>
+                <th class="text-center">{% translate "Title" %}</th>
+                <th class="text-center">{% translate "Action" %}</th>
+            </tr>
+            {% for notif in notifications %}
+                <tr class="{{ notif.level }}">
+                    <td class="text-center">{{ notif.timestamp }}</td>
+                    <td class="text-center">{{ notif.title }}</td>
+                    <td class="text-center">
+                        <a href="{% url 'notifications:view' notif.id %}" class="btn btn-primary" title="View">
+                            <span class="glyphicon glyphicon-eye-open"></span>
+                        </a>
+                        <a href="{% url 'notifications:remove' notif.id %}" class="btn btn-danger" title="Remove">
+                            <span class="glyphicon glyphicon-remove"></span>
+                        </a>
+                    </td>
+                </tr>
+            {% endfor %}
+        </table>
+    </div>
+{% else %}
+    <div class="alert alert-default text-center">{% translate "No notifications." %}</div>
+{% endif %}

allianceauth/notifications/templates/notifications/view.html

@@ -5,25 +5,22 @@
 {% block page_title %}{% translate "View Notification" %}{% endblock page_title %}
 
 {% block content %}
+    <h1 class="page-header text-center">
+        {% translate "View Notification" %}
+        <div class="text-right">
+            <a href="{% url 'notifications:list' %}" class="btn btn-primary btn-lg">
+                <span class="glyphicon glyphicon-arrow-left"></span>
+            </a>
+        </div>
+    </h1>
 
-    <div class="col-lg-12">
-        <h1 class="page-header text-center">
-            {% translate "View Notification" %}
-            <div class="text-right">
-                <a href="{% url 'notifications:list' %}" class="btn btn-primary btn-lg">
-                    <span class="glyphicon glyphicon-arrow-left"></span>
-                </a>
-            </div>
-        </h1>
-        <div class="col-lg-12 container">
-            <div class="row">
-                <div class="col-lg-12">
-                    <div class="panel panel-{{ notif.level }}">
-                        <div class="panel-heading">{{ notif.timestamp }} {{ notif.title }}</div>
-                        <div class="panel-body"><pre>{{ notif.message }}</pre></div>
-                    </div>
-                </div>
+    <div class="row">
+        <div class="col-lg-12">
+            <div class="panel panel-{{ notif.level }}">
+                <div class="panel-heading">{{ notif.timestamp }} {{ notif.title }}</div>
+                <div class="panel-body"><pre>{{ notif.message }}</pre></div>
             </div>
         </div>
     </div>
+
 {% endblock %}

allianceauth/notifications/tests/test_core.py

@@ -0,0 +1,85 @@
+from django.test import TestCase
+
+from allianceauth.tests.auth_utils import AuthUtils
+
+from ..core import NotifyApiWrapper
+from ..models import Notification
+
+
+class TestUserNotificationCount(TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        super().setUpClass()
+        cls.user = AuthUtils.create_user("bruce_wayne")
+
+    def test_should_add_danger_notification(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify.danger(user=self.user, title="title", message="message")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.DANGER)
+
+    def test_should_add_info_notification(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify.info(user=self.user, title="title", message="message")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.INFO)
+
+    def test_should_add_success_notification(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify.success(user=self.user, title="title", message="message")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.SUCCESS)
+
+    def test_should_add_warning_notification(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify.warning(user=self.user, title="title", message="message")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.WARNING)
+
+    def test_should_add_info_notification_via_callable(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify(user=self.user, title="title", message="message")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.INFO)
+
+    def test_should_add_danger_notification_via_callable(self):
+        # given
+        notify = NotifyApiWrapper()
+        # when
+        notify(user=self.user, title="title", message="message", level="danger")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, Notification.Level.DANGER)

allianceauth/notifications/tests/test_init.py

@@ -4,11 +4,8 @@ from allianceauth.tests.auth_utils import AuthUtils
 from .. import notify
 from ..models import Notification
 
-MODULE_PATH = 'allianceauth.notifications'
-
 
 class TestUserNotificationCount(TestCase):
-
     @classmethod
     def setUpTestData(cls):
         cls.user = AuthUtils.create_user('magic_mike')
@@ -23,6 +20,18 @@ class TestUserNotificationCount(TestCase):
             alliance_name='RIDERS'
         )
 
-    def test_can_notify(self):
-        notify(self.user, 'dummy')
+    def test_can_notify_short(self):
+        # when
+        notify(self.user, "dummy")
+        # then
         self.assertEqual(Notification.objects.filter(user=self.user).count(), 1)
+
+    def test_can_notify_full(self):
+        # when
+        notify(user=self.user, title="title", message="message", level="danger")
+        # then
+        obj = Notification.objects.first()
+        self.assertEqual(obj.user, self.user)
+        self.assertEqual(obj.title, "title")
+        self.assertEqual(obj.message, "message")
+        self.assertEqual(obj.level, "danger")

allianceauth/notifications/tests/test_managers.py

@@ -1,5 +1,6 @@
 from unittest.mock import patch
 
+from django.conf import settings
 from django.contrib.auth.models import User
 from django.test import TestCase, override_settings
 
@@ -113,29 +114,53 @@ class TestUserNotify(TestCase):
         self.assertSetEqual(result, expected)
 
 
+@patch("allianceauth.notifications.managers.logger")
 @patch(
-    MODULE_PATH + '.Notification.NOTIFICATIONS_MAX_PER_USER_DEFAULT',
+    MODULE_PATH + ".Notification.NOTIFICATIONS_MAX_PER_USER_DEFAULT",
     NOTIFICATIONS_MAX_PER_USER_DEFAULT
 )
 class TestMaxNotificationsPerUser(TestCase):
-
-    @override_settings(NOTIFICATIONS_MAX_PER_USER=None)
-    def test_reset_to_default_if_not_defined(self):
+    @override_settings(NOTIFICATIONS_MAX_PER_USER=42)
+    def test_should_use_custom_integer_setting(self, mock_logger):
+        # when
         result = Notification.objects._max_notifications_per_user()
-        expected = NOTIFICATIONS_MAX_PER_USER_DEFAULT
-        self.assertEqual(result, expected)
+        # then
+        self.assertEqual(result, 42)
+        self.assertFalse(mock_logger.warning.called)
 
-    @override_settings(NOTIFICATIONS_MAX_PER_USER='11')
-    def test_reset_to_default_if_not_int(self):
+    @override_settings(NOTIFICATIONS_MAX_PER_USER="42")
+    def test_should_use_custom_string_setting(self, mock_logger):
+        # when
         result = Notification.objects._max_notifications_per_user()
-        expected = NOTIFICATIONS_MAX_PER_USER_DEFAULT
-        self.assertEqual(result, expected)
+        # then
+        self.assertEqual(result, 42)
+        self.assertFalse(mock_logger.warning.called)
+
+    @override_settings()
+    def test_should_use_default_if_not_defined(self, mock_logger):
+        # given
+        del settings.NOTIFICATIONS_MAX_PER_USER
+        # when
+        result = Notification.objects._max_notifications_per_user()
+        # then
+        self.assertEqual(result, NOTIFICATIONS_MAX_PER_USER_DEFAULT)
+        self.assertFalse(mock_logger.warning.called)
+
+    @override_settings(NOTIFICATIONS_MAX_PER_USER="abc")
+    def test_should_reset_to_default_if_not_int(self, mock_logger):
+        # when
+        result = Notification.objects._max_notifications_per_user()
+        # then
+        self.assertEqual(result, NOTIFICATIONS_MAX_PER_USER_DEFAULT)
+        self.assertTrue(mock_logger.warning.called)
 
     @override_settings(NOTIFICATIONS_MAX_PER_USER=-1)
-    def test_reset_to_default_if_lt_zero(self):
+    def test_should_reset_to_default_if_lt_zero(self, mock_logger):
+        # when
         result = Notification.objects._max_notifications_per_user()
-        expected = NOTIFICATIONS_MAX_PER_USER_DEFAULT
-        self.assertEqual(result, expected)
+        # then
+        self.assertEqual(result, NOTIFICATIONS_MAX_PER_USER_DEFAULT)
+        self.assertTrue(mock_logger.warning.called)
 
 
 @patch('allianceauth.notifications.managers.cache')

allianceauth/permissions_tool/templates/permissions_tool/audit.html

@@ -73,6 +73,8 @@
                 ],
                 bootstrap: true
             },
+            "stateSave": true,
+            "stateDuration": 0,
             drawCallback: function ( settings ) {
                 let api = this.api();
                 let rows = api.rows( {page:'current'} ).nodes();

allianceauth/permissions_tool/templates/permissions_tool/overview.html

@@ -106,8 +106,10 @@
                         idx: 1
                     }
                 ],
-                bootstrap: true
+                bootstrap: true,
             },
+            "stateSave": true,
+            "stateDuration": 0,
             drawCallback: function ( settings ) {
                 let api = this.api();
                 let rows = api.rows( {page:'current'} ).nodes();

allianceauth/services/modules/teamspeak3/admin.py

@@ -1,7 +1,8 @@
 from django.contrib import admin
-
-from .models import AuthTS, Teamspeak3User, StateGroup
+from django.contrib.auth.models import Group
+from .models import AuthTS, Teamspeak3User, StateGroup, TSgroup
 from ...admin import ServicesUserAdmin
+from allianceauth.groupmanagement.models import ReservedGroupName
 
 
 @admin.register(Teamspeak3User)
@@ -25,6 +26,16 @@ class AuthTSgroupAdmin(admin.ModelAdmin):
     fields = ('auth_group', 'ts_group')
     filter_horizontal = ('ts_group',)
 
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == 'auth_group':
+            kwargs['queryset'] = Group.objects.exclude(name__in=ReservedGroupName.objects.values_list('name', flat=True))
+        return super().formfield_for_foreignkey(db_field, request, **kwargs)
+
+    def formfield_for_manytomany(self, db_field, request, **kwargs):
+        if db_field.name == 'ts_group':
+            kwargs['queryset'] = TSgroup.objects.exclude(ts_group_name__in=ReservedGroupName.objects.values_list('name', flat=True))
+        return super().formfield_for_manytomany(db_field, request, **kwargs)
+
     def _ts_group(self, obj):
         return [x for x in obj.ts_group.all().order_by('ts_group_id')]
 

allianceauth/services/modules/teamspeak3/manager.py

@@ -4,6 +4,7 @@ from django.conf import settings
 
 from .util.ts3 import TS3Server, TeamspeakError
 from .models import TSgroup
+from allianceauth.groupmanagement.models import ReservedGroupName
 
 logger = logging.getLogger(__name__)
 
@@ -156,32 +157,25 @@ class Teamspeak3Manager:
             logger.info(f"Removed user id {uid} from group id {groupid} on TS3 server.")
 
     def _sync_ts_group_db(self):
-        logger.debug("_sync_ts_group_db function called.")
         try:
             remote_groups = self._group_list()
-            local_groups = TSgroup.objects.all()
-            logger.debug("Comparing remote groups to TSgroup objects: %s" % local_groups)
-            for key in remote_groups:
-                logger.debug(f"Typecasting remote_group value at position {key} to int: {remote_groups[key]}")
-                remote_groups[key] = int(remote_groups[key])
+            managed_groups = {g:int(remote_groups[g]) for g in remote_groups if g in set(remote_groups.keys()) - set(ReservedGroupName.objects.values_list('name', flat=True))}
+            remove = TSgroup.objects.exclude(ts_group_id__in=managed_groups.values())
+
+            if remove:
+                logger.debug(f"Deleting {remove.count()} TSgroup models: not found on server, or reserved name.")
+                remove.delete()
+
+            add = {g:managed_groups[g] for g in managed_groups if managed_groups[g] in set(managed_groups.values()) - set(TSgroup.objects.values_list("ts_group_id", flat=True))}
+            if add:
+                logger.debug(f"Adding {len(add)} new TSgroup models.")
+                models = [TSgroup(ts_group_name=name, ts_group_id=add[name]) for name in add]
+                TSgroup.objects.bulk_create(models)
 
-            for group in local_groups:
-                logger.debug("Checking local group %s" % group)
-                if group.ts_group_id not in remote_groups.values():
-                    logger.debug(
-                        f"Local group id {group.ts_group_id} not found on server. Deleting model {group}")
-                    TSgroup.objects.filter(ts_group_id=group.ts_group_id).delete()
-            for key in remote_groups:
-                g = TSgroup(ts_group_id=remote_groups[key], ts_group_name=key)
-                q = TSgroup.objects.filter(ts_group_id=g.ts_group_id)
-                if not q:
-                    logger.debug("Local group does not exist for TS group {}. Creating TSgroup model {}".format(
-                        remote_groups[key], g))
-                    g.save()
         except TeamspeakError as e:
-            logger.error("Error occured while syncing TS group db: %s" % str(e))
-        except:
-            logger.exception("An unhandled exception has occured while syncing TS groups.")
+            logger.error(f"Error occurred while syncing TS group db: {str(e)}")
+        except Exception:
+            logger.exception(f"An unhandled exception has occurred while syncing TS groups.")
 
     def add_user(self, user, fmt_name):
         username_clean = self.__santatize_username(fmt_name[:30])
@@ -240,7 +234,7 @@ class Teamspeak3Manager:
                 logger.exception(f"Failed to delete user id {uid} from TS3 - received response {ret}")
                 return False
         else:
-            logger.warn("User with id %s not found on TS3 server. Assuming succesful deletion." % uid)
+            logger.warning("User with id %s not found on TS3 server. Assuming succesful deletion." % uid)
             return True
 
     def check_user_exists(self, uid):
@@ -270,7 +264,8 @@ class Teamspeak3Manager:
                     addgroups.append(ts_groups[ts_group_key])
             for user_ts_group_key in user_ts_groups:
                 if user_ts_groups[user_ts_group_key] not in ts_groups.values():
-                    remgroups.append(user_ts_groups[user_ts_group_key])
+                    if not ReservedGroupName.objects.filter(name=user_ts_group_key).exists():
+                        remgroups.append(user_ts_groups[user_ts_group_key])
 
             for g in addgroups:
                 logger.info(f"Adding Teamspeak user {userid} into group {g}")

allianceauth/services/modules/teamspeak3/tests.py

@@ -5,16 +5,18 @@ from django import urls
 from django.contrib.auth.models import User, Group, Permission
 from django.core.exceptions import ObjectDoesNotExist
 from django.db.models import signals
+from django.contrib.admin import AdminSite
 
 from allianceauth.tests.auth_utils import AuthUtils
 from .auth_hooks import Teamspeak3Service
 from .models import Teamspeak3User, AuthTS, TSgroup, StateGroup
 from .tasks import Teamspeak3Tasks
 from .signals import m2m_changed_authts_group, post_save_authts, post_delete_authts
+from .admin import AuthTSgroupAdmin
 
 from .manager import Teamspeak3Manager
 from .util.ts3 import TeamspeakError
-from allianceauth.authentication.models import State
+from allianceauth.groupmanagement.models import ReservedGroupName
 
 MODULE_PATH = 'allianceauth.services.modules.teamspeak3'
 DEFAULT_AUTH_GROUP = 'Member'
@@ -315,6 +317,9 @@ class Teamspeak3SignalsTestCase(TestCase):
 
 
 class Teamspeak3ManagerTestCase(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.reserved = ReservedGroupName.objects.create(name='reserved', reason='tests', created_by='Bob, praise be!')
 
     @staticmethod
     def my_side_effect(*args, **kwargs):
@@ -334,8 +339,135 @@ class Teamspeak3ManagerTestCase(TestCase):
         manager._server = server
 
         # create test data
-        user = User.objects.create_user("dummy")
-        user.profile.state = State.objects.filter(name="Member").first()
+        user = AuthUtils.create_user("dummy")
+        AuthUtils.assign_state(user, AuthUtils.get_member_state())
 
         # perform test
         manager.add_user(user, "Dummy User")
+
+    @mock.patch.object(Teamspeak3Manager, '_get_userid')
+    @mock.patch.object(Teamspeak3Manager, '_user_group_list')
+    @mock.patch.object(Teamspeak3Manager, '_add_user_to_group')
+    @mock.patch.object(Teamspeak3Manager, '_remove_user_from_group')
+    def test_update_groups_add(self, remove, add, groups, userid):
+        """Add to one group"""
+        userid.return_value = 1
+        groups.return_value = {'test': 1}
+
+        Teamspeak3Manager().update_groups(1, {'test': 1, 'dummy': 2})
+        self.assertEqual(add.call_count, 1)
+        self.assertEqual(remove.call_count, 0)
+        self.assertEqual(add.call_args[0][1], 2)
+
+    @mock.patch.object(Teamspeak3Manager, '_get_userid')
+    @mock.patch.object(Teamspeak3Manager, '_user_group_list')
+    @mock.patch.object(Teamspeak3Manager, '_add_user_to_group')
+    @mock.patch.object(Teamspeak3Manager, '_remove_user_from_group')
+    def test_update_groups_remove(self, remove, add, groups, userid):
+        """Remove from one group"""
+        userid.return_value = 1
+        groups.return_value = {'test': '1', 'dummy': '2'}
+
+        Teamspeak3Manager().update_groups(1, {'test': 1})
+        self.assertEqual(add.call_count, 0)
+        self.assertEqual(remove.call_count, 1)
+        self.assertEqual(remove.call_args[0][1], 2)
+
+    @mock.patch.object(Teamspeak3Manager, '_get_userid')
+    @mock.patch.object(Teamspeak3Manager, '_user_group_list')
+    @mock.patch.object(Teamspeak3Manager, '_add_user_to_group')
+    @mock.patch.object(Teamspeak3Manager, '_remove_user_from_group')
+    def test_update_groups_remove_reserved(self, remove, add, groups, userid):
+        """Remove from one group, but do not touch reserved group"""
+        userid.return_value = 1
+        groups.return_value = {'test': 1, 'dummy': 2, self.reserved.name: 3}
+
+        Teamspeak3Manager().update_groups(1, {'test': 1})
+        self.assertEqual(add.call_count, 0)
+        self.assertEqual(remove.call_count, 1)
+        self.assertEqual(remove.call_args[0][1], 2)
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_create(self, group_list):
+        """Populate the list of all TSgroups"""
+        group_list.return_value = {'allowed':'1', 'also allowed':'2'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 2)
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_delete(self, group_list):
+        """Populate the list of all TSgroups, and delete one which no longer exists"""
+        TSgroup.objects.create(ts_group_name='deleted', ts_group_id=3)
+        group_list.return_value = {'allowed': '1'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 1)
+        self.assertFalse(TSgroup.objects.filter(ts_group_name='deleted').exists())
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_dont_create_reserved(self, group_list):
+        """Populate the list of all TSgroups, ignoring a reserved group name"""
+        group_list.return_value = {'allowed': '1', 'reserved': '4'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 1)
+        self.assertFalse(TSgroup.objects.filter(ts_group_name='reserved').exists())
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_delete_reserved(self, group_list):
+        """Populate the list of all TSgroups, deleting the TSgroup model for one which has become reserved"""
+        TSgroup.objects.create(ts_group_name='reserved', ts_group_id=4)
+        group_list.return_value = {'allowed': '1', 'reserved': '4'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 1)
+        self.assertFalse(TSgroup.objects.filter(ts_group_name='reserved').exists())
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_partial_addition(self, group_list):
+        """Some TSgroups already exist in database, add new ones"""
+        TSgroup.objects.create(ts_group_name='allowed', ts_group_id=1)
+        group_list.return_value = {'allowed': '1', 'also allowed': '2'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 2)
+
+    @mock.patch.object(Teamspeak3Manager, '_group_list')
+    def test_sync_group_db_partial_removal(self, group_list):
+        """One TSgroup has been deleted on server, so remove its model"""
+        TSgroup.objects.create(ts_group_name='allowed', ts_group_id=1)
+        TSgroup.objects.create(ts_group_name='also allowed', ts_group_id=2)
+        group_list.return_value = {'allowed': '1'}
+        Teamspeak3Manager()._sync_ts_group_db()
+        self.assertEqual(TSgroup.objects.all().count(), 1)
+
+
+class MockRequest:
+    pass
+
+
+class MockSuperUser:
+    def has_perm(self, perm, obj=None):
+        return True
+
+
+request = MockRequest()
+request.user = MockSuperUser()
+
+
+class Teamspeak3AdminTestCase(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.site = AdminSite()
+        cls.admin = AuthTSgroupAdmin(AuthTS, cls.site)
+        cls.group = Group.objects.create(name='test')
+        cls.ts_group = TSgroup.objects.create(ts_group_name='test')
+
+    def test_field_queryset_no_reserved_names(self):
+        """Ensure all groups are listed when no reserved names"""
+        form = self.admin.get_form(request)
+        self.assertQuerysetEqual(form.base_fields['auth_group']._get_queryset(), Group.objects.all())
+        self.assertQuerysetEqual(form.base_fields['ts_group']._get_queryset(), TSgroup.objects.all())
+
+    def test_field_queryset_reserved_names(self):
+        """Ensure reserved group names are filtered out"""
+        ReservedGroupName.objects.bulk_create([ReservedGroupName(name='test', reason='tests', created_by='Bob')])
+        form = self.admin.get_form(request)
+        self.assertQuerysetEqual(form.base_fields['auth_group']._get_queryset(), Group.objects.none())
+        self.assertQuerysetEqual(form.base_fields['ts_group']._get_queryset(), TSgroup.objects.none())

allianceauth/services/signals.py

@@ -1,4 +1,5 @@
 import logging
+from functools import partial
 
 from django.contrib.auth.models import User, Group, Permission
 from django.core.exceptions import ObjectDoesNotExist
@@ -8,7 +9,7 @@ from django.db.models.signals import pre_delete
 from django.db.models.signals import pre_save
 from django.dispatch import receiver
 from .hooks import ServicesHook
-from .tasks import disable_user
+from .tasks import disable_user, update_groups_for_user
 
 from allianceauth.authentication.models import State, UserProfile
 from allianceauth.authentication.signals import state_changed
@@ -19,21 +20,27 @@ logger = logging.getLogger(__name__)
 
 @receiver(m2m_changed, sender=User.groups.through)
 def m2m_changed_user_groups(sender, instance, action, *args, **kwargs):
-    logger.debug(f"Received m2m_changed from {instance} groups with action {action}")
-
-    def trigger_service_group_update():
-        logger.debug("Triggering service group update for %s" % instance)
-        # Iterate through Service hooks
-        for svc in ServicesHook.get_services():
-            try:
-                svc.validate_user(instance)
-                svc.update_groups(instance)
-            except:
-                logger.exception(f'Exception running update_groups for services module {svc} on user {instance}')
-
-    if instance.pk and (action == "post_add" or action == "post_remove" or action == "post_clear"):
-        logger.debug("Waiting for commit to trigger service group update for %s" % instance)
-        transaction.on_commit(trigger_service_group_update)
+    logger.debug(
+        "%s: Received m2m_changed from groups with action %s", instance, action
+    )
+    if instance.pk and (
+        action == "post_add" or action == "post_remove" or action == "post_clear"
+    ):
+        if isinstance(instance, User):
+            logger.debug(
+                "Waiting for commit to trigger service group update for %s", instance
+            )
+            transaction.on_commit(partial(update_groups_for_user.delay, instance.pk))
+        elif (
+            isinstance(instance, Group)
+            and kwargs.get("model") is User
+            and "pk_set" in kwargs
+        ):
+            for user_pk in kwargs["pk_set"]:
+                logger.debug(
+                    "%s: Waiting for commit to trigger service group update for user", user_pk
+                )
+                transaction.on_commit(partial(update_groups_for_user.delay, user_pk))
 
 
 @receiver(m2m_changed, sender=User.user_permissions.through)

allianceauth/services/tasks.py

@@ -47,3 +47,20 @@ def disable_user(user):
     for svc in ServicesHook.get_services():
         if svc.service_active_for_user(user):
             svc.delete_user(user)
+
+
+@shared_task
+def update_groups_for_user(user_pk: int) -> None:
+    """Update groups for all services registered to a user."""
+    user = User.objects.get(pk=user_pk)
+    logger.debug("%s: Triggering service group update for user", user)
+    for svc in ServicesHook.get_services():
+        try:
+            svc.validate_user(user)
+            svc.update_groups(user)
+        except Exception:
+            logger.exception(
+                'Exception running update_groups for services module %s on user %s',
+                svc,
+                user
+            )

allianceauth/services/tests/test_signals.py

@@ -1,7 +1,7 @@
 from copy import deepcopy
 from unittest import mock
 
-from django.test import TestCase
+from django.test import override_settings, TestCase, TransactionTestCase
 from django.contrib.auth.models import Group, Permission
 
 from allianceauth.authentication.models import State
@@ -9,6 +9,9 @@ from allianceauth.eveonline.models import EveCharacter
 from allianceauth.tests.auth_utils import AuthUtils
 
 
+MODULE_PATH = 'allianceauth.services.signals'
+
+
 class ServicesSignalsTestCase(TestCase):
     def setUp(self):
         self.member = AuthUtils.create_user('auth_member', disconnect_signals=True)
@@ -17,17 +20,12 @@ class ServicesSignalsTestCase(TestCase):
         )
         self.none_user = AuthUtils.create_user('none_user', disconnect_signals=True)
 
-    @mock.patch('allianceauth.services.signals.transaction')
-    @mock.patch('allianceauth.services.signals.ServicesHook')
-    def test_m2m_changed_user_groups(self, services_hook, transaction):
+    @mock.patch(MODULE_PATH + '.transaction', spec=True)
+    @mock.patch(MODULE_PATH + '.update_groups_for_user', spec=True)
+    def test_m2m_changed_user_groups(self, update_groups_for_user, transaction):
         """
         Test that update_groups hook function is called on user groups change
         """
-        svc = mock.Mock()
-        svc.update_groups.return_value = None
-        svc.validate_user.return_value = None
-
-        services_hook.get_services.return_value = [svc]
 
         # Overload transaction.on_commit so everything happens synchronously
         transaction.on_commit = lambda fn: fn()
@@ -39,17 +37,11 @@ class ServicesSignalsTestCase(TestCase):
         self.member.save()
 
         # Assert
-        self.assertTrue(services_hook.get_services.called)
+        self.assertTrue(update_groups_for_user.delay.called)
+        args, _ = update_groups_for_user.delay.call_args
+        self.assertEqual(self.member.pk, args[0])
 
-        self.assertTrue(svc.update_groups.called)
-        args, kwargs = svc.update_groups.call_args
-        self.assertEqual(self.member, args[0])
-
-        self.assertTrue(svc.validate_user.called)
-        args, kwargs = svc.validate_user.call_args
-        self.assertEqual(self.member, args[0])
-
-    @mock.patch('allianceauth.services.signals.disable_user')
+    @mock.patch(MODULE_PATH + '.disable_user')
     def test_pre_delete_user(self, disable_user):
         """
         Test that disable_member is called when a user is deleted
@@ -60,7 +52,7 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = disable_user.call_args
         self.assertEqual(self.none_user, args[0])
 
-    @mock.patch('allianceauth.services.signals.disable_user')
+    @mock.patch(MODULE_PATH + '.disable_user')
     def test_pre_save_user_inactivation(self, disable_user):
         """
         Test a user set inactive has disable_member called
@@ -72,7 +64,7 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = disable_user.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.disable_user')
+    @mock.patch(MODULE_PATH + '.disable_user')
     def test_disable_services_on_loss_of_main_character(self, disable_user):
         """
         Test a user set inactive has disable_member called
@@ -84,8 +76,8 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = disable_user.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.transaction')
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.transaction')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_m2m_changed_group_permissions(self, services_hook, transaction):
         from django.contrib.contenttypes.models import ContentType
         svc = mock.Mock()
@@ -116,8 +108,8 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = svc.validate_user.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.transaction')
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.transaction')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_m2m_changed_user_permissions(self, services_hook, transaction):
         from django.contrib.contenttypes.models import ContentType
         svc = mock.Mock()
@@ -145,8 +137,8 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = svc.validate_user.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.transaction')
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.transaction')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_m2m_changed_user_state_permissions(self, services_hook, transaction):
         from django.contrib.contenttypes.models import ContentType
         svc = mock.Mock()
@@ -180,7 +172,7 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = svc.validate_user.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_state_changed_services_validation_and_groups_update(self, services_hook):
         """Test a user changing state has service accounts validated and groups updated
         """
@@ -206,8 +198,7 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = svc.update_groups.call_args
         self.assertEqual(self.member, args[0])
 
-
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_state_changed_services_validation_and_groups_update_1(self, services_hook):
         """Test a user changing main has service accounts validated and sync updated
         """
@@ -238,7 +229,7 @@ class ServicesSignalsTestCase(TestCase):
         args, kwargs = svc.sync_nickname.call_args
         self.assertEqual(self.member, args[0])
 
-    @mock.patch('allianceauth.services.signals.ServicesHook')
+    @mock.patch(MODULE_PATH + '.ServicesHook')
     def test_state_changed_services_validation_and_groups_update_2(self, services_hook):
         """Test a user changing main has service does not have accounts validated
         and sync updated if the new main is equal to the old main
@@ -260,3 +251,71 @@ class ServicesSignalsTestCase(TestCase):
         self.assertFalse(services_hook.get_services.called)
         self.assertFalse(svc.validate_user.called)
         self.assertFalse(svc.sync_nickname.called)
+
+
+@mock.patch(
+    "allianceauth.services.modules.mumble.auth_hooks.MumbleService.update_groups"
+)
+@override_settings(CELERY_ALWAYS_EAGER=True, CELERY_EAGER_PROPAGATES_EXCEPTIONS=True)
+class TestUserGroupBulkUpdate(TransactionTestCase):
+    def test_should_run_user_service_check_when_group_added_to_user(
+        self, mock_update_groups
+    ):
+        # given
+        user = AuthUtils.create_user("Bruce Wayne")
+        AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        group = Group.objects.create(name="Group")
+        mock_update_groups.reset_mock()
+        # when
+        user.groups.add(group)
+        # then
+        users_updated = {obj[0][0] for obj in mock_update_groups.call_args_list}
+        self.assertSetEqual(users_updated, {user})
+
+    def test_should_run_user_service_check_when_multiple_groups_are_added_to_user(
+        self, mock_update_groups
+    ):
+        # given
+        user = AuthUtils.create_user("Bruce Wayne")
+        AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        group_1 = Group.objects.create(name="Group 1")
+        group_2 = Group.objects.create(name="Group 2")
+        mock_update_groups.reset_mock()
+        # when
+        user.groups.add(group_1, group_2)
+        # then
+        users_updated = {obj[0][0] for obj in mock_update_groups.call_args_list}
+        self.assertSetEqual(users_updated, {user})
+
+    def test_should_run_user_service_check_when_user_added_to_group(
+        self, mock_update_groups
+    ):
+        # given
+        user = AuthUtils.create_user("Bruce Wayne")
+        AuthUtils.add_main_character_2(user, "Bruce Wayne", 1001)
+        group = Group.objects.create(name="Group")
+        mock_update_groups.reset_mock()
+        # when
+        group.user_set.add(user)
+        # then
+        users_updated = {obj[0][0] for obj in mock_update_groups.call_args_list}
+        self.assertSetEqual(users_updated, {user})
+
+    def test_should_run_user_service_check_when_multiple_users_are_added_to_group(
+        self, mock_update_groups
+    ):
+        # given
+        user_1 = AuthUtils.create_user("Bruce Wayne")
+        AuthUtils.add_main_character_2(user_1, "Bruce Wayne", 1001)
+        user_2 = AuthUtils.create_user("Peter Parker")
+        AuthUtils.add_main_character_2(user_2, "Peter Parker", 1002)
+        user_3 = AuthUtils.create_user("Lex Luthor")
+        AuthUtils.add_main_character_2(user_3, "Lex Luthor", 1011)
+        group = Group.objects.create(name="Group")
+        user_1.groups.add(group)
+        mock_update_groups.reset_mock()
+        # when
+        group.user_set.add(user_2, user_3)
+        # then
+        users_updated = {obj[0][0] for obj in mock_update_groups.call_args_list}
+        self.assertSetEqual(users_updated, {user_2, user_3})

allianceauth/services/tests/test_tasks.py

@@ -3,32 +3,50 @@ from unittest import mock
 from celery_once import AlreadyQueued
 
 from django.core.cache import cache
-from django.test import TestCase
+from django.test import override_settings, TestCase
 
 from allianceauth.tests.auth_utils import AuthUtils
-from allianceauth.services.tasks import validate_services
+from allianceauth.services.tasks import validate_services, update_groups_for_user
 
 from ..tasks import DjangoBackend
 
 
+@override_settings(CELERY_ALWAYS_EAGER=True, CELERY_EAGER_PROPAGATES_EXCEPTIONS=True)
 class ServicesTasksTestCase(TestCase):
     def setUp(self):
         self.member = AuthUtils.create_user('auth_member')
 
     @mock.patch('allianceauth.services.tasks.ServicesHook')
     def test_validate_services(self, services_hook):
+        # given
         svc = mock.Mock()
         svc.validate_user.return_value = None
-
         services_hook.get_services.return_value = [svc]
-
+        # when
         validate_services.delay(self.member.pk)
-
+        # then
         self.assertTrue(services_hook.get_services.called)
         self.assertTrue(svc.validate_user.called)
-        args, kwargs = svc.validate_user.call_args
+        args, _ = svc.validate_user.call_args
         self.assertEqual(self.member, args[0])  # Assert correct user is passed to service hook function
 
+    @mock.patch('allianceauth.services.tasks.ServicesHook')
+    def test_update_groups_for_user(self, services_hook):
+        # given
+        svc = mock.Mock()
+        svc.validate_user.return_value = None
+        services_hook.get_services.return_value = [svc]
+        # when
+        update_groups_for_user.delay(self.member.pk)
+        # then
+        self.assertTrue(services_hook.get_services.called)
+        self.assertTrue(svc.validate_user.called)
+        args, _ = svc.validate_user.call_args
+        self.assertEqual(self.member, args[0])  # Assert correct user
+        self.assertTrue(svc.update_groups.called)
+        args, _ = svc.update_groups.call_args
+        self.assertEqual(self.member, args[0])  # Assert correct user
+
 
 class TestDjangoBackend(TestCase):
 

allianceauth/srp/templates/srp/data.html

@@ -267,7 +267,9 @@ ESC to cancel{% endblocktrans %}"id="blah"></i></th>
                     "targets": [4, 5],
                     "type": "num"
                 }
-            ]
+            ],
+            "stateSave": true,
+            "stateDuration": 0
         });
 
         // tooltip

allianceauth/static/css/auth-base.css

@@ -95,6 +95,11 @@ ul.list-group.list-group-horizontal > li.list-group-item {
     .table-aa > tbody > tr:last-child {
         border-bottom: none;
     }
+
+    .task-status-progress-bar {
+        font-size: 15px!important;
+        line-height: normal!important;
+    }
 }
 
 /* highlight active menu items

allianceauth/static/js/eve-time.js

@@ -1,58 +1,20 @@
 $(document).ready(function () {
     'use strict';
 
-    /**
-     * check time
-     * @param i
-     * @returns {string}
-     */
-    let checkTime = function (i) {
-        if (i < 10) {
-            i = '0' + i;
-        }
-
-        return i;
-    };
-
     /**
      * render a JS clock for Eve Time
      * @param element
-     * @param utcOffset
      */
-    let renderClock = function (element, utcOffset) {
-        let today = new Date();
-        let h = today.getUTCHours();
-        let m = today.getUTCMinutes();
-
-        h = h + utcOffset;
-
-        if (h > 24) {
-            h = h - 24;
-        }
-
-        if (h < 0) {
-            h = h + 24;
-        }
-
-        h = checkTime(h);
-        m = checkTime(m);
+    const renderClock = function (element) {
+        const datetimeNow = new Date();
+        const h = String(datetimeNow.getUTCHours()).padStart(2, '0');
+        const m = String(datetimeNow.getUTCMinutes()).padStart(2, '0');
 
         element.html(h + ':' + m);
-
-        setTimeout(function () {
-            renderClock(element, 0);
-        }, 500);
     };
 
-    /**
-     * functions that need to be executed on load
-     */
-    let init = function () {
-        renderClock($('.eve-time-wrapper .eve-time-clock'), 0);
-    };
-
-    /**
-     * start the show
-     */
-    init();
+    // Start the Eve time clock in the top menu bar
+    setInterval(function () {
+        renderClock($('.eve-time-wrapper .eve-time-clock'));
+    }, 500);
 });

allianceauth/templates/allianceauth/admin-status/celery_bar_partial.html

@@ -0,0 +1,12 @@
+{% load humanize %}
+{% load admin_status %}
+
+<div
+    class="progress-bar progress-bar-{{ level }} task-status-progress-bar"
+    role="progressbar"
+    aria-valuenow="{% decimal_widthratio tasks_count tasks_total 100 %}"
+    aria-valuemin="0"
+    aria-valuemax="100"
+    style="width: {% decimal_widthratio tasks_count tasks_total 100 %}%;">
+    <p style="margin-top:5px;">{% widthratio tasks_count tasks_total 100 %}%</p>
+</div>

allianceauth/templates/allianceauth/admin-status/overview.html

@@ -1,4 +1,6 @@
 {% load i18n %}
+{% load humanize %}
+
 <div class="col-sm-12">
     <div class="row vertical-flexbox-row2">
         <div class="col-sm-6">
@@ -75,29 +77,25 @@
             <div class="panel panel-primary" style="height:50%;">
                 <div class="panel-heading text-center"><h3 class="panel-title">{% translate "Task Queue" %}</h3></div>
                 <div class="panel-body flex-center-horizontal">
-                    <div class="progress" style="height: 21px;">
-                        <div class="progress-bar
-                            {% if task_queue_length > 500 %}
-                                progress-bar-danger
-                            {% elif task_queue_length > 100 %}
-                                progress-bar-warning
-                            {% else %}
-                                progress-bar-success
-                            {% endif %}
-                            " role="progressbar" aria-valuenow="{% widthratio task_queue_length 500 100 %}"
-                                aria-valuemin="0" aria-valuemax="100"
-                                style="width: {% widthratio task_queue_length 500 100 %}%;">
-                        </div>
+                    <p>
+                    {% blocktranslate with total=tasks_total|intcomma latest=earliest_task|timesince|default:"?" %}
+                    Status of {{ total }} processed tasks • last {{ latest }}
+                    {% endblocktranslate %}
+                    </p>
+                    <div
+                        class="progress"
+                        style="height: 21px;"
+                        title="{{ tasks_succeeded|intcomma }} succeeded, {{ tasks_retried|intcomma }} retried, {{ tasks_failed|intcomma }} failed"
+                    >
+                        {% include "allianceauth/admin-status/celery_bar_partial.html" with label="suceeded" level="success" tasks_count=tasks_succeeded %}
+                        {% include "allianceauth/admin-status/celery_bar_partial.html" with label="retried" level="info" tasks_count=tasks_retried %}
+                        {% include "allianceauth/admin-status/celery_bar_partial.html" with label="failed" level="danger" tasks_count=tasks_failed %}
                     </div>
-                    {% if task_queue_length < 0 %}
-                        {% translate "Error retrieving task queue length" %}
-                    {% else %}
-                        {% blocktrans trimmed count tasks=task_queue_length %}
-                        {{ tasks }} task
-                        {% plural %}
-                        {{ tasks }} tasks
-                        {% endblocktrans %}
-                    {% endif %}
+                    <p>
+                        {% blocktranslate with queue_length=task_queue_length|default_if_none:"?"|intcomma %}
+                        {{ queue_length }} queued tasks
+                        {% endblocktranslate %}
+                    </p>
                 </div>
             </div>
         </div>

allianceauth/templates/bundles/jquery-ui-css.html

@@ -1,3 +1,5 @@
-<!-- Start jQuery UI CSS from cdnjs -->
-<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.css" integrity="sha512-aOG0c6nPNzGk+5zjwyJaoRUgCdOrfSDhmMID2u4+OIslr0GjpLKo7Xm0Ao3xmpM4T8AmIouRkqwj1nrdVsLKEQ==" crossorigin="anonymous" referrerpolicy="no-referrer" />
-<!-- End jQuery UI CSS from cdnjs -->
+{% load static %}
+<!-- Start jQuery UI CSS from Alliance Auth -->
+<!-- CDNs all contain theme.css, which is not supposed to be in the base CSS, Which is why this is uniquely bundled in not using a CDN -->
+<link rel="stylesheet" href="{% static 'js/jquery-ui/1.12.1/css/jquery-ui.min.css' %}" integrity="sha512-7smZe1765O+Mm1UZH46SzaFClbRX7dEs01lB9lqU91oocmugWWfQXVQNVr5tEwktYSqwJMErEfr4GvflXMgTPA==" crossorigin="anonymous" referrerpolicy="no-referrer"/>
+<!-- End jQuery UI CSS from aa-gdpr -->

allianceauth/templatetags/admin_status.py

@@ -1,9 +1,11 @@
 import logging
+from typing import Optional
 
-import requests
 import amqp.exceptions
-from packaging.version import Version as Pep440Version, InvalidVersion
+import requests
 from celery.app import app_or_default
+from packaging.version import InvalidVersion
+from packaging.version import Version as Pep440Version
 
 from django import template
 from django.conf import settings
@@ -11,6 +13,7 @@ from django.core.cache import cache
 
 from allianceauth import __version__
 
+from ..authentication.task_statistics.counters import dashboard_results
 
 register = template.Library()
 
@@ -33,33 +36,62 @@ GITLAB_AUTH_ANNOUNCEMENT_ISSUES_URL = (
 logger = logging.getLogger(__name__)
 
 
+@register.simple_tag()
+def decimal_widthratio(this_value, max_value, max_width) -> str:
+    if max_value == 0:
+        return str(0)
+
+    return str(round(this_value/max_value * max_width, 2))
+
+
 @register.inclusion_tag('allianceauth/admin-status/overview.html')
 def status_overview() -> dict:
     response = {
-        'notifications': list(),
-        'current_version': __version__,
-        'task_queue_length': -1,
+        "notifications": list(),
+        "current_version": __version__,
+        "task_queue_length": None,
+        "tasks_succeeded": 0,
+        "tasks_retried": 0,
+        "tasks_failed": 0,
+        "tasks_total": 0,
+        "tasks_hours": 0,
+        "earliest_task": None
     }
     response.update(_current_notifications())
     response.update(_current_version_summary())
     response.update({'task_queue_length': _fetch_celery_queue_length()})
+    response.update(_celery_stats())
     return response
 
 
-def _fetch_celery_queue_length() -> int:
+def _celery_stats() -> dict:
+    hours = getattr(settings, "ALLIANCEAUTH_DASHBOARD_TASKS_MAX_HOURS", 24)
+    results = dashboard_results(hours=hours)
+    return {
+        "tasks_succeeded": results.succeeded,
+        "tasks_retried": results.retried,
+        "tasks_failed": results.failed,
+        "tasks_total": results.total,
+        "tasks_hours": results.hours,
+        "earliest_task": results.earliest_task
+    }
+
+
+def _fetch_celery_queue_length() -> Optional[int]:
     try:
         app = app_or_default(None)
         with app.connection_or_acquire() as conn:
-            return conn.default_channel.queue_declare(
+            result = conn.default_channel.queue_declare(
                 queue=getattr(settings, 'CELERY_DEFAULT_QUEUE', 'celery'),
                 passive=True
-            ).message_count
+            )
+            return result.message_count
     except amqp.exceptions.ChannelError:
         # Queue doesn't exist, probably empty
         return 0
     except Exception:
         logger.exception("Failed to get celery queue length")
-    return -1
+    return None
 
 
 def _current_notifications() -> dict:

allianceauth/tests/auth_utils.py

@@ -1,3 +1,5 @@
+from typing import List
+
 from django.contrib.auth.models import User, Group, Permission
 from django.db.models.signals import m2m_changed, pre_save, post_save
 from django.test import TestCase
@@ -174,7 +176,7 @@ class AuthUtils:
         alliance_id=None,
         alliance_name='',
         disconnect_signals=False
-    ):
+    ) -> EveCharacter:
         """new version that works in all cases"""
         if disconnect_signals:
             cls.disconnect_signals()
@@ -258,6 +260,23 @@ class AuthUtils:
         p = cls.get_permission_by_name(perm)
         return cls.add_permissions_to_user([p], user, disconnect_signals)
 
+    @classmethod
+    def add_permissions_to_user_by_name(
+        cls, perms: List[str], user: User, disconnect_signals: bool = True
+    ) -> User:
+        """Add permissions given by name to a user
+
+        Args:
+            perms: List of permission names as 'app_label.codename'
+            user: user object
+            disconnect_signals: whether to run process without signals
+
+        Returns:
+            Updated user object
+        """
+        permissions = [cls.get_permission_by_name(perm) for perm in perms]
+        return cls.add_permissions_to_user(permissions, user, disconnect_signals)
+
     @staticmethod
     def get_permission_by_name(perm: str) -> Permission:
         """returns permission specified by qualified name

docker/.env.example

@@ -1,7 +1,7 @@
 PROTOCOL=https://
 AUTH_SUBDOMAIN=%AUTH_SUBDOMAIN%
 DOMAIN=%DOMAIN%
-AA_DOCKER_TAG=registry.gitlab.com/allianceauth/allianceauth/auth:v2.9
+AA_DOCKER_TAG=registry.gitlab.com/allianceauth/allianceauth/auth:v2.13
 
 # Nginx Proxy Manager
 PROXY_HTTP_PORT=80

docker/Dockerfile

@@ -1,5 +1,5 @@
 FROM python:3.9-slim
-ARG AUTH_VERSION=2.9.0
+ARG AUTH_VERSION=2.13.0
 ARG AUTH_PACKAGE=allianceauth==${AUTH_VERSION}
 ENV VIRTUAL_ENV=/opt/venv
 ENV AUTH_USER=allianceauth
@@ -39,7 +39,6 @@ RUN allianceauth start myauth
 COPY /allianceauth/project_template/project_name/settings/local.py ${AUTH_HOME}/myauth/myauth/settings/local.py
 RUN allianceauth update myauth
 RUN mkdir -p ${STATIC_BASE}/myauth/static
-RUN python ${AUTH_HOME}/myauth/manage.py collectstatic --noinput
 COPY /docker/conf/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 RUN echo 'alias auth="python $AUTH_HOME/myauth/manage.py"' >> ~/.bashrc && \
     echo 'alias supervisord="supervisord -c /etc/supervisor/conf.d/supervisord.conf"' >> ~/.bashrc && \

docker/README.md

@@ -8,7 +8,7 @@ You should have the following available on the system you are using to set this
 
 ## Setup Guide
 
-1. run `bash <(curl -s https://gitlab.com/allianceauth/allianceauth/-/raw/v2.9.x/docker/scripts/download.sh)`. This will download all the files you need to install auth and place them in a directory named `aa-docker`. Feel free to rename/move this folder.
+1. run `bash <(curl -s https://gitlab.com/allianceauth/allianceauth/-/raw/v2.11.x/docker/scripts/download.sh)`. This will download all the files you need to install auth and place them in a directory named `aa-docker`. Feel free to rename/move this folder.
 1. run `./scripts/prepare-env.sh` to set up your environment
 1. (optional) Change `PROTOCOL` to `http://` if not using SSL in `.env`
 1. run `docker-compose --env-file=.env up -d` (NOTE: if this command hangs, follow the instructions [here](https://www.digitalocean.com/community/tutorials/how-to-setup-additional-entropy-for-cloud-servers-using-haveged))
@@ -67,3 +67,16 @@ _NOTE: If you specify a version of allianceauth in your `requirements.txt` in a
 1. Update the versions in your `requirements.txt` file
 1. Run `docker-compose build`
 1. Run `docker-compose --env-file=.env up -d`
+
+## Notes
+
+### Apple M1 Support
+If you want to run locally on an M1 powered Apple device, you'll need to add `platform: linux/x86_64` under each container in `docker-compose.yml` as the auth container is not compiled for ARM (other containers may work without this, but it's known to work if added to all containers).
+
+Example:
+
+```yaml
+  redis:
+    platform: linux/x86_64
+    image: redis:6.2
+```

docker/docker-compose.yml

@@ -52,7 +52,7 @@ services:
       - auth_mysql
 
   grafana:
-    image: grafana/grafana:8.2
+    image: grafana/grafana-oss:8.3.2
     restart: always
     depends_on:
       - auth_mysql

docker/scripts/download.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
-git clone -b build-docker-image https://gitlab.com/allianceauth/allianceauth.git aa-git
+git clone https://gitlab.com/allianceauth/allianceauth.git aa-git
 cp -R aa-git/docker ./aa-docker
 rm -rf aa-git

docs/_static/css/rtd_dark.css

@@ -0,0 +1,114 @@
+/*!
+ * @name          Readthedocs
+ * @namespace     http://userstyles.org
+ * @description	  Styles the documentation pages hosted on Readthedocs.io
+ * @author        Anthony Post
+ * @homepage      https://userstyles.org/styles/142968
+ * @version       0.20170529055029
+ *
+ * Modified by Aloïs Dreyfus: 20200527-1037
+ * Modified by Erik Kalkoken: 20220615
+ */
+
+@media (prefers-color-scheme: dark) {
+    a:visited {
+        color: #bf84d8;
+    }
+
+    pre {
+        background-color: #2d2d2d !important;
+    }
+
+    .wy-nav-content {
+        background: #3c3c3c;
+        color: aliceblue;
+    }
+
+    .method dt, .class dt, .data dt, .attribute dt, .function dt,
+    .descclassname, .descname {
+        background-color: #525252 !important;
+        color: white !important;
+    }
+
+    .toc-backref {
+        color: grey !important;
+    }
+
+    code.literal {
+        background-color: #2d2d2d !important;
+        border: 1px solid #6d6d6d !important;
+    }
+
+    .wy-nav-content-wrap {
+        background-color: rgba(0, 0, 0, 0.6) !important;
+    }
+
+    .sidebar {
+        background-color: #191919 !important;
+    }
+
+    .sidebar-title {
+        background-color: #2b2b2b !important;
+    }
+
+    .xref, .py-meth {
+        color: #7ec3e6 !important;
+    }
+
+    .admonition, .note {
+        background-color: #2d2d2d !important;
+    }
+
+    .wy-side-nav-search {
+        background-color: inherit;
+        border-bottom: 1px solid #fcfcfc;
+    }
+
+    .wy-table thead, .rst-content table.docutils thead, .rst-content table.field-list thead {
+        background-color: #b9b9b9;
+    }
+
+    .wy-table thead th, .rst-content table.docutils thead th, .rst-content table.field-list thead th {
+        border: solid 2px #e1e4e5;
+    }
+
+    .wy-table thead p, .rst-content table.docutils thead p, .rst-content table.field-list thead p {
+        margin: 0;
+    }
+
+    .wy-table-odd td, .wy-table-striped tr:nth-child(2n-1) td, .rst-content table.docutils:not(.field-list) tr:nth-child(2n-1) td {
+        background-color: #343131;
+    }
+
+    .highlight .m {
+        color: inherit
+    }
+
+    /* Literal.Number */
+    .highlight .nv {
+        color: #3a7ca8
+    }
+
+    /* Name.Variable */
+
+    body {
+        text-align: justify;
+    }
+
+    .rst-content .section .admonition ul {
+        margin-bottom: 0;
+    }
+
+    li.toctree-l1 {
+        margin-top: 5px;
+        margin-bottom: 5px;
+    }
+
+    .wy-menu-vertical li code {
+        color: #E74C3C;
+    }
+
+    .wy-menu-vertical .xref {
+        color: #2980B9 !important;
+    }
+}

docs/conf.py

@@ -42,6 +42,7 @@ from recommonmark.transform import AutoStructify
 extensions = [
     'sphinx_rtd_theme',
     'sphinx.ext.autodoc',
+    'sphinx.ext.napoleon',
     'recommonmark',
 ]
 
@@ -59,7 +60,7 @@ master_doc = 'index'
 
 # General information about the project.
 project = 'Alliance Auth'
-copyright = '2018-2020, Alliance Auth'
+copyright = '2018-2022, Alliance Auth'
 author = 'R4stl1n'
 
 # The version info for the project you're documenting, acts as replacement for
@@ -110,6 +111,7 @@ html_theme_options = {
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
 html_static_path = ['_static']
+html_css_files = ["css/rtd_dark.css"]
 
 
 # -- Options for HTMLHelp output ------------------------------------------

docs/development/dev_setup/aa-dev-setup-wsl-vsc-v2.md

@@ -150,12 +150,14 @@ sudo redis-server --daemonize yes
 
 ```eval_rst
 .. note::
-    WSL does not have an init.d service, so it will not automatically start your services such as MySQL and Redis when you boot your Windows machine. For convenience we recommend putting the commands for starting these services in a bash script. Here is an example: ::
+    WSL does not have an init.d service, so it will not automatically start your services such as MySQL and Redis when you boot your Windows machine. For convenience we recommend putting the commands for starting these services in a bash script. Here is an example:
 
-    #/bin/bash
-    # start services for AA dev
-    sudo service mysql start
-    sudo redis-server --daemonize yes
+    ::
+
+        #/bin/bash
+        # start services for AA dev
+        sudo service mysql start
+        sudo redis-server --daemonize yes
 
     In addition it is possible to configure Windows to automatically start WSL services, but that procedure goes beyond the scopes of this guide.
 ```

docs/development/tech_docu/templatetags.rst

@@ -1,15 +1,27 @@
-=============
-Template Tags
-=============
+=======================
+Template tags & filters
+=======================
 
-The following template tags are available to be used by all apps. To use them just load the respeetive template tag in your template like so:
+The following template tags and filters are available to be used by all apps. To use them just load them into your template like so:
 
-.. code-block:: html
+.. code-block:: html+django
 
     {% load evelinks %}
 
+
+Template Filters
+================
+
 evelinks
-========
+--------
+
+Example for using an evelinks filter to render an alliance logo:
+
+
+.. code-block:: html+django
+
+    <img src="{{ alliance_id|alliance_logo_url }}">
+
 
 .. automodule:: allianceauth.eveonline.templatetags.evelinks
     :members:

docs/features/core/admin_site.md

@@ -0,0 +1,96 @@
+# Admin Site
+
+The admin site allows administrators to configure, manage and trouble shoot Alliance Auth and all it's applications and services. E.g. you can create new groups and assign groups to users.
+
+You can open the admin site by clicking on "Admin" in the drop down menu for a user that has access.
+
+![Admin Site](/_static/images/features/core/admin_site.png)
+
+## Setup for small to medium size installations
+
+For small to medium size alliances it is often sufficient to have no more then two superuser admins (admins that also are superusers). Having two admins usually makes sense, so you can have one primary and one backup.
+
+```eval_rst
+.. warning::
+    Superusers have read & write access to everything on your AA installation. Superusers also automatically have all permissions and therefore access to all features of your apps. Therefore we recommend to be very careful to whom you give superuser privileges.
+```
+
+## Setup for large installations
+
+For large alliances and coalitions you may want to have a couple of administrators to be able to distribute and handle the work load. However, having a larger number of superusers may be a security concern.
+
+As an alternative to superusers admins you can define staff admins. Staff admins can perform most of the daily admin work, but are not superusers and therefore can be restricted in what they can access.
+
+To create a staff admin you need to do two things:
+
+1. Enable the `is_staff` property for a user
+1. Give the user permissions for admin tasks
+
+```eval_rst
+.. note::
+    Note that staff admins have the following limitations:
+
+    - Can not promote users to staff
+    - Can not promote users to superuser
+    - Can not add/remove permissions for users, groups and states
+
+    These limitations exist to prevent staff admins to promote themselves to quasi superusers. Only superusers can perform these actions.
+```
+
+### Staff property
+
+Access to the admin site is restricted. Users needs to have the `is_staff` property to be able to open the site at all. The superuser that is created during the installation
+process will automatically have access to the admin site.
+
+```eval_rst
+.. hint::
+    Without any permissions a "staff user" can open the admin site, but can neither view nor edit anything except for viewing the list of permissions.
+```
+
+### Permissions for common admin tasks
+
+Here is a list of permissions a staff admin would need to perform some common admin tasks:
+
+#### Edit users
+
+- auth | user | Can view user
+- auth | user | Can change user
+- authentication | user | Can view user
+- authentication | user | Can change user
+- authentication | user profile | Can change profile
+
+#### Delete users
+
+- auth | user | Can view user
+- auth | user | Can delete user
+- authentication | user | Can delete user
+- authentication | user profile | Can delete user profile
+
+#### Add & edit states
+
+- authentication | state | Can add state
+- authentication | state | Can change state
+- authentication | state | Can view state
+
+#### Delete states
+
+- authentication | state | Can delete state
+- authentication | state | Can view state
+
+#### Add & edit groups
+
+- auth | group | Can add group
+- auth | group | Can change group
+- auth | group | Can view group
+- authentication | group | Can add group
+- authentication | group | Can change group
+- authentication | group | Can view group
+
+#### Delete groups
+
+- auth | group | Can delete group
+- authentication | group | Can delete group
+
+### Permissions for other apps
+
+The permissions a staff admin needs to perform tasks for other applications depends on how the applications are configured. the default is to have four permissions (change, delete, edit view) for each model of the applications. The view permission is usually required to see the model list on the admin site and the other three permissions are required to perform the respective action to an object of that model. However, app developer can chose to define permissions differently.

docs/features/core/analytics.md

@@ -10,6 +10,12 @@ To Opt-Out, modify our pre-loaded token using the Admin dashboard */admin/analyt
 
 Each of the three features Daily Stats, Celery Events and Page Views can be enabled/Disabled independently.
 
+Alternatively, you can fully opt out of analytics with the following optional setting:
+
+```python
+ANALYTICS_DISABLED = True
+```
+
 ![Analytics Tokens](/_static/images/features/core/analytics/tokens.png)
 
 ## What
@@ -58,6 +64,8 @@ This data is stored in a Team Google Analytics Dashboard. The Maintainers all ha
 
 ### Analytics Event
 
+```eval_rst
 .. automodule:: allianceauth.analytics.tasks
     :members: analytics_event
     :undoc-members:
+```

docs/features/core/dashboard.md

@@ -7,3 +7,18 @@ The content of the dashboard is specific to the logged in user. It has a sidebar
 For admin users the dashboard shows additional technical information about the  AA instance.
 
 ![dashboard](/_static/images/features/core/dashboard/dashboard.png)
+
+## Settings
+
+Here is a list of available settings for the dashboard. They can be configured by adding them to your AA settings file (``local.py``).
+Note that all settings are optional and the app will use the documented default settings if they are not used.
+
+```eval_rst
++-----------------------------------------------------+-------------------------------------------------------------------------+-----------+
+| Name                                                | Description                                                             | Default   |
++=====================================================+=========================================================================+===========+
+| ``ALLIANCEAUTH_DASHBOARD_TASKS_MAX_HOURS``          | Statistics will be calculated for task events not older than max hours. | ``24``    |
++-----------------------------------------------------+-------------------------------------------------------------------------+-----------+
+| ``ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED`` | Disables recording of task statistics. Used mainly in development.      | ``False`` |
++-----------------------------------------------------+-------------------------------------------------------------------------+-----------+
+```

docs/features/core/groups.md

@@ -38,6 +38,10 @@ The key difference is that the group is completely unmanaged by Auth. **Once a m
 
 Most people won't have a use for public groups, though it can be useful if you wish to allow public access to some services. You can grant service permissions on a public group to allow this behavior.
 
+### Restricted
+
+When a group is restricted only superuser admins can directly add or remove them to/from users. The purpose of this property is prevent staff admins from assigning themselves to groups that are security sensitive. The "restricted" property can be combined with all the other properties.
+
 ```eval_rst
 .. _ref-reserved-group-names:
 ```
@@ -48,7 +52,7 @@ When using Alliance Auth to manage external services like Discord, Auth will aut
 
 ```eval_rst
 .. note::
-    While this feature can help to avoid naming conflicts with groups on external services, the respective service component in Alliance Auth also needs to be build in such a way that it knows how to prevent these conflicts. Currently only the Discord service has this ability.
+    While this feature can help to avoid naming conflicts with groups on external services, the respective service component in Alliance Auth also needs to be build in such a way that it knows how to prevent these conflicts. Currently only the Discord and Teamspeak3 services have this ability.
 ```
 
 ## Managing groups
@@ -90,11 +94,16 @@ This allows you to more finely control who has access to manage which groups.
 
 ### Auto Leave
 
-By default in AA, Both requests and leaves for non-open groups must be approved by a group manager. If you wish to allow users to leave groups without requiring approvals, add the following lines to your `local.py`
+By default, in AA both requests and leaves for non-open groups must be approved by a group manager. If you wish to allow users to leave groups without requiring approvals, add the following lines to your `local.py`
 
 ```python
 ## Allows users to freely leave groups without requiring approval.
-AUTO_LEAVE = True
+GROUPMANAGEMENT_AUTO_LEAVE = True
+```
+
+```eval_rst
+.. note::
+    Before you set `GROUPMANAGEMENT_AUTO_LEAVE = True`, make sure there are no pending leave requests, as this option will hide the "Leave Requests" tab.
 ```
 
 ## Settings

docs/features/core/index.md

@@ -11,4 +11,5 @@ Managing access to applications and services is one of the core functions of **A
     groups
     analytics
     notifications
+    admin_site
 ```

docs/features/services/teamspeak3.md

@@ -160,7 +160,7 @@ This error generally means teamspeak returned an error message that went unhandl
 
 This most commonly happens when your teamspeak server is externally hosted. You need to add the auth server IP to the teamspeak serverquery whitelist. This varies by provider.
 
-If you have SSH access to the server hosting it, you need to locate the teamspeak server folder and add the auth server IP on a new line in  `server_query_whitelist.txt`
+If you have SSH access to the server hosting it, you need to locate the teamspeak server folder and add the auth server IP on a new line in  `query_ip_allowlist.txt` (named `query_ip_whitelist.txt` on older teamspeak versions).
 
 ### `520 invalid loginname or password`
 

docs/requirements.txt

@@ -2,13 +2,15 @@
 sphinx>=3.2.1,<4.0.0
 sphinx_rtd_theme==0.5.0
 recommonmark==0.6.0
+Jinja2<3.1
 
 # Autodoc dependencies
 django>=3.2,<4.0.0
 django-celery-beat>=2.0.0
+django-redis-cache
 django-bootstrap-form
 django-sortedm2m
-django-esi>=3,<4
+django-esi>=3,<5
 celery>5,<6
 celery_once
 passlib

setup.py

@@ -30,10 +30,10 @@ install_requires = [
     'django-celery-beat>=2.0.0',
 
     'openfire-restapi',
-    'sleekxmpp',
+    'sleekxmpp<=1.3.2',
     'pydiscourse',
 
-    'django-esi>=3.0.0,<4.0.0'
+    'django-esi>=4.0.1,<5.0.0'
 ]
 
 testing_extras = [

tests/settings_all.py

@@ -154,3 +154,5 @@ PASSWORD_HASHERS = [
 ]
 
 LOGGING = None  # Comment out to enable logging for debugging
+
+ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED = True  # disable for tests

tests/settings_core.py

@@ -27,3 +27,5 @@ PASSWORD_HASHERS = [
 ]
 
 LOGGING = None  # Comment out to enable logging for debugging
+
+ALLIANCEAUTH_DASHBOARD_TASK_STATISTICS_DISABLED = True  # disable for tests

tox.ini

@@ -1,7 +1,7 @@
 [tox]
 skipsdist = true
 usedevelop = true
-envlist = py{37,38,39,310}-{all,core}
+envlist = py{37,38,39,310,311}-{all,core}, docs
 
 [testenv]
 setenv =
@@ -12,6 +12,7 @@ basepython =
     py38: python3.8
     py39: python3.9
     py310: python3.10
+    py311: python3.11
 deps=
     coverage
 install_command = pip install -e ".[testing]" -U {opts} {packages}
@@ -20,3 +21,11 @@ commands =
     core: coverage run runtests.py allianceauth.authentication.tests.test_app_settings -v 2 --debug-mode
     all: coverage report -m
     all: coverage xml
+
+[testenv:docs]
+description = invoke sphinx-build to build the HTML docs
+basepython = python3.9
+deps = -r{toxinidir}/docs/requirements.txt
+install_command =
+commands =
+    sphinx-build -T -E -b html -d "{toxworkdir}/docs_doctree" -D language=en docs "{toxworkdir}/docs_out" {posargs}