From 699e8e58d77c137d9d8c1c71b08b9a5a466ff275 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 26 Apr 2023 18:16:00 +0200
Subject: [PATCH 001/209] fix checkbox ref #2518

---
 .../form/dynamic-form/dynamic-form.component.html                | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
index 4324868f22..332e4ea498 100644
--- a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
+++ b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
@@ -149,6 +149,7 @@
             [name]="formDefComp['attribut_name']"
             [value]="item.value"
             (change)="onCheckChange($event, form.get(formDefComp['attribut_name']))"
+            [checked]="form.get(formDefComp['attribut_name']).value?.includes(item.value)"
           />
           <label for="{{ item.label }}_{{ rand }}" class="custom-control-label">
             <span [innerHTML]="item.label"></span>

From 3e5ae997642b49106566246daff824666b6de99d Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Thu, 27 Apr 2023 14:09:22 +0200
Subject: [PATCH 002/209] fix use of integer values in checkbox ref #2518

---
 .../dynamic-form/dynamic-form.component.html     |  2 +-
 .../form/dynamic-form/dynamic-form.component.ts  | 16 +++++-----------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
index 332e4ea498..f60a60c63f 100644
--- a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
+++ b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.html
@@ -148,7 +148,7 @@
             id="{{ item.label }}_{{ rand }}"
             [name]="formDefComp['attribut_name']"
             [value]="item.value"
-            (change)="onCheckChange($event, form.get(formDefComp['attribut_name']))"
+            (change)="onCheckChange($event, form.get(formDefComp['attribut_name']), item.value)"
             [checked]="form.get(formDefComp['attribut_name']).value?.includes(item.value)"
           />
           <label for="{{ item.label }}_{{ rand }}" class="custom-control-label">
diff --git a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.ts b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.ts
index 4ef233da55..1969b201e4 100644
--- a/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.ts
+++ b/frontend/src/app/GN2CommonModule/form/dynamic-form/dynamic-form.component.ts
@@ -95,24 +95,18 @@ export class DynamicFormComponent implements OnInit, OnChanges, OnDestroy {
     this.form.patchValue(value);
   }
 
-  onCheckChange(event, formControl: UntypedFormControl) {
-    const currentFormValue = Object.assign([], formControl.value);
+  onCheckChange(event, formControl: UntypedFormControl, value) {
+    let currentFormValue = Object.assign([], formControl.value);
     // Selected
     if (event.target.checked) {
       // Add a new control in the arrayForm
-      currentFormValue.push(event.target.value);
+      currentFormValue.push(value);
       // Patch value to declench validators
       formControl.patchValue(currentFormValue);
     } else {
       // Find the unselected element
-      currentFormValue.forEach((val, index) => {
-        if (val === event.target.value) {
-          // Remove the unselected element from the arrayForm
-          currentFormValue.splice(index, 1);
-        }
-      });
-      // Patch value to declench validators
-      formControl.patchValue(currentFormValue);
+      // and patch value to declench validators
+      formControl.patchValue(currentFormValue.filter((valItem) => valItem != value));
     }
   }
 

From 29494a97a57670e8a78241d782b2e186902ef6e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 10 May 2023 16:28:59 +0200
Subject: [PATCH 003/209] fix alembic: support broken versions of importlib

Some version of importlib, including those distributed among Python 3.10
and 3.11, returns entry points twice due to the transition from
.egg-info to .dist-info
---
 backend/geonature/app.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index 97cb47a7bf..e31175e351 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -51,14 +51,16 @@ def configure_alembic(alembic_config):
     'migrations' entry point value of the 'gn_module' group for all modules having such entry point.
     Thus, alembic will find migrations of all installed geonature modules.
     """
-    version_locations = alembic_config.get_main_option("version_locations", default="").split()
+    version_locations = set(
+        alembic_config.get_main_option("version_locations", default="").split()
+    )
     if "VERSION_LOCATIONS" in config["ALEMBIC"]:
         version_locations.extend(config["ALEMBIC"]["VERSION_LOCATIONS"].split())
     for entry_point in chain(
         entry_points(group="alembic", name="migrations"),
         entry_points(group="gn_module", name="migrations"),
     ):
-        version_locations += [entry_point.value]
+        version_locations.add(entry_point.value)
     alembic_config.set_main_option("version_locations", " ".join(version_locations))
     return alembic_config
 

From d0e0ca11552358a77abd4b9236e101f7e740ec85 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 14:46:29 +0200
Subject: [PATCH 004/209] bump usershub auth module

---
 backend/dependencies/UsersHub-authentification-module | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/dependencies/UsersHub-authentification-module b/backend/dependencies/UsersHub-authentification-module
index 0d269c8323..529a497e21 160000
--- a/backend/dependencies/UsersHub-authentification-module
+++ b/backend/dependencies/UsersHub-authentification-module
@@ -1 +1 @@
-Subproject commit 0d269c8323e441b13fe8ffd7ca99ec36178c6415
+Subproject commit 529a497e218f09edff708eddcb07aae225ce60cf

From 4437d9831ba36d2bc955dc162d45dc70bc5d7800 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 15:13:17 +0200
Subject: [PATCH 005/209] fix entrypoints returned twice

---
 backend/geonature/utils/module.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/utils/module.py b/backend/geonature/utils/module.py
index e2111b3c9f..5c01382980 100644
--- a/backend/geonature/utils/module.py
+++ b/backend/geonature/utils/module.py
@@ -18,7 +18,7 @@
 
 
 def iter_modules_dist():
-    for module_code_entry in entry_points(group="gn_module", name="code"):
+    for module_code_entry in set(entry_points(group="gn_module", name="code")):
         yield module_code_entry.dist
 
 

From d1090c0eccaf35db36fbc6cdff3abc1b65dbcba9 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 16:34:48 +0200
Subject: [PATCH 006/209] Fix set has no attribute extend

---
 backend/geonature/app.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index e31175e351..a93a2c42db 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -55,7 +55,7 @@ def configure_alembic(alembic_config):
         alembic_config.get_main_option("version_locations", default="").split()
     )
     if "VERSION_LOCATIONS" in config["ALEMBIC"]:
-        version_locations.extend(config["ALEMBIC"]["VERSION_LOCATIONS"].split())
+        version_locations |= set(config["ALEMBIC"]["VERSION_LOCATIONS"].split())
     for entry_point in chain(
         entry_points(group="alembic", name="migrations"),
         entry_points(group="gn_module", name="migrations"),

From 039d3a2e16f576e053a76933e52f5610eacfc330 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Wed, 17 May 2023 18:53:57 +0200
Subject: [PATCH 007/209] feat(backend): periodic task to remove media

Also add a config parameter to change the CRON value
---
 backend/geonature/core/gn_commons/tasks.py | 33 ++++++++++++++++++++++
 backend/geonature/utils/config_schema.py   |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 backend/geonature/core/gn_commons/tasks.py

diff --git a/backend/geonature/core/gn_commons/tasks.py b/backend/geonature/core/gn_commons/tasks.py
new file mode 100644
index 0000000000..d7d097dc2f
--- /dev/null
+++ b/backend/geonature/core/gn_commons/tasks.py
@@ -0,0 +1,33 @@
+from celery.schedules import crontab
+from celery.utils.log import get_task_logger
+
+from geonature.core.gn_commons.repositories import TMediumRepository
+from geonature.utils.celery import celery_app
+from geonature.utils.config import config
+
+logger = get_task_logger(__name__)
+
+
+@celery_app.on_after_finalize.connect
+def setup_periodic_tasks(sender, **kwargs):
+    ct = config["MEDIAS_REFRESH_CRONTAB"]
+    if ct:
+        minute, hour, day_of_month, month_of_year, day_of_week = ct.split(" ")
+        sender.add_periodic_task(
+            crontab(
+                minute=minute,
+                hour=hour,
+                day_of_week=day_of_week,
+                day_of_month=day_of_month,
+                month_of_year=month_of_year,
+            ),
+            clean_attachments.s(),
+            name="clean medias",
+        )
+
+
+@celery_app.task(bind=True)
+def clean_attachments(self):
+    logger.info("Cleaning medias...")
+    TMediumRepository.sync_medias()
+    logger.info("Medias cleaned")
diff --git a/backend/geonature/utils/config_schema.py b/backend/geonature/utils/config_schema.py
index 4c4116bd2f..b5cf50e7a2 100644
--- a/backend/geonature/utils/config_schema.py
+++ b/backend/geonature/utils/config_schema.py
@@ -555,6 +555,7 @@ class GnGeneralSchemaConf(Schema):
     HOME = fields.Nested(HomeConfig, load_default=HomeConfig().load({}))
     NOTIFICATIONS_ENABLED = fields.Boolean(load_default=True)
     PROFILES_REFRESH_CRONTAB = fields.String(load_default="0 3 * * *")
+    MEDIAS_REFRESH_CRONTAB = fields.String(load_default="0 1 * * *")
 
     @validates_schema
     def validate_enable_sign_up(self, data, **kwargs):

From 4087ab9c4c0c34c6f9d8f5d7481457e2c60b680f Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Wed, 17 May 2023 18:54:44 +0200
Subject: [PATCH 008/209] test: adapt fixture & add test for the task

---
 backend/geonature/tests/fixtures.py        |  8 +++++++-
 backend/geonature/tests/test_gn_commons.py | 22 +++++++++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index e0a2022e5d..eec41ff384 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -50,6 +50,7 @@
     "medium",
     "module",
     "perm_object",
+    "celery_eager",
 ]
 
 
@@ -371,8 +372,13 @@ def create_media(media_path=""):
 
 @pytest.fixture
 def medium(app):
+    # FIXME: find a better way to get the id_media that will be created
+    new_id_media = (db.session.query(func.max(TMedias.id_media)).scalar() or 0) + 1
     image = Image.new("RGBA", size=(1, 1), color=(155, 0, 0))
-    with tempfile.NamedTemporaryFile(dir=TMedias.base_dir(), suffix=".png") as f:
+    # Delete = false since it will be done automatically
+    with tempfile.NamedTemporaryFile(
+        dir=TMedias.base_dir(), prefix=f"{new_id_media}_", suffix=".png", delete=False
+    ) as f:
         image.save(f, "png")
         yield create_media(media_path=str(f.name))
 
diff --git a/backend/geonature/tests/test_gn_commons.py b/backend/geonature/tests/test_gn_commons.py
index 5eea8c694d..95a617b09d 100644
--- a/backend/geonature/tests/test_gn_commons.py
+++ b/backend/geonature/tests/test_gn_commons.py
@@ -14,7 +14,7 @@
 from geonature.core.gn_commons.models import TAdditionalFields, TMedias, TPlaces, BibTablesLocation
 from geonature.core.gn_commons.models.base import TModules, TParameters, BibWidgets
 from geonature.core.gn_commons.repositories import TMediaRepository
-
+from geonature.core.gn_commons.tasks import clean_attachments
 from geonature.core.gn_permissions.models import TObjects
 from geonature.utils.env import db
 from geonature.utils.errors import GeoNatureError
@@ -539,3 +539,23 @@ def test_api_get_id_table_location_not_found(self):
 
         assert response.status_code == 204  # No content
         assert response.json is None
+
+
+@pytest.mark.usefixtures("temporary_transaction")
+class TestTasks:
+    def test_clean_attachements(self, monkeypatch, celery_eager, medium):
+        # Monkey patch the __before_commit_delete not to remove file
+        # when deleting the medium, so the clean_attachments can work
+        def mock_delete_media(self):
+            return None
+
+        monkeypatch.setattr(TMedias, "__before_commit_delete__", mock_delete_media)
+
+        # Remove media to trigger the cleaning
+        db.session.delete(medium)
+        db.session.commit()
+
+        clean_attachments()
+
+        # File should be removed
+        assert not Path(medium.media_path).is_file()

From 04a84cb048722900043a552af301dca14d4e6933 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Wed, 17 May 2023 19:00:23 +0200
Subject: [PATCH 009/209] feat(backend): remove sync_media anywhere else

---
 backend/geonature/core/gn_commons/medias/routes.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/backend/geonature/core/gn_commons/medias/routes.py b/backend/geonature/core/gn_commons/medias/routes.py
index 0835d052e6..0f0f6762eb 100644
--- a/backend/geonature/core/gn_commons/medias/routes.py
+++ b/backend/geonature/core/gn_commons/medias/routes.py
@@ -90,8 +90,6 @@ def insert_or_update_media(id_media=None):
 
     m = TMediaRepository(data=data, file=file, id_media=id_media).create_or_update_media()
 
-    TMediumRepository.sync_medias()
-
     return m.as_dict()
 
 
@@ -106,8 +104,6 @@ def delete_media(id_media):
 
     TMediaRepository(id_media=id_media).delete()
 
-    TMediumRepository.sync_medias()
-
     return {"resp": "media {} deleted".format(id_media)}
 
 

From 684481e9448641c10873f67ded26040f43786552 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 22 May 2023 11:42:08 +0200
Subject: [PATCH 010/209] chore: named crontab parameter

---
 backend/geonature/core/gn_commons/tasks.py | 2 +-
 backend/geonature/utils/config_schema.py   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_commons/tasks.py b/backend/geonature/core/gn_commons/tasks.py
index d7d097dc2f..09544a0d98 100644
--- a/backend/geonature/core/gn_commons/tasks.py
+++ b/backend/geonature/core/gn_commons/tasks.py
@@ -10,7 +10,7 @@
 
 @celery_app.on_after_finalize.connect
 def setup_periodic_tasks(sender, **kwargs):
-    ct = config["MEDIAS_REFRESH_CRONTAB"]
+    ct = config["MEDIA_CLEAN_CRONTAB"]
     if ct:
         minute, hour, day_of_month, month_of_year, day_of_week = ct.split(" ")
         sender.add_periodic_task(
diff --git a/backend/geonature/utils/config_schema.py b/backend/geonature/utils/config_schema.py
index b5cf50e7a2..4afe91bc2d 100644
--- a/backend/geonature/utils/config_schema.py
+++ b/backend/geonature/utils/config_schema.py
@@ -555,7 +555,7 @@ class GnGeneralSchemaConf(Schema):
     HOME = fields.Nested(HomeConfig, load_default=HomeConfig().load({}))
     NOTIFICATIONS_ENABLED = fields.Boolean(load_default=True)
     PROFILES_REFRESH_CRONTAB = fields.String(load_default="0 3 * * *")
-    MEDIAS_REFRESH_CRONTAB = fields.String(load_default="0 1 * * *")
+    MEDIA_CLEAN_CRONTAB = fields.String(load_default="0 1 * * *")
 
     @validates_schema
     def validate_enable_sign_up(self, data, **kwargs):

From 8410170958004507e3a613a31c336b5e3a590c49 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 22 May 2023 11:42:52 +0200
Subject: [PATCH 011/209] config(backend): add in config example

---
 config/default_config.toml.example | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/default_config.toml.example b/config/default_config.toml.example
index 1f58969093..988d6bc3ad 100644
--- a/config/default_config.toml.example
+++ b/config/default_config.toml.example
@@ -73,6 +73,8 @@ MAIL_ON_ERROR = false
 # Notifications (true / false)
 NOTIFICATIONS_ENABLED = true
 
+MEDIA_CLEAN_CRONTAB = "0 1 * * *"
+
 [USERSHUB]
     # URL de l'application Usershub
     URL_USERSHUB = "http://127.0.0.1:5001"

From c1ffaf275eb06c74047dbccdb51e1235db015a35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 18:03:12 +0200
Subject: [PATCH 012/209] celery: import tasks from gn_commons

---
 backend/geonature/core/gn_commons/routes.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index 55bdea9112..6d37a49e1e 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -26,6 +26,7 @@
 from geonature.core.gn_permissions import decorators as permissions
 from geonature.core.gn_permissions.decorators import login_required
 from geonature.core.gn_permissions.tools import get_scopes_by_action
+import geonature.core.gn_commons.tasks  # noqa: F401
 
 from shapely.geometry import asShape
 from geoalchemy2.shape import from_shape

From 0ce87ba16027349099d244dcc832b89680242233 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Lech=C3=A9mia?=
 <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 18:04:41 +0200
Subject: [PATCH 013/209] Fixed navbar and sidenav (#2556)

* Fixed navbar and sidenav
add toggle btn to hidde sidenav

* style
---
 .../templates/admin/index_layout.html         | 34 ++++---
 backend/geonature/templates/layout.html       | 99 +++++++++++--------
 2 files changed, 78 insertions(+), 55 deletions(-)

diff --git a/backend/geonature/templates/admin/index_layout.html b/backend/geonature/templates/admin/index_layout.html
index 95ae680d55..adeac99710 100644
--- a/backend/geonature/templates/admin/index_layout.html
+++ b/backend/geonature/templates/admin/index_layout.html
@@ -10,36 +10,38 @@
       {% set children = item.get_children() %}
       {%- if children %}
       <a 
-        data-toggle="collapse" 
-        href="#collapseExample" 
-        class="list-group-item disabled list-group-item-action main-item">
+        class="list-group-item list-group-item-action main-item">
         {{ layout.menu_icon(item) }}{{ item.name }}
       </a>
-          {%- for child in children -%}
-            {%- if child.is_category() -%}
-              {{ menu(menu_root=[child]) }}
-            {% else %}
 
-              <a 
-                href="{{ child.get_url() }}" 
-                class="list-group-item list-group-item-action child-item">
-                {{ layout.menu_icon(child) }}{{ child.name }}
-              </a>
+          {%- for child in children -%}
+          {%- if child.is_category() -%}
+                {{ menu(menu_root=[child]) }}
+              {% else %}
+              
+                <a 
+                  href="{{ child.get_url() }}" 
+                  class="list-group-item list-group-item-action child-item">
+                  {{ layout.menu_icon(child) }}{{ child.name }}
+                </a>
+                
+                {%- endif %}
+                {%- endfor %}
 
-            {%- endif %}
-          {%- endfor %}
       {% endif %}
     {%- else %}
-      {%- if item.is_accessible() and item.is_visible() -%}
+      {%- if item.is_accessible() and item.is_visible() and item.name != 'Accueil' -%}
+      
           <a 
             href="{{ item.get_url() }}"  
             {% if item.target %} target="{{ item.target }}"{% endif %} 
             class="list-group-item list-group-item-action main-item">
-            {{ layout.menu_icon(item) }}{{ item.name }}
+            {{ layout.menu_icon(item) }}{{ item.name }} 
           </a>
 
       {%- endif -%}
     {% endif -%}
   {% endfor %}
 </div>
+
 {% endmacro %}
diff --git a/backend/geonature/templates/layout.html b/backend/geonature/templates/layout.html
index 81590f58e3..0bfc4406b9 100644
--- a/backend/geonature/templates/layout.html
+++ b/backend/geonature/templates/layout.html
@@ -3,69 +3,90 @@
 
 {% extends 'admin/base.html' %}
 
-{% block head_tail %}
+{% block head_css %}
   {{ super() }}
   <style>
-        .side-nav {
-            min-height: 94vh;
-            width: 15%;
-            background-color:#EEE; ;
+        #sticky-sidebar {
+            max-height: 94vh;
+            overflow-y: auto;
         }
-        #main {
-            display: flex;
+
+        #container {
+            margin-top:80px;
         }
         .navbar {
             margin-bottom: 0px;
         }
         #header {
-            height: 6vh;
+            height: 60px;
+            z-index: 100;
+            background-color: white;
+            border-bottom: solid 1px;
         }
         .main-item {
             font-weight: bold;
+            background-color: gainsboro!important;
         }
         .child-item {
             padding-left: 35px;
         }
-        #content {
-            width: 85%;
-            padding: 20px;
-        }
-        #header {
-            border-bottom: solid 1px;
+        #sideNavToggler{
+            border-color:black
         }
 </style>
 {% endblock %}
 
-{% block page_body %}
+{% block head_tail %}
+<script>
+    function toggleSideBar() {
+    var main = document.getElementById("main");
+    if(main.classList.contains("offset-2")) {
+        document.getElementById("sticky-sidebar").style.display = "none"
+        main.classList.remove("offset-2");
+        main.classList.remove("col-10");
+        main.classList.add("col-12");
+    } else {
+        document.getElementById("sticky-sidebar").style.display = "block"
+        main.classList.add("offset-2");
+        main.classList.remove("col-12");
+        main.classList.add("col-10");
+    }
 
+}
 
-<div id="container">
-    <nav id="header" class="navbar navbar-expand-lg navbar-light">
-        <a class="navbar-brand mr-auto" href=" {{url_for("admin.index")}} ">Administration GeoNature</a>
-        <ul class="navbar-nav my-2 my-lg-0">
-            <li class="nav-item">
-                {{layout.menu_links()}}
-            </li>
-        </ul>
-      </nav>
+</script>
+{% endblock %}
 
-    <div id="main">
-        <nav class="side-nav">
-           {{index_layout.menu()}} 
+{% block page_body %}
 
-        </nav>
-        <div id="content" >
-            {% block brand %}
-            <h2 id="brand">{{ admin_view.name|capitalize }}</h2>
-            {% endblock %}
-            {{ layout.messages() }}
+<nav id="header" class="navbar navbar-expand-lg navbar-light fixed-top">
     
-            {% set render_ctx = h.resolve_ctx() %}
+    <button id="sideNavToggler" class="mr-2 btn btn-light" type="button" onclick="toggleSideBar()" > <span class="navbar-toggler-icon"></span></button>
+    <a class="navbar-brand mr-auto" href=" {{url_for("admin.index")}} "> 
+        <i class="fa fa-home"></i>
+         Administration GeoNature
+    </a>
+    <ul class="navbar-nav my-2 my-lg-0">
+        <li class="nav-item">
+            {{layout.menu_links()}}
+        </li>
+    </ul>
+  </nav>
+    <div class="container-fluid" id="container">
+        <div class="row" >
+            <div class="col-2 px-1 position-fixed" id="sticky-sidebar">
     
-            {% block body %}
-            {% endblock %}
-         </div>
-    </div>
+                {{index_layout.menu()}} 
+            </div>
+
+            <div class="col-10 offset-2" id="main">
+                {% block body %}
+                 {% endblock %}
+            </div>
+        </div>
 
-</div>
+    </div>
 {% endblock %}
+
+
+

From 5772c1a90f6155a890e1bdb3ecc51cfcc8d4b6ca Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 24 Apr 2023 16:58:05 +0200
Subject: [PATCH 014/209] feat: add id_source filter for synthese/validation

Use datalist widget to do that
---
 .../core/gn_synthese/utils/query_select_sqla.py       |  5 +++++
 .../form/synthese-form/dynamicFormConfig.ts           | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 3f636f61db..4521377436 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -23,6 +23,7 @@
     CorAreaSynthese,
     BibReportsTypes,
     TReport,
+    TSources,
 )
 from geonature.core.gn_meta.models import (
     CorDatasetActor,
@@ -313,6 +314,10 @@ def filter_other_filters(self, user):
             date_max = date_max.replace(hour=23, minute=59, second=59)
             self.query = self.query.where(self.model.date_max <= date_max)
 
+        if "id_source" in self.filters:
+            self.add_join(TSources, self.model.id_source, TSources.id_source)
+            self.query = self.query.where(self.model.id_source == self.filters.pop("id_source"))
+
         if "id_acquisition_framework" in self.filters:
             if hasattr(self.model, "id_acquisition_framework"):
                 self.query = self.query.where(
diff --git a/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts b/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
index 9a5a636f1d..e0cc142479 100644
--- a/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
+++ b/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
@@ -270,4 +270,15 @@ export const DYNAMIC_FORM_DEF = [
     attribut_name: 'unique_id_sinp',
     required: false,
   },
+  {
+    type_widget: 'datalist',
+    attribut_name: 'id_source',
+    attribut_label: 'Source de la donnée',
+    api: 'synthese/sources',
+    application: 'GeoNature',
+    keyValue: 'id_source',
+    keyLabel: 'name_source',
+    data_path: '',
+    required: false,
+  },
 ];

From 87cc3686ed557ecb5a97f7bd418e41f8699cf61e Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 24 Apr 2023 17:07:06 +0200
Subject: [PATCH 015/209] test: add test on filter id_source

---
 backend/geonature/tests/test_synthese.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 7085a7fced..a2fbf207db 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -281,6 +281,22 @@ def test_get_observations_for_web_filter_comment(self, users, synthese_data, tax
 
         assert id_synthese in (feature["properties"]["id"] for feature in r.json["features"])
 
+    def test_get_observations_for_web_filter_id_source(self, users, synthese_data, source):
+        set_logged_user_cookie(self.client, users["self_user"])
+        id_source = source.id_source
+
+        url = url_for("gn_synthese.get_observations_for_web")
+        filters = {"id_source": id_source}
+        r = self.client.get(url, json=filters)
+
+        expected_data = {
+            synthese.id_synthese
+            for synthese in synthese_data.values()
+            if synthese.id_source == id_source
+        }
+        response_data = {feature["properties"]["id"] for feature in r.json["features"]}
+        assert expected_data.issubset(response_data)
+
     def test_get_synthese_data_cruved(self, app, users, synthese_data, datasets):
         set_logged_user_cookie(self.client, users["self_user"])
 

From 9ded39d317e7ae2ef0fe2b00ff419729ae929435 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 26 Apr 2023 15:20:26 +0200
Subject: [PATCH 016/209] process non array id_ filters

---
 .../geonature/core/gn_synthese/utils/query_select_sqla.py    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 4521377436..941988653d 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -391,7 +391,10 @@ def filter_other_filters(self, user):
                 self.query = self.query.where(CorAreaSynthese.id_area.in_(value))
             elif colname.startswith("id_"):
                 col = getattr(self.model.__table__.columns, colname)
-                self.query = self.query.where(col.in_(value))
+                if isinstance(value, list):
+                    self.query = self.query.where(col.in_(value))
+                else:
+                    self.query = self.query.where(col == value)
             elif hasattr(self.model.__table__.columns, colname):
                 col = getattr(self.model.__table__.columns, colname)
                 if str(col.type) == "INTEGER":

From 71c65b233b48b7a0f779ec43e513da4acc40caa8 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 26 Apr 2023 15:20:46 +0200
Subject: [PATCH 017/209] add advanced filter id_synthese

---
 .../GN2CommonModule/form/synthese-form/dynamicFormConfig.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts b/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
index e0cc142479..fd86b5458c 100644
--- a/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
+++ b/frontend/src/app/GN2CommonModule/form/synthese-form/dynamicFormConfig.ts
@@ -270,6 +270,12 @@ export const DYNAMIC_FORM_DEF = [
     attribut_name: 'unique_id_sinp',
     required: false,
   },
+  {
+    type_widget: 'number',
+    attribut_label: 'ID (id_synthese)',
+    attribut_name: 'id_synthese',
+    required: false,
+  },
   {
     type_widget: 'datalist',
     attribut_name: 'id_source',

From 755fe35bffb2653952b31e1219844cf697f3341e Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 2 May 2023 09:46:35 +0200
Subject: [PATCH 018/209] synthese models server default values

---
 backend/geonature/core/gn_synthese/models.py | 60 +++++++++++++-------
 1 file changed, 41 insertions(+), 19 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/models.py b/backend/geonature/core/gn_synthese/models.py
index 592ada7afb..3d9686a111 100644
--- a/backend/geonature/core/gn_synthese/models.py
+++ b/backend/geonature/core/gn_synthese/models.py
@@ -269,35 +269,43 @@ class Synthese(DB.Model):
     nomenclature_geo_object_nature = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_geo_object_nature]
     )
-    id_nomenclature_grp_typ = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_grp_typ = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_grp_typ = db.relationship(TNomenclatures, foreign_keys=[id_nomenclature_grp_typ])
     id_nomenclature_obs_technique = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_obs_technique = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_obs_technique]
     )
-    id_nomenclature_bio_status = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_bio_status = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_bio_status = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_bio_status]
     )
     id_nomenclature_bio_condition = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_bio_condition = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_bio_condition]
     )
-    id_nomenclature_naturalness = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_naturalness = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_naturalness = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_naturalness]
     )
     id_nomenclature_valid_status = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_valid_status = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_valid_status]
     )
-    id_nomenclature_exist_proof = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_exist_proof = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_exist_proof = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_exist_proof]
     )
@@ -307,17 +315,25 @@ class Synthese(DB.Model):
     nomenclature_diffusion_level = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_diffusion_level]
     )
-    id_nomenclature_life_stage = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_life_stage = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_life_stage = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_life_stage]
     )
-    id_nomenclature_sex = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_sex = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_sex = db.relationship(TNomenclatures, foreign_keys=[id_nomenclature_sex])
-    id_nomenclature_obj_count = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_obj_count = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_obj_count = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_obj_count]
     )
-    id_nomenclature_type_count = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_type_count = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_type_count = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_type_count]
     )
@@ -326,39 +342,44 @@ class Synthese(DB.Model):
         TNomenclatures, foreign_keys=[id_nomenclature_sensitivity]
     )
     id_nomenclature_observation_status = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_observation_status = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_observation_status]
     )
-    id_nomenclature_blurring = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_blurring = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_blurring = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_blurring]
     )
     id_nomenclature_source_status = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_source_status = db.relationship(
-        TNomenclatures, foreign_keys=[id_nomenclature_source_status]
+        TNomenclatures,
+        foreign_keys=[id_nomenclature_source_status],
     )
     id_nomenclature_info_geo_type = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_info_geo_type = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_info_geo_type]
     )
-    id_nomenclature_behaviour = db.Column(db.Integer, ForeignKey(TNomenclatures.id_nomenclature))
+    id_nomenclature_behaviour = db.Column(
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
+    )
     nomenclature_behaviour = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_behaviour]
     )
     id_nomenclature_biogeo_status = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_biogeo_status = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_biogeo_status]
     )
     id_nomenclature_determination_method = db.Column(
-        db.Integer, ForeignKey(TNomenclatures.id_nomenclature)
+        db.Integer, ForeignKey(TNomenclatures.id_nomenclature), server_default=FetchedValue()
     )
     nomenclature_determination_method = db.relationship(
         TNomenclatures, foreign_keys=[id_nomenclature_determination_method]
@@ -450,6 +471,7 @@ class BibReportsTypes(DB.Model):
 @serializable
 class TReport(DB.Model):
     __tablename__ = "t_reports"
+
     __table_args__ = {"schema": "gn_synthese"}
     id_report = DB.Column(DB.Integer(), primary_key=True)
     id_synthese = DB.Column(DB.Integer(), ForeignKey("gn_synthese.synthese.id_synthese"))

From a264b4a9e0bdc007cf2610db5f24f85431250142 Mon Sep 17 00:00:00 2001
From: joelclems <40370682+joelclems@users.noreply.github.com>
Date: Mon, 22 May 2023 18:39:20 +0200
Subject: [PATCH 019/209] split script install db (#2545)

---
 .github/workflows/cypress.yml           | 20 ++----
 .github/workflows/pytest.yml            | 26 ++------
 backend/Dockerfile                      | 13 ++--
 install/03_create_db.sh                 | 82 +------------------------
 install/03b_populate_db.sh              | 57 +++++++++++++++++
 install/03b_populate_db_for_test.sh     | 16 +++++
 install/assets/db/add_pg_extensions.sql | 20 ++++++
 install/assets/docker_startup.sh        | 41 +++++++++++++
 8 files changed, 151 insertions(+), 124 deletions(-)
 create mode 100755 install/03b_populate_db.sh
 create mode 100755 install/03b_populate_db_for_test.sh
 create mode 100644 install/assets/db/add_pg_extensions.sql
 create mode 100755 install/assets/docker_startup.sh

diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml
index 714d0cc42d..99d2c85043 100644
--- a/.github/workflows/cypress.yml
+++ b/.github/workflows/cypress.yml
@@ -37,17 +37,14 @@ jobs:
           psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "postgis_raster";'
         env:
           PGPASSWORD: geonatpasswd
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
       - name: Add database extensions
         run: |
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "hstore";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "uuid-ossp";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "pg_trgm";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "unaccent";'
+          psql -h localhost -U geonatadmin -d geonature2db -f install/assets/db/add_pg_extensions.sql
         env:
           PGPASSWORD: geonatpasswd
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
       - name: Set up Python 3.9
         uses: actions/setup-python@v4
         with:
@@ -75,14 +72,7 @@ jobs:
         working-directory: ./backend
       - name: Install database
         run: |
-          geonature db upgrade geonature@head -x local-srid=2154
-          geonature db autoupgrade -x local-srid=2154
-          geonature db upgrade geonature-samples@head
-          geonature db upgrade taxhub@head
-          geonature taxref import-v15 --skip-bdc-statuts
-          geonature db upgrade nomenclatures_taxonomie_data@head
-          geonature db upgrade ref_geo_fr_departments@head
-
+          install/03b_populate_db_for_test.sh
         env:
           GEONATURE_CONFIG_FILE: config/test_config.toml
         # FRONTEND
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index e7b2196f49..60a4b370f9 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -54,17 +54,14 @@ jobs:
           psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "postgis_raster";'
         env:
           PGPASSWORD: geonatpasswd
+      - uses: actions/checkout@v3
+        with:
+          submodules: true
       - name: Add database extensions
         run: |
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "hstore";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "uuid-ossp";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "pg_trgm";'
-          psql -h localhost -U geonatadmin -d geonature2db -tc 'CREATE EXTENSION "unaccent";'
+          psql -h localhost -U geonatadmin -d geonature2db -f install/assets/db/add_pg_extensions.sql
         env:
           PGPASSWORD: geonatpasswd
-      - uses: actions/checkout@v3
-        with:
-          submodules: true
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
@@ -88,20 +85,7 @@ jobs:
           GEONATURE_CONFIG_FILE: config/test_config.toml
       - name: Install database
         run: |
-          geonature db upgrade geonature@head -x local-srid=2154
-          geonature db autoupgrade -x local-srid=2154
-          geonature db upgrade ref_geo_fr_departments@head
-          geonature taxref import-v16
-          geonature db upgrade geonature-samples@head
-          geonature db upgrade nomenclatures_taxonomie_data@head
-          geonature db upgrade ref_geo_fr_municipalities@head
-          geonature db upgrade ref_geo_inpn_grids_5@head
-          geonature sensitivity add-referential \
-            --source-name "Référentiel sensibilité TAXREF v16 20230203" \
-            --url https://geonature.fr/data/inpn/sensitivity/RefSensibiliteV16_20230203.zip \
-            --zipfile RefSensibiliteV16_20230203.zip \
-            --csvfile RefSensibiliteV16_20230203/RefSensibilite_16.csv \
-            --encoding=iso-8859-15
+          install/03b_populate_db_for_test.sh
         env:
           GEONATURE_CONFIG_FILE: config/test_config.toml
       - name: Show database status
diff --git a/backend/Dockerfile b/backend/Dockerfile
index ed57b44a18..aa45799087 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -139,19 +139,14 @@ COPY --from=build-utils /build/dist/*.whl .
 COPY --from=build-utils-geo /build/dist/*.whl .
 COPY --from=build-geonature /build/dist/*.whl .
 
+COPY --chmod=755 /install/03b_populate_db.sh /populate_db.sh
+COPY --chmod=755 /install/assets/docker_startup.sh /startup.sh
+
 ENV GEONATURE_CONFIG_FILE ""
 
 EXPOSE 8000
 
-CMD [ "gunicorn", "geonature:create_app()", \
-    "--worker-tmp-dir=/dev/shm", \
-    "--name=geonature", \
-    "--workers=2", \
-    "--threads=2", \
-    "--access-logfile=-", \
-    "--error-logfile=-", \
-    "--bind=0.0.0.0:8000" \
-]
+CMD ["/startup.sh"]
 
 
 FROM wheels-light AS wheels
diff --git a/install/03_create_db.sh b/install/03_create_db.sh
index 85e522194c..9baab9a8f5 100755
--- a/install/03_create_db.sh
+++ b/install/03_create_db.sh
@@ -58,30 +58,8 @@ fi
 write_log "Creating GeoNature database..."
 sudo -u postgres -s createdb -O $user_pg $db_name -T template0 -E UTF-8 -l $my_local |& tee -a "${LOG_FILE}"
 
-write_log "Adding default PostGIS extension"
-sudo -u postgres -s psql -d $db_name -c "CREATE EXTENSION IF NOT EXISTS postgis;" |& tee -a "${LOG_FILE}"
-
-write_log "Extracting PostGIS version"
-postgis_full_version=$(sudo -u postgres -s psql -d "${db_name}" -c "SELECT PostGIS_Version();")
-postgis_short_version=$(echo "${postgis_full_version}" | sed -n 's/^\s*\([0-9]*\.[0-9]*\)\s.*/\1/p')
-write_log "PostGIS full version:\n ${postgis_full_version}"
-write_log  "PostGIS short version extract: '${postgis_short_version}'"
-
-write_log "Adding Raster PostGIS extension if necessary"
-postgis_required_version="3.0"
-if [[ "$(printf '%s\n' "${postgis_required_version}" "${postgis_short_version}" | sort -V | head -n1)" = "${postgis_required_version}" ]]; then
-    write_log "PostGIS version greater than or equal to ${postgis_required_version} --> adding Raster extension"
-    sudo -u postgres -s psql -d $db_name -c "CREATE EXTENSION IF NOT EXISTS postgis_raster;" |& tee -a "${LOG_FILE}"
-else
-    write_log "PostGIS version lower than ${postgis_required_version} --> do nothing"
-fi
-
-write_log "Adding other use PostgreSQL extensions"
-sudo -u postgres -s psql -d $db_name -c "CREATE EXTENSION IF NOT EXISTS hstore;" |& tee -a "${LOG_FILE}"
-sudo -u postgres -s psql -d $db_name -c "CREATE EXTENSION IF NOT EXISTS plpgsql WITH SCHEMA pg_catalog; COMMENT ON EXTENSION plpgsql IS 'PL/pgSQL procedural language';" |& tee -a "${LOG_FILE}"
-sudo -u postgres -s psql -d $db_name -c 'CREATE EXTENSION IF NOT EXISTS "uuid-ossp";' |& tee -a "${LOG_FILE}"
-sudo -u postgres -s psql -d $db_name -c "CREATE EXTENSION IF NOT EXISTS pg_trgm WITH SCHEMA pg_catalog;" |& tee -a "${LOG_FILE}"
-sudo -u postgres -s psql -d $db_name -c 'CREATE EXTENSION IF NOT EXISTS "unaccent";' |& tee -a "${LOG_FILE}"
+write_log "Adding PostgreSQL extensions"
+sudo -u postgres -s psql -d $db_name -f "${SCRIPT_DIR}/assets/db/add_pg_extensions.sql" |& tee -a "${LOG_FILE}"
 
 
 # Mise en place de la structure de la BDD et des données permettant son fonctionnement avec l'application
@@ -100,58 +78,4 @@ if [[ "${MODE}" == "dev" ]]; then
     mkdir -p "${DATA_DIRECTORY}"
 fi
 
-geonature db upgrade geonature@head -x local-srid=$srid_local |& tee -a "${LOG_FILE}"
-geonature db autoupgrade -x local-srid=$srid_local |& tee -a "${LOG_FILE}"
-
-geonature db exec "DO 'BEGIN ASSERT EXISTS (SELECT 1 FROM taxonomie.taxref); END'" 2>/dev/null || if [ "$install_bdc_statuts" = true ];
-then
-    geonature db upgrade ref_geo_fr_departments@head |& tee -a "${LOG_FILE}"
-    geonature taxref import-v16
-else
-    geonature taxref import-v16 --skip-bdc-statuts
-fi
-geonature db upgrade nomenclatures_taxonomie_data@head
-
-# Installation des données exemples
-if [ "$add_sample_data" = true ];
-then
-    write_log "Inserting sample datasets..."
-    geonature db upgrade geonature-samples@head |& tee -a "${LOG_FILE}"
-fi
-
-if [ "$install_sig_layers" = true ];
-then
-    geonature db upgrade ref_geo_fr_departments@head |& tee -a "${LOG_FILE}"
-    geonature db upgrade ref_geo_fr_municipalities@head |& tee -a "${LOG_FILE}"
-    geonature db upgrade ref_geo_fr_regions@head |& tee -a "${LOG_FILE}"
-fi
-
-if [ "$install_grid_layer" = true ];
-then
-    geonature db upgrade ref_geo_inpn_grids_1@head |& tee -a "${LOG_FILE}"
-    geonature db upgrade ref_geo_inpn_grids_5@head |& tee -a "${LOG_FILE}"
-    geonature db upgrade ref_geo_inpn_grids_10@head |& tee -a "${LOG_FILE}"
-fi
-
-if [ "$install_ref_sensitivity" = true ];
-then
-    geonature db upgrade ref_geo_fr_departments@head |& tee -a "${LOG_FILE}"
-    geonature sensitivity add-referential \
-            --source-name "Référentiel sensibilité TAXREF v16 20230203" \
-            --url https://geonature.fr/data/inpn/sensitivity/RefSensibiliteV16_20230203.zip \
-            --zipfile RefSensibiliteV16_20230203.zip \
-            --csvfile RefSensibiliteV16_20230203/RefSensibilite_16.csv  \
-            --encoding=iso-8859-15 |& tee -a "${LOG_FILE}"
-    geonature sensitivity refresh-rules-cache |& tee -a "${LOG_FILE}"
-fi
-
-if  [ "$install_default_dem" = true ];
-then
-    geonature db upgrade ign_bd_alti@head -x local-srid=$srid_local |& tee -a "${LOG_FILE}"
-    if [ "$vectorise_dem" = true ];
-    then
-        geonature db upgrade ign_bd_alti_vector@head |& tee -a "${LOG_FILE}"
-    fi
-fi
-
-geonature db autoupgrade -x local-srid=$srid_local |& tee -a "${LOG_FILE}"
+. ${SCRIPT_DIR}/03b_populate_db.sh |& tee -a "${LOG_FILE}"
diff --git a/install/03b_populate_db.sh b/install/03b_populate_db.sh
new file mode 100755
index 0000000000..c8ce303965
--- /dev/null
+++ b/install/03b_populate_db.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+geonature db upgrade geonature@head -x local-srid=$srid_local
+geonature db autoupgrade -x local-srid=$srid_local
+
+geonature db exec "DO 'BEGIN ASSERT EXISTS (SELECT 1 FROM taxonomie.taxref); END'" 2>/dev/null \
+|| if [ "$install_bdc_statuts" = true ];
+then
+    geonature db upgrade ref_geo_fr_departments@head
+    geonature taxref import-v16
+else
+    geonature taxref import-v16 --skip-bdc-statuts
+fi
+geonature db upgrade nomenclatures_taxonomie_data@head
+
+# Installation des données exemples
+if [ "$add_sample_data" = true ];
+then
+    geonature db upgrade geonature-samples@head
+fi
+
+if [ "$install_sig_layers" = true ];
+then
+    geonature db upgrade ref_geo_fr_departments@head
+    geonature db upgrade ref_geo_fr_municipalities@head
+    geonature db upgrade ref_geo_fr_regions@head
+fi
+
+if [ "$install_grid_layer" = true ];
+then
+    geonature db upgrade ref_geo_inpn_grids_1@head
+    geonature db upgrade ref_geo_inpn_grids_5@head
+    geonature db upgrade ref_geo_inpn_grids_10@head
+fi
+
+geonature db exec "DO 'BEGIN ASSERT EXISTS (SELECT 1 FROM gn_sensitivity.t_sensitivity_rules); END'" 2>/dev/null \
+|| if [ "$install_ref_sensitivity" = true ];
+then
+    geonature db upgrade ref_geo_fr_departments@head
+    geonature sensitivity add-referential \
+            --source-name "Référentiel sensibilité TAXREF v16 20230203" \
+            --url https://geonature.fr/data/inpn/sensitivity/RefSensibiliteV16_20230203.zip \
+            --zipfile RefSensibiliteV16_20230203.zip \
+            --csvfile RefSensibiliteV16_20230203/RefSensibilite_16.csv  \
+            --encoding=iso-8859-15
+    geonature sensitivity refresh-rules-cache
+fi
+
+if  [ "$install_default_dem" = true ];
+then
+    geonature db upgrade ign_bd_alti@head -x local-srid=$srid_local
+    if [ "$vectorise_dem" = true ];
+    then
+        geonature db upgrade ign_bd_alti_vector@head
+    fi
+fi
+
+geonature db autoupgrade -x local-srid=$srid_local
diff --git a/install/03b_populate_db_for_test.sh b/install/03b_populate_db_for_test.sh
new file mode 100755
index 0000000000..5da25bd843
--- /dev/null
+++ b/install/03b_populate_db_for_test.sh
@@ -0,0 +1,16 @@
+geonature db upgrade geonature@head -x local-srid=2154
+geonature db autoupgrade -x local-srid=2154
+geonature db upgrade ref_geo_fr_departments@head
+geonature db upgrade taxhub@head
+geonature taxref import-v16
+geonature db upgrade geonature-samples@head
+geonature db upgrade nomenclatures_taxonomie_data@head
+geonature db upgrade ref_geo_fr_municipalities@head
+geonature db upgrade ref_geo_fr_departments@head
+geonature db upgrade ref_geo_inpn_grids_5@head
+geonature sensitivity add-referential \
+    --source-name "Référentiel sensibilité TAXREF v16 20230203" \
+    --url https://geonature.fr/data/inpn/sensitivity/RefSensibiliteV16_20230203.zip \
+    --zipfile RefSensibiliteV16_20230203.zip \
+    --csvfile RefSensibiliteV16_20230203/RefSensibilite_16.csv \
+    --encoding=iso-8859-15
diff --git a/install/assets/db/add_pg_extensions.sql b/install/assets/db/add_pg_extensions.sql
new file mode 100644
index 0000000000..1fac8f7d84
--- /dev/null
+++ b/install/assets/db/add_pg_extensions.sql
@@ -0,0 +1,20 @@
+CREATE EXTENSION IF NOT EXISTS "hstore";
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pg_trgm";
+CREATE EXTENSION IF NOT EXISTS "unaccent";
+
+-- postgis
+
+CREATE EXTENSION IF NOT EXISTS "postgis";
+
+-- check if postgis_raster is available
+DO
+$$
+BEGIN
+    IF EXISTS (
+        SELECT name FROM PG_CATALOG.PG_AVAILABLE_EXTENSIONS WHERE name = 'postgis_raster'
+    ) THEN
+        CREATE EXTENSION IF NOT EXISTS "postgis_raster";
+    END IF;
+END
+$$
\ No newline at end of file
diff --git a/install/assets/docker_startup.sh b/install/assets/docker_startup.sh
new file mode 100755
index 0000000000..fce7099001
--- /dev/null
+++ b/install/assets/docker_startup.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# script <geonature>/install/assert/docker_startup.sh
+# fait appel à <geonature>/install/03b_populate_db.sh (renommé  /populate_db.sh dans le docker)
+# pour lancer les migrations alembic et les commandes d'ajouts de donneés (taxref, sensibilité)
+# si la variable d'environnement GEONATURE_POPULATE_DB est définie à True
+# sinon il lance gunicorn directement
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+
+# creer les tables et peupler la base
+if [ "${GEONATURE_POPULATE_DB}" = true ]; then
+    . /populate_db.sh
+    if [ "$usershub" = true ];
+    then
+        geonature db upgrade usershub@head
+        if [ "$usershub_samples" = true ];
+        then
+            geonature db upgrade usershub-samples@head
+        fi
+    fi
+
+    if [ "$taxhub" = true ];
+    then
+        geonature db upgrade taxhub@head
+        if [ "$taxhub_samples" = true ];
+        then
+            geonature db upgrade taxhub-admin@head
+        fi
+    fi
+fi
+
+# lancement de l'application
+gunicorn "geonature:create_app()" \
+    --name=geonature \
+    --workers=2 \
+    --threads=2 \
+    --bind=0.0.0.0:8000
\ No newline at end of file

From 6aab09c2a8b06f3d70cb254ffcceab1d3e36dcbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 16 May 2023 22:48:13 +0200
Subject: [PATCH 020/209] handle APPLICATION_ROOT with DispatcherMiddleware

This make APPLICATION_ROOT works with dev mode.
---
 backend/geonature/app.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index a93a2c42db..a5d17b2173 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -19,6 +19,8 @@
 from flask_sqlalchemy import before_models_committed
 from werkzeug.middleware.proxy_fix import ProxyFix
 from werkzeug.middleware.shared_data import SharedDataMiddleware
+from werkzeug.middleware.dispatcher import DispatcherMiddleware
+from werkzeug.wrappers import Response
 from psycopg2.errors import UndefinedTable
 import sqlalchemy as sa
 from sqlalchemy.exc import OperationalError, ProgrammingError
@@ -97,9 +99,6 @@ def create_app(with_external_mods=True):
 
     app.config.update(config)
 
-    if "SCRIPT_NAME" not in os.environ:
-        os.environ["SCRIPT_NAME"] = app.config["APPLICATION_ROOT"].rstrip("/")
-
     # Enable deprecation warnings in debug mode
     if app.debug and not sys.warnoptions:
         warnings.filterwarnings(action="default", category=DeprecationWarning)
@@ -108,6 +107,11 @@ def create_app(with_external_mods=True):
     app.wsgi_app = SchemeFix(app.wsgi_app, scheme=config.get("PREFERRED_URL_SCHEME"))
     app.wsgi_app = ProxyFix(app.wsgi_app, x_host=1)
     app.wsgi_app = RequestID(app.wsgi_app)
+    if app.config["APPLICATION_ROOT"] != "/":
+        app.wsgi_app = DispatcherMiddleware(
+            Response("Not Found", status=404),
+            {app.config["APPLICATION_ROOT"].rstrip("/"): app.wsgi_app},
+        )
 
     if config.get("CUSTOM_STATIC_FOLDER"):
         app.wsgi_app = SharedDataMiddleware(

From db45d83af1429054fa0833c9b61933ef96e267e7 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 11:02:07 +0200
Subject: [PATCH 021/209] Dynamic form : fix number default value #2540

---
 .../form/dynamic-form-generator/dynamic-form.service.ts       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/app/GN2CommonModule/form/dynamic-form-generator/dynamic-form.service.ts b/frontend/src/app/GN2CommonModule/form/dynamic-form-generator/dynamic-form.service.ts
index 7fada8cb3b..2119469415 100644
--- a/frontend/src/app/GN2CommonModule/form/dynamic-form-generator/dynamic-form.service.ts
+++ b/frontend/src/app/GN2CommonModule/form/dynamic-form-generator/dynamic-form.service.ts
@@ -128,10 +128,10 @@ export class DynamicFormService {
   createControl(formDef): AbstractControl {
     const formControl = new UntypedFormControl();
     const value = formDef.value || null;
-    this.setControl(formControl, formDef, value);
+    const defaultValue = parseFloat(value) ? parseFloat(value) : value;
+    this.setControl(formControl, formDef, defaultValue);
     return formControl;
   }
-
   addNewControl(formDef, formGroup: UntypedFormGroup) {
     //Mise en fonction des valeurs des dynamic-form ex: "hidden: "({value}) => value.monChamps != 'maValeur'""
     for (const keyParam of Object.keys(formDef)) {

From f63581eb0cb6fd43a145a9188f2fdddd7511ff5d Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 11:36:30 +0200
Subject: [PATCH 022/209] Fix marker moove - fix #2554

---
 .../src/app/GN2CommonModule/map/marker/marker.component.ts   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts b/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
index ba8e7fe3c0..05ef264755 100644
--- a/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
+++ b/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
@@ -58,6 +58,7 @@ export class MarkerComponent implements OnInit, OnChanges {
   ngOnInit() {
     this.map = this.mapservice.map;
     this.zoomLevel = this.zoomLevel || this.config.MAPCONFIG.ZOOM_LEVEL_RELEVE;
+
     this.setMarkerLegend();
     // activation or not of the marker
     if (this.defaultEnable) {
@@ -138,7 +139,9 @@ export class MarkerComponent implements OnInit, OnChanges {
         this.map.addLayer(this.mapservice.marker);
         this.markerMoveEvent(this.mapservice.marker);
       } else {
-        this.markerChanged.emit(this.markerToGeojson(this.mapservice.marker.getLatLng()));
+        const geojsonCoord = this.markerToGeojson(this.mapservice.marker.getLatLng());
+        this.mapservice.setGeojsonCoord(geojsonCoord);
+        this.markerChanged.emit(geojsonCoord);
       }
     });
   }

From e80a455f44521966461dd299493605ee8b53bb38 Mon Sep 17 00:00:00 2001
From: Mathieu ROUDAUT <mroudaut@creamontblanc.org>
Date: Mon, 27 Mar 2023 10:42:40 +0200
Subject: [PATCH 023/209] feat: make scripts portable across unix systems

---
 backend/geonature/utils/command.py                          | 6 +++---
 data/migrations/2.0.1to2.1.0.sh                             | 2 +-
 data/migrations/2.4.0to2.4.1_insert_departments.sh          | 4 ++--
 data/migrations/missing_grid.sh                             | 2 +-
 data/migrations/v1tov2/migratetoV2.sh                       | 2 +-
 data/migrations/v1tov2/my_organisme/mymigratetoV2.sh        | 2 +-
 data/migrations/v1tov2/old/v1_compat.sh.old                 | 2 +-
 data/scripts/backup/pgdump2ftpbackup.sh                     | 2 +-
 data/scripts/import_ginco/import_ca.sh                      | 2 +-
 data/scripts/import_ginco/import_mtd.sh                     | 2 +-
 .../import_ginco/import_taxref/import_new_taxref_version.sh | 2 +-
 data/scripts/import_ginco/restore_db.sh                     | 2 +-
 data/scripts/ref_geo/insert_reg.sh                          | 4 ++--
 data/scripts/sensi/import_sensi_depobio.sh                  | 2 +-
 install/00_install_nvm.sh                                   | 2 +-
 install/01_install_backend.sh                               | 2 +-
 install/02_configure_systemd.sh                             | 2 +-
 install/03_create_db.sh                                     | 2 +-
 install/04_install_gn_modules.sh                            | 2 +-
 install/05_install_frontend.sh                              | 2 +-
 install/06_configure_apache.sh                              | 2 +-
 install/install_all/install_all.sh                          | 2 +-
 install/migration/beta4tobeta5.sh                           | 2 +-
 install/migration/migration.sh                              | 2 +-
 install/utils                                               | 2 +-
 lint.sh                                                     | 2 +-
 26 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/backend/geonature/utils/command.py b/backend/geonature/utils/command.py
index ba7d715af0..661f5c18f5 100644
--- a/backend/geonature/utils/command.py
+++ b/backend/geonature/utils/command.py
@@ -57,7 +57,7 @@ def create_frontend_module_config(module_code, output_file=None):
 
 
 def nvm_available():
-    return run(["/bin/bash", "-i", "-c", "type -t nvm"], stdout=DEVNULL).returncode == 0
+    return run(["/usr/bin/env bash", "-i", "-c", "type -t nvm"], stdout=DEVNULL).returncode == 0
 
 
 def install_frontend_dependencies(module_frontend_path):
@@ -65,12 +65,12 @@ def install_frontend_dependencies(module_frontend_path):
     if nvm_available():
         with (FRONTEND_DIR / ".nvmrc").open("r") as f:
             node_version = f.read().strip()
-        cmd = ["/bin/bash", "-i", "-c", f"nvm exec {node_version} {' '.join(cmd)}"]
+        cmd = ["/usr/bin/env bash", "-i", "-c", f"nvm exec {node_version} {' '.join(cmd)}"]
     run(cmd, check=True, cwd=module_frontend_path)
 
 
 def build_frontend():
     cmd = ["npm", "run", "build"]
     if nvm_available():
-        cmd = ["/bin/bash", "-i", "-c", f"nvm exec {' '.join(cmd)}"]
+        cmd = ["/usr/bin/env bash", "-i", "-c", f"nvm exec {' '.join(cmd)}"]
     run(cmd, check=True, cwd=str(FRONTEND_DIR))
diff --git a/data/migrations/2.0.1to2.1.0.sh b/data/migrations/2.0.1to2.1.0.sh
index 80403e9167..44d1c5e826 100755
--- a/data/migrations/2.0.1to2.1.0.sh
+++ b/data/migrations/2.0.1to2.1.0.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # faux sudo car sinon la commande "sudo -n -u" ne le demande pas
 sudo ls
diff --git a/data/migrations/2.4.0to2.4.1_insert_departments.sh b/data/migrations/2.4.0to2.4.1_insert_departments.sh
index 92520a49cb..48db9473eb 100755
--- a/data/migrations/2.4.0to2.4.1_insert_departments.sh
+++ b/data/migrations/2.4.0to2.4.1_insert_departments.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 filepath=$(realpath $0)
 GEONATURE_ROOT=$(dirname $(dirname $(dirname $filepath)))
@@ -16,4 +16,4 @@ export PGPASSWORD=$user_pg_pass;psql -h $db_host -U $user_pg -d $db_name -f $GEO
 sudo -n -u postgres -s psql -d $db_name -c "DROP TABLE ref_geo.temp_fr_departements;" &>> $GEONATURE_ROOT/var/log/insert_departements.log
 
 rm $GEONATURE_ROOT/tmp/geonature/departement_admin_express_2020-02.zip
-rm $GEONATURE_ROOT/tmp/geonature/fr_departements.sql
\ No newline at end of file
+rm $GEONATURE_ROOT/tmp/geonature/fr_departements.sql
diff --git a/data/migrations/missing_grid.sh b/data/migrations/missing_grid.sh
index 94ea99cdae..9d7ab61666 100755
--- a/data/migrations/missing_grid.sh
+++ b/data/migrations/missing_grid.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 . ../../config/settings.ini
 cd ../../
 
diff --git a/data/migrations/v1tov2/migratetoV2.sh b/data/migrations/v1tov2/migratetoV2.sh
index efeaa25268..d85735e88c 100755
--- a/data/migrations/v1tov2/migratetoV2.sh
+++ b/data/migrations/v1tov2/migratetoV2.sh
@@ -1,4 +1,4 @@
-#! /bin/bash
+#! /usr/bin/env bash
 . migratetoV2.ini
 . ../../../config/settings.ini
 echo $geonature1user
diff --git a/data/migrations/v1tov2/my_organisme/mymigratetoV2.sh b/data/migrations/v1tov2/my_organisme/mymigratetoV2.sh
index 4005d5e336..f52aa8649c 100755
--- a/data/migrations/v1tov2/my_organisme/mymigratetoV2.sh
+++ b/data/migrations/v1tov2/my_organisme/mymigratetoV2.sh
@@ -1,4 +1,4 @@
-#! /bin/bash
+#! /usr/bin/env bash
 . ../migratetoV2.ini
 . mymigratetov2.ini
 . ../../../../config/settings.ini
diff --git a/data/migrations/v1tov2/old/v1_compat.sh.old b/data/migrations/v1tov2/old/v1_compat.sh.old
index b184262a26..0f291e450e 100755
--- a/data/migrations/v1tov2/old/v1_compat.sh.old
+++ b/data/migrations/v1tov2/old/v1_compat.sh.old
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 . v1_compat.ini
 . ../../../config/settings.ini
diff --git a/data/scripts/backup/pgdump2ftpbackup.sh b/data/scripts/backup/pgdump2ftpbackup.sh
index 5f9847e7ab..0a9b476716 100644
--- a/data/scripts/backup/pgdump2ftpbackup.sh
+++ b/data/scripts/backup/pgdump2ftpbackup.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 BKPDIR="/var/backups/pgsql"
 TODAY=`date +%F`
diff --git a/data/scripts/import_ginco/import_ca.sh b/data/scripts/import_ginco/import_ca.sh
index 1dcef8acb0..95c817aad8 100644
--- a/data/scripts/import_ginco/import_ca.sh
+++ b/data/scripts/import_ginco/import_ca.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 . settings.ini
 # export all variable in settings.ini
diff --git a/data/scripts/import_ginco/import_mtd.sh b/data/scripts/import_ginco/import_mtd.sh
index 0a1854b6e8..a1b3bb7a5c 100755
--- a/data/scripts/import_ginco/import_mtd.sh
+++ b/data/scripts/import_ginco/import_mtd.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 . settings.ini
 # export all variable in settings.ini
diff --git a/data/scripts/import_ginco/import_taxref/import_new_taxref_version.sh b/data/scripts/import_ginco/import_taxref/import_new_taxref_version.sh
index ebab7f0442..345dce8649 100755
--- a/data/scripts/import_ginco/import_taxref/import_new_taxref_version.sh
+++ b/data/scripts/import_ginco/import_taxref/import_new_taxref_version.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 . ../settings.ini
 
 mkdir -p /tmp/taxhub
diff --git a/data/scripts/import_ginco/restore_db.sh b/data/scripts/import_ginco/restore_db.sh
index 835e447924..c17b7ee3a0 100755
--- a/data/scripts/import_ginco/restore_db.sh
+++ b/data/scripts/import_ginco/restore_db.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Scripts qui restaure une BDD GINCO à parit d'un DUMP SQL
 # Puis crée un Foreign Data Wrapper entre la base restaurée et la base GeoNature cible 
diff --git a/data/scripts/ref_geo/insert_reg.sh b/data/scripts/ref_geo/insert_reg.sh
index 57f2c67952..ae2653bffc 100755
--- a/data/scripts/ref_geo/insert_reg.sh
+++ b/data/scripts/ref_geo/insert_reg.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 filepath=$(realpath $0)
 GEONATURE_ROOT=$(dirname $(dirname $(dirname $filepath)))
@@ -15,4 +15,4 @@ export PGPASSWORD=$user_pg_pass;psql -h $db_host -U $user_pg -d $db_name -f $GEO
 sudo -n -u postgres psql -d $db_name -c "DROP TABLE ref_geo.temp_fr_regions;" &>> $GEONATURE_ROOT/var/log/insert_reg.log
 
 # rm $GEONATURE_ROOT/tmp/geonature/reg_fr_admin_express_2020-07.zip
-rm $GEONATURE_ROOT/tmp/geonature/fr_regions.sql
\ No newline at end of file
+rm $GEONATURE_ROOT/tmp/geonature/fr_regions.sql
diff --git a/data/scripts/sensi/import_sensi_depobio.sh b/data/scripts/sensi/import_sensi_depobio.sh
index 91c4c3ac06..fb343d7d6e 100755
--- a/data/scripts/sensi/import_sensi_depobio.sh
+++ b/data/scripts/sensi/import_sensi_depobio.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Script remplaçant les règles de sensibilité nationales et régionales intégrées dans GeoNature, par les règles départementales.
 # Utilisé pour DEPOBIO pour disposer des règles de sensibilité à jour, au niveau départemantal.
diff --git a/install/00_install_nvm.sh b/install/00_install_nvm.sh
index 865216cd55..a5f11f67d8 100755
--- a/install/00_install_nvm.sh
+++ b/install/00_install_nvm.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 
 echo "Installation de nvm"
diff --git a/install/01_install_backend.sh b/install/01_install_backend.sh
index 34925baeb1..3bc6e3042f 100755
--- a/install/01_install_backend.sh
+++ b/install/01_install_backend.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # DESC: Usage help
 # ARGS: None
diff --git a/install/02_configure_systemd.sh b/install/02_configure_systemd.sh
index fa6cae2569..253ec2aee7 100755
--- a/install/02_configure_systemd.sh
+++ b/install/02_configure_systemd.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 
 set -eo pipefail
diff --git a/install/03_create_db.sh b/install/03_create_db.sh
index 9baab9a8f5..15122407f5 100755
--- a/install/03_create_db.sh
+++ b/install/03_create_db.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 
 set -eo pipefail
diff --git a/install/04_install_gn_modules.sh b/install/04_install_gn_modules.sh
index ca98d5f240..64106b7305 100755
--- a/install/04_install_gn_modules.sh
+++ b/install/04_install_gn_modules.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -eo pipefail
 
diff --git a/install/05_install_frontend.sh b/install/05_install_frontend.sh
index 5cecdc5c92..7dced1a0c0 100755
--- a/install/05_install_frontend.sh
+++ b/install/05_install_frontend.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # DESC: Usage help
 # ARGS: None
diff --git a/install/06_configure_apache.sh b/install/06_configure_apache.sh
index f3dfd0536c..ff562eb88b 100755
--- a/install/06_configure_apache.sh
+++ b/install/06_configure_apache.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 . "${SCRIPT_DIR}/utils"
diff --git a/install/install_all/install_all.sh b/install/install_all/install_all.sh
index 496aa2f460..99bd0a35df 100755
--- a/install/install_all/install_all.sh
+++ b/install/install_all/install_all.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 
diff --git a/install/migration/beta4tobeta5.sh b/install/migration/beta4tobeta5.sh
index 494886506f..09b6cc8cee 100755
--- a/install/migration/beta4tobeta5.sh
+++ b/install/migration/beta4tobeta5.sh
@@ -1,4 +1,4 @@
-#/bin/bash
+#/usr/bin/env bash
 
 BASE_DIR=$(readlink -e "${0%/*}")
 
diff --git a/install/migration/migration.sh b/install/migration/migration.sh
index 5758ccf83a..16601b7179 100755
--- a/install/migration/migration.sh
+++ b/install/migration/migration.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 SERVICES=("geonature" "geonature-worker" "taxhub" "usershub")
 
diff --git a/install/utils b/install/utils
index 52ad18307b..79e7fccab0 100755
--- a/install/utils
+++ b/install/utils
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 
 export BASE_DIR=$(dirname "${SCRIPT_DIR}")
diff --git a/lint.sh b/lint.sh
index 552626c9ad..f9399ad14f 100755
--- a/lint.sh
+++ b/lint.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # backend
 black .

From 7904a6396acc23f023b69d7728c8018f3245f806 Mon Sep 17 00:00:00 2001
From: Mathieu ROUDAUT <mroudaut@creamontblanc.org>
Date: Mon, 27 Mar 2023 11:39:59 +0200
Subject: [PATCH 024/209] fix(install): python script with bash command

---
 backend/geonature/utils/command.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/utils/command.py b/backend/geonature/utils/command.py
index 661f5c18f5..98b3a15df4 100644
--- a/backend/geonature/utils/command.py
+++ b/backend/geonature/utils/command.py
@@ -57,7 +57,7 @@ def create_frontend_module_config(module_code, output_file=None):
 
 
 def nvm_available():
-    return run(["/usr/bin/env bash", "-i", "-c", "type -t nvm"], stdout=DEVNULL).returncode == 0
+    return run(["/usr/bin/env", "bash", "-i", "-c", "type -t nvm"], stdout=DEVNULL).returncode == 0
 
 
 def install_frontend_dependencies(module_frontend_path):
@@ -65,12 +65,12 @@ def install_frontend_dependencies(module_frontend_path):
     if nvm_available():
         with (FRONTEND_DIR / ".nvmrc").open("r") as f:
             node_version = f.read().strip()
-        cmd = ["/usr/bin/env bash", "-i", "-c", f"nvm exec {node_version} {' '.join(cmd)}"]
+        cmd = ["/usr/bin/env", "bash", "-i", "-c", f"nvm exec {node_version} {' '.join(cmd)}"]
     run(cmd, check=True, cwd=module_frontend_path)
 
 
 def build_frontend():
     cmd = ["npm", "run", "build"]
     if nvm_available():
-        cmd = ["/usr/bin/env bash", "-i", "-c", f"nvm exec {' '.join(cmd)}"]
+        cmd = ["/usr/bin/env", "bash", "-i", "-c", f"nvm exec {' '.join(cmd)}"]
     run(cmd, check=True, cwd=str(FRONTEND_DIR))

From 714481310f8d30179303214b1f49385627d6f11b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 16 May 2023 11:14:07 +0200
Subject: [PATCH 025/209] check releve ownership before accessing counting

---
 backend/geonature/tests/test_pr_occtax.py  |  9 ++++--
 contrib/occtax/backend/occtax/blueprint.py | 32 ++++++++--------------
 2 files changed, 18 insertions(+), 23 deletions(-)

diff --git a/backend/geonature/tests/test_pr_occtax.py b/backend/geonature/tests/test_pr_occtax.py
index e1af27aef3..c4f27a7344 100644
--- a/backend/geonature/tests/test_pr_occtax.py
+++ b/backend/geonature/tests/test_pr_occtax.py
@@ -4,7 +4,7 @@
 from datetime import datetime as dt
 
 from flask import url_for, current_app, g
-from werkzeug.exceptions import Forbidden, NotFound
+from werkzeug.exceptions import Unauthorized, Forbidden, NotFound
 from shapely.geometry import Point
 from geoalchemy2.shape import from_shape
 from sqlalchemy import func
@@ -231,7 +231,12 @@ def test_post_releve_in_module_bis(self, users, releve_data, module, datasets):
         data = response.json
         assert data["properties"]["id_module"] == module.id_module
 
-    def test_get_defaut_nomenclatures(self):
+    def test_get_defaut_nomenclatures(self, users):
+        response = self.client.get(url_for("pr_occtax.getDefaultNomenclatures"))
+        assert response.status_code == Unauthorized.code
+
+        set_logged_user_cookie(self.client, users["user"])
+
         response = self.client.get(url_for("pr_occtax.getDefaultNomenclatures"))
         assert response.status_code == 200
 
diff --git a/contrib/occtax/backend/occtax/blueprint.py b/contrib/occtax/backend/occtax/blueprint.py
index 16b4171f37..2950e99d08 100644
--- a/contrib/occtax/backend/occtax/blueprint.py
+++ b/contrib/occtax/backend/occtax/blueprint.py
@@ -125,27 +125,11 @@ def getReleves(scope):
     }
 
 
-@blueprint.route("/<module_code>/occurrences", methods=["GET"])
-@blueprint.route("/occurrences", methods=["GET"])
-@permissions.check_cruved_scope("R")
-@json_resp
-def getOccurrences():
-    """
-    Get all Occurrences
-
-    .. :quickref: Occtax;
-
-    :returns: `dict<TOccurrencesOccurrence>`
-    """
-    q = DB.session.query(TOccurrencesOccurrence)
-    data = q.all()
-    return [n.as_dict() for n in data]
-
-
 @blueprint.route("/<module_code>/counting/<int:id_counting>", methods=["GET"])
 @blueprint.route("/counting/<int:id_counting>", methods=["GET"])
+@permissions.check_cruved_scope("R", get_scope=True)
 @json_resp
-def getOneCounting(id_counting):
+def getOneCounting(scope, id_counting):
     """
     Get one counting record, with its id_counting
 
@@ -156,6 +140,10 @@ def getOneCounting(id_counting):
     :returns: a dict representing a counting record
     :rtype: dict<CorCountingOccurrence>
     """
+    ccc = CorCountingOccurrence.query.get_or_404(id_counting)
+    if not ccc.occurrence.releve.has_instance_permissions(scope):
+        raise Forbidden
+
     try:
         data = (
             DB.session.query(CorCountingOccurrence, TRelevesOccurrence.id_releve_occtax)
@@ -513,8 +501,8 @@ def deleteOneOccurence(id_occ, scope):
 
 @blueprint.route("/<module_code>/releve/occurrence_counting/<int:id_count>", methods=["DELETE"])
 @blueprint.route("/releve/occurrence_counting/<int:id_count>", methods=["DELETE"])
-@permissions.check_cruved_scope("D")
-def deleteOneOccurenceCounting(id_count):
+@permissions.check_cruved_scope("D", get_scope=True)
+def deleteOneOccurenceCounting(scope, id_count):
     """Delete one counting
 
     .. :quickref: Occtax;
@@ -523,7 +511,8 @@ def deleteOneOccurenceCounting(id_count):
 
     """
     ccc = CorCountingOccurrence.query.get_or_404(id_count)
-    # TODO check ccc ownership!
+    if not ccc.occurence.releve.has_instance_permission(scope):
+        raise Forbidden
     DB.session.delete(ccc)
     DB.session.commit()
     return "", 204
@@ -531,6 +520,7 @@ def deleteOneOccurenceCounting(id_count):
 
 @blueprint.route("/<module_code>/defaultNomenclatures", methods=["GET"])
 @blueprint.route("/defaultNomenclatures", methods=["GET"])
+@permissions.login_required
 def getDefaultNomenclatures():
     """Get default nomenclatures define in occtax module
 

From 7f0941f120e0e958decbf4d5d283e40cd0dd7ea6 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Thu, 6 Apr 2023 20:13:51 +0200
Subject: [PATCH 026/209] feat(api): add notification for comment on obs

---
 backend/geonature/core/gn_synthese/routes.py  | 18 +++++
 ...452_add_validation_comment_notification.py | 79 +++++++++++++++++++
 2 files changed, 97 insertions(+)
 create mode 100644 backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index be8c13f2b7..d5d8793b92 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -32,6 +32,7 @@
 from geonature.utils.utilsgeometrytools import export_as_geo_file
 
 from geonature.core.gn_meta.models import TDatasets
+from geonature.core.notifications.utils import dispatch_notifications
 
 from geonature.core.gn_synthese.models import (
     BibReportsTypes,
@@ -1100,9 +1101,26 @@ def create_report(scope):
         id_type=type_exists.id_type,
     )
     session.add(new_entry)
+    notify_new_report_change(synthese=synthese, content=content)
     session.commit()
 
 
+def notify_new_report_change(synthese, content):
+    if not synthese.id_digitiser:
+        return
+    dispatch_notifications(
+        code_categories=["VALIDATION-NEW-COMMENT"],
+        id_roles=[synthese.id_digitiser],
+        title="Nouveau commentaire sur une observation",
+        url=(
+            current_app.config["URL_APPLICATION"]
+            + "/#/validation/occurrence/"
+            + str(synthese.id_synthese)
+        ),
+        context={"synthese": synthese, "content": content},
+    )
+
+
 @routes.route("/reports/<int:id_report>", methods=["PUT"])
 @permissions.login_required
 @json_resp
diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
new file mode 100644
index 0000000000..2c64f6cf8c
--- /dev/null
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
@@ -0,0 +1,79 @@
+"""add_validation_comment_notification
+
+Revision ID: 95acee9f0452
+Revises: 9e9218653d6c
+Create Date: 2023-04-06 19:02:39.863972
+
+"""
+import sqlalchemy as sa
+from alembic import op
+
+from geonature.core.notifications.models import (
+    NotificationCategory,
+    NotificationRule,
+    NotificationTemplate,
+)
+
+# revision identifiers, used by Alembic.
+revision = "95acee9f0452"
+down_revision = "9e9218653d6c"
+branch_labels = None
+depends_on = None
+
+CATEGORY_CODE = "VALIDATION-NEW-COMMENT"
+
+
+def upgrade():
+    bind = op.get_bind()
+    session = sa.orm.Session(bind=bind)
+
+    # Add category
+    category = NotificationCategory(
+        code=CATEGORY_CODE,
+        label="Nouveau commentaire dans une discussion sur une observation",
+        description=(
+            "Se déclenche lorsqu'un nouveau commentaire "
+            "est ajouté dans une discussion de validation"
+        ),
+    )
+
+    session.add(category)
+
+    # Add template
+    email_content = """ <p>Bonjour <i>{{ role.nom_complet }}</i> !</p> 
+    <p>Votre observation de l'espèce : {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }} a reçu un commentaire</p>
+    <p>Vous pouvez y accéder directement <a href="{{ url }}">ici</a></p>
+    <p><i>Vous recevez cet email automatiquement via le service de notification de GeoNature.</i></p>
+    """
+    db_content = """ Vous avez reçu un nouveau commentaire sur votre observation 
+    de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}
+    """
+
+    for method, content in (("EMAIL", email_content), ("DB", db_content)):
+        template = NotificationTemplate(category=category, code_method=method, content=content)
+        session.add(template)
+
+    session.commit()
+
+
+def downgrade():
+    bind = op.get_bind()
+    session = sa.orm.Session(bind=bind)
+    # Do not use NotificationCategory.query as it is not the same session!
+    category = (
+        session.query(NotificationCategory)
+        .filter(NotificationCategory.code == CATEGORY_CODE)
+        .one()
+    )
+
+    if category:
+        session.query(NotificationRule).filter(
+            NotificationRule.code_category == category.code
+        ).delete()
+        # Since there is no cascade, need to delete template manually
+        session.query(NotificationTemplate).filter(
+            NotificationTemplate.code_category == category.code
+        ).delete()
+
+        session.delete(category)
+        session.commit()

From da01b417bbeb29040921cd8b570243f0c2ada85b Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 09:43:17 +0200
Subject: [PATCH 027/209] fix: return url to synthese instead of validation

---
 backend/geonature/core/gn_synthese/routes.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index d5d8793b92..bbce049ecf 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1114,7 +1114,7 @@ def notify_new_report_change(synthese, content):
         title="Nouveau commentaire sur une observation",
         url=(
             current_app.config["URL_APPLICATION"]
-            + "/#/validation/occurrence/"
+            + "/#/synthese/occurrence/"
             + str(synthese.id_synthese)
         ),
         context={"synthese": synthese, "content": content},

From 47451c55646e177e4481fe31eb71e511fb859a8c Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 09:53:52 +0200
Subject: [PATCH 028/209] feat(api): add user who commented to the notif

---
 backend/geonature/core/gn_synthese/routes.py                | 6 +++---
 .../95acee9f0452_add_validation_comment_notification.py     | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index bbce049ecf..b2c3e2fd93 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1101,11 +1101,11 @@ def create_report(scope):
         id_type=type_exists.id_type,
     )
     session.add(new_entry)
-    notify_new_report_change(synthese=synthese, content=content)
+    notify_new_report_change(synthese=synthese, user=g.current_user, content=content)
     session.commit()
 
 
-def notify_new_report_change(synthese, content):
+def notify_new_report_change(synthese, user, content):
     if not synthese.id_digitiser:
         return
     dispatch_notifications(
@@ -1117,7 +1117,7 @@ def notify_new_report_change(synthese, content):
             + "/#/synthese/occurrence/"
             + str(synthese.id_synthese)
         ),
-        context={"synthese": synthese, "content": content},
+        context={"synthese": synthese, "user": user, "content": content},
     )
 
 
diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
index 2c64f6cf8c..e379964465 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
@@ -41,11 +41,11 @@ def upgrade():
 
     # Add template
     email_content = """ <p>Bonjour <i>{{ role.nom_complet }}</i> !</p> 
-    <p>Votre observation de l'espèce : {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }} a reçu un commentaire</p>
+    <p>{{ user.nom_complet }} a commenté votre observation de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}</p>
     <p>Vous pouvez y accéder directement <a href="{{ url }}">ici</a></p>
     <p><i>Vous recevez cet email automatiquement via le service de notification de GeoNature.</i></p>
     """
-    db_content = """ Vous avez reçu un nouveau commentaire sur votre observation 
+    db_content = """ {{ user.nom_complet }} a commenté votre observation 
     de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}
     """
 

From f539cd857dc429bc99f821cfcc93c7c8ae918dc4 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 10:00:53 +0200
Subject: [PATCH 029/209] feat(db): change migration labels & more robust

---
 ...5acee9f0452_add_validation_comment_notification.py | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
index e379964465..ee39500ace 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
@@ -20,7 +20,7 @@
 branch_labels = None
 depends_on = None
 
-CATEGORY_CODE = "VALIDATION-NEW-COMMENT"
+CATEGORY_CODE = "OBSERVATION-COMMENT"
 
 
 def upgrade():
@@ -30,10 +30,9 @@ def upgrade():
     # Add category
     category = NotificationCategory(
         code=CATEGORY_CODE,
-        label="Nouveau commentaire dans une discussion sur une observation",
+        label="Nouveau commentaire sur une observation",
         description=(
-            "Se déclenche lorsqu'un nouveau commentaire "
-            "est ajouté dans une discussion de validation"
+            "Se déclenche lorsqu'un nouveau commentaire " "est ajouté à une de vos observations"
         ),
     )
 
@@ -63,10 +62,10 @@ def downgrade():
     category = (
         session.query(NotificationCategory)
         .filter(NotificationCategory.code == CATEGORY_CODE)
-        .one()
+        .one_or_none()
     )
 
-    if category:
+    if category is not None:
         session.query(NotificationRule).filter(
             NotificationRule.code_category == category.code
         ).delete()

From ce8b9efbb8067bc299719a9e5aacc39d3daec14e Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 10:17:05 +0200
Subject: [PATCH 030/209] style: remove useless white space

---
 .../95acee9f0452_add_validation_comment_notification.py         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
index ee39500ace..d033e57abd 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
@@ -32,7 +32,7 @@ def upgrade():
         code=CATEGORY_CODE,
         label="Nouveau commentaire sur une observation",
         description=(
-            "Se déclenche lorsqu'un nouveau commentaire " "est ajouté à une de vos observations"
+            "Se déclenche lorsqu'un nouveau commentaire est ajouté à une de vos observations"
         ),
     )
 

From b253d6c0a9674348f90e991832c7d01d0f6a6e18 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 14:25:14 +0200
Subject: [PATCH 031/209] fix(api): wrong code_categories

---
 backend/geonature/core/gn_synthese/routes.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index b2c3e2fd93..0b79342a32 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1109,7 +1109,7 @@ def notify_new_report_change(synthese, user, content):
     if not synthese.id_digitiser:
         return
     dispatch_notifications(
-        code_categories=["VALIDATION-NEW-COMMENT"],
+        code_categories=["OBSERVATION-COMMENT"],
         id_roles=[synthese.id_digitiser],
         title="Nouveau commentaire sur une observation",
         url=(

From 5cfc19a325561b34b5136ac7eb377a2979a1ab32 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 14:51:59 +0200
Subject: [PATCH 032/209] feat(api): send notification to commenters

---
 backend/geonature/core/gn_synthese/routes.py | 26 ++++++++++++++------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 0b79342a32..9d9b2902a4 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1083,12 +1083,14 @@ def create_report(scope):
         synthese = Synthese.query.get_or_404(id_synthese)
         if not synthese.has_instance_permission(scope):
             raise Forbidden
+
+        report_query = TReport.query.filter(
+            TReport.id_synthese == id_synthese,
+            TReport.report_type.has(BibReportsTypes.type == type_name),
+        )
         # only allow one alert by id_synthese
         if type_name in ["alert", "pin"]:
-            alert_exists = TReport.query.filter(
-                TReport.id_synthese == id_synthese,
-                TReport.report_type.has(BibReportsTypes.type == type_name),
-            ).one_or_none()
+            alert_exists = report_query.one_or_none()
             if alert_exists is not None:
                 raise Conflict("This type already exists for this id")
     except KeyError:
@@ -1101,16 +1103,26 @@ def create_report(scope):
         id_type=type_exists.id_type,
     )
     session.add(new_entry)
-    notify_new_report_change(synthese=synthese, user=g.current_user, content=content)
+
+    if type_name == "discussion" and g.current_user.id_role != synthese.id_digitiser:
+        commenters = [
+            report.id_role
+            for report in report_query.filter(TReport.id_role != synthese.id_digitiser).distinct(
+                TReport.id_role
+            )
+        ]
+        notify_new_report_change(
+            synthese=synthese, user=g.current_user, commenters=commenters, content=content
+        )
     session.commit()
 
 
-def notify_new_report_change(synthese, user, content):
+def notify_new_report_change(synthese, user, commenters, content):
     if not synthese.id_digitiser:
         return
     dispatch_notifications(
         code_categories=["OBSERVATION-COMMENT"],
-        id_roles=[synthese.id_digitiser],
+        id_roles=[synthese.id_digitiser] + commenters,
         title="Nouveau commentaire sur une observation",
         url=(
             current_app.config["URL_APPLICATION"]

From 1a9a26eac3dd4c5b19a673d9d031d5eb9d8a701b Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 7 Apr 2023 15:23:27 +0200
Subject: [PATCH 033/209] feat(api): add cor_observers and refact

---
 backend/geonature/core/gn_synthese/routes.py | 34 +++++++++++++-------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 9d9b2902a4..e2fc19dc1e 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -20,7 +20,7 @@
 from sqlalchemy.orm import joinedload, lazyload, selectinload
 from geojson import FeatureCollection, Feature
 import sqlalchemy as sa
-from sqlalchemy.orm import load_only, aliased
+from sqlalchemy.orm import load_only, aliased, Load
 
 from utils_flask_sqla.generic import serializeQuery, GenericTable
 from utils_flask_sqla.response import to_csv_resp, to_json_resp, json_resp
@@ -1080,7 +1080,12 @@ def create_report(scope):
         type_exists = BibReportsTypes.query.filter_by(type=type_name).first()
         if not type_exists:
             raise BadRequest("This report type does not exist")
-        synthese = Synthese.query.get_or_404(id_synthese)
+        synthese = Synthese.query.options(
+            Load(Synthese).raiseload("*"),
+            joinedload("cor_observers"),
+            joinedload("digitiser"),
+            joinedload("dataset"),
+        ).get_or_404(id_synthese)
         if not synthese.has_instance_permission(scope):
             raise Forbidden
 
@@ -1104,25 +1109,32 @@ def create_report(scope):
     )
     session.add(new_entry)
 
-    if type_name == "discussion" and g.current_user.id_role != synthese.id_digitiser:
-        commenters = [
+    if type_name == "discussion":
+        # Get the observers of the observation
+        observers = {observer.id_role for observer in synthese.cor_observers}
+        # Get the users that commented the observation
+        commenters = {
             report.id_role
-            for report in report_query.filter(TReport.id_role != synthese.id_digitiser).distinct(
-                TReport.id_role
-            )
-        ]
+            for report in report_query.filter(
+                TReport.id_role not in {synthese.id_digitiser} | observers
+            ).distinct(TReport.id_role)
+        }
+        # The id_roles are the Union between observers and commenters
+        id_roles = observers | commenters
+        # Remove the user that just commented the obs not to notify him/her
+        id_roles.remove(g.current_user.id_role)
         notify_new_report_change(
-            synthese=synthese, user=g.current_user, commenters=commenters, content=content
+            synthese=synthese, user=g.current_user, id_roles=id_roles, content=content
         )
     session.commit()
 
 
-def notify_new_report_change(synthese, user, commenters, content):
+def notify_new_report_change(synthese, user, id_roles, content):
     if not synthese.id_digitiser:
         return
     dispatch_notifications(
         code_categories=["OBSERVATION-COMMENT"],
-        id_roles=[synthese.id_digitiser] + commenters,
+        id_roles=id_roles,
         title="Nouveau commentaire sur une observation",
         url=(
             current_app.config["URL_APPLICATION"]

From d56d28a22acba232814ba897d81bb29a1db7d96b Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Sat, 8 Apr 2023 11:13:11 +0200
Subject: [PATCH 034/209] test(api): move notification fixture & cor_obs

To make it available across other tests
Add cor_observers in synthese fixture
---
 backend/geonature/tests/fixtures.py           | 13 ++++++++++---
 backend/geonature/tests/test_notifications.py |  9 ++-------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index eec41ff384..c9ec57a78e 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -4,7 +4,7 @@
 
 from PIL import Image
 import pytest
-from flask import testing, url_for
+from flask import testing, url_for, current_app
 from werkzeug.datastructures import Headers
 from sqlalchemy import func
 from shapely.geometry import Point
@@ -50,6 +50,7 @@
     "medium",
     "module",
     "perm_object",
+    "notifications_enabled",
     "celery_eager",
 ]
 
@@ -275,7 +276,7 @@ def source():
     return source
 
 
-def create_synthese(geom, taxon, user, dataset, source, uuid):
+def create_synthese(geom, taxon, user, dataset, source, uuid, cor_observers):
     now = datetime.datetime.now()
     return Synthese(
         id_source=source.id_source,
@@ -290,6 +291,7 @@ def create_synthese(geom, taxon, user, dataset, source, uuid):
         the_geom_local=func.st_transform(geom, 2154),
         date_min=now,
         date_max=now,
+        cor_observers=cor_observers,
     )
 
 
@@ -316,7 +318,7 @@ def synthese_data(app, users, datasets, source):
             )
             geom = from_shape(point, srid=4326)
             taxon = Taxref.query.filter_by(cd_nom=cd_nom).one()
-            s = create_synthese(geom, taxon, users["self_user"], ds, source, unique_id_sinp)
+            s = create_synthese(geom, taxon, users["self_user"], ds, source, unique_id_sinp, [users["admin_user"], users["user"]])
             db.session.add(s)
             data[name] = s
     return data
@@ -415,3 +417,8 @@ def create_report(id_synthese, id_role, content, id_type, deleted):
             data.append(create_report(id_synthese, *args))
 
     return data
+
+
+@pytest.fixture()
+def notifications_enabled(monkeypatch):
+    monkeypatch.setitem(current_app.config, "NOTIFICATIONS_ENABLED", True)
diff --git a/backend/geonature/tests/test_notifications.py b/backend/geonature/tests/test_notifications.py
index 2106ab19b2..f6b0fe464b 100644
--- a/backend/geonature/tests/test_notifications.py
+++ b/backend/geonature/tests/test_notifications.py
@@ -4,7 +4,7 @@
 import datetime
 from unittest.mock import patch
 
-from flask import url_for, jsonify, current_app
+from flask import url_for
 from werkzeug.exceptions import Forbidden, Unauthorized, BadRequest
 
 from geonature.utils.env import db
@@ -16,18 +16,13 @@
     NotificationTemplate,
 )
 from geonature.core.notifications import utils
-from geonature.tests.fixtures import celery_eager
+from geonature.tests.fixtures import celery_eager, notifications_enabled
 
 from .utils import set_logged_user_cookie
 
 log = logging.getLogger()
 
 
-@pytest.fixture()
-def notifications_enabled(monkeypatch):
-    monkeypatch.setitem(current_app.config, "NOTIFICATIONS_ENABLED", True)
-
-
 @pytest.fixture(scope="class")
 def clear_default_notification_rules():
     NotificationRule.query.filter(NotificationRule.id_role.is_(None)).delete()

From 686a2a2ca6abbef7b64ac749e882e9a7e481e8e0 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Sat, 8 Apr 2023 11:16:38 +0200
Subject: [PATCH 035/209] test(api): first tests on comment notifications

---
 backend/geonature/tests/test_reports.py | 60 +++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index fd71d4e0d3..f7a95bd251 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -7,11 +7,26 @@
 
 from geonature.utils.env import db
 from geonature.core.gn_synthese.models import TReport, BibReportsTypes, Synthese
+from geonature.core.notifications.models import Notification, NotificationRule
+from geonature.utils.env import db
 
 from .fixtures import *
 from .utils import logged_user_headers, set_logged_user_cookie
 
 
+@pytest.fixture()
+def admin_notification_rule(users):
+    with db.session.begin_nested():
+        new_notification_rule = NotificationRule(
+            id_role=users["admin_user"].id_role,
+            code_method="DB",
+            code_category="OBSERVATION-COMMENT",
+            subscribed=True,
+        )
+        db.session.add(new_notification_rule)
+    return new_notification_rule
+
+
 @pytest.mark.usefixtures("client_class", "temporary_transaction")
 class TestReports:
     def test_create_report(self, synthese_data, users):
@@ -105,3 +120,48 @@ def test_list_reports(self, reports_data, synthese_data, users):
             # NO TYPE - TYPE IS NOT REQUIRED
             response = self.client.get(url_for(url, idSynthese=ids[1]))
             assert response.status_code == 200
+
+
+@pytest.mark.usefixtures("client_class", "notifications_enabled", "temporary_transaction")
+class TestReportsNotifications:
+    def test_report_notification_on_own_obs(self, synthese_data, users, admin_notification_rule):
+        set_logged_user_cookie(self.client, users["user"])
+        url = "gn_synthese.create_report"
+        synthese = synthese_data["obs1"]
+        id_synthese = synthese.id_synthese
+        data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
+        response = self.client.post(url_for(url), data=data)
+
+        # Just test that the comment had been sent
+        assert response.status_code == 204
+
+        notifications = Notification.query.filter(
+            Notification.id_role == users["admin_user"].id_role
+        ).all()
+        assert len(notifications) > 0
+        assert all(synthese.nom_cite in notif.content for notif in notifications)
+        assert (
+            Notification.query.filter(Notification.id_role == users["user"].id_role).first()
+            is None
+        )
+
+    def test_report_notification_on_not_own_obs(self, synthese_data, users):
+        set_logged_user_cookie(self.client, users["self_user"])
+        url = "gn_synthese.create_report"
+        synthese = synthese_data["obs1"]
+        id_synthese = synthese.id_synthese
+        data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
+        response = self.client.post(url_for(url), data=data)
+
+        # Just test that the comment had been sent
+        assert response.status_code == 204
+
+        notifications = Notification.query.filter(
+            Notification.id_role in (user.id_role for user in (users["user"], users["admin_user"]))
+        ).all()
+
+        assert all(synthese.nom_cite in notif.content for notif in notifications)
+        assert (
+            Notification.query.filter(Notification.id_role == users["self_user"].id_role).first()
+            is None
+        )

From e7aa8c74a8b8ec208df5f8681e50b7446a480937 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Sat, 8 Apr 2023 11:17:41 +0200
Subject: [PATCH 036/209] style(api): applied black

---
 backend/geonature/tests/fixtures.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index c9ec57a78e..77f1ef7288 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -318,7 +318,15 @@ def synthese_data(app, users, datasets, source):
             )
             geom = from_shape(point, srid=4326)
             taxon = Taxref.query.filter_by(cd_nom=cd_nom).one()
-            s = create_synthese(geom, taxon, users["self_user"], ds, source, unique_id_sinp, [users["admin_user"], users["user"]])
+            s = create_synthese(
+                geom,
+                taxon,
+                users["self_user"],
+                ds,
+                source,
+                unique_id_sinp,
+                [users["admin_user"], users["user"]],
+            )
             db.session.add(s)
             data[name] = s
     return data

From af70dd5927d6fe353d5ddc09ac464e0ca0628a61 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Sat, 8 Apr 2023 11:44:36 +0200
Subject: [PATCH 037/209] test(api): add test for comment

---
 backend/geonature/tests/test_reports.py | 59 ++++++++++++++++++++++++-
 1 file changed, 57 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index f7a95bd251..eb2f4e8a11 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -27,6 +27,32 @@ def admin_notification_rule(users):
     return new_notification_rule
 
 
+@pytest.fixture()
+def self_user_notification_rule(users):
+    with db.session.begin_nested():
+        new_notification_rule = NotificationRule(
+            id_role=users["self_user"].id_role,
+            code_method="DB",
+            code_category="OBSERVATION-COMMENT",
+            subscribed=True,
+        )
+        db.session.add(new_notification_rule)
+    return new_notification_rule
+
+
+@pytest.fixture()
+def user_notification_rule(users):
+    with db.session.begin_nested():
+        new_notification_rule = NotificationRule(
+            id_role=users["user"].id_role,
+            code_method="DB",
+            code_category="OBSERVATION-COMMENT",
+            subscribed=True,
+        )
+        db.session.add(new_notification_rule)
+    return new_notification_rule
+
+
 @pytest.mark.usefixtures("client_class", "temporary_transaction")
 class TestReports:
     def test_create_report(self, synthese_data, users):
@@ -145,7 +171,9 @@ def test_report_notification_on_own_obs(self, synthese_data, users, admin_notifi
             is None
         )
 
-    def test_report_notification_on_not_own_obs(self, synthese_data, users):
+    def test_report_notification_on_not_own_obs(
+        self, synthese_data, users, admin_notification_rule, user_notification_rule
+    ):
         set_logged_user_cookie(self.client, users["self_user"])
         url = "gn_synthese.create_report"
         synthese = synthese_data["obs1"]
@@ -157,11 +185,38 @@ def test_report_notification_on_not_own_obs(self, synthese_data, users):
         assert response.status_code == 204
 
         notifications = Notification.query.filter(
-            Notification.id_role in (user.id_role for user in (users["user"], users["admin_user"]))
+            Notification.id_role.in_(
+                (user.id_role for user in (users["user"], users["admin_user"]))
+            )
         ).all()
 
+        assert len(notifications) > 0
         assert all(synthese.nom_cite in notif.content for notif in notifications)
         assert (
             Notification.query.filter(Notification.id_role == users["self_user"].id_role).first()
             is None
         )
+
+    def test_report_notification_on_obs_commented(
+        self, synthese_data, users, self_user_notification_rule
+    ):
+        # TODO: refact this to make a function/fixture
+        set_logged_user_cookie(self.client, users["self_user"])
+        url = "gn_synthese.create_report"
+        synthese = synthese_data["obs1"]
+        id_synthese = synthese.id_synthese
+        data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
+        _ = self.client.post(url_for(url), data=data)
+        assert (
+            Notification.query.filter(Notification.id_role == users["self_user"].id_role).first()
+            is None
+        )
+        set_logged_user_cookie(self.client, users["user"])
+        data = {"item": id_synthese, "content": "comment 5", "type": "discussion"}
+        _ = self.client.post(url_for(url), data=data)
+
+        notifications = Notification.query.filter(
+            Notification.id_role == users["self_user"].id_role
+        ).all()
+
+        assert len(notifications) > 0

From d65f79d32549c0c5195d5e8ef57ad56e1696a03a Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 14:58:42 +0200
Subject: [PATCH 038/209] fix(api): notin_ for proper SQL + id_digitiser

notin_ instead of not in for SQL debugging purposes and performances
id_digitiser since it was missing
Also add discard instead of delete for cases when g.current_user.id_role
is not present in id_roles
---
 backend/geonature/core/gn_synthese/routes.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index e2fc19dc1e..f52c5ce24c 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1116,13 +1116,13 @@ def create_report(scope):
         commenters = {
             report.id_role
             for report in report_query.filter(
-                TReport.id_role not in {synthese.id_digitiser} | observers
+                TReport.id_role.notin_({synthese.id_digitiser} | observers)
             ).distinct(TReport.id_role)
         }
         # The id_roles are the Union between observers and commenters
-        id_roles = observers | commenters
+        id_roles = observers | commenters | { synthese.id_digitiser }
         # Remove the user that just commented the obs not to notify him/her
-        id_roles.remove(g.current_user.id_role)
+        id_roles.discard(g.current_user.id_role)
         notify_new_report_change(
             synthese=synthese, user=g.current_user, id_roles=id_roles, content=content
         )

From a28be4605b418481d9c32fab43a687ae3bb97906 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:03:00 +0200
Subject: [PATCH 039/209] test(api): make last test work and refact

---
 backend/geonature/tests/test_reports.py | 73 ++++++++++++++++---------
 1 file changed, 48 insertions(+), 25 deletions(-)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index eb2f4e8a11..c546c099c7 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -28,10 +28,10 @@ def admin_notification_rule(users):
 
 
 @pytest.fixture()
-def self_user_notification_rule(users):
+def associate_user_notification_rule(users):
     with db.session.begin_nested():
         new_notification_rule = NotificationRule(
-            id_role=users["self_user"].id_role,
+            id_role=users["associate_user"].id_role,
             code_method="DB",
             code_category="OBSERVATION-COMMENT",
             subscribed=True,
@@ -53,6 +53,19 @@ def user_notification_rule(users):
     return new_notification_rule
 
 
+@pytest.fixture()
+def self_user_notification_rule(users):
+    with db.session.begin_nested():
+        new_notification_rule = NotificationRule(
+            id_role=users["self_user"].id_role,
+            code_method="DB",
+            code_category="OBSERVATION-COMMENT",
+            subscribed=True,
+        )
+        db.session.add(new_notification_rule)
+    return new_notification_rule
+
+
 @pytest.mark.usefixtures("client_class", "temporary_transaction")
 class TestReports:
     def test_create_report(self, synthese_data, users):
@@ -150,13 +163,17 @@ def test_list_reports(self, reports_data, synthese_data, users):
 
 @pytest.mark.usefixtures("client_class", "notifications_enabled", "temporary_transaction")
 class TestReportsNotifications:
-    def test_report_notification_on_own_obs(self, synthese_data, users, admin_notification_rule):
-        set_logged_user_cookie(self.client, users["user"])
+    def post_comment(self, synthese, user):
+        set_logged_user_cookie(self.client, user)
         url = "gn_synthese.create_report"
-        synthese = synthese_data["obs1"]
         id_synthese = synthese.id_synthese
         data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
-        response = self.client.post(url_for(url), data=data)
+        return self.client.post(url_for(url), data=data)
+
+    def test_report_notification_on_own_obs(self, synthese_data, users, admin_notification_rule):
+        synthese = synthese_data["obs1"]
+
+        response = self.post_comment(synthese=synthese, user=users["user"])
 
         # Just test that the comment had been sent
         assert response.status_code == 204
@@ -174,12 +191,8 @@ def test_report_notification_on_own_obs(self, synthese_data, users, admin_notifi
     def test_report_notification_on_not_own_obs(
         self, synthese_data, users, admin_notification_rule, user_notification_rule
     ):
-        set_logged_user_cookie(self.client, users["self_user"])
-        url = "gn_synthese.create_report"
         synthese = synthese_data["obs1"]
-        id_synthese = synthese.id_synthese
-        data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
-        response = self.client.post(url_for(url), data=data)
+        response = self.post_comment(synthese=synthese, user=users["self_user"])
 
         # Just test that the comment had been sent
         assert response.status_code == 204
@@ -198,25 +211,35 @@ def test_report_notification_on_not_own_obs(
         )
 
     def test_report_notification_on_obs_commented(
-        self, synthese_data, users, self_user_notification_rule
+        self,
+        synthese_data,
+        users,
+        associate_user_notification_rule,
+        admin_notification_rule,
+        user_notification_rule,
+        self_user_notification_rule,
     ):
         # TODO: refact this to make a function/fixture
-        set_logged_user_cookie(self.client, users["self_user"])
-        url = "gn_synthese.create_report"
         synthese = synthese_data["obs1"]
-        id_synthese = synthese.id_synthese
-        data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
-        _ = self.client.post(url_for(url), data=data)
+        _ = self.post_comment(synthese=synthese, user=users["associate_user"])
         assert (
-            Notification.query.filter(Notification.id_role == users["self_user"].id_role).first()
+            Notification.query.filter(
+                Notification.id_role == users["associate_user"].id_role
+            ).first()
             is None
         )
-        set_logged_user_cookie(self.client, users["user"])
-        data = {"item": id_synthese, "content": "comment 5", "type": "discussion"}
-        _ = self.client.post(url_for(url), data=data)
-
-        notifications = Notification.query.filter(
-            Notification.id_role == users["self_user"].id_role
-        ).all()
+        _ = self.post_comment(synthese=synthese, user=users["admin_user"])
+
+        user_roles = {
+            user.id_role
+            for user in (
+                users["associate_user"],
+                users["admin_user"],
+                users["self_user"],
+                users["user"],
+            )
+        }
+        notifications = Notification.query.filter(Notification.id_role.in_(user_roles)).all()
 
         assert len(notifications) > 0
+        assert {notification.id_role for notification in notifications} == user_roles

From 8d8b9964387ec58650abae9c20b71b7f6de53c9f Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:03:43 +0200
Subject: [PATCH 040/209] style(api): apply black

---
 backend/geonature/core/gn_synthese/routes.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index f52c5ce24c..13f1be5b66 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -1120,7 +1120,7 @@ def create_report(scope):
             ).distinct(TReport.id_role)
         }
         # The id_roles are the Union between observers and commenters
-        id_roles = observers | commenters | { synthese.id_digitiser }
+        id_roles = observers | commenters | {synthese.id_digitiser}
         # Remove the user that just commented the obs not to notify him/her
         id_roles.discard(g.current_user.id_role)
         notify_new_report_change(

From caa8a6e6156a429a5fe6d2000da0a019e34cc377 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:20:38 +0200
Subject: [PATCH 041/209] test(api): refactor and documented test

---
 backend/geonature/tests/test_reports.py | 84 +++++++++++++++++++------
 1 file changed, 64 insertions(+), 20 deletions(-)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index c546c099c7..0c7ce889b3 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -1,12 +1,11 @@
-import pytest
 import json
 
+import pytest
 from flask import url_for
 from sqlalchemy import func
-from werkzeug.exceptions import Forbidden, BadRequest, Unauthorized, NotFound
+from werkzeug.exceptions import BadRequest, Forbidden, NotFound, Unauthorized
 
-from geonature.utils.env import db
-from geonature.core.gn_synthese.models import TReport, BibReportsTypes, Synthese
+from geonature.core.gn_synthese.models import BibReportsTypes, Synthese, TReport
 from geonature.core.notifications.models import Notification, NotificationRule
 from geonature.utils.env import db
 
@@ -170,7 +169,24 @@ def post_comment(self, synthese, user):
         data = {"item": id_synthese, "content": "comment 4", "type": "discussion"}
         return self.client.post(url_for(url), data=data)
 
-    def test_report_notification_on_own_obs(self, synthese_data, users, admin_notification_rule):
+    def test_report_notification_on_own_obs(
+        self,
+        synthese_data,
+        users,
+        admin_notification_rule,
+        user_notification_rule,
+        self_user_notification_rule,
+    ):
+        """
+        Given:
+        - user and admin_user are observer of a synthese data
+        - self_user is the digitiser
+        When
+        - user adds a comment
+        Then
+        - admin_user and self_user receives a notification
+        - user does not receive a notification since user wrote a comment
+        """
         synthese = synthese_data["obs1"]
 
         response = self.post_comment(synthese=synthese, user=users["user"])
@@ -178,10 +194,9 @@ def test_report_notification_on_own_obs(self, synthese_data, users, admin_notifi
         # Just test that the comment had been sent
         assert response.status_code == 204
 
-        notifications = Notification.query.filter(
-            Notification.id_role == users["admin_user"].id_role
-        ).all()
-        assert len(notifications) > 0
+        id_roles = {user.id_role for user in (users["admin_user"], users["self_user"])}
+        notifications = Notification.query.filter(Notification.id_role.in_(id_roles)).all()
+        assert {notification.id_role for notification in notifications} == id_roles
         assert all(synthese.nom_cite in notif.content for notif in notifications)
         assert (
             Notification.query.filter(Notification.id_role == users["user"].id_role).first()
@@ -189,24 +204,42 @@ def test_report_notification_on_own_obs(self, synthese_data, users, admin_notifi
         )
 
     def test_report_notification_on_not_own_obs(
-        self, synthese_data, users, admin_notification_rule, user_notification_rule
+        self,
+        synthese_data,
+        users,
+        admin_notification_rule,
+        user_notification_rule,
+        self_user_notification_rule,
+        associate_user_notification_rule,
     ):
+        """
+        Given:
+        - user and admin_user are observer of a synthese data
+        - self_user is the digitiser
+        When
+        - associate_user adds a comment
+        Then
+        - user, admin_user and self_user receives a notification
+        - associate_user does not receive a notification since associate_user wrote a comment
+        """
+
         synthese = synthese_data["obs1"]
-        response = self.post_comment(synthese=synthese, user=users["self_user"])
+        response = self.post_comment(synthese=synthese, user=users["associate_user"])
 
         # Just test that the comment had been sent
         assert response.status_code == 204
 
-        notifications = Notification.query.filter(
-            Notification.id_role.in_(
-                (user.id_role for user in (users["user"], users["admin_user"]))
-            )
-        ).all()
+        id_roles = {
+            user.id_role for user in (users["user"], users["admin_user"], users["self_user"])
+        }
+        notifications = Notification.query.filter(Notification.id_role.in_(id_roles)).all()
 
-        assert len(notifications) > 0
+        assert {notification.id_role for notification in notifications} == id_roles
         assert all(synthese.nom_cite in notif.content for notif in notifications)
         assert (
-            Notification.query.filter(Notification.id_role == users["self_user"].id_role).first()
+            Notification.query.filter(
+                Notification.id_role == users["associate_user"].id_role
+            ).first()
             is None
         )
 
@@ -219,8 +252,20 @@ def test_report_notification_on_obs_commented(
         user_notification_rule,
         self_user_notification_rule,
     ):
-        # TODO: refact this to make a function/fixture
+        """
+        Given:
+        - user and admin_user are observer of a synthese data
+        - self_user is the digitiser
+        When
+        - associate_user adds a comment
+        - admin_user adds a comment afterwards
+        Then
+        - user, admin_user and self_user receives a notification since associate_user commented
+        - associate_user receives a notification since admin_user commented on the observation
+        associate_user commented on
+        """
         synthese = synthese_data["obs1"]
+
         _ = self.post_comment(synthese=synthese, user=users["associate_user"])
         assert (
             Notification.query.filter(
@@ -241,5 +286,4 @@ def test_report_notification_on_obs_commented(
         }
         notifications = Notification.query.filter(Notification.id_role.in_(user_roles)).all()
 
-        assert len(notifications) > 0
         assert {notification.id_role for notification in notifications} == user_roles

From a39a52e33e580b286eb9843290a74fd21fe06e4a Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:29:16 +0200
Subject: [PATCH 042/209] test(api): add more comment and explanations

---
 backend/geonature/tests/test_reports.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index 0c7ce889b3..8addccf0b8 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -163,6 +163,7 @@ def test_list_reports(self, reports_data, synthese_data, users):
 @pytest.mark.usefixtures("client_class", "notifications_enabled", "temporary_transaction")
 class TestReportsNotifications:
     def post_comment(self, synthese, user):
+        """Post a comment on a synthese row as a user"""
         set_logged_user_cookie(self.client, user)
         url = "gn_synthese.create_report"
         id_synthese = synthese.id_synthese
@@ -194,10 +195,13 @@ def test_report_notification_on_own_obs(
         # Just test that the comment had been sent
         assert response.status_code == 204
 
+        # Check that admin_user (observer) and self_user (digitiser) are notified
         id_roles = {user.id_role for user in (users["admin_user"], users["self_user"])}
         notifications = Notification.query.filter(Notification.id_role.in_(id_roles)).all()
+
         assert {notification.id_role for notification in notifications} == id_roles
         assert all(synthese.nom_cite in notif.content for notif in notifications)
+        # Check that user is not notified since he posted the comment
         assert (
             Notification.query.filter(Notification.id_role == users["user"].id_role).first()
             is None
@@ -229,6 +233,7 @@ def test_report_notification_on_not_own_obs(
         # Just test that the comment had been sent
         assert response.status_code == 204
 
+        # Check that user, admin_user (observers) and self_user (digitiser) are notified
         id_roles = {
             user.id_role for user in (users["user"], users["admin_user"], users["self_user"])
         }
@@ -236,6 +241,7 @@ def test_report_notification_on_not_own_obs(
 
         assert {notification.id_role for notification in notifications} == id_roles
         assert all(synthese.nom_cite in notif.content for notif in notifications)
+        # But check also that associate_user is not notified for the comment he posted
         assert (
             Notification.query.filter(
                 Notification.id_role == users["associate_user"].id_role
@@ -260,21 +266,27 @@ def test_report_notification_on_obs_commented(
         - associate_user adds a comment
         - admin_user adds a comment afterwards
         Then
+        - after the first comment is posted, associate_user does not receive a notification
         - user, admin_user and self_user receives a notification since associate_user commented
         - associate_user receives a notification since admin_user commented on the observation
         associate_user commented on
         """
         synthese = synthese_data["obs1"]
 
+        # Post first comment so that associate_user can be notified on future comments
         _ = self.post_comment(synthese=synthese, user=users["associate_user"])
+        # Check that associate_user is not notified (just in case)
         assert (
             Notification.query.filter(
                 Notification.id_role == users["associate_user"].id_role
             ).first()
             is None
         )
+        # Post second comment to notify associate_user on future comments
         _ = self.post_comment(synthese=synthese, user=users["admin_user"])
 
+        # Check that all these roles are notified. Careful, even admin_user is notified
+        # because of the first comment
         user_roles = {
             user.id_role
             for user in (

From 73b851190c4763b06d3b69ac18de3c1987c1836b Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:44:27 +0200
Subject: [PATCH 043/209] style(db): renamed migration and changed content

---
 ... 95acee9f0452_add_comment_notification.py} | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)
 rename backend/geonature/migrations/versions/{95acee9f0452_add_validation_comment_notification.py => 95acee9f0452_add_comment_notification.py} (69%)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
similarity index 69%
rename from backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
rename to backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
index d033e57abd..af293a5963 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_validation_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
@@ -1,4 +1,4 @@
-"""add_validation_comment_notification
+"""add_comment_notification
 
 Revision ID: 95acee9f0452
 Revises: 9e9218653d6c
@@ -21,6 +21,17 @@
 depends_on = None
 
 CATEGORY_CODE = "OBSERVATION-COMMENT"
+EMAIL_CONTENT = (
+    "<p>Bonjour <i>{{ role.nom_complet }}</i> !</p>"
+    "<p>{{ user.nom_complet }} a commenté l'observation de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}" 
+    "que vous avez créée ou commentée</p>"
+    "<p>Vous pouvez y accéder directement <a href=\"{{ url }}\">ici</a></p>"
+    "<p><i>Vous recevez cet email automatiquement via le service de notification de GeoNature.</i></p>"
+)
+DB_CONTENT = (
+    "{{ user.nom_complet }} a commenté l'observation de {{ synthese.nom_cite }} du "
+    "{{ synthese.meta_create_date.strftime('%d-%m-%Y') }} que vous avez créée ou commentée"
+)
 
 
 def upgrade():
@@ -38,17 +49,7 @@ def upgrade():
 
     session.add(category)
 
-    # Add template
-    email_content = """ <p>Bonjour <i>{{ role.nom_complet }}</i> !</p> 
-    <p>{{ user.nom_complet }} a commenté votre observation de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}</p>
-    <p>Vous pouvez y accéder directement <a href="{{ url }}">ici</a></p>
-    <p><i>Vous recevez cet email automatiquement via le service de notification de GeoNature.</i></p>
-    """
-    db_content = """ {{ user.nom_complet }} a commenté votre observation 
-    de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}
-    """
-
-    for method, content in (("EMAIL", email_content), ("DB", db_content)):
+    for method, content in (("EMAIL", EMAIL_CONTENT), ("DB", DB_CONTENT)):
         template = NotificationTemplate(category=category, code_method=method, content=content)
         session.add(template)
 

From 782cda9f290ac19f6269e3c2ee60ac76fcd73102 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 15:48:06 +0200
Subject: [PATCH 044/209] style(db): applied black and changed description

---
 .../versions/95acee9f0452_add_comment_notification.py       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
index af293a5963..e0b82b9fb8 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
@@ -23,9 +23,9 @@
 CATEGORY_CODE = "OBSERVATION-COMMENT"
 EMAIL_CONTENT = (
     "<p>Bonjour <i>{{ role.nom_complet }}</i> !</p>"
-    "<p>{{ user.nom_complet }} a commenté l'observation de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}" 
+    "<p>{{ user.nom_complet }} a commenté l'observation de {{ synthese.nom_cite }} du {{ synthese.meta_create_date.strftime('%d-%m-%Y') }}"
     "que vous avez créée ou commentée</p>"
-    "<p>Vous pouvez y accéder directement <a href=\"{{ url }}\">ici</a></p>"
+    '<p>Vous pouvez y accéder directement <a href="{{ url }}">ici</a></p>'
     "<p><i>Vous recevez cet email automatiquement via le service de notification de GeoNature.</i></p>"
 )
 DB_CONTENT = (
@@ -43,7 +43,7 @@ def upgrade():
         code=CATEGORY_CODE,
         label="Nouveau commentaire sur une observation",
         description=(
-            "Se déclenche lorsqu'un nouveau commentaire est ajouté à une de vos observations"
+            "Se déclenche lorsqu'un nouveau commentaire est ajouté à une de vos observations, ou une observation que vous avez commenté"
         ),
     )
 

From 3b667ccd0ee836e5076b581d23a457ee68cb95f3 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Tue, 11 Apr 2023 17:48:26 +0200
Subject: [PATCH 045/209] test(api): refactor to use function in fixture

---
 backend/geonature/tests/test_reports.py | 40 +++++++------------------
 1 file changed, 10 insertions(+), 30 deletions(-)

diff --git a/backend/geonature/tests/test_reports.py b/backend/geonature/tests/test_reports.py
index 8addccf0b8..fdcb54e124 100644
--- a/backend/geonature/tests/test_reports.py
+++ b/backend/geonature/tests/test_reports.py
@@ -13,11 +13,10 @@
 from .utils import logged_user_headers, set_logged_user_cookie
 
 
-@pytest.fixture()
-def admin_notification_rule(users):
+def add_notification_rule(user):
     with db.session.begin_nested():
         new_notification_rule = NotificationRule(
-            id_role=users["admin_user"].id_role,
+            id_role=user.id_role,
             code_method="DB",
             code_category="OBSERVATION-COMMENT",
             subscribed=True,
@@ -26,43 +25,24 @@ def admin_notification_rule(users):
     return new_notification_rule
 
 
+@pytest.fixture()
+def admin_notification_rule(users):
+    return add_notification_rule(users["admin_user"])
+
+
 @pytest.fixture()
 def associate_user_notification_rule(users):
-    with db.session.begin_nested():
-        new_notification_rule = NotificationRule(
-            id_role=users["associate_user"].id_role,
-            code_method="DB",
-            code_category="OBSERVATION-COMMENT",
-            subscribed=True,
-        )
-        db.session.add(new_notification_rule)
-    return new_notification_rule
+    return add_notification_rule(users["associate_user"])
 
 
 @pytest.fixture()
 def user_notification_rule(users):
-    with db.session.begin_nested():
-        new_notification_rule = NotificationRule(
-            id_role=users["user"].id_role,
-            code_method="DB",
-            code_category="OBSERVATION-COMMENT",
-            subscribed=True,
-        )
-        db.session.add(new_notification_rule)
-    return new_notification_rule
+    return add_notification_rule(users["user"])
 
 
 @pytest.fixture()
 def self_user_notification_rule(users):
-    with db.session.begin_nested():
-        new_notification_rule = NotificationRule(
-            id_role=users["self_user"].id_role,
-            code_method="DB",
-            code_category="OBSERVATION-COMMENT",
-            subscribed=True,
-        )
-        db.session.add(new_notification_rule)
-    return new_notification_rule
+    return add_notification_rule(users["self_user"])
 
 
 @pytest.mark.usefixtures("client_class", "temporary_transaction")

From 2fd3d3a207671f52a5eaa2266ed9a6ee905569de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 19:13:02 +0200
Subject: [PATCH 046/209] fix(db): rebase comment notification migration

---
 .../versions/95acee9f0452_add_comment_notification.py         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
index e0b82b9fb8..d7b76ea03d 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
@@ -1,4 +1,4 @@
-"""add_comment_notification
+"""add comment notification
 
 Revision ID: 95acee9f0452
 Revises: 9e9218653d6c
@@ -16,7 +16,7 @@
 
 # revision identifiers, used by Alembic.
 revision = "95acee9f0452"
-down_revision = "9e9218653d6c"
+down_revision = "e2a94808cf76"
 branch_labels = None
 depends_on = None
 

From d554686486015df03f7c78ec270135f43abfa831 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 23 May 2023 17:25:59 +0200
Subject: [PATCH 047/209] flask admin : add missing view title

---
 backend/geonature/templates/layout.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/backend/geonature/templates/layout.html b/backend/geonature/templates/layout.html
index 0bfc4406b9..c16398ac43 100644
--- a/backend/geonature/templates/layout.html
+++ b/backend/geonature/templates/layout.html
@@ -80,6 +80,8 @@
             </div>
 
             <div class="col-10 offset-2" id="main">
+                <h2>{{ admin_view.name|capitalize }}</h2>
+                {{ layout.messages() }}
                 {% block body %}
                  {% endblock %}
             </div>

From bd8ca9d7a8ff9af9e87f49508377f93c00f3cf2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Fri, 14 Apr 2023 15:50:37 +0200
Subject: [PATCH 048/209] permissions: remove backoffice

---
 backend/geonature/app.py                      |   1 -
 .../gn_permissions/backoffice/__init__.py     |   0
 .../core/gn_permissions/backoffice/forms.py   |  97 ----
 .../templates/cruved_scope_form.html          | 100 -----
 .../backoffice/templates/cruved_user.html     | 131 ------
 .../backoffice/templates/filter_form.html     |  36 --
 .../backoffice/templates/filter_list.html     |  70 ---
 .../backoffice/templates/librairies.html      |  11 -
 .../backoffice/templates/nav-bar.html         |  27 --
 .../templates/other_permissions_form.html     |  31 --
 .../templates/user_other_permissions.html     |  73 ---
 .../backoffice/templates/users.html           |  56 ---
 .../core/gn_permissions/backoffice/views.py   | 419 ------------------
 .../geonature/core/gn_permissions/tools.py    |  91 +---
 backend/geonature/tests/fixtures.py           |  25 --
 backend/geonature/tests/test_gn_permission.py | 344 +-------------
 16 files changed, 6 insertions(+), 1506 deletions(-)
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/__init__.py
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/forms.py
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/cruved_scope_form.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/cruved_user.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/filter_form.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/filter_list.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/librairies.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/nav-bar.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/other_permissions_form.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/user_other_permissions.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/templates/users.html
 delete mode 100644 backend/geonature/core/gn_permissions/backoffice/views.py

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index a5d17b2173..c8a7a2e19c 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -196,7 +196,6 @@ def set_sentry_context():
         ("ref_geo.routes:routes", "/geo"),
         ("geonature.core.gn_commons.routes:routes", "/gn_commons"),
         ("geonature.core.gn_permissions.routes:routes", "/permissions"),
-        ("geonature.core.gn_permissions.backoffice.views:routes", "/permissions_backoffice"),
         ("geonature.core.users.routes:routes", "/users"),
         ("geonature.core.gn_synthese.routes:routes", "/synthese"),
         ("geonature.core.gn_meta.routes:routes", "/meta"),
diff --git a/backend/geonature/core/gn_permissions/backoffice/__init__.py b/backend/geonature/core/gn_permissions/backoffice/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/backend/geonature/core/gn_permissions/backoffice/forms.py b/backend/geonature/core/gn_permissions/backoffice/forms.py
deleted file mode 100644
index 1ca8f4c471..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/forms.py
+++ /dev/null
@@ -1,97 +0,0 @@
-from flask_wtf import FlaskForm
-
-
-from wtforms import (
-    StringField,
-    PasswordField,
-    BooleanField,
-    SubmitField,
-    HiddenField,
-    SelectField,
-    RadioField,
-    SelectMultipleField,
-    widgets,
-    Form,
-)
-from wtforms.validators import DataRequired, Email
-from wtforms.widgets import TextArea
-from wtforms_sqlalchemy.fields import QuerySelectField
-
-
-from geonature.core.gn_permissions.models import TFilters, BibFiltersType, TActions
-from geonature.core.gn_commons.models import TModules
-from geonature.utils.env import DB
-
-
-class CruvedScopeForm(FlaskForm):
-    """
-    Forms to manage cruved scope permissions
-    """
-
-    C = RadioField("create_scope")
-    R = RadioField("read_scope")
-    U = RadioField("update_scope")
-    V = RadioField("validate_scope")
-    E = RadioField("edit_scope")
-    D = RadioField("delete_scope")
-    submit = SubmitField("Valider")
-
-    def init_choices(self):
-        """
-        Get and set the scope filters to the form choices
-        """
-        data = (
-            DB.session.query(TFilters.id_filter, TFilters.description_filter)
-            .join(BibFiltersType, BibFiltersType.id_filter_type == TFilters.id_filter_type)
-            .filter(BibFiltersType.code_filter_type == "SCOPE")
-            .all()
-        )
-        scope_choices = [(str(code), value) for code, value in data]
-        self.C.choices = scope_choices
-        self.R.choices = scope_choices
-        self.U.choices = scope_choices
-        self.V.choices = scope_choices
-        self.E.choices = scope_choices
-        self.D.choices = scope_choices
-
-    def __init__(self, *args, **kwargs):
-        super(CruvedScopeForm, self).__init__(*args, **kwargs)
-        self.init_choices()
-
-
-class OtherPermissionsForm(FlaskForm):
-    module = QuerySelectField(
-        "action",
-        query_factory=lambda: DB.session.query(TModules.id_module, TModules.module_label)
-        .order_by(TModules.module_label)
-        .all(),
-        get_pk=lambda mod: str(mod.id_module),
-        get_label=lambda mod: mod.module_label,
-    )
-    action = QuerySelectField(
-        "action",
-        query_factory=lambda: DB.session.query(TActions).all(),
-        get_pk=lambda act: act.id_action,
-        get_label=lambda act: act.description_action,
-    )
-    filter = SelectField(
-        "filtre",
-    )
-    submit = SubmitField("Valider")
-
-    def __init__(self, id_filter_type, *args, **kwargs):
-        super(OtherPermissionsForm, self).__init__(*args, **kwargs)
-        # id_filter_type = args[0]
-        self.filter.choices = [
-            (str(filt.id_filter), filt.label_filter)
-            for filt in DB.session.query(TFilters)
-            .filter(TFilters.id_filter_type == id_filter_type)
-            .all()
-        ]
-
-
-class FilterForm(FlaskForm):
-    label_filter = StringField("Label", validators=[DataRequired()])
-    value_filter = StringField("Valeur du filtre", validators=[DataRequired()])
-    description_filter = StringField("Description", validators=[DataRequired()], widget=TextArea())
-    submit = SubmitField("Valider")
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/cruved_scope_form.html b/backend/geonature/core/gn_permissions/backoffice/templates/cruved_scope_form.html
deleted file mode 100644
index 37b47e0ddb..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/cruved_scope_form.html
+++ /dev/null
@@ -1,100 +0,0 @@
-<html>
-    {% include "librairies.html" %}    
-    <style>
-        td,
-        th {
-          text-align: center;
-        }
-      </style>
-  <body>
-      {% include "nav-bar.html" %}    
-
-    <div class="container">
-
-      {% if not id_object %}
-      <h3> CRUVED de l'utilisateur {{user.nom_role}} {{user.prenom_role if user.prenom_role}} pour le module {{module.module_label}} </h5>
-      {% else %}
-
-      <h3> CRUVED de l'utilisateur {{user.nom_role}} {{user.prenom_role if user.prenom_role}} pour {{object_instance.code_object}} </h5>
-        <h5>
-            {{object_instance.description_object}} 
-        </h5>
-      {% endif %}
-
-
-    {% if not user.groupe %}
-    <div class="alert alert-warning" role="alert">
-      Préferez l'attribution du CRUVED à des groupes plutôt qu'à des utilisateurs
-    </div>
-    {% endif %}
-
-    {% with messages = get_flashed_messages() %} 
-      {% if messages %}
-       {% for message in messages %}
-        <div class="alert alert-warning" role="alert">{{ message }}</div>
-      {% endfor %}
-    {% endif %}
-   {% endwith %}
-
-      <form action="" method="POST">
-        {{ form.csrf_token }} {{ form.hidden_tag() }}
-        <table class="table table-striped">
-          <thead>
-            <th></th>
-            <th>Aucune donnée</th>
-            <th>Mes données</th>
-            <th>Les données de mon organisme</th>
-            <th>Toutes les données</th>
-          </thead>
-          <tbody>
-            <tr>
-              <td>Créer - Create</td>
-              {% for subfield in form.C %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-            <tr>
-              <td>Lire - Read</td>
-              {% for subfield in form.R %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-
-            <tr>
-              <td>Mettre à jour - Update</td>
-
-              {% for subfield in form.U %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-
-            <tr>
-              <td>Valider - Validate</td>
-
-              {% for subfield in form.V %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-
-            <tr>
-              <td>Export - Export</td>
-
-              {% for subfield in form.E %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-
-            <tr>
-              <td>Supprimer - Delete</td>
-              {% for subfield in form.D %}
-              <td>{{ subfield }}</td>
-              {% endfor %}
-            </tr>
-          </tbody>
-        </table>
-        {{form.submit(class="form-control btn-success")}}
-      </form>
-
-    </div>
-  </body>
-</html>
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/cruved_user.html b/backend/geonature/core/gn_permissions/backoffice/templates/cruved_user.html
deleted file mode 100644
index 39824f26df..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/cruved_user.html
+++ /dev/null
@@ -1,131 +0,0 @@
-<html>
-{% include "librairies.html" %}
-
-<body>
-  {% include "nav-bar.html" %}
-
-  <div class="container">
-    {% if user.group %}
-    <h5> CRUVED du groupe {{user.nom_role}} </h5>
-    {% else %}
-    <h5> CRUVED de l'utilisateur {{user.nom_role}} {{user.prenom_role if user.prenom_role}}</h5>
-    {% endif %}
-
-
-    {% if groupes|length > 0 %}
-    <div class="alert alert-primary" role="alert">
-      <p>
-        L'utilisateur <b> {{user.nom_role}} {{user.prenom_role if user.prenom_role}} </b>
-        appartient aux groupe(s) suivant(s). <br>
-        Son CRUVED peut-être surchargé par celui des groupes auxquels il appartient
-      </p>
-      <table>
-        {% for groupe in groupes %}
-        <tr>
-          <td style="padding-right:30px;">
-            - {{groupe.nom_role}}
-          </td>
-          <td>
-            <a href="{{ url_for('gn_permissions_backoffice.user_cruved' ,id_role=groupe.id_role)}}">
-              <button class="btn btn-sm btn-primary"> Voir CRUVED <i class="fa fa-eye" aria-hidden="true"></i></button>
-            </a>
-          </td>
-
-        </tr>
-        {% endfor %}
-      </table>
-
-    </div>
-
-    {% endif %}
-
-    <table class="table table-striped">
-      {% for mod in modules %}
-      <tr>
-        <td>
-
-          {{ mod.module_code }}
-          {% if mod.module_objects | length > 0 %}
-          <br>
-          <button onclick="toogleClass()" class="btn btn-secondary" style="margin:10px" type="button"
-            data-toggle="collapse" data-target="#collapseExample-{{loop.index}}" aria-expanded="false"
-            aria-controls="collapseExample">
-            Objets du module <span id="toggle-btn" class="fa fa-chevron-right" aria-hidden="true"></span>
-
-          </button>
-          {% endif %}
-
-        </td>
-        <td>
-          {% for cruved in mod.module_cruved[0] %}
-          <ul>
-            <li>{{ cruved.label }} : <b> {{ cruved.value }}</b> </li>
-          </ul>
-          {% endfor %}
-          <div class="collapse" id="collapseExample-{{loop.index}}">
-            {% for obj in mod.module_objects %}
-
-            <div class="card card-body" style="margin:10px">
-              {{ obj.code_object }}
-              <small> {{obj.description_object}} </small>
-              <small>
-                {% if obj.cruved[1] %}
-                Hérité du module parent
-                {% endif %}
-              </small>
-
-              <br>
-
-              {% for action in obj.cruved[0] %}
-              <ul>
-                <li>
-                  {{action.label}}: {{ action.value }}
-                </li>
-              </ul>
-              {% endfor %}
-              <a
-                href="{{ url_for('gn_permissions_backoffice.permission_form', id_module=mod.id_module, id_role=user.id_role, id_object=obj.id_object) }}">
-                <button class="btn btn-primary">
-                  Edit <span class="fa fa-pencil" aria-hidden="true"></span>
-                </button>
-              </a>
-            </div>
-
-            {% endfor %}
-          </div>
-        <td>
-          {% if mod.module_cruved[1] %}
-          Hérité du module parent {{mod.module_cruved[2][0]}}
-          {% if mod.module_cruved[2][1] != "ALL" %},{{mod.module_cruved[2][1]}}{% endif %}
-          {% endif %}
-        </td>
-        <td>
-          <a
-            href="{{ url_for('gn_permissions_backoffice.permission_form', id_module=mod.id_module, id_role=user.id_role) }}">
-            <button class="btn btn-primary">
-              Edit <span class="fa fa-pencil" aria-hidden="true"></span>
-            </button>
-          </a>
-        </td>
-      </tr>
-      {% endfor %}
-    </table>
-
-
-  </div>
-
-
-  <script>
-
-    var toogleClass = function () {
-      $('#toggle-btn').toggleClass('fa-chevron-down', 'fa-chevron-right');
-    }
-
-  </script>
-
-</body>
-
-
-
-
-</html>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/filter_form.html b/backend/geonature/core/gn_permissions/backoffice/templates/filter_form.html
deleted file mode 100644
index 719a926873..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/filter_form.html
+++ /dev/null
@@ -1,36 +0,0 @@
-
-<html>
-        {% include "librairies.html" %}     
-    
-  <body>
-      {% include "nav-bar.html" %}    
-    <div class="container">
-        <h5>  {{'Editer' if id_filter else 'Ajouter'}} un filtre  </h5>
-      <h3>{{filter_type.label_filter_type}} </h3>
-      
-      <form action="", method="POST">
-        
-          {{ form.csrf_token }} {{ form.hidden_tag() }}
-          <div class="form-group">
-              {{form.label_filter.label}}
-              {{ form.label_filter(class="form-control") }}
-          </div>
-          <div class="form-group">
-            {{ form.value_filter.label}}
-            <br>
-            <small>
-              {{filter_type.description_filter_type}}
-            </small>
-            {{ form.value_filter(class="form-control")}}
-          </div>
-          <div class="form-group">
-            {{ form.description_filter.label}}        
-            {{ form.description_filter(class="form-control") }}
-          </div>
-
-          {{form.submit(class="form-control btn-success")}}
-      </form>
-    </div>
-  </body>
-
-</html>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/filter_list.html b/backend/geonature/core/gn_permissions/backoffice/templates/filter_list.html
deleted file mode 100644
index 4b3a3946d0..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/filter_list.html
+++ /dev/null
@@ -1,70 +0,0 @@
-
-<html>
-        {% include "librairies.html" %}     
-    
-    <body>
-        {% include "nav-bar.html" %}
-        <div class="container">
-        {% with messages = get_flashed_messages() %}
-        {% if messages %}
-            {% for message in messages %}
-                <div class="alert alert-success" role="alert">{{ message }}</div>
-            {% endfor %}
-         {% endif %}
-        {% endwith %}
-            <h3> Filtres - '{{filter_type.label_filter_type}}' </h3>
-            <small> {{filter_type.description_filter_type}} </small>
-            <table class="table table striped">
-                <thead>
-                    <th> Label </th>
-                    <th> Decription </th>
-
-                    <th> Valeurs </th>
-                    <th>  </th>
-                    <th>  </th>
-                </thead>
-                {% for filter in filters %}
-                <tr>
-                    <td>
-                        {{filter.label_filter}}
-
-                    </td>
-                    <td>
-                        {{filter.description_filter}}
-                    </td>
-                    <td>
-                        {{filter.value_filter}}
-
-                    </td>
-
-                    <td>
-                        <a href="{{ url_for(
-                            'gn_permissions_backoffice.filter_form',
-                            id_filter_type=filter_type.id_filter_type,
-                            id_filter=filter.id_filter
-                            )}}">
-                            <button class="btn btn-primary"> Editer </button>
-                        </a>
-                    </td>
-                    <td>
-                        <form action="{{ url_for(
-                            'gn_permissions_backoffice.delete_filter',
-                            id_filter=filter.id_filter
-                            )}}" method="POST">
-                            <input class="btn btn-danger" type="submit" value="Supprimer">
-                        </form>
-                    </td>
-
-                </tr>
-                {% endfor %}
-            </table>
-
-            <a href="{{ url_for('gn_permissions_backoffice.filter_form', id_filter_type=filter_type.id_filter_type)}}">
-                    <button class="btn btn-sm btn-success"> Ajouter un filtre </button> </li>
-            </a>
-        </div>
-
-    </body>
-
-
-</html>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/librairies.html b/backend/geonature/core/gn_permissions/backoffice/templates/librairies.html
deleted file mode 100644
index c0e6ad4d86..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/librairies.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<head>
-
-<link rel="stylesheet" type="text/css" href="{{url_for('static', filename='node_modules/bootstrap/dist/css/bootstrap.css')}}"" />
-<script type="text/javascript" src="{{url_for('static', filename='node_modules/jquery/dist/jquery.min.js')}}" >  </script>
-<script type="text/javascript" src="{{url_for('static', filename='node_modules/popper.js/dist/umd/popper.min.js')}}" >  </script>
-<script type="text/javascript" src="{{url_for('static', filename='node_modules/bootstrap/dist/js/bootstrap.min.js')}}" >  </script>
-
-<link rel="stylesheet" type="text/css" href="{{url_for('static', filename='node_modules/font-awesome/css/font-awesome.min.css')}}"" />
-
-
-</head>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/nav-bar.html b/backend/geonature/core/gn_permissions/backoffice/templates/nav-bar.html
deleted file mode 100644
index 0d29380a84..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/nav-bar.html
+++ /dev/null
@@ -1,27 +0,0 @@
-
-<nav class="navbar navbar-collapse navbar-expand-lg navbar-light bg-light ">
-    <div class="navbar-header">
-        <a class="navbar-brand" href="{{ config.URL_APPLICATION }}">GeoNature</a>
-        <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
-        <span class="navbar-toggler-icon"></span>
-        </button>
-    </div>
-        <div class="collapse navbar-collapse" id="navbarNav">
-            <ul class="navbar-nav mr-auto">
-                <li class="nav-item">
-                        <a class="nav-link" href="{{ config.URL_APPLICATION }}/#/admin">
-                                Accueil admin
-                        </a>
-                        
-                </li>
-                <li class="nav-item">
-                    <a class="nav-link" href="{{ url_for('gn_permissions_backoffice.users') }}">
-                            Liste des roles
-                    </a>
-                   
-                </li>
-            </ul>
-
-
-    </div>
-</nav>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/other_permissions_form.html b/backend/geonature/core/gn_permissions/backoffice/templates/other_permissions_form.html
deleted file mode 100644
index 815589889a..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/other_permissions_form.html
+++ /dev/null
@@ -1,31 +0,0 @@
-
-<html>
-        {% include "librairies.html" %}     
-    
-    <body>
-            {% include "nav-bar.html" %}  
-        <div class="container">
-                <h3>  {{filter_type.label_filter_type}} pour le role : {{user.nom_role}} {{user.prenom_role if user.prenom_role}} </h3>
-                <small> </small>
-
-                <form action=""" method="POST">
-                        {{ form.csrf_token }} {{ form.hidden_tag() }}
-                    <div class="form-group">
-                        <label for=""> Module</label>
-                          {{form.module(class="form-control")}}
-                    </div>
-                    <div class="form-group">
-                        <label for=""> Action</label>
-                          {{form.action(class="form-control")}}
-                    </div>
-                    <div class="form-group">
-                        <label for=""> Filtre</label>
-                          {{form.filter(class="form-control")}}
-                    </div>
-
-                    {{form.submit(class="form-control btn-success")}}
-                </form>
-
-        </div>
-    </body>
-</html>
\ No newline at end of file
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/user_other_permissions.html b/backend/geonature/core/gn_permissions/backoffice/templates/user_other_permissions.html
deleted file mode 100644
index 4563c7b6f7..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/user_other_permissions.html
+++ /dev/null
@@ -1,73 +0,0 @@
-
-<html>
-    {% include "librairies.html" %}     
-
-<body>
-    {% include "nav-bar.html" %}
-    <div class="container">
-      <h3> Permissions du role {{user.nom_role}} {{user.prenom_role if user.prenom_role}} </h3>
-      {% if permissions | length > 0 %}
-      <table class="table table-striped">
-          <thead>
-            <th> Action </th>
-            <th> Module </th>
-            <th> Type de filtre</th>
-            <th> Filtre </th>
-
-          </thead>
-          <tbody>
-            {% for perm in permissions %}
-            <tr >
-              <td> {{perm.action.description_action}} </td>
-              <td> {{perm.module.module_code}} </td>
-              <td> {{perm.filter.code_filter_type}} </td>
-              <td> {{perm.filter.label_filter}} </td>
-              <td>
-                <a href="{{ url_for(
-                  'gn_permissions_backoffice.other_permissions_form' ,
-                  id_role=user.id_role,
-                  id_filter_type=perm.filter.id_filter_type,
-                  id_permission=perm.id_permission
-                  )}}">
-                    <button class="btn btn-sm btn-primary"> Editer </button> </li>
-                </a>
-              </td>
-            </tr>
-            {% endfor %}
-          </tbody>
-      </table>
-    {% else %}
-
-      <div class="alert alert-warning" role="alert">
-          Aucune permission n'a été attribuée à ce role
-      </div>
-
-    <br>
-    <br>
-
-    {% endif %}
-        
-      <h5> Type de permissions disponibles </h5>
-      <table class="table table-striped">
-
-        {% for filter_type in filter_types %}
-          <tr> 
-            <td> <b> {{filter_type.label_filter_type}} </b>  </td>
-            <td> 
-                <a href="{{ url_for('gn_permissions_backoffice.other_permissions_form' ,id_role=user.id_role, id_filter_type=filter_type.id_filter_type)}}">
-                    <button class="btn btn-sm btn-primary"> Ajouter des permissions </button> </li>
-                  </a>
-            </td>
-            <td>
-                <a href="{{ url_for('gn_permissions_backoffice.filter_list', id_filter_type=filter_type.id_filter_type)}}">
-                    <button class="btn btn-sm btn-primary"> Gérer les filtres </button> </li>
-                </a>
-            </td>
-
-          </tr>
-        {% endfor %}
-      </table>
-
-    </div>
-</body>
-</html>
diff --git a/backend/geonature/core/gn_permissions/backoffice/templates/users.html b/backend/geonature/core/gn_permissions/backoffice/templates/users.html
deleted file mode 100644
index 642720b5e1..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/templates/users.html
+++ /dev/null
@@ -1,56 +0,0 @@
-<html>
-  <header>
-    <link rel="stylesheet" type="text/css" href="{{url_for('static', filename='node_modules/bootstrap/dist/css/bootstrap.css')
-    }}"" />
-    
-    <style>
-      .is_group{
-        background-color:rgba(104, 226, 96, 0.6)!important;
-      }
-    </style>
-  </header>
-
-  <body>
-    {% include "nav-bar.html" %}    
-    <div class="container">
-        <h3> Liste des roles</h3>
-
-        {% with messages = get_flashed_messages() %} {% if messages %} {% for
-          message in messages %}
-          <div class="alert alert-success" role="alert">{{ message }}</div>
-          {% endfor %} {% endif %} {% endwith %} {% block body %}{% endblock %}
-
-        <table class="table table-striped">
-            <thead>
-              <th>Id role</th>
-              <th>Nom role</th>
-              <th>Prenom role</th>
-              <th>Nb CRUVED</th>
-              <th></th>
-            </thead>
-            <tbody>
-              {% for user in users %}
-              <tr class="{{'is_group' if user.groupe }}">
-                <td>{{ user.id_role }}</td>
-                <td>{{ user.nom_role }}</td>
-                <td>{{ user.prenom_role if user.prenom_role }}</td>
-                <td> <b> {{user.nb_cruved}}</b>  </td>
-                <td>
-                  <a href="{{ url_for('gn_permissions_backoffice.user_cruved' ,id_role=user.id_role)}}">
-                    <button class="btn btn-sm btn-primary"> Editer le CRUVED</button>
-                  </a>
-
-                  <a href="{{ url_for('gn_permissions_backoffice.user_other_permissions' ,id_role=user.id_role)}}">
-                    <button class="btn btn-sm btn-primary"> Editer les autres permissions </button>
-                  </a>
-                </td>
-              </tr>
-      
-              {% endfor %}
-            </tbody>
-          </table>
-    </div>
-
-  </body>
-
-</html>
diff --git a/backend/geonature/core/gn_permissions/backoffice/views.py b/backend/geonature/core/gn_permissions/backoffice/views.py
deleted file mode 100644
index 0bde09b08e..0000000000
--- a/backend/geonature/core/gn_permissions/backoffice/views.py
+++ /dev/null
@@ -1,419 +0,0 @@
-from flask import (
-    request,
-    render_template,
-    Blueprint,
-    flash,
-    current_app,
-    redirect,
-    url_for,
-    g,
-)
-
-from sqlalchemy.exc import IntegrityError, SQLAlchemyError
-from sqlalchemy.orm import joinedload
-from sqlalchemy.sql import func
-from sqlalchemy import or_
-
-
-from geonature.utils.env import DB
-from geonature.core.gn_permissions.backoffice.forms import (
-    CruvedScopeForm,
-    OtherPermissionsForm,
-    FilterForm,
-)
-from geonature.core.gn_permissions.tools import (
-    cruved_scope_for_user_in_module,
-    beautifulize_cruved,
-)
-from geonature.core.gn_permissions.models import (
-    TFilters,
-    BibFiltersType,
-    TActions,
-    CorRoleActionFilterModuleObject,
-    TObjects,
-)
-from geonature.core.users.models import CorRole
-from pypnusershub.db.models import Organisme as BibOrganismes, Application
-from geonature.core.gn_commons.models import TModules
-from geonature.core.gn_permissions import decorators as permissions
-
-
-from pypnusershub.db.models import User, AppRole
-
-routes = Blueprint("gn_permissions_backoffice", __name__, template_folder="templates")
-
-
-@routes.before_request
-def set_current_module_and_object():
-    g.current_module = TModules.query.filter_by(module_code="ADMIN").one()
-    g.current_object = TObjects.query.filter_by(code_object="PERMISSIONS").one()
-
-
-@routes.route(
-    "cruved_form/module/<int:id_module>/role/<int:id_role>/object/<int:id_object>",
-    methods=["GET", "POST"],
-)
-@routes.route("cruved_form/module/<int:id_module>/role/<int:id_role>", methods=["GET", "POST"])
-@permissions.check_cruved_scope("R")
-def permission_form(id_module, id_role, id_object=None):
-    """
-    .. :quickref: View_Permission;
-    """
-    # TODO: check post permissions
-    form = None
-    module = DB.session.query(TModules).get(id_module)
-    object_instance = None
-    module_objects = []
-    if id_object:
-        object_instance = DB.session.query(TObjects).get(id_object)
-    else:
-        object_instance = DB.session.query(TObjects).filter_by(code_object="ALL").first()
-
-    user = DB.session.query(User).get(id_role)
-    if request.method == "GET":
-        cruved, herited, herited_obj = cruved_scope_for_user_in_module(
-            id_role=id_role,
-            module_code=module.module_code,
-            object_code=object_instance.code_object,
-            get_id=True,
-        )
-        form = CruvedScopeForm(**cruved)
-        # get the real cruved of user to set a warning
-        real_cruved = (
-            DB.session.query(CorRoleActionFilterModuleObject)
-            .filter_by(
-                id_module=id_module,
-                id_role=id_role,
-                id_object=object_instance.id_object,
-            )
-            .all()
-        )
-        if len(real_cruved) == 0 and not module.module_code == "ADMIN":
-            msg_heritage_obj = ""
-            if herited:
-                msg_heritage_obj = f" - objet {herited_obj[1]}"
-                if herited_obj[1] == "ALL":
-                    msg_heritage_obj = ""
-                msg_heritage_obj = f" {herited_obj[0]} {msg_heritage_obj}"
-            flash(
-                f"""
-                Attention ce role n'a pas encore de CRUVED dans ce module.
-                Celui-ci lui est hérité de son groupe et/ou du module parent{msg_heritage_obj}
-                """
-            )
-        return render_template(
-            "cruved_scope_form.html",
-            form=form,
-            user=user,
-            module=module,
-            object_instance=object_instance,
-            id_object=id_object,
-            config=current_app.config,
-        )
-
-    else:
-        form = CruvedScopeForm(request.form)
-        if form.validate_on_submit():
-            actions_id = {
-                action.code_action: action.id_action for action in DB.session.query(TActions).all()
-            }
-            for code_action, id_action in actions_id.items():
-                privilege = {
-                    "id_role": id_role,
-                    "id_action": id_action,
-                    "id_module": id_module,
-                    "id_object": object_instance.id_object,
-                }
-                # check if a row already exist for a module, a role and an action
-                # force to not set several filter for the same role-action-module-object
-                permission_instance = (
-                    DB.session.query(CorRoleActionFilterModuleObject)
-                    .filter_by(**privilege)
-                    .join(
-                        TFilters,
-                        TFilters.id_filter == CorRoleActionFilterModuleObject.id_filter,
-                    )
-                    .join(
-                        BibFiltersType,
-                        BibFiltersType.id_filter_type == TFilters.id_filter_type,
-                    )
-                    .filter(BibFiltersType.code_filter_type == "SCOPE")
-                    .first()
-                )
-                # if already exist update the id_filter
-                if permission_instance:
-                    permission_instance.id_filter = int(form.data[code_action])
-                    DB.session.merge(permission_instance)
-                else:
-                    permission_row = CorRoleActionFilterModuleObject(
-                        id_role=id_role,
-                        id_action=id_action,
-                        id_filter=int(form.data[code_action]),
-                        id_module=id_module,
-                        id_object=object_instance.id_object,
-                    )
-                    DB.session.add(permission_row)
-                DB.session.commit()
-            flash("CRUVED mis à jour pour le role {}".format(user.id_role))
-        return redirect(url_for("gn_permissions_backoffice.user_cruved", id_role=id_role))
-
-
-@routes.route("/users", methods=["GET"])
-@permissions.check_cruved_scope("R", get_scope=True)
-def users(scope):
-    """
-    .. :quickref: View_Permission;
-    Render a list with all users with their number of cruved
-    Link to edit cruved and other permissions
-    Only display user which have profil in GeoNature and active user
-    """
-
-    id_app = (
-        Application.query.filter_by(code_application=current_app.config["CODE_APPLICATION"])
-        .one()
-        .id_application
-    )
-    q = (
-        DB.session.query(AppRole, func.count(CorRoleActionFilterModuleObject.id_role))
-        .outerjoin(
-            CorRoleActionFilterModuleObject,
-            CorRoleActionFilterModuleObject.id_role == AppRole.id_role,
-        )
-        .filter(AppRole.id_application == id_app)
-        .group_by(AppRole)
-        .order_by(AppRole.groupe.desc(), AppRole.nom_role.asc())
-    )
-    # filter with cruved auth
-    if scope == 2:
-        q = q.join(
-            BibOrganismes, BibOrganismes.id_organisme == g.current_user.id_organisme
-        ).filter(BibOrganismes == g.current_user.id_organisme)
-    elif scope == 1:
-        q = q.filter(User.id_role == g.current_user.id_role)
-
-    data = q.all()
-
-    users = []
-    for user in data:
-        user_dict = user[0].as_dict()
-        user_dict["nb_cruved"] = user[1]
-        users.append(user_dict)
-    return render_template("users.html", users=users, config=current_app.config)
-
-
-@routes.route("/user_cruved/<id_role>", methods=["GET"])
-@permissions.check_cruved_scope("R")
-def user_cruved(id_role):
-    """
-    .. :quickref: View_Permission;
-    Get all scope CRUVED (with heritage) for a user in all modules
-    """
-    user = DB.session.query(User).get(id_role).as_dict()
-    modules_data = (
-        DB.session.query(TModules)
-        .options(joinedload(TModules.objects))
-        .order_by(TModules.module_order)
-        .all()
-    )
-    groupes_data = DB.session.query(CorRole).filter(CorRole.id_role_utilisateur == id_role).all()
-    actions_label = {}
-    for action in DB.session.query(TActions).all():
-        actions_label[action.code_action] = action.description_action
-    modules = []
-    for module in modules_data:
-        module = module.as_dict(fields=["objects"])
-        # get cruved for all objects
-        module_objects_as_dict = []
-        for _object in module.get("objects", []):
-            object_cruved, herited, herited_obj = cruved_scope_for_user_in_module(
-                id_role=id_role,
-                module_code=module["module_code"],
-                object_code=_object["code_object"],
-            )
-            _object["cruved"] = (
-                beautifulize_cruved(actions_label, object_cruved),
-                herited,
-                herited_obj,
-            )
-            module_objects_as_dict.append(_object)
-
-        module["module_objects"] = module_objects_as_dict
-
-        # do not display cruved for module which have objects
-
-        cruved, herited, herited_obj = cruved_scope_for_user_in_module(
-            id_role, module["module_code"]
-        )
-        cruved_beautiful = beautifulize_cruved(actions_label, cruved)
-        module["module_cruved"] = (cruved_beautiful, herited, herited_obj)
-        modules.append(module)
-    return render_template(
-        "cruved_user.html",
-        user=user,
-        groupes=[groupe.role.as_dict() for groupe in groupes_data],
-        modules=modules,
-        config=current_app.config,
-    )
-
-
-@routes.route("/user_other_permissions/<id_role>", methods=["GET"])
-@permissions.check_cruved_scope("R")
-def user_other_permissions(id_role):
-    """
-    .. :quickref: View_Permission;
-    Get all the permissions define for a user expect SCOPE permissions
-    """
-    user = DB.session.query(User).get(id_role).as_dict()
-
-    permissions = (
-        DB.session.query(CorRoleActionFilterModuleObject)
-        .join(User)
-        .join(TModules)
-        .join(TActions)
-        .join(TFilters)
-        .join(BibFiltersType)
-        .filter(BibFiltersType.code_filter_type != "SCOPE")
-        .filter(User.id_role == id_role)
-        .order_by(TModules.module_code, BibFiltersType.code_filter_type)
-        .all()
-    )
-
-    filter_types = DB.session.query(BibFiltersType).filter(
-        BibFiltersType.code_filter_type != "SCOPE"
-    )
-
-    return render_template(
-        "user_other_permissions.html",
-        user=user,
-        filter_types=filter_types,
-        permissions=permissions,
-    )
-
-
-@routes.route(
-    "/other_permissions_form/id_permission/<int:id_permission>/user/<int:id_role>/filter_type/<int:id_filter_type>",
-    methods=["GET", "POST"],
-)
-@routes.route(
-    "/other_permissions_form/user/<int:id_role>/filter_type/<int:id_filter_type>",
-    methods=["GET", "POST"],
-)
-@permissions.check_cruved_scope("R")
-def other_permissions_form(id_role, id_filter_type, id_permission=None):
-    """
-    Form to define permisisons for a user expect SCOPE permissions
-    .. :quickref: View_Permission;
-    """
-    if id_permission:
-        perm = DB.session.query(CorRoleActionFilterModuleObject).get(id_permission)
-        form = OtherPermissionsForm(
-            id_filter_type,
-            action=perm.id_action,
-            filter=perm.id_filter,
-            module=perm.id_module,
-        )
-    else:
-        form = OtherPermissionsForm(id_filter_type)
-    user = DB.session.query(User).get(id_role).as_dict()
-    filter_type = DB.session.query(BibFiltersType).get(id_filter_type)
-
-    if request.method == "POST" and form.validate_on_submit():
-        permInstance = CorRoleActionFilterModuleObject(
-            id_permission=id_permission,
-            id_role=id_role,
-            id_action=form.data["action"].id_action,
-            id_filter=int(form.data["filter"]),
-            id_module=form.data["module"].id_module,
-        )
-        if id_permission:
-            DB.session.merge(permInstance)
-        else:
-            DB.session.add(permInstance)
-        DB.session.commit()
-
-        return redirect(
-            url_for("gn_permissions_backoffice.user_other_permissions", id_role=id_role)
-        )
-
-    return render_template(
-        "other_permissions_form.html", user=user, form=form, filter_type=filter_type
-    )
-
-
-@routes.route(
-    "/filter_form/id_filter_type/<int:id_filter_type>/id_filter/<int:id_filter>",
-    methods=["GET", "POST"],
-)
-@routes.route("/filter_form/id_filter_type/<int:id_filter_type>", methods=["GET", "POST"])
-@permissions.check_cruved_scope(
-    "R",
-    object_code="PERMISSIONS",
-)
-def filter_form(id_filter_type, id_filter=None):
-    """
-    .. :quickref: View_Permission;
-    """
-    # TODO: check post permissions
-    filter_type = DB.session.query(BibFiltersType).get(id_filter_type)
-    # if id_filter: its an edit, preload the form
-    if id_filter:
-        filter_value = DB.session.query(TFilters).get(id_filter).as_dict()
-        form = FilterForm(**filter_value)
-    else:
-        form = FilterForm()
-    if request.method == "POST" and form.validate_on_submit():
-        filter_instance = TFilters(
-            id_filter=id_filter,
-            label_filter=form.data["label_filter"],
-            value_filter=form.data["value_filter"],
-            description_filter=form.data["description_filter"],
-            id_filter_type=id_filter_type,
-        )
-        if id_filter:
-            DB.session.merge(filter_instance)
-            flash("Filtre édité avec succès")
-        else:
-            DB.session.add(filter_instance)
-            flash("Filtre ajouté avec succès")
-        DB.session.commit()
-        return redirect(
-            url_for("gn_permissions_backoffice.filter_list", id_filter_type=id_filter_type)
-        )
-    return render_template(
-        "filter_form.html", form=form, filter_type=filter_type, id_filter=id_filter
-    )
-
-
-@routes.route("/filter_list/id_filter_type/<int:id_filter_type>", methods=["GET"])
-@permissions.check_cruved_scope(
-    "R",
-    object_code="PERMISSIONS",
-)
-def filter_list(id_filter_type):
-    """
-    .. :quickref: View_Permission;
-    """
-    filters = DB.session.query(TFilters).filter(TFilters.id_filter_type == id_filter_type)
-    filter_type = DB.session.query(BibFiltersType).get(id_filter_type)
-    return render_template("filter_list.html", filters=filters, filter_type=filter_type)
-
-
-@routes.route("/filter/<id_filter>", methods=["POST"])
-@permissions.check_cruved_scope(
-    "D",
-    object_code="PERMISSIONS",
-)
-def delete_filter(id_filter):
-    """
-    .. :quickref: View_Permission;
-    """
-    my_filter = DB.session.query(TFilters).get_or_404(id_filter)
-    DB.session.delete(my_filter)
-    DB.session.commit()
-    flash("Filtre supprimé avec succès")
-    return redirect(
-        url_for(
-            "gn_permissions_backoffice.filter_list",
-            id_filter_type=my_filter.id_filter_type,
-        )
-    )
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index ae38a551e0..b40ff3e0ee 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -1,13 +1,8 @@
-import logging, json
 from itertools import groupby
 
 import sqlalchemy as sa
 from sqlalchemy.orm import joinedload
-from sqlalchemy.sql.expression import func
-from flask import current_app, redirect, Response, g
-from werkzeug.exceptions import Forbidden, Unauthorized
-from werkzeug.routing import RequestRedirect
-from authlib.jose.errors import ExpiredTokenError, JoseError
+from flask import g
 
 from geonature.core.gn_commons.models import TModules
 from geonature.core.gn_permissions.models import (
@@ -16,82 +11,10 @@
     TActions,
     TObjects,
 )
-from geonature.utils.env import db, DB
+from geonature.utils.env import db
 
 from pypnusershub.db.models import User
 
-log = logging.getLogger(__name__)
-
-
-def beautifulize_cruved(actions, cruved):
-    """
-    Build more readable the cruved dict with the actions label
-    Params:
-        actions: dict action {'C': 'Action de créer'}
-        cruved: dict of cruved
-    Return:
-        Array<dict> [{'label': 'Action de Lire', 'value': '3'}]
-    """
-    cruved_beautiful = []
-    for key, value in cruved.items():
-        temp = {}
-        temp["label"] = actions.get(key)
-        temp["value"] = value
-        cruved_beautiful.append(temp)
-    return cruved_beautiful
-
-
-def cruved_scope_for_user_in_module(
-    id_role=None,
-    module_code=None,
-    object_code=None,
-    get_id=False,
-):
-    """
-    get the user cruved for a module or object
-    if no cruved for a module, the cruved parent module is taken
-    Child app cruved alway overright parent module cruved
-    Params:
-        - id_role(int)
-        - module_code(str)
-        - object_code(str)
-        - get_id(bool): if true return the id_scope for each action
-            if false return the filter_value for each action
-        - append_to_select (dict) : dict of extra select module object for heritage
-    Return a tuple
-    - index 0: the cruved as a dict : {'C': 0, 'R': 2 ...}
-    - index 1: a boolean which say if its an herited cruved
-    """
-    cruved = {}
-    herited_object = [None, None]
-    no_access_filter = (
-        TFilters.query.filter(TFilters.filter_type.has(code_filter_type="SCOPE"))
-        .filter_by(value_filter="0")
-        .one()
-    )
-    for action_code in "CRUVED":
-        permissions, _module_code, _object_code = _get_permissions(
-            action_code, id_role, module_code, object_code
-        )
-        if (_module_code != module_code) or (_object_code != (object_code or "ALL")):
-            herited_object = [_module_code, _object_code]
-        max_scope = 0
-        max_permission = None
-        for permission in permissions:
-            if permission.filter.filter_type.code_filter_type != "SCOPE":
-                continue
-            scope = int(permission.filter.value_filter)
-            if scope >= max_scope:
-                max_scope = scope
-                max_permission = permission
-        if max_permission is not None:
-            cruved[action_code] = max_permission.filter.id_filter if get_id else str(max_scope)
-        else:
-            cruved[action_code] = (
-                no_access_filter.id_filter if get_id else str(no_access_filter.value_filter)
-            )
-    return cruved, herited_object != [None, None], herited_object
-
 
 def _get_user_permissions(id_role):
     default_module = TModules.query.filter_by(module_code="GEONATURE").one()
@@ -161,7 +84,7 @@ def get_user_permissions_by_action(id_role=None):
     return g.permissions_by_action[id_role]
 
 
-def _get_permissions(action_code, id_role, module_code, object_code):
+def get_permissions(action_code, id_role=None, module_code=None, object_code=None):
     """
     This function ensure module and object inheritance.
     Permissions have been sorted (which is required for using groupby) by module_code and object_code,
@@ -183,12 +106,8 @@ def _get_permissions(action_code, id_role, module_code, object_code):
         ):
             if _object_code not in [object_code, "ALL"]:
                 continue
-            return list(__permissions), _module_code, _object_code
-    return [], None, None
-
-
-def get_permissions(action_code, id_role=None, module_code=None, object_code=None):
-    return _get_permissions(action_code, id_role, module_code, object_code)[0]
+            return list(__permissions)
+    return []
 
 
 def get_scope(action_code, id_role=None, module_code=None, object_code=None):
diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 77f1ef7288..44d2e0d2aa 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -46,7 +46,6 @@
     "synthese_data",
     "source",
     "reports_data",
-    "filters",
     "medium",
     "module",
     "perm_object",
@@ -332,30 +331,6 @@ def synthese_data(app, users, datasets, source):
     return data
 
 
-@pytest.fixture(scope="function")
-def filters():
-    """
-    Creates one filter per filter type
-    """
-    # Gather all types
-    avail_filter_types = BibFiltersType.query.order_by(BibFiltersType.id_filter_type).all()
-    # Init returned filter_dict
-    filters_dict = {}
-    # For each type, generate a Filter
-    with db.session.begin_nested():
-        for i, filter_type in enumerate(avail_filter_types):
-            new_filter = TFilters(
-                label_filter=f"test_{i}",
-                value_filter=f"value_{i}",
-                description_filter="Filtre test",
-                id_filter_type=filter_type.id_filter_type,
-            )
-            filters_dict[filter_type.code_filter_type] = new_filter
-            db.session.add(new_filter)
-
-    return filters_dict
-
-
 def create_media(media_path=""):
     photo_type = TNomenclatures.query.filter(
         BibNomenclaturesTypes.mnemonique == "TYPE_MEDIA", TNomenclatures.mnemonique == "Photo"
diff --git a/backend/geonature/tests/test_gn_permission.py b/backend/geonature/tests/test_gn_permission.py
index de60a5bf59..1b049f998a 100644
--- a/backend/geonature/tests/test_gn_permission.py
+++ b/backend/geonature/tests/test_gn_permission.py
@@ -1,54 +1,5 @@
 import pytest
-from flask import request, template_rendered, url_for
-from sqlalchemy import func
-from werkzeug.exceptions import Forbidden, Unauthorized
-
-from pypnusershub.db.models import User
-
-from geonature.core.gn_permissions.models import (
-    CorRoleActionFilterModuleObject,
-    TFilters,
-    TActions,
-)
-from geonature.core.gn_commons.models import TModules
-from geonature.core.gn_permissions.tools import (
-    cruved_scope_for_user_in_module,
-)
-from geonature.utils.env import DB
-
-from .fixtures import filters
-from .utils import logged_user_headers, set_logged_user_cookie
-
-
-@pytest.fixture
-def captured_templates(app):
-    recorded = []
-
-    def record(sender, template, context, **extra):
-        recorded.append((template, context))
-
-    template_rendered.connect(record, app)
-    try:
-        yield recorded
-    finally:
-        template_rendered.disconnect(record, app)
-
-
-@pytest.fixture
-def unavailable_filter_id():
-    return DB.session.query(func.max(TFilters.id_filter)).scalar() + 1
-
-
-@pytest.fixture
-def unavailable_user_id():
-    return DB.session.query(func.max(User.id_role)).scalar() + 1
-
-
-@pytest.fixture
-def deactivate_csrf(monkeypatch, app):
-    # Deactivate the csrf check on the form otherwise it will appear
-    # with errors on csrf
-    monkeypatch.setitem(app.config, "WTF_CSRF_ENABLED", False)
+from flask import url_for
 
 
 @pytest.mark.usefixtures("client_class")
@@ -58,296 +9,3 @@ def test_logout(self):
 
         assert response.status_code == 200
         assert response.data == b"Logout"
-
-
-@pytest.mark.usefixtures("client_class", "temporary_transaction")
-class TestGnPermissionsTools:
-    """Test of gn_permissions tools functions"""
-
-    def test_cruved_scope_for_user_in_module(self, users):
-        admin_user = users["admin_user"]
-        # get cruved for geonature
-        cruved, herited, _ = cruved_scope_for_user_in_module(
-            id_role=admin_user.id_role, module_code="GEONATURE"
-        )
-        assert herited == False
-        assert cruved == {"C": "3", "R": "3", "U": "3", "V": "3", "E": "3", "D": "3"}
-
-        cruved, herited, _ = cruved_scope_for_user_in_module(
-            id_role=admin_user.id_role, module_code="GEONATURE", get_id=True
-        )
-
-        assert herited == False
-        assert cruved == {"C": 4, "R": 4, "U": 4, "V": 4, "E": 4, "D": 4}
-
-
-@pytest.mark.usefixtures("client_class", "temporary_transaction")
-class TestGnPermissionsView:
-    def test_get_users(self, users, captured_templates):
-        """
-        Test get page with all roles
-        """
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-
-        response = self.client.get(url_for("gn_permissions_backoffice.users"))
-
-        template, context = captured_templates[0]
-        assert template.name == "users.html"
-        assert response.status_code == 200
-        users_context = context["users"]
-        assert b"Liste des roles" in response.data
-        assert admin_user.id_role in [user["id_role"] for user in users_context]
-
-    def test_get_user_cruveds(self, users, captured_templates):
-        """
-        Test get page with all cruved of a user
-        """
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-
-        response = self.client.get(
-            url_for("gn_permissions_backoffice.user_cruved", id_role=admin_user.id_role)
-        )
-
-        template, context = captured_templates[0]
-        assert template.name == "cruved_user.html"
-        assert response.status_code == 200
-        user_context = context["user"]
-        assert user_context["id_role"] == admin_user.id_role
-        assert len(context["modules"]) != 0
-
-    def test_get_cruved_scope_form_allowed(self, users):
-        """
-        Test get user cruved form page
-        """
-        admin_user = users["admin_user"]
-        # with user admin
-        set_logged_user_cookie(self.client, admin_user)
-
-        response = self.client.get(
-            url_for(
-                "gn_permissions_backoffice.permission_form",
-                id_role=admin_user.id_role,
-                id_module=1,
-                id_object=None,
-            )
-        )
-
-        assert response.status_code == 200
-
-    def test_post_cruved_scope_form(self, users):
-        """
-        Test a post an an update on table cor_role_action_filter_module_object
-        """
-        self_user = users["self_user"]
-        set_logged_user_cookie(self.client, self_user)
-        # WARNING: wet set ID not code in the form !
-        data = {"C": "4", "R": "3", "U": "3", "V": "4", "E": "2", "D": "3"}
-
-        response = self.client.post(
-            url_for(
-                "gn_permissions_backoffice.permission_form",
-                id_role=self_user.id_role,
-                id_module=0,
-                id_object=None,
-            ),
-            data=data,
-            content_type="multipart/form-data",
-        )
-
-        assert response.status_code == 302
-
-    def test_get_user_other_permissions(self, users, captured_templates):
-        """
-        Test of view who return the user permissions expect SCOPE
-        """
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-
-        response = self.client.get(
-            url_for("gn_permissions_backoffice.user_other_permissions", id_role=admin_user.id_role)
-        )
-
-        template, context = captured_templates[0]
-        assert template.name == "user_other_permissions.html"
-        assert response.status_code == 200
-        user_context = context["user"]
-        assert user_context["id_role"] == admin_user.id_role
-
-    def test_post_other_perm_wrong(self, users):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        # test wrong parameter in form
-        wrong_data = {"module": "0", "action": "1", "filter": "truc"}
-
-        response = self.client.post(
-            url_for(
-                "gn_permissions_backoffice.other_permissions_form",
-                id_role=1,
-                id_filter_type=4,
-            ),
-            data=wrong_data,
-        )
-
-        # if the post returns a 200, its an error which renders the initial template form (otherwise it should be 302, see other tests)
-        response.status_code == 200
-
-    def test_post_other_perm(self, deactivate_csrf, users, filters):
-        """
-        Test post/update a permission (no scope)
-        """
-
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        one_filter = next(iter(filters.values()))
-        module = TModules.query.first()
-        action = TActions.query.first()
-        CorRoleActionFilterModuleObject.query.filter_by(
-            id_role=admin_user.id_role,
-            id_action=action.id_action,
-            id_filter=one_filter.id_filter,
-            id_module=module.id_module,
-        ).delete()
-        CorRoleActionFilterModuleObject.query.filter_by(
-            id_role=admin_user.id_role,
-            id_action=action.id_action,
-            id_module=module.id_module,
-        ).delete()
-        valid_data = {
-            "module": str(module.id_module),
-            "action": str(action.id_action),
-            "filter": one_filter.id_filter,
-        }
-
-        response = self.client.post(
-            url_for(
-                "gn_permissions_backoffice.other_permissions_form",
-                id_role=admin_user.id_role,
-                id_filter_type=one_filter.id_filter_type,
-            ),
-            data=valid_data,
-        )
-
-        assert response.status_code == 302
-
-    # @pytest.mark.usefixtures('deactivate_csrf') seems not working here
-    def test_update_other_perm(self, deactivate_csrf, users, filters):
-        admin_user = users["admin_user"]
-        self_user = users["self_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        # Get the permission to update
-        permission = (
-            DB.session.query(CorRoleActionFilterModuleObject)
-            .filter(CorRoleActionFilterModuleObject.id_role == self_user.id_role)
-            .first()
-        )
-        id_permission = permission.id_permission
-        # Take the last filter so that we cannot have a SCOPE filter type
-        one_filter = next(iter(filters.values()))
-        # change action and filter
-        update_data = {
-            "module": str(permission.id_module),
-            "action": str(permission.id_action),
-            "filter": one_filter.id_filter,
-        }
-
-        response = self.client.post(
-            url_for(
-                "gn_permissions_backoffice.other_permissions_form",
-                id_role=self_user.id_role,
-                id_filter_type=one_filter.id_filter_type,
-                id_permission=permission.id_permission,
-            ),
-            data=update_data,
-        )
-
-        assert response.status_code == 302
-        # TODO: maybe a better way to do this
-        updated_permission = DB.session.query(CorRoleActionFilterModuleObject).get(id_permission)
-        assert updated_permission.id_action == int(update_data["action"])
-
-    def test_post_filter(self, deactivate_csrf, users, filters):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        data = {
-            "label_filter": "Les sonneurs",
-            "value_filter": "212",
-            "description_filter": "Filtre de validation des sonneurs",
-        }
-        one_filter = filters[list(filters.keys())[0]]
-        id_filter_type = one_filter.id_filter_type
-
-        response = self.client.post(
-            url_for("gn_permissions_backoffice.filter_form", id_filter_type=id_filter_type),
-            data=data,
-        )
-
-        assert response.status_code == 302
-
-    def test_update_filter(self, deactivate_csrf, users, filters):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        one_filter = filters[list(filters.keys())[0]]
-        update_data = {
-            "label_filter": "Les sonneurs bleus",
-            "value_filter": "213",
-            "description_filter": "Filtre de validation des sonneurs bleus",
-            "submit": "Valider",
-        }
-
-        response = self.client.post(
-            url_for(
-                "gn_permissions_backoffice.filter_form",
-                id_filter_type=one_filter.id_filter_type,
-                id_filter=one_filter.id_filter,
-            ),
-            data=update_data,
-        )
-
-        assert response.status_code == 302
-
-    def test_get_filters_list(self, users, captured_templates, filters):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        one_filter = filters[list(filters.keys())[0]]
-        id_filter_type = one_filter.id_filter_type
-
-        response = self.client.get(
-            url_for("gn_permissions_backoffice.filter_list", id_filter_type=id_filter_type)
-        )
-
-        template, context = captured_templates[0]
-        assert template.name == "filter_list.html"
-        # Here context["filters"] is of type BaseQuery
-        filters_gathered = context["filters"].all()
-        assert id_filter_type in [filt.id_filter_type for filt in filters_gathered]
-        assert response.status_code == 200
-
-    def test_delete_filter_fail(self, users, unavailable_filter_id):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-
-        response = self.client.post(
-            url_for("gn_permissions_backoffice.delete_filter", id_filter=unavailable_filter_id)
-        )
-
-        assert response.status_code == 404
-
-    def test_delete_filter(self, users, filters):
-        admin_user = users["admin_user"]
-        set_logged_user_cookie(self.client, admin_user)
-        one_filter = filters[list(filters.keys())[0]]
-
-        response = self.client.post(
-            url_for("gn_permissions_backoffice.delete_filter", id_filter=one_filter.id_filter)
-        )
-
-        # Since there is a redirection : 302
-        assert response.status_code == 302
-        assert (
-            url_for(
-                "gn_permissions_backoffice.filter_list", id_filter_type=one_filter.id_filter_type
-            )
-            in response.location
-        )

From 849c7ac62a9cafa7ff5110f44a3a65aaee7559f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Thu, 20 Apr 2023 14:12:46 +0200
Subject: [PATCH 049/209] add ADDITIONAL_FIELDS object in ADMIN module

---
 ...5a5099e084_add_additional_fields_object.py | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py

diff --git a/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py b/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py
new file mode 100644
index 0000000000..fa78d8e5d6
--- /dev/null
+++ b/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py
@@ -0,0 +1,43 @@
+"""add additional fields object
+
+Revision ID: df5a5099e084
+Revises: 0630b93bcfe0
+Create Date: 2023-04-20 10:46:00.334251
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "df5a5099e084"
+down_revision = "95acee9f0452"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_objects (code_object, description_object)
+        VALUES (
+            'ADDITIONAL_FIELDS',
+            'Gestion du backoffice des champs additionnels'
+        )
+        """
+    )
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.cor_object_module (id_object, id_module)
+        VALUES (
+            (SELECT id_object FROM gn_permissions.t_objects WHERE code_object = 'ADDITIONAL_FIELDS'),
+            (SELECT id_module FROM gn_commons.t_modules WHERE module_code = 'ADMIN')
+        )
+        """
+    )
+
+
+def downgrade():
+    op.execute("DELETE FROM gn_permissions.t_objects WHERE code_object = 'ADDITIONAL_FIELDS'")

From 6d98f6fd7649bccc605e2990cd83c6fdb788d737 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Thu, 20 Apr 2023 14:10:18 +0200
Subject: [PATCH 050/209] permissions: reset cached perms on each requests

---
 backend/geonature/app.py                       |  1 +
 backend/geonature/core/gn_permissions/tools.py | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index c8a7a2e19c..22b066d025 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -162,6 +162,7 @@ def load_current_user():
             g.current_user = user_from_token(request.cookies["token"]).role
         except (KeyError, UnreadableAccessRightsError, AccessRightsExpiredError):
             g.current_user = None
+        g.permissions_by_action = {}
 
     if config.get("SENTRY_DSN"):
         from sentry_sdk import set_tag, set_user
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index b40ff3e0ee..3fae82963d 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -77,11 +77,12 @@ def get_user_permissions_by_action(id_role=None):
     """
     if id_role is None:
         id_role = g.current_user.id_role
-    if "permissions_by_action" not in g:
-        g.permissions_by_action = dict()
-    if id_role not in g.permissions_by_action:
-        g.permissions_by_action[id_role] = _get_user_permissions_by_action(id_role)
-    return g.permissions_by_action[id_role]
+    if "permissions_by_action" in g:  # before_request have been called
+        if id_role not in g.permissions_by_action:
+            g.permissions_by_action[id_role] = _get_user_permissions_by_action(id_role)
+        return g.permissions_by_action[id_role]
+    else:
+        return _get_user_permissions_by_action(id_role)
 
 
 def get_permissions(action_code, id_role=None, module_code=None, object_code=None):

From a8d6dd5ca1dae6da9dbba7d37526ea531b451c65 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Wed, 12 Apr 2023 17:44:34 +0200
Subject: [PATCH 051/209] Add scope="class" to fixtures in test_permissions.py

---
 backend/geonature/tests/test_permissions.py | 24 ++++++++++-----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index 762abd3264..71ba76a1d7 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -17,12 +17,12 @@
 from pypnusershub.db.models import User
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def actions():
     return {action.code_action: action for action in TActions.query.all()}
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def scopes():
     scope_type = BibFiltersType.query.filter_by(code_filter_type="SCOPE").one()
     return {f.value_filter: f for f in TFilters.query.filter_by(filter_type=scope_type).all()}
@@ -38,29 +38,29 @@ def create_module(label):
     )
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def module_gn():
     return TModules.query.filter_by(module_code="GEONATURE").one()
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def object_all():
     return TObjects.query.filter_by(code_object="ALL").one()
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def object_a():
     obj = TObjects(code_object="object_a")
     return obj
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def object_b():
     obj = TObjects(code_object="object_b")
     return obj
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def module_a():
     with db.session.begin_nested():
         module = create_module("module_a")
@@ -68,7 +68,7 @@ def module_a():
     return module
 
 
-@pytest.fixture
+@pytest.fixture(scope="class")
 def module_b():
     with db.session.begin_nested():
         module = create_module("module_b")
@@ -76,7 +76,7 @@ def module_b():
     return module
 
 
-@pytest.fixture
+@pytest.fixture()
 def groups():
     groups = {
         "g1": User(groupe=True),
@@ -88,7 +88,7 @@ def groups():
     return groups
 
 
-@pytest.fixture
+@pytest.fixture()
 def roles(groups):
     roles = {
         "r1": User(),
@@ -118,7 +118,7 @@ def cruved_dict(scopes):
     }
 
 
-@pytest.fixture
+@pytest.fixture()
 def permissions(roles, groups, actions, scopes):
     roles = ChainMap(roles, groups)
 
@@ -135,7 +135,7 @@ def _permissions(role, cruved, **kwargs):
     return _permissions
 
 
-@pytest.fixture
+@pytest.fixture()
 def assert_cruved(roles):
     def _assert_cruved(role, cruved, module=None, object=None):
         role = roles[role]

From cfb83cb592a3495a5b3340ec55b022215bcaa8fb Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Wed, 12 Apr 2023 18:37:07 +0200
Subject: [PATCH 052/209] Remove modules and objects permissions inheritance

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 .../geonature/core/gn_permissions/tools.py    | 80 ++++++++-----------
 1 file changed, 35 insertions(+), 45 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index 3fae82963d..c97e9747b5 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -17,8 +17,6 @@
 
 
 def _get_user_permissions(id_role):
-    default_module = TModules.query.filter_by(module_code="GEONATURE").one()
-    default_object = TObjects.query.filter_by(code_object="ALL").one()
     return (
         CorRoleActionFilterModuleObject.query.options(
             joinedload(CorRoleActionFilterModuleObject.action),
@@ -34,31 +32,15 @@ def _get_user_permissions(id_role):
                 ),
             ),
         )
-        # These ordering ensure groupby is working properly, as well as allows module / object inheritance
-        .order_by(
-            CorRoleActionFilterModuleObject.id_action,
-            # ensure GEONATURE module is the last
-            db.case(
-                [
-                    (CorRoleActionFilterModuleObject.id_module == default_module.id_module, -1),
-                ],
-                else_=CorRoleActionFilterModuleObject.id_module,
-            ).desc(),
-            # ensure ALL object is the last
-            db.case(
-                [
-                    (CorRoleActionFilterModuleObject.id_object == default_object.id_object, -1),
-                ],
-                else_=CorRoleActionFilterModuleObject.id_object,
-            ).desc(),
-        )
+        # These ordering ensure groupby is working properly
+        .order_by(CorRoleActionFilterModuleObject.id_action)
         .all()
     )
 
 
 def _get_user_permissions_by_action(id_role):
     permissions = _get_user_permissions(id_role)
-    # This ensure empty permissions list for action without permissions
+    # This ensures empty permissions list for action without permissions
     permissions_by_action = {action.code_action: [] for action in TActions.query.all()}
     # Note: groupby require sorted data, which is done at SQL level
     permissions_by_action.update(
@@ -87,37 +69,39 @@ def get_user_permissions_by_action(id_role=None):
 
 def get_permissions(action_code, id_role=None, module_code=None, object_code=None):
     """
-    This function ensure module and object inheritance.
-    Permissions have been sorted (which is required for using groupby) by module_code and object_code,
-    with insurance GEONATURE module and ALL object are latest.
-    We return first list of permissions found.
+    This function returns a list of all the permissions that match (action_code, id_role, module_code, object_code).
+    If module_code is None, it is set as the code of the current module or as "GEONATURE" if no current module found.
+    If object_code is None, it is set as the code of the current object or as "ALL" if no current object found.
+
+    :returns : the list of permissions that match, and an empty list if no match
     """
-    if module_code is None and hasattr(g, "current_module"):
-        module_code = g.current_module.module_code
+    if module_code is None:
+        if hasattr(g, "current_module"):
+            module_code = g.current_module.module_code
+        else:
+            module_code = "GEONATURE"
 
-    if object_code is None and hasattr(g, "current_object"):
-        object_code = g.current_object.code_object
+    if object_code is None:
+        if hasattr(g, "current_object"):
+            object_code = g.current_object.code_object
+        else:
+            object_code = "ALL"
 
-    permissions = get_user_permissions_by_action(id_role)[action_code]
-    for _module_code, _permissions in groupby(permissions, key=lambda p: p.module.module_code):
-        if _module_code not in [module_code, "GEONATURE"]:
-            continue
-        for _object_code, __permissions in groupby(
-            _permissions, key=lambda p: p.object.code_object
-        ):
-            if _object_code not in [object_code, "ALL"]:
-                continue
-            return list(__permissions)
-    return []
+    return [
+        p
+        for p in get_user_permissions_by_action(id_role)[action_code]
+        if p.module.module_code == module_code and p.object.code_object == object_code
+    ]
 
 
 def get_scope(action_code, id_role=None, module_code=None, object_code=None):
     """
-    Note: we filter permissions by scope *after* module / object inheritance.
-    This means we get null scope if there are non-scope permissions at module level
-    but scope permissions at GEONATURE level.
-    If we want to inherite scope without others permissions types considered,
-    we should filter non-scope permissions *before* inheritance.
+    This function gets the final scope permission.
+
+    It takes the maximum for all the permissions that match (action_code, id_role, module_code, object_code) and with
+    of a "SCOPE" filter type.
+
+    :returns : (int) The scope computed for specified arguments
     """
     permissions = get_permissions(action_code, id_role, module_code, object_code)
     max_scope = 0
@@ -129,6 +113,12 @@ def get_scope(action_code, id_role=None, module_code=None, object_code=None):
 
 
 def get_scopes_by_action(id_role=None, module_code=None, object_code=None):
+    """
+    This function gets the scopes permissions for each one of the 6 actions in "CRUVED",
+    that match (id_role, module_code, object_code)
+
+    :returns : (dict) A dict of the scope for each one of the 6 actions (the char in "CRUVED")
+    """
     return {
         action_code: get_scope(action_code, id_role, module_code, object_code)
         for action_code in "CRUVED"

From ff52472d7f749b1c40fc57da949811b7f10795e6 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Wed, 12 Apr 2023 18:41:35 +0200
Subject: [PATCH 053/209] Update test_permissions

Remove tests for modules and objects inheritance.
Add a test for no module or no object specified for `_get_permissions` (and thus for `get_scopes_by_action`)
---
 backend/geonature/tests/fixtures.py         |  30 ++++-
 backend/geonature/tests/test_permissions.py | 138 ++++----------------
 2 files changed, 54 insertions(+), 114 deletions(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 44d2e0d2aa..29ef4c8556 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -76,7 +76,8 @@ def app():
 
 
 @pytest.fixture(scope="function")
-def module():
+def module(users):
+    other_module = TModules.query.filter_by(module_code="GEONATURE").one()
     with db.session.begin_nested():
         new_module = TModules(
             module_code="MODULE_1",
@@ -86,6 +87,19 @@ def module():
             active_backend=False,
         )
         db.session.add(new_module)
+    # Copy perission from another module
+    with db.session.begin_nested():
+        for perm in CorRoleActionFilterModuleObject.query.filter_by(
+            id_module=other_module.id_module
+        ):
+            new_perm = CorRoleActionFilterModuleObject(
+                id_role=perm.id_role,
+                id_action=perm.id_action,
+                id_filter=perm.id_filter,
+                id_module=new_module.id_module,
+                id_object=perm.id_object,
+            )
+            db.session.add(new_perm)
     return new_module
 
 
@@ -130,13 +144,19 @@ def create_user(username, organisme=None, scope=None):
                 id_role=user.id_role, id_application=app.id_application, id_profil=profil.id_profil
             )
             db.session.add(right)
+            object_all = TObjects.query.filter_by(code_object="ALL").one()
             if scope:
                 for action in actions.values():
                     for module in modules:
-                        permission = CorRoleActionFilterModuleObject(
-                            role=user, action=action, filter=scope, module=module
-                        )
-                        db.session.add(permission)
+                        for obj in [object_all] + module.objects:
+                            permission = CorRoleActionFilterModuleObject(
+                                role=user,
+                                action=action,
+                                filter=scope,
+                                module=module,
+                                object=obj,
+                            )
+                            db.session.add(permission)
         return user
 
     users = {}
diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index 71ba76a1d7..a20882627e 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -119,17 +119,19 @@ def cruved_dict(scopes):
 
 
 @pytest.fixture()
-def permissions(roles, groups, actions, scopes):
+def permissions(roles, groups, actions, scopes, module_gn):
     roles = ChainMap(roles, groups)
 
-    def _permissions(role, cruved, **kwargs):
+    def _permissions(role, cruved, *, module=module_gn, **kwargs):
         role = roles[role]
         with db.session.begin_nested():
             for a, s in zip("CRUVED", cruved):
                 if s == "-":
                     continue
                 db.session.add(
-                    Permission(role=role, action=actions[a], filter=scopes[s], **kwargs)
+                    Permission(
+                        role=role, action=actions[a], filter=scopes[s], module=module, **kwargs
+                    )
                 )
 
     return _permissions
@@ -156,13 +158,31 @@ def test_no_right(self, assert_cruved, module_gn, module_a, object_a):
         assert_cruved("r1", "000000", module_gn, object_a)
         assert_cruved("r1", "000000", module_a, object_a)
 
-    def test_module_perm(self, permissions, assert_cruved, module_gn, module_a):
-        permissions("r1", "0123--", module=module_a)
+    def test_module_perm(self, permissions, assert_cruved, module_gn, module_a, module_b):
+        permissions("r1", "1----2", module=module_gn)
+        permissions("r1", "-1---1", module=module_a)
+        permissions("r1", "--1---", module=module_b)
 
-        assert_cruved("r1", "000000")
-        assert_cruved("r1", "012300", module_a)
+        assert_cruved("r1", "100002")
+        assert_cruved("r1", "010001", module_a)
+        assert_cruved("r1", "001000", module_b)
         assert_cruved("r2", "000000", module_a)
 
+    def test_no_module_no_object_specified(
+        self, permissions, assert_cruved, module_gn, object_all, module_a, object_a
+    ):
+        permissions("r1", "11----", module=module_gn, object=object_all)
+        permissions("r1", "--11--", module=module_gn, object=object_a)
+        permissions("r1", "----11", module=module_a, object=object_all)
+
+        assert_cruved("r1", "110000", module=module_gn)
+        assert_cruved("r1", "110000", object=object_all)
+        assert_cruved("r1", "110000")
+
+        assert_cruved("r1", "001100", object=object_a)
+
+        assert_cruved("r1", "000011", module=module_a)
+
     def test_group_inheritance(self, permissions, assert_cruved, module_gn, module_a):
         permissions("g1", "0123--", module=module_a)
 
@@ -179,17 +199,6 @@ def test_user_and_group_perm(self, permissions, assert_cruved, module_a):
 
         assert_cruved("g1_r1", "112300", module=module_a)  # max of user and group permission
 
-    def test_module_inheritance(self, permissions, assert_cruved, module_gn, module_a, module_b):
-        permissions("r1", "121---", module=module_gn)
-        permissions("r1", "012123", module=module_b)
-
-        assert_cruved("r1", "121000")
-        assert_cruved("r1", "121000", module_a)  # A inherite GN permissions
-        assert_cruved("r1", "012123", module_b)  # perms on B have precedence
-        assert_cruved("r2", "000000")
-        assert_cruved("r2", "000000", module_a)
-        assert_cruved("r2", "000000", module_b)
-
     def test_multi_groups_one_perm(self, permissions, assert_cruved, module_a):
         permissions("g1", "0123--", module=module_a)
 
@@ -205,56 +214,6 @@ def test_multi_groups_multi_perms(self, permissions, assert_cruved, module_a):
         assert_cruved("g2_r1", "012103", module_a)
         assert_cruved("g12_r1", "122313", module_a)  # max of both groups permissions
 
-    def test_group_module_inheritance(
-        self, permissions, assert_cruved, module_gn, module_a, module_b
-    ):
-        permissions("g1", "121---", module=module_gn)
-        permissions("g1", "012123", module=module_b)
-
-        assert_cruved("g1_r1", "121000")
-        assert_cruved("g1_r1", "121000", module_a)  # A inherite GN permissions
-        assert_cruved("g1_r1", "012123", module_b)  # perms on B have precedence
-
-    def test_group_and_user_module_inheritance(
-        self, permissions, assert_cruved, module_gn, module_a
-    ):
-        permissions("g1", "1023--", module=module_gn)
-        permissions("g1_r1", "0123--", module=module_a)
-
-        assert_cruved("g1_r1", "102300")
-        assert_cruved("g1_r2", "102300")
-        assert_cruved("g1_r1", "012300", module_a)  # module A have precedence on GN
-        assert_cruved("g1_r2", "102300", module_a)  # module A inherite GN perms
-
-    def test_user_and_group_module_inheritance(
-        self, permissions, assert_cruved, module_gn, module_a
-    ):
-        permissions("g1_r1", "0123--", module=module_gn)
-        permissions("g1", "1023--", module=module_a)
-
-        assert_cruved("g1_r1", "012300")
-        assert_cruved("g1_r2", "000000")  # no perm on GN
-        assert_cruved("g1_r1", "102300", module_a)  # module A have precedence on GN
-        assert_cruved("g1_r2", "102300", module_a)  # module A perm through group
-
-    def test_multi_group_module_inheritance(
-        self, permissions, assert_cruved, module_gn, module_a, module_b
-    ):
-        permissions("g1", "121-1-", module=module_gn)
-        permissions("g2", "2101-3", module=module_gn)
-        permissions("g1", "0121-2", module=module_b)
-
-        assert_cruved("g12_r1", "221113")  # max of both permissions
-        assert_cruved("g12_r1", "221113", module_a)  # A inherite max of GN permissions
-        assert_cruved("g12_r1", "012112", module_b)  # perms on B have precedence
-
-        assert_cruved("g1_r1", "121010")
-        assert_cruved("g2_r1", "210103")
-        assert_cruved("g1_r1", "121010", module_a)  # A inherite GN permissions
-        assert_cruved("g1_r1", "012112", module_b)  # perms on B have precedence
-        assert_cruved("g2_r1", "210103", module_a)  # A inherite GN permissions
-        assert_cruved("g2_r1", "210103", module_b)  # B inherite GN permissions
-
     def test_object_perm(self, permissions, assert_cruved, module_a, module_b, object_a, object_b):
         permissions("r1", "1----2", module=module_a)
         permissions("r1", "-1---1", module=module_a, object=object_a)
@@ -263,45 +222,6 @@ def test_object_perm(self, permissions, assert_cruved, module_a, module_b, objec
 
         assert_cruved("r1", "000000")
         assert_cruved("r1", "100002", module_a)
-        assert_cruved("r1", "110001", module_a, object_a)
+        assert_cruved("r1", "010001", module_a, object_a)
         assert_cruved("r1", "001000", module_b, object_a)
-        assert_cruved("r1", "100102", module_a, object_b)
-
-    def test_object_inheritance(
-        self,
-        permissions,
-        assert_cruved,
-        module_gn,
-        module_a,
-        module_b,
-        object_all,
-        object_a,
-        object_b,
-    ):
-        permissions("r1", "1-----", module=module_gn, object=object_all)
-        permissions("r1", "-1----", module=module_gn, object=object_a)
-        permissions("r1", "--1---", module=module_a, object=object_all)
-        permissions("r1", "---1--", module=module_a, object=object_a)
-
-        assert_cruved("r1", "111100", module_a, object_a)
-
-    def test_object_priority(
-        self,
-        permissions,
-        assert_cruved,
-        module_gn,
-        module_a,
-        module_b,
-        object_all,
-        object_a,
-        object_b,
-    ):
-        permissions("r1", "222---", module=module_gn, object=object_all)
-        permissions("r1", "1--22-", module=module_gn, object=object_a)
-        permissions("r1", "-1-1-2", module=module_a, object=object_all)
-        permissions("r1", "--1-11", module=module_a, object=object_a)
-
-        assert_cruved("r1", "222000", module_gn, object_all)
-        assert_cruved("r1", "122220", module_gn, object_a)
-        assert_cruved("r1", "212102", module_a, object_all)
-        assert_cruved("r1", "111111", module_a, object_a)
+        assert_cruved("r1", "000100", module_a, object_b)

From eb6ffb8adda4a86cad67473fd7daf3729bab2b44 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 18 Apr 2023 11:55:11 +0200
Subject: [PATCH 054/209] Update docs about permissions admin.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the line about modules and objects inheritance, in the section "Récapitulatif".

Remove reference to the view `gn_permissions.v_users_permissions` not existing anymore. The view, actually named `v_roles_permissions`, is removed by the Alembic migration "cec41a6d3a15".

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 docs/admin-manual.rst | 2 --
 1 file changed, 2 deletions(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index 576843e212..f766bd1467 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -437,9 +437,7 @@ Récapitulatif
 - Dans GeoNature V2 on peut attribuer à un role des actions possibles, sur lesquels on peut ajouter des filtres, dans un module ou sur toute l'application GeoNature (définis dans ``gn_permissions.cor_role_action_filter_module_object``).
 - 6 actions sont possibles dans GeoNature : Create / Read / Update / Validate / Export / Delete (aka CRUVED).
 - Différents types de filtre existent. Le plus courant est le filtre de type "SCOPE" (portée) : 3 portées sont attribuables à des actions: Mes données / Les données de mon organisme / Toutes les données.
-- Une vue permet de retourner toutes les actions, leurs filtres et leurs modules de GeoNature pour tous les rôles (``gn_permissions.v_users_permissions``)
 - Des fonctions PostgreSQL ont aussi été intégrées pour faciliter la récupération de ces informations (``gn_permissions.cruved_for_user_in_module``, ``gn_permissions.does_user_have_scope_permission``, ...)
-- Les permissions attribuées à un module surchargent les permission attribuées sur l'ensemble de l'application par un mécanisme d'héritage. Par défaut et en l'absence de permissions, tous les modules héritent des permissions de GeoNature. Attention cependant aux utilisateurs appartenant à plusieurs groupes. Si un CRUVED est définit pour un module à un seul de ses groupes, c'est ce CRUVED qui sera pris en compte. En effet, le mécanisme d'héritage ne fonctionne plus lorsqu'on surcouche implicitement le CRUVED d'un module pour un groupe.
 - Si un utilisateur n'a aucune action possible sur un module, alors il ne lui sera pas affiché et il ne pourra pas y accéder
 - Il est aussi possible de ne pas utiliser UsersHub pour gérer les utilisateurs et de connecter GeoNature à un CAS (voir configuration). Actuellement ce paramétrage est fonctionnel en se connectant au CAS de l'INPN (MNHN)
 

From a656a65256b8ab01aca8e4611ca6525ad31da28d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 18 Apr 2023 15:25:56 +0200
Subject: [PATCH 055/209] module access allowed as soon as one perm exists

Any permission (for any action) on any module objects (or 'ALL' object) grant access to the module.
---
 backend/geonature/core/gn_commons/routes.py | 42 +++++++++++----------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index 6d37a49e1e..6badfdfe82 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -68,25 +68,29 @@ def list_modules():
     for module in modules:
         if module.module_code in current_app.config["DISABLED_MODULES"]:
             continue
-        cruved = get_scopes_by_action(module_code=module.module_code)
-        if cruved["R"] > 0:
-            module_dict = module.as_dict(fields=["objects"])
-            module_dict["cruved"] = cruved
-            if module.active_frontend:
-                module_dict["module_url"] = "{}/#/{}".format(
-                    current_app.config["URL_APPLICATION"], module.module_path
-                )
-            else:
-                module_dict["module_url"] = module.module_external_url
-            module_dict["module_objects"] = {}
-            # get cruved for each object
-            for obj_dict in module_dict["objects"]:
-                obj_code = obj_dict["code_object"]
-                obj_dict["cruved"] = get_scopes_by_action(
-                    module_code=module.module_code,
-                    object_code=obj_code,
-                )
-                module_dict["module_objects"][obj_code] = obj_dict
+        module_allowed = False
+        module_dict = module.as_dict(fields=["objects"])
+        module_dict["cruved"] = get_scopes_by_action(module_code=module.module_code)
+        if any(module_dict["cruved"].values()):
+            module_allowed = True
+        if module.active_frontend:
+            module_dict["module_url"] = "{}/#/{}".format(
+                current_app.config["URL_APPLICATION"], module.module_path
+            )
+        else:
+            module_dict["module_url"] = module.module_external_url
+        module_dict["module_objects"] = {}
+        # get cruved for each object
+        for obj_dict in module_dict["objects"]:
+            obj_code = obj_dict["code_object"]
+            obj_dict["cruved"] = get_scopes_by_action(
+                module_code=module.module_code,
+                object_code=obj_code,
+            )
+            if any(obj_dict["cruved"].values()):
+                module_allowed = True
+            module_dict["module_objects"][obj_code] = obj_dict
+        if module_allowed:
             allowed_modules.append(module_dict)
     return jsonify(allowed_modules)
 

From 9a84e7979e9a69c77664b46b38a236ed2c750f9f Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Thu, 13 Apr 2023 17:56:48 +0200
Subject: [PATCH 056/209] Add a migration to inherit permissions for modules
 and objects

---
 ...d_permissions_inherited_modules_objects.py | 600 ++++++++++++++++++
 1 file changed, 600 insertions(+)
 create mode 100644 backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py

diff --git a/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py b/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py
new file mode 100644
index 0000000000..a578585954
--- /dev/null
+++ b/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py
@@ -0,0 +1,600 @@
+"""add permissions inherited modules objects
+
+Add rows in `gn_permissions.cor_role_action_filter_module_object` to keep the permissions that were previously 
+inherited from the module "GEONATURE" and the object "ALL". 
+Necessary with the removal of modules and objects inheritance in the function used to get permissions.
+
+Revision ID: 0630b93bcfe0
+Revises: cf1c1fdbde77
+Create Date: 2023-04-13 14:24:21.124669
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "0630b93bcfe0"
+down_revision = "df5a5099e084"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    """
+    Add the permissions that were computed by modules/objects inheritance
+    Remove the 'scope 0' filter
+
+    Create backup tables for the permissions, filters types and filters.
+    """
+
+    """
+    Backup permissions and filters in order to be able to downgrade
+    """
+    # Backup permissions
+    # include Foreign Keys, so that restore is eventually not broken by update/removal
+    # of any referenced role, action, filter, module or object
+    op.execute(
+        """
+        create or replace function create_backup_table(source_table text, new_table text)
+        returns void language plpgsql
+        as $$
+        declare
+            rec record;
+        begin
+            execute format(
+                'create table %s (like %s including constraints including identity including indexes)',
+                new_table, source_table);
+            for rec in
+                select oid, conname
+                from pg_constraint
+                where contype = 'f' 
+                and conrelid = source_table::regclass
+            loop
+                execute format(
+                    'alter table %s add constraint %s %s',
+                    new_table,
+                    'backup_' || rec.conname,
+                    pg_get_constraintdef(rec.oid));
+            end loop;
+            execute format(
+                'insert into %s select * from %s', 
+                new_table, source_table);
+        end $$;
+        """
+    )
+    op.execute(
+        """
+        SELECT
+        create_backup_table(
+        'gn_permissions.cor_role_action_filter_module_object',
+        'gn_permissions.backup_cor_role_action_filter_module_object'
+        );
+        """
+    )
+    op.execute(
+        """
+        SELECT
+        create_backup_table(
+        'gn_permissions.t_filters',
+        'gn_permissions.backup_t_filters'
+        );
+        """
+    )
+    op.execute(
+        """
+        SELECT
+        create_backup_table(
+        'gn_permissions.bib_filters_type',
+        'gn_permissions.backup_bib_filters_type'
+        );
+        """
+    )
+    op.execute(
+        """
+        DROP FUNCTION create_backup_table;
+        """
+    )
+    # Associate FK 'fk_backup_cor_r_a_f_m_o_id_filter' to 'backup_t_filters' instead of 't_filters'
+    # ON DELETE and ON UPDATE rules should not matter, as no modification from 'backup_t_filters' is expected
+    op.drop_constraint(
+        "backup_fk_cor_r_a_f_m_o_id_filter",
+        table_name="backup_cor_role_action_filter_module_object",
+        schema="gn_permissions",
+    )
+    op.create_foreign_key(
+        "backup_fk_cor_r_a_f_m_o_id_filter",
+        source_schema="gn_permissions",
+        source_table="backup_cor_role_action_filter_module_object",
+        local_cols=["id_filter"],
+        referent_schema="gn_permissions",
+        referent_table="backup_t_filters",
+        remote_cols=["id_filter"],
+        onupdate=None,
+        ondelete="CASCADE",
+    )
+    op.drop_constraint(
+        "backup_fk_t_filters_id_filter_type",
+        table_name="backup_t_filters",
+        schema="gn_permissions",
+    )
+    op.create_foreign_key(
+        "backup_fk_t_filters_id_filter_type",
+        source_schema="gn_permissions",
+        source_table="backup_t_filters",
+        local_cols=["id_filter_type"],
+        referent_schema="gn_permissions",
+        referent_table="backup_bib_filters_type",
+        remote_cols=["id_filter_type"],
+        onupdate=None,
+        ondelete="CASCADE",
+    )
+
+    """
+    Remove permissions with filters which are not of SCOPE type
+    """
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.cor_role_action_filter_module_object p
+        USING
+            gn_permissions.t_filters f,
+            gn_permissions.bib_filters_type t
+        WHERE
+            p.id_filter = f.id_filter
+        AND
+            f.id_filter_type = t.id_filter_type
+        AND
+            t.code_filter_type != 'SCOPE'
+        """
+    )
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_filters f
+        USING
+            gn_permissions.bib_filters_type t
+        WHERE
+            f.id_filter_type = t.id_filter_type
+        AND
+            t.code_filter_type != 'SCOPE'
+        """
+    )
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.bib_filters_type t
+        WHERE
+            t.code_filter_type != 'SCOPE'
+        """
+    )
+    """
+    Thereafter, all permissions are of SCOPE type without requiring verification
+    """
+
+    """
+    Modules inheritance:
+    
+    Inherit permissions (id_role, id_action, id_filter, _ , id_object) from module GN to other modules
+    when a permission (id_role, id_action, _ , _ , id_object) is not already specified for the other module.
+    """
+    # For permissions associated to roles which are users, and roles which are groups with no corresponding user that
+    # have a scope restriction for the permission :
+    #   by 'scope restriction' we mean a case where the permission to be inserted is
+    #   (id_role_group, id_action, id_filter_group, id_module, id_object), with id_filter_group of type 'SCOPE',
+    #   where the role id_role_user is associated to the role id_role_group and where there exists a permission
+    #   (id_role_user, id_action, id_filter_user, id_module, id_object) with id_filter_user < id_filter_group).
+    op.execute(
+        """
+        INSERT
+            INTO
+            gn_permissions.cor_role_action_filter_module_object
+                (id_role,
+                id_action,
+                id_filter,
+                id_module,
+                id_object)
+        SELECT
+                perm_gn.id_role,
+                perm_gn.id_action,
+                perm_gn.id_filter,
+                module_other.id_module,
+                perm_gn.id_object
+        FROM
+            gn_commons.t_modules module_other,
+            gn_permissions.cor_role_action_filter_module_object perm_gn
+            JOIN gn_commons.t_modules module_gn ON perm_gn.id_module = module_gn.id_module
+            JOIN utilisateurs.t_roles r ON perm_gn.id_role = r.id_role
+            JOIN gn_permissions.t_filters filter_scope_group ON perm_gn.id_filter = filter_scope_group.id_filter 
+        WHERE
+            module_gn.module_code = 'GEONATURE'
+            AND 
+            module_other.module_code != 'GEONATURE'
+            AND 
+            (
+                r.groupe IS FALSE
+                OR
+                NOT EXISTS
+                (
+                SELECT
+                    NULL
+                FROM
+                    gn_permissions.cor_role_action_filter_module_object restriction_perm_exists
+                    JOIN utilisateurs.cor_roles association_group_user 
+                        ON restriction_perm_exists.id_role = association_group_user.id_role_utilisateur
+                        AND perm_gn.id_role = association_group_user.id_role_groupe
+                    JOIN gn_permissions.t_filters filter_scope_user
+                        ON restriction_perm_exists.id_filter = filter_scope_user.id_filter
+                WHERE
+                    restriction_perm_exists.id_action = perm_gn.id_action
+                    AND
+                    restriction_perm_exists.id_module = module_other.id_module
+                    AND
+                    restriction_perm_exists.id_object = perm_gn.id_object
+                    AND
+                    filter_scope_user.value_filter::INTEGER < filter_scope_group.value_filter::INTEGER
+                )
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_exists
+            WHERE
+                perm_exists.id_role = perm_gn.id_role
+                AND 
+                perm_exists.id_action = perm_gn.id_action
+                AND 
+                perm_exists.id_module = module_other.id_module
+                AND 
+                perm_exists.id_object = perm_gn.id_object
+            )
+        ;
+        """
+    )
+    # For permissions associated to roles which are groups with at least one corresponding user that have a scope
+    # restriction for the permission
+    op.execute(
+        """
+        INSERT
+            INTO
+            gn_permissions.cor_role_action_filter_module_object
+                (id_role,
+                id_action,
+                id_filter,
+                id_module,
+                id_object)
+        SELECT
+                user_other.id_role,
+                perm_gn.id_action,
+                perm_gn.id_filter,
+                module_other.id_module,
+                perm_gn.id_object
+        FROM
+            gn_commons.t_modules module_other,
+            gn_permissions.cor_role_action_filter_module_object perm_gn
+                JOIN gn_commons.t_modules module_gn 
+                    ON perm_gn.id_module = module_gn.id_module
+                JOIN utilisateurs.t_roles role_groupe 
+                    ON perm_gn.id_role = role_groupe.id_role
+                JOIN gn_permissions.t_filters filter_scope_group 
+                    ON perm_gn.id_filter = filter_scope_group.id_filter,
+            utilisateurs.t_roles user_other
+                JOIN utilisateurs.cor_roles association_group_other_user 
+                    ON user_other.id_role = association_group_other_user.id_role_utilisateur
+        WHERE
+            module_gn.module_code = 'GEONATURE'
+            AND 
+            module_other.module_code != 'GEONATURE'
+            AND 
+            perm_gn.id_role = association_group_other_user.id_role_groupe
+            AND 
+            (
+                role_groupe.groupe IS TRUE
+                AND
+                EXISTS
+                (
+                SELECT
+                    restriction_perm_exists.id_role AS id_user_with_restriction
+                FROM
+                    gn_permissions.cor_role_action_filter_module_object restriction_perm_exists
+                    JOIN utilisateurs.cor_roles association_group_user 
+                        ON restriction_perm_exists.id_role = association_group_user.id_role_utilisateur
+                        AND perm_gn.id_role = association_group_user.id_role_groupe
+                    JOIN gn_permissions.t_filters filter_scope_user
+                        ON restriction_perm_exists.id_filter = filter_scope_user.id_filter
+                WHERE
+                    restriction_perm_exists.id_action = perm_gn.id_action
+                    AND
+                    restriction_perm_exists.id_module = module_other.id_module
+                    AND
+                    restriction_perm_exists.id_object = perm_gn.id_object
+                    AND
+                    filter_scope_user.value_filter::INTEGER < filter_scope_group.value_filter::INTEGER
+                )
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_group_exists
+            WHERE
+                perm_group_exists.id_role = perm_gn.id_role
+                AND 
+                perm_group_exists.id_action = perm_gn.id_action
+                AND 
+                perm_group_exists.id_module = module_other.id_module
+                AND 
+                perm_group_exists.id_object = perm_gn.id_object
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_user_exists
+            WHERE
+                perm_user_exists.id_role = user_other.id_role
+                AND 
+                perm_user_exists.id_action = perm_gn.id_action
+                AND 
+                perm_user_exists.id_module = module_other.id_module
+                AND 
+                perm_user_exists.id_object = perm_gn.id_object
+            )
+        ;
+        """
+    )
+
+    """
+    Objects inheritance:
+     
+    Inherit permissions (id_role, id_action, id_filter, id_module, id_object("ALL")) from object ALL to other objects
+    when the other object is associated to the module id_module in the `gn_permissions.cor_object_module`
+    and when a permission (id_role, id_action, _ , id_module, _ ) is not already specified for the other object.
+    """
+    # For permissions associated to roles which are users, and roles which are groups with no corresponding user that
+    # have a scope restriction for the permission :
+    op.execute(
+        """
+        INSERT
+            INTO
+            gn_permissions.cor_role_action_filter_module_object
+                (id_role,
+                id_action,
+                id_filter,
+                id_module,
+                id_object)
+        SELECT
+            perm_object_all.id_role,
+            perm_object_all.id_action,
+            perm_object_all.id_filter,
+            perm_object_all.id_module,
+            object_other.id_object
+        FROM
+            gn_permissions.cor_role_action_filter_module_object perm_object_all
+            JOIN gn_permissions.t_objects object_all 
+                ON perm_object_all.id_object = object_all.id_object
+            JOIN gn_permissions.cor_object_module cor_object_module 
+                ON cor_object_module.id_module = perm_object_all.id_module
+            JOIN gn_permissions.t_objects object_other 
+                ON object_other.id_object = cor_object_module.id_object
+            JOIN utilisateurs.t_roles r 
+                ON perm_object_all.id_role = r.id_role
+            JOIN gn_permissions.t_filters filter_scope_group 
+                ON perm_object_all.id_filter = filter_scope_group.id_filter
+        WHERE
+            object_all.code_object = 'ALL'
+            AND
+            object_other.code_object != 'ALL'
+            AND 
+            (
+                r.groupe IS FALSE
+                OR
+                NOT EXISTS
+                (
+                SELECT
+                    NULL
+                FROM
+                    gn_permissions.cor_role_action_filter_module_object restriction_perm_exists
+                    JOIN utilisateurs.cor_roles association_group_user 
+                        ON restriction_perm_exists.id_role = association_group_user.id_role_utilisateur
+                        AND perm_object_all.id_role = association_group_user.id_role_groupe
+                    JOIN gn_permissions.t_filters filter_scope_user
+                        ON restriction_perm_exists.id_filter = filter_scope_user.id_filter
+                WHERE
+                    restriction_perm_exists.id_action = perm_object_all.id_action
+                    AND
+                    restriction_perm_exists.id_module = perm_object_all.id_module
+                    AND
+                    restriction_perm_exists.id_object = object_other.id_object
+                    AND
+                    filter_scope_user.value_filter::INTEGER < filter_scope_group.value_filter::INTEGER
+                )
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_exists
+            WHERE
+                perm_exists.id_role = perm_object_all.id_role
+                AND 
+                perm_exists.id_action = perm_object_all.id_action
+                AND 
+                perm_exists.id_module = perm_object_all.id_module
+                AND 
+                perm_exists.id_object = object_other.id_object
+            )
+        ;
+    """
+    )
+    # For permissions associated to roles which are groups with at least one corresponding user that have a scope
+    # restriction for the permission
+    op.execute(
+        """
+        INSERT
+            INTO
+            gn_permissions.cor_role_action_filter_module_object
+                (id_role,
+                id_action,
+                id_filter,
+                id_module,
+                id_object)
+        SELECT
+            user_other.id_role,
+            perm_object_all.id_action,
+            perm_object_all.id_filter,
+            perm_object_all.id_module,
+            object_other.id_object
+        FROM
+            gn_permissions.cor_role_action_filter_module_object perm_object_all
+                JOIN gn_permissions.t_objects object_all 
+                    ON perm_object_all.id_object = object_all.id_object
+                JOIN gn_permissions.cor_object_module cor_object_module 
+                    ON cor_object_module.id_module = perm_object_all.id_module
+                JOIN gn_permissions.t_objects object_other 
+                    ON object_other.id_object = cor_object_module.id_object
+                JOIN utilisateurs.t_roles role_groupe
+                    ON perm_object_all.id_role = role_groupe.id_role
+                JOIN gn_permissions.t_filters filter_scope_group 
+                    ON perm_object_all.id_filter = filter_scope_group.id_filter,
+            utilisateurs.t_roles user_other
+                JOIN utilisateurs.cor_roles association_group_other_user 
+                    ON user_other.id_role = association_group_other_user.id_role_utilisateur
+        WHERE
+            object_all.code_object = 'ALL'
+            AND
+            object_other.code_object != 'ALL'
+            AND 
+            perm_object_all.id_role = association_group_other_user.id_role_groupe
+            AND
+            (
+                role_groupe.groupe IS TRUE
+                AND
+                EXISTS
+                (
+                SELECT
+                    restriction_perm_exists.id_role AS id_user_with_restriction
+                FROM
+                    gn_permissions.cor_role_action_filter_module_object restriction_perm_exists
+                    JOIN utilisateurs.cor_roles association_group_user 
+                        ON restriction_perm_exists.id_role = association_group_user.id_role_utilisateur
+                        AND perm_object_all.id_role = association_group_user.id_role_groupe
+                    JOIN gn_permissions.t_filters filter_scope_user
+                        ON restriction_perm_exists.id_filter = filter_scope_user.id_filter
+                WHERE
+                    restriction_perm_exists.id_action = perm_object_all.id_action
+                    AND
+                    restriction_perm_exists.id_module = perm_object_all.id_module
+                    AND
+                    restriction_perm_exists.id_object = object_other.id_object
+                    AND
+                    filter_scope_user.value_filter::INTEGER < filter_scope_group.value_filter::INTEGER
+                )
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_group_exists
+            WHERE
+                perm_group_exists.id_role = perm_object_all.id_role
+                AND 
+                perm_group_exists.id_action = perm_object_all.id_action
+                AND 
+                perm_group_exists.id_module = perm_object_all.id_module
+                AND 
+                perm_group_exists.id_object = object_other.id_object
+            )
+            AND
+            NOT EXISTS 
+            (
+            SELECT
+                NULL
+            FROM
+                gn_permissions.cor_role_action_filter_module_object perm_user_exists
+            WHERE
+                perm_user_exists.id_role = user_other.id_role
+                AND 
+                perm_user_exists.id_action = perm_object_all.id_action
+                AND 
+                perm_user_exists.id_module = perm_object_all.id_module
+                AND 
+                perm_user_exists.id_object = object_other.id_object
+            )
+        ;
+    """
+    )
+
+
+def downgrade():
+    """
+    Restore the permissions and filters from backup
+    """
+
+    # First clear existing data
+    op.execute(
+        """
+        DELETE FROM gn_permissions.cor_role_action_filter_module_object;
+        DELETE FROM gn_permissions.t_filters;
+        DELETE FROM gn_permissions.bib_filters_type;
+        """
+    )
+
+    """
+    Restore filters types from backup table
+    """
+    op.execute(
+        """
+        INSERT INTO gn_permissions.bib_filters_type
+            (id_filter_type, code_filter_type, label_filter_type, description_filter_type)
+        SELECT id_filter_type, code_filter_type, label_filter_type, description_filter_type
+        FROM gn_permissions.backup_bib_filters_type
+        """
+    )
+
+    """
+    Restore filters from backup table
+    """
+    op.execute(
+        """
+        INSERT INTO gn_permissions.t_filters 
+            (id_filter, label_filter, value_filter, description_filter, id_filter_type)
+        SELECT id_filter, label_filter, value_filter, description_filter, id_filter_type
+        FROM gn_permissions.backup_t_filters
+        """
+    )
+
+    """
+    Restore permissions from backup table
+    """
+    op.execute(
+        """
+        INSERT INTO gn_permissions.cor_role_action_filter_module_object 
+            (id_permission, id_role, id_action, id_module, id_object, id_filter)
+        SELECT id_permission, id_role, id_action, id_module, id_object, id_filter
+        FROM gn_permissions.backup_cor_role_action_filter_module_object;
+        """
+    )
+
+    """
+    Drop backup tables
+    
+    drop 'backup_t_filters' after 'backup_cor_role_action_filter_module_object' because of 
+    'fk_backup_cor_r_a_f_m_o_id_filter' referencing 'backup_t_filters'
+    """
+    op.drop_table(
+        schema="gn_permissions", table_name="backup_cor_role_action_filter_module_object"
+    )
+    op.drop_table(schema="gn_permissions", table_name="backup_t_filters")
+    op.drop_table(schema="gn_permissions", table_name="backup_bib_filters_type")

From a84b5f83cc65894c12e09367c75b74bfe1ce3519 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Fri, 21 Apr 2023 11:34:29 +0200
Subject: [PATCH 057/209] permissions: remove scope 0

All permissions with scope 0 filter are removed.
---
 ...d_permissions_inherited_modules_objects.py | 45 +++++++++++++++++++
 backend/geonature/tests/fixtures.py           |  4 +-
 backend/geonature/tests/test_permissions.py   | 10 ++---
 3 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py b/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py
index a578585954..973ad40ccb 100644
--- a/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py
+++ b/backend/geonature/migrations/versions/0630b93bcfe0_add_permissions_inherited_modules_objects.py
@@ -96,6 +96,7 @@ def upgrade():
         """
     )
     # Associate FK 'fk_backup_cor_r_a_f_m_o_id_filter' to 'backup_t_filters' instead of 't_filters'
+    # to be able to delete scope 0 from 't_filters' while keeping the associated rows in backup of permissions
     # ON DELETE and ON UPDATE rules should not matter, as no modification from 'backup_t_filters' is expected
     op.drop_constraint(
         "backup_fk_cor_r_a_f_m_o_id_filter",
@@ -536,6 +537,48 @@ def upgrade():
     """
     )
 
+    """
+    Remove scope '0'
+    """
+    # Remove associated permissions
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.cor_role_action_filter_module_object p
+        WHERE
+            id_filter = (
+                SELECT
+                    f.id_filter
+                FROM
+                    gn_permissions.t_filters f
+                JOIN
+                    gn_permissions.bib_filters_type t USING (id_filter_type)
+                WHERE
+                    t.code_filter_type = 'SCOPE'
+                    AND
+                    f.value_filter = '0'
+            )
+        """
+    )
+    # Remove filter
+    # we assume that we have 'ON DELETE NO ACTION' for 'fk_cor_r_a_f_m_o_id_filter',
+    # and thus for 'fk_backup_cor_r_a_f_m_o_id_filter, and that removal of the filter for 'scope 0' will not
+    # lead, by cascade, to a suppression of the associated permissions in the backup table of permissions.
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_filters
+        WHERE
+            id_filter_type = (
+                SELECT id_filter_type 
+                FROM gn_permissions.bib_filters_type 
+                WHERE code_filter_type = 'SCOPE'
+                )
+        AND
+            value_filter = '0'
+        """
+    )
+
 
 def downgrade():
     """
@@ -565,6 +608,8 @@ def downgrade():
 
     """
     Restore filters from backup table
+    
+    restores, in particular, the filter for scope 0
     """
     op.execute(
         """
diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 29ef4c8556..b23164d054 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -123,7 +123,7 @@ def users(app):
     }
     scope_filters = {
         scope: TFilters.query.filter(TFilters.value_filter == str(scope)).one()
-        for scope in [0, 1, 2, 3]
+        for scope in [1, 2, 3]
     }
 
     def create_user(username, organisme=None, scope=None):
@@ -165,7 +165,7 @@ def create_user(username, organisme=None, scope=None):
     db.session.add(organisme)
 
     users_to_create = [
-        ("noright_user", organisme, scope_filters[0]),
+        ("noright_user", organisme, None),
         ("stranger_user", None, scope_filters[2]),
         ("associate_user", organisme, scope_filters[2]),
         ("self_user", organisme, scope_filters[1]),
diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index a20882627e..09f17b7d4c 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -184,7 +184,7 @@ def test_no_module_no_object_specified(
         assert_cruved("r1", "000011", module=module_a)
 
     def test_group_inheritance(self, permissions, assert_cruved, module_gn, module_a):
-        permissions("g1", "0123--", module=module_a)
+        permissions("g1", "-123--", module=module_a)
 
         assert_cruved("r1", "000000")
         assert_cruved("r1", "000000", module_a)
@@ -194,13 +194,13 @@ def test_group_inheritance(self, permissions, assert_cruved, module_gn, module_a
         assert_cruved("g2_r1", "000000", module_a)
 
     def test_user_and_group_perm(self, permissions, assert_cruved, module_a):
-        permissions("g1", "0123--", module=module_a)
-        permissions("g1_r1", "1023--", module=module_a)
+        permissions("g1", "-123--", module=module_a)
+        permissions("g1_r1", "1-23--", module=module_a)
 
         assert_cruved("g1_r1", "112300", module=module_a)  # max of user and group permission
 
     def test_multi_groups_one_perm(self, permissions, assert_cruved, module_a):
-        permissions("g1", "0123--", module=module_a)
+        permissions("g1", "-123--", module=module_a)
 
         assert_cruved("g1_r1", "012300", module_a)
         assert_cruved("g12_r1", "012300", module_a)
@@ -208,7 +208,7 @@ def test_multi_groups_one_perm(self, permissions, assert_cruved, module_a):
 
     def test_multi_groups_multi_perms(self, permissions, assert_cruved, module_a):
         permissions("g1", "12131-", module=module_a)
-        permissions("g2", "0121-3", module=module_a)
+        permissions("g2", "-121-3", module=module_a)
 
         assert_cruved("g1_r1", "121310", module_a)
         assert_cruved("g2_r1", "012103", module_a)

From b2024a36f4344b2d4d74caac437b645fcab7e6fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 12 Apr 2023 18:21:49 +0200
Subject: [PATCH 058/209] permissions: multiple filters per permission

---
 backend/geonature/core/gn_commons/admin.py    |   6 +-
 .../gn_commons/models/additional_fields.py    |   6 +-
 .../geonature/core/gn_commons/models/base.py  |   2 +-
 backend/geonature/core/gn_commons/routes.py   |   1 -
 .../geonature/core/gn_permissions/models.py   | 161 ++++-----
 .../geonature/core/gn_permissions/tools.py    |  30 +-
 ...b0e4729_multiple_filters_per_permission.py | 331 ++++++++++++++++++
 backend/geonature/tests/fixtures.py           |  47 +--
 backend/geonature/tests/test_gn_commons.py    |   4 +-
 backend/geonature/tests/test_gn_meta.py       |   5 -
 backend/geonature/tests/test_permissions.py   |  32 +-
 11 files changed, 460 insertions(+), 165 deletions(-)
 create mode 100644 backend/geonature/migrations/versions/7fe46b0e4729_multiple_filters_per_permission.py

diff --git a/backend/geonature/core/gn_commons/admin.py b/backend/geonature/core/gn_commons/admin.py
index ad40ae8867..d747c9f3df 100644
--- a/backend/geonature/core/gn_commons/admin.py
+++ b/backend/geonature/core/gn_commons/admin.py
@@ -7,7 +7,7 @@
 
 from geonature.core.admin.utils import CruvedProtectedMixin
 from geonature.core.gn_commons.models import TModules
-from geonature.core.gn_permissions.models import TObjects
+from geonature.core.gn_permissions.models import PermObject
 from geonature.core.gn_commons.schemas import TAdditionalFieldsSchema
 from geonature.utils.env import DB
 
@@ -86,8 +86,8 @@ class BibFieldAdmin(CruvedProtectedMixin, ModelView):
             )
         },
         "objects": {
-            "query_factory": lambda: DB.session.query(TObjects).filter(
-                TObjects.code_object.in_(
+            "query_factory": lambda: DB.session.query(PermObject).filter(
+                PermObject.code_object.in_(
                     current_app.config["ADDITIONAL_FIELDS"]["IMPLEMENTED_OBJECTS"]
                 )
             )
diff --git a/backend/geonature/core/gn_commons/models/additional_fields.py b/backend/geonature/core/gn_commons/models/additional_fields.py
index 74bad505d7..d449da6a24 100644
--- a/backend/geonature/core/gn_commons/models/additional_fields.py
+++ b/backend/geonature/core/gn_commons/models/additional_fields.py
@@ -10,7 +10,7 @@
 
 from .base import cor_field_module, cor_field_object, cor_field_dataset
 from geonature.core.gn_meta.models import TDatasets
-from geonature.core.gn_permissions.models import TObjects
+from geonature.core.gn_permissions.models import PermObject
 
 
 @serializable
@@ -49,8 +49,8 @@ class TAdditionalFields(DB.Model):
         "TModules",
         secondary=cor_field_module,
     )
-    objects = DB.relationship("TObjects", secondary=cor_field_object)
-    datasets = DB.relationship("TDatasets", secondary=cor_field_dataset)
+    objects = DB.relationship(PermObject, secondary=cor_field_object)
+    datasets = DB.relationship(TDatasets, secondary=cor_field_dataset)
 
     def __str__(self):
         return f"{self.field_label} ({self.description})"
diff --git a/backend/geonature/core/gn_commons/models/base.py b/backend/geonature/core/gn_commons/models/base.py
index 0db72bcc13..b55432459f 100644
--- a/backend/geonature/core/gn_commons/models/base.py
+++ b/backend/geonature/core/gn_commons/models/base.py
@@ -102,7 +102,7 @@ class TModules(DB.Model):
     meta_update_date = DB.Column(DB.DateTime)
 
     objects = DB.relationship(
-        "TObjects", secondary=lambda: _resolve_import_cor_object_module(), backref="modules"
+        "PermObject", secondary=lambda: _resolve_import_cor_object_module(), backref="modules"
     )
     # relationship datasets add via backref
 
diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index 6badfdfe82..98eb005c31 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -20,7 +20,6 @@
 )
 from geonature.core.gn_commons.repositories import TMediaRepository
 from geonature.core.gn_commons.repositories import get_table_location_id
-from geonature.core.gn_permissions.models import TObjects
 from geonature.utils.env import DB, db, BACKEND_DIR
 from geonature.utils.config import config_frontend, config
 from geonature.core.gn_permissions import decorators as permissions
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index b1aa2fa363..0309a6fd1b 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -2,61 +2,60 @@
 Models of gn_permissions schema
 """
 
+import sqlalchemy as sa
 from sqlalchemy import ForeignKey
 from sqlalchemy.sql import select
+from sqlalchemy.orm import foreign
 
 from utils_flask_sqla.serializers import serializable
 from pypnusershub.db.models import User
 
-from geonature.utils.env import DB
+from geonature.utils.env import db
 
 
 @serializable
-class BibFiltersType(DB.Model):
+class PermFilterType(db.Model):
     __tablename__ = "bib_filters_type"
     __table_args__ = {"schema": "gn_permissions"}
-    id_filter_type = DB.Column(DB.Integer, primary_key=True)
-    code_filter_type = DB.Column(DB.Unicode)
-    label_filter_type = DB.Column(DB.Unicode)
-    description_filter_type = DB.Column(DB.Unicode)
+    id_filter_type = db.Column(db.Integer, primary_key=True)
+    code_filter_type = db.Column(db.Unicode)
+    label_filter_type = db.Column(db.Unicode)
+    description_filter_type = db.Column(db.Unicode)
 
 
 @serializable
-class TFilters(DB.Model):
-    __tablename__ = "t_filters"
+class PermScope(db.Model):
+    __tablename__ = "bib_filters_scope"
     __table_args__ = {"schema": "gn_permissions"}
-    id_filter = DB.Column(DB.Integer, primary_key=True)
-    value_filter = DB.Column(DB.Unicode)
-    label_filter = DB.Column(DB.Unicode)
-    description_filter = DB.Column(DB.Unicode)
-    id_filter_type = DB.Column(DB.Integer, ForeignKey(BibFiltersType.id_filter_type))
-    filter_type = DB.relationship(BibFiltersType)
+    value = db.Column(db.Integer, primary_key=True)
+    label = db.Column(db.Unicode)
+    description = db.Column(db.Unicode)
 
 
 @serializable
-class TActions(DB.Model):
-    __tablename__ = "t_actions"
+class PermAction(db.Model):
+    __tablename__ = "bib_actions"
     __table_args__ = {"schema": "gn_permissions"}
-    id_action = DB.Column(DB.Integer, primary_key=True)
-    code_action = DB.Column(DB.Unicode)
-    description_action = DB.Column(DB.Unicode)
+    id_action = db.Column(db.Integer, primary_key=True)
+    code_action = db.Column(db.Unicode)
+    description_action = db.Column(db.Unicode)
 
 
-cor_object_module = DB.Table(
+cor_object_module = db.Table(
     "cor_object_module",
-    DB.Column(
+    db.Column(
         "id_cor_object_module",
-        DB.Integer,
+        db.Integer,
         primary_key=True,
     ),
-    DB.Column(
+    db.Column(
         "id_object",
-        DB.Integer,
+        db.Integer,
         ForeignKey("gn_permissions.t_objects.id_object"),
     ),
-    DB.Column(
+    db.Column(
         "id_module",
-        DB.Integer,
+        db.Integer,
         ForeignKey("gn_commons.t_modules.id_module"),
     ),
     schema="gn_permissions",
@@ -64,78 +63,60 @@ class TActions(DB.Model):
 
 
 @serializable
-class TObjects(DB.Model):
+class PermObject(db.Model):
     __tablename__ = "t_objects"
     __table_args__ = {"schema": "gn_permissions"}
-    id_object = DB.Column(DB.Integer, primary_key=True)
-    code_object = DB.Column(DB.Unicode)
-    description_object = DB.Column(DB.Unicode)
+    id_object = db.Column(db.Integer, primary_key=True)
+    code_object = db.Column(db.Unicode)
+    description_object = db.Column(db.Unicode)
 
     def __str__(self):
         return f"{self.code_object} ({self.description_object})"
 
 
-@serializable
-class CorRoleActionFilterModuleObject(DB.Model):
-    __tablename__ = "cor_role_action_filter_module_object"
-    __table_args__ = {"schema": "gn_permissions"}
-    id_permission = DB.Column(DB.Integer, primary_key=True)
-    id_role = DB.Column(DB.Integer, ForeignKey("utilisateurs.t_roles.id_role"))
-    id_action = DB.Column(DB.Integer, ForeignKey("gn_permissions.t_actions.id_action"))
-    id_filter = DB.Column(DB.Integer, ForeignKey("gn_permissions.t_filters.id_filter"))
-    id_module = DB.Column(DB.Integer, ForeignKey("gn_commons.t_modules.id_module"))
-    id_object = DB.Column(
-        DB.Integer,
-        ForeignKey("gn_permissions.t_objects.id_object"),
-        default=select([TObjects.id_object]).where(TObjects.code_object == "ALL"),
-    )
-
-    role = DB.relationship(User, primaryjoin=(User.id_role == id_role), foreign_keys=[id_role])
+# compat.
+TObjects = PermObject
 
-    action = DB.relationship(
-        TActions,
-        primaryjoin=(TActions.id_action == id_action),
-        foreign_keys=[id_action],
-    )
 
-    filter = DB.relationship(
-        TFilters,
-        primaryjoin=(TFilters.id_filter == id_filter),
-        foreign_keys=[id_filter],
+@serializable
+class Permission(db.Model):
+    __tablename__ = "t_permissions"
+    __table_args__ = {"schema": "gn_permissions"}
+    id_permission = db.Column(db.Integer, primary_key=True)
+    id_role = db.Column(db.Integer, ForeignKey("utilisateurs.t_roles.id_role"))
+    id_action = db.Column(db.Integer, ForeignKey(PermAction.id_action))
+    id_module = db.Column(db.Integer, ForeignKey("gn_commons.t_modules.id_module"))
+    id_object = db.Column(
+        db.Integer,
+        ForeignKey(PermObject.id_object),
+        default=select([PermObject.id_object]).where(PermObject.code_object == "ALL"),
     )
 
-    module = DB.relationship("TModules")
-    object = DB.relationship("TObjects")
-
-    def is_permission_already_exist(
-        self, id_role, id_action, id_module, id_filter_type, id_object=1
-    ):
-        """
-        Tell if a permission exist for a user, an action, a module and a filter_type
-        Return:
-            A CorRoleActionFilterModuleObject if exist or None
-        """
-        privilege = {
-            "id_role": id_role,
-            "id_action": id_action,
-            "id_module": id_module,
-            "id_object": id_object,
-        }
-        return (
-            DB.session.query(CorRoleActionFilterModuleObject)
-            .filter_by(**privilege)
-            .join(TFilters, TFilters == CorRoleActionFilterModuleObject.id_filter)
-            .join(BibFiltersType, BibFiltersType.id_filter_type == TFilters.id_filter)
-            .filter(BibFiltersType.id_filter_type == id_filter_type)
-            .first()
-        )
-
-    def __str__(self):
-        return (
-            f"Permission("
-            f"id_role={self.id_role},"
-            f"action={self.action},"
-            f"filter={self.filter},"
-            f"module={self.module},"
-            f"object={self.object})"
-        )
+    role = db.relationship(User)
+    action = db.relationship(PermAction)
+    module = db.relationship("TModules")
+    object = db.relationship(PermObject)
+
+    scope_value = db.Column(db.Integer, ForeignKey(PermScope.value), nullable=True)
+    scope = db.relationship(PermScope)
+
+    filters_fields = {
+        "SCOPE": scope_value,
+    }
+
+    def has_other_filters_than(self, *expected_filters):
+        for name, field in self.filters_fields.items():
+            if name in expected_filters:
+                continue  # this filter is expected, defined or not
+            # for unexpected filters, return True if filter is set
+            value = getattr(self, field.name)
+            if field.nullable:
+                # for nullable field, consider filter in use if not None
+                if value is not None:
+                    return True
+            else:
+                # for non-nullable field, consider filter in use if value evaluate as True
+                # XXX may not be appropriate for futur non bool filters
+                if value:
+                    return True
+        return False
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index c97e9747b5..7da07882e1 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -6,10 +6,10 @@
 
 from geonature.core.gn_commons.models import TModules
 from geonature.core.gn_permissions.models import (
-    CorRoleActionFilterModuleObject,
-    TFilters,
-    TActions,
-    TObjects,
+    PermAction,
+    PermObject,
+    PermScope,
+    Permission,
 )
 from geonature.utils.env import db
 
@@ -18,22 +18,19 @@
 
 def _get_user_permissions(id_role):
     return (
-        CorRoleActionFilterModuleObject.query.options(
-            joinedload(CorRoleActionFilterModuleObject.action),
-            joinedload(CorRoleActionFilterModuleObject.filter).joinedload(TFilters.filter_type),
+        Permission.query.options(
+            joinedload(Permission.action),
         )
         .filter(
             sa.or_(
                 # direct permissions
-                CorRoleActionFilterModuleObject.id_role == id_role,
+                Permission.id_role == id_role,
                 # permissions through group
-                CorRoleActionFilterModuleObject.role.has(
-                    User.members.any(User.id_role == id_role)
-                ),
+                Permission.role.has(User.members.any(User.id_role == id_role)),
             ),
         )
         # These ordering ensure groupby is working properly
-        .order_by(CorRoleActionFilterModuleObject.id_action)
+        .order_by(Permission.id_action)
         .all()
     )
 
@@ -41,7 +38,7 @@ def _get_user_permissions(id_role):
 def _get_user_permissions_by_action(id_role):
     permissions = _get_user_permissions(id_role)
     # This ensures empty permissions list for action without permissions
-    permissions_by_action = {action.code_action: [] for action in TActions.query.all()}
+    permissions_by_action = {action.code_action: [] for action in PermAction.query.all()}
     # Note: groupby require sorted data, which is done at SQL level
     permissions_by_action.update(
         {
@@ -106,9 +103,12 @@ def get_scope(action_code, id_role=None, module_code=None, object_code=None):
     permissions = get_permissions(action_code, id_role, module_code, object_code)
     max_scope = 0
     for permission in permissions:
-        if permission.filter.filter_type.code_filter_type != "SCOPE":
+        if permission.has_other_filters_than("SCOPE"):
             continue
-        max_scope = max(max_scope, int(permission.filter.value_filter))
+        if permission.scope_value is None:
+            max_scope = 3
+        else:
+            max_scope = max(max_scope, permission.scope_value)
     return max_scope
 
 
diff --git a/backend/geonature/migrations/versions/7fe46b0e4729_multiple_filters_per_permission.py b/backend/geonature/migrations/versions/7fe46b0e4729_multiple_filters_per_permission.py
new file mode 100644
index 0000000000..7566a7f027
--- /dev/null
+++ b/backend/geonature/migrations/versions/7fe46b0e4729_multiple_filters_per_permission.py
@@ -0,0 +1,331 @@
+"""multiple filters per permission
+
+Revision ID: 7fe46b0e4729
+Revises: cf1c1fdbde77
+Create Date: 2023-04-12 14:38:44.788935
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy import Column, ForeignKey, Integer, Unicode
+from sqlalchemy.types import ARRAY
+
+
+# revision identifiers, used by Alembic.
+revision = "7fe46b0e4729"
+down_revision = "0630b93bcfe0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # Remove unused table
+    op.drop_table(schema="gn_permissions", table_name="cor_filter_type_module")
+
+    # Rename tables with better names
+    op.rename_table(
+        schema="gn_permissions", old_table_name="t_actions", new_table_name="bib_actions"
+    )
+    op.rename_table(
+        schema="gn_permissions",
+        old_table_name="cor_role_action_filter_module_object",
+        new_table_name="t_permissions",
+    )
+
+    # Remove triggers
+    op.execute("DROP TRIGGER tri_check_no_multiple_scope_perm ON gn_permissions.t_permissions")
+    op.execute("DROP FUNCTION gn_permissions.fct_tri_does_user_have_already_scope_filter()")
+
+    # Remove SCOPE '3' as equivalent to no filters
+    op.alter_column(
+        schema="gn_permissions",
+        table_name="t_permissions",
+        column_name="id_filter",
+        nullable=True,
+    )
+    op.execute(
+        """
+        UPDATE
+            gn_permissions.t_permissions
+        SET
+            id_filter = NULL
+        WHERE
+            id_filter = (
+                SELECT
+                    f.id_filter
+                FROM
+                    gn_permissions.t_filters f
+                JOIN
+                    gn_permissions.bib_filters_type t USING (id_filter_type)
+                WHERE
+                    t.code_filter_type = 'SCOPE'
+                AND
+                    f.value_filter = '3'
+            )
+        """
+    )
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_filters
+        WHERE
+            id_filter_type = (SELECT id_filter_type FROM gn_permissions.bib_filters_type WHERE code_filter_type = 'SCOPE')
+        AND
+            value_filter = '3'
+        """
+    )
+
+    # Migrate t_permissions.id_filter to t_permissions.filter_scope
+    op.create_table(
+        "bib_filters_scope",
+        Column("value", Integer, primary_key=True),
+        Column("label", Unicode),
+        Column("description", Unicode),
+        schema="gn_permissions",
+    )
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.bib_filters_scope (
+                value,
+                label,
+                description
+            )
+        SELECT
+            f.value_filter::int,
+            f.label_filter,
+            f.description_filter
+        FROM
+            gn_permissions.t_filters f
+        JOIN
+            gn_permissions.bib_filters_type t USING (id_filter_type)
+        WHERE
+            t.code_filter_type = 'SCOPE'
+        """
+    )
+    op.add_column(
+        schema="gn_permissions",
+        table_name="t_permissions",
+        column=Column(
+            "scope_value",
+            Integer,
+            ForeignKey("gn_permissions.bib_filters_scope.value"),
+            nullable=True,
+        ),
+    )
+    op.execute(
+        """
+        UPDATE
+            gn_permissions.t_permissions p
+        SET
+            scope_value = s.value
+        FROM
+            gn_permissions.t_filters f
+        JOIN
+            gn_permissions.bib_filters_scope s ON s.value = f.value_filter::int
+        JOIN
+            gn_permissions.bib_filters_type t ON t.id_filter_type = f.id_filter_type
+        WHERE
+            t.code_filter_type = 'SCOPE'
+        AND
+            p.id_filter = f.id_filter
+        """
+    )
+    op.drop_column(schema="gn_permissions", table_name="t_permissions", column_name="id_filter")
+    op.drop_table(schema="gn_permissions", table_name="t_filters")
+
+
+def downgrade():
+    op.create_table(
+        "t_filters",
+        Column("id_filter", Integer, primary_key=True),
+        Column("label_filter", Unicode(255)),
+        Column("value_filter", Unicode),
+        Column("description_filter", Unicode),
+        Column(
+            "id_filter_type",
+            Integer,
+            ForeignKey(
+                "gn_permissions.bib_filters_type.id_filter_type",
+                name="fk_t_filters_id_filter_type",
+            ),
+        ),
+        schema="gn_permissions",
+    )
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_filters (
+                label_filter,
+                value_filter,
+                description_filter,
+                id_filter_type
+            )
+        SELECT
+            s.label,
+            s.value::varchar,
+            s.description,
+            t.id_filter_type
+        FROM
+            gn_permissions.bib_filters_scope s
+        JOIN
+            gn_permissions.bib_filters_type t ON t.code_filter_type = 'SCOPE'
+        """
+    )
+    op.add_column(
+        schema="gn_permissions",
+        table_name="t_permissions",
+        column=Column(
+            "id_filter",
+            Integer,
+            ForeignKey("gn_permissions.t_filters.id_filter", name="fk_cor_r_a_f_m_o_id_filter"),
+            nullable=True,
+        ),
+    )
+    # Copy scope_value into id_filter
+    op.execute(
+        """
+        UPDATE
+            gn_permissions.t_permissions p
+        SET
+            id_filter = f.id_filter
+        FROM (
+            SELECT
+                p.id_permission,
+                f.id_filter
+            FROM
+                gn_permissions.t_permissions p
+            JOIN
+                gn_permissions.bib_filters_scope s ON p.scope_value = s.value
+            JOIN
+                gn_permissions.t_filters f ON f.value_filter::int = s.value
+            JOIN
+                gn_permissions.bib_filters_type t ON t.id_filter_type = f.id_filter_type
+            WHERE
+                t.code_filter_type = 'SCOPE'
+            AND
+                p.scope_value IS NOT NULL
+        ) f
+        WHERE
+            p.id_permission = f.id_permission
+        """
+    )
+    op.drop_column(schema="gn_permissions", table_name="t_permissions", column_name="scope_value")
+    op.drop_table(schema="gn_permissions", table_name="bib_filters_scope")
+    # Set SCOPE=3 for permissions without any filters
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_filters (id_filter_type, label_filter, value_filter, description_filter)
+        VALUES (
+            (SELECT id_filter_type FROM gn_permissions.bib_filters_type WHERE code_filter_type = 'SCOPE'),
+            'Toutes les données',
+            '3',
+            'Toutes les données'
+        )
+        """
+    )
+    op.execute(
+        """
+        UPDATE
+            gn_permissions.t_permissions p
+        SET
+            id_filter = (
+                SELECT
+                    f.id_filter
+                FROM
+                    gn_permissions.t_filters f
+                JOIN
+                    gn_permissions.bib_filters_type t USING (id_filter_type)
+                WHERE
+                    t.code_filter_type = 'SCOPE'
+                AND
+                    f.value_filter = '3'
+           )
+        WHERE
+            id_filter IS NULL
+        """
+    )
+    op.alter_column(
+        schema="gn_permissions",
+        table_name="t_permissions",
+        column_name="id_filter",
+        nullable=False,
+    )
+    # op.drop_table(schema="gn_permissions", table_name="t_filters")
+    op.execute(
+        """
+        CREATE FUNCTION gn_permissions.fct_tri_does_user_have_already_scope_filter()
+         RETURNS trigger
+         LANGUAGE plpgsql
+        AS $function$
+        -- Check if a role has already a SCOPE permission for an action/module/object
+        -- use in constraint to force not set multiple scope permission on the same action/module/object
+        DECLARE
+        the_code_filter_type character varying;
+        the_nb_permission integer;
+        BEGIN
+         SELECT INTO the_code_filter_type bib.code_filter_type
+         FROM gn_permissions.t_filters f
+         JOIN gn_permissions.bib_filters_type bib ON bib.id_filter_type = f.id_filter_type
+         WHERE f.id_filter = NEW.id_filter
+        ;
+        -- if the filter type is NOT SCOPE, its OK to set multiple permissions
+        IF the_code_filter_type != 'SCOPE' THEN
+        RETURN NEW;
+        -- if the new filter is 'SCOPE TYPE', check if there is not already a permission for this
+        -- action/module/object/role
+        ELSE
+            SELECT INTO the_nb_permission count(perm.id_permission)
+            FROM gn_permissions.cor_role_action_filter_module_object perm
+            JOIN gn_permissions.t_filters f ON f.id_filter = perm.id_filter
+            JOIN gn_permissions.bib_filters_type bib ON bib.id_filter_type = f.id_filter_type AND bib.code_filter_type = 'SCOPE'
+            WHERE id_role=NEW.id_role AND id_action=NEW.id_action AND id_module=NEW.id_module AND id_object=NEW.id_object;
+
+         -- if its an insert 0 row must be present, if its an update 1 row must be present
+          IF(TG_OP = 'INSERT' AND the_nb_permission = 0) OR (TG_OP = 'UPDATE' AND the_nb_permission = 1) THEN
+                RETURN NEW;
+            END IF;
+            BEGIN
+                RAISE EXCEPTION 'ATTENTION: il existe déjà un enregistrement de type SCOPE pour le role % l''action % sur le module % et l''objet % . Il est interdit de définir plusieurs portées à un role pour le même action sur un module et un objet', NEW.id_role, NEW.id_action, NEW.id_module, NEW.id_object ;
+            END;
+
+
+        END IF;
+
+        END;
+
+        $function$
+        ;
+        """
+    )
+    op.execute(
+        """
+        CREATE TRIGGER tri_check_no_multiple_scope_perm
+        BEFORE INSERT OR UPDATE
+        ON gn_permissions.t_permissions
+        FOR EACH ROW
+        EXECUTE PROCEDURE gn_permissions.fct_tri_does_user_have_already_scope_filter()
+        """
+    )
+    op.rename_table(
+        schema="gn_permissions",
+        old_table_name="t_permissions",
+        new_table_name="cor_role_action_filter_module_object",
+    )
+    op.rename_table(
+        schema="gn_permissions", old_table_name="bib_actions", new_table_name="t_actions"
+    )
+    op.create_table(
+        "cor_filter_type_module",
+        Column(
+            "id_filter_type",
+            Integer,
+            ForeignKey("gn_permissions.bib_filters_type.id_filter_type"),
+            primary_key=True,
+        ),
+        Column(
+            "id_module", Integer, ForeignKey("gn_commons.t_modules.id_module"), primary_key=True
+        ),
+        schema="gn_permissions",
+    )
diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index b23164d054..231e9096da 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -13,11 +13,10 @@
 from geonature import create_app
 from geonature.utils.env import db
 from geonature.core.gn_permissions.models import (
-    TActions,
-    TFilters,
-    BibFiltersType,
-    CorRoleActionFilterModuleObject,
-    TObjects,
+    PermFilterType,
+    PermAction,
+    PermObject,
+    Permission,
 )
 from geonature.core.gn_commons.models import TModules, TMedias, BibTablesLocation
 from geonature.core.gn_meta.models import (
@@ -89,15 +88,13 @@ def module(users):
         db.session.add(new_module)
     # Copy perission from another module
     with db.session.begin_nested():
-        for perm in CorRoleActionFilterModuleObject.query.filter_by(
-            id_module=other_module.id_module
-        ):
-            new_perm = CorRoleActionFilterModuleObject(
+        for perm in Permission.query.filter_by(id_module=other_module.id_module):
+            new_perm = Permission(
                 id_role=perm.id_role,
                 id_action=perm.id_action,
-                id_filter=perm.id_filter,
                 id_module=new_module.id_module,
                 id_object=perm.id_object,
+                scope_value=perm.scope_value,
             )
             db.session.add(new_perm)
     return new_module
@@ -106,7 +103,7 @@ def module(users):
 @pytest.fixture(scope="function")
 def perm_object():
     with db.session.begin_nested():
-        new_object = TObjects(code_object="TEST_OBJECT")
+        new_object = PermObject(code_object="TEST_OBJECT")
         db.session.add(new_object)
     return new_object
 
@@ -118,13 +115,7 @@ def users(app):
 
     modules = TModules.query.all()
 
-    actions = {
-        code: TActions.query.filter(TActions.code_action == code).one() for code in "CRUVED"
-    }
-    scope_filters = {
-        scope: TFilters.query.filter(TFilters.value_filter == str(scope)).one()
-        for scope in [1, 2, 3]
-    }
+    actions = {code: PermAction.query.filter_by(code_action=code).one() for code in "CRUVED"}
 
     def create_user(username, organisme=None, scope=None):
         # do not commit directly on current transaction, as we want to rollback all changes at the end of tests
@@ -144,17 +135,17 @@ def create_user(username, organisme=None, scope=None):
                 id_role=user.id_role, id_application=app.id_application, id_profil=profil.id_profil
             )
             db.session.add(right)
-            object_all = TObjects.query.filter_by(code_object="ALL").one()
-            if scope:
+            if scope > 0:
+                object_all = PermObject.query.filter_by(code_object="ALL").one()
                 for action in actions.values():
                     for module in modules:
                         for obj in [object_all] + module.objects:
-                            permission = CorRoleActionFilterModuleObject(
+                            permission = Permission(
                                 role=user,
                                 action=action,
-                                filter=scope,
                                 module=module,
                                 object=obj,
+                                scope_value=scope if scope != 3 else None,
                             )
                             db.session.add(permission)
         return user
@@ -165,12 +156,12 @@ def create_user(username, organisme=None, scope=None):
     db.session.add(organisme)
 
     users_to_create = [
-        ("noright_user", organisme, None),
-        ("stranger_user", None, scope_filters[2]),
-        ("associate_user", organisme, scope_filters[2]),
-        ("self_user", organisme, scope_filters[1]),
-        ("user", organisme, scope_filters[2]),
-        ("admin_user", organisme, scope_filters[3]),
+        ("noright_user", organisme, 0),
+        ("stranger_user", None, 2),
+        ("associate_user", organisme, 2),
+        ("self_user", organisme, 1),
+        ("user", organisme, 2),
+        ("admin_user", organisme, 3),
     ]
 
     for username, *args in users_to_create:
diff --git a/backend/geonature/tests/test_gn_commons.py b/backend/geonature/tests/test_gn_commons.py
index 95a617b09d..ccd3fed645 100644
--- a/backend/geonature/tests/test_gn_commons.py
+++ b/backend/geonature/tests/test_gn_commons.py
@@ -15,7 +15,7 @@
 from geonature.core.gn_commons.models.base import TModules, TParameters, BibWidgets
 from geonature.core.gn_commons.repositories import TMediaRepository
 from geonature.core.gn_commons.tasks import clean_attachments
-from geonature.core.gn_permissions.models import TObjects
+from geonature.core.gn_permissions.models import PermObject
 from geonature.utils.env import db
 from geonature.utils.errors import GeoNatureError
 
@@ -34,7 +34,7 @@ def place(users):
 @pytest.fixture(scope="function")
 def additional_field(app, datasets):
     module = TModules.query.filter(TModules.module_code == "SYNTHESE").one()
-    obj = TObjects.query.filter(TObjects.code_object == "ALL").one()
+    obj = PermObject.query.filter(PermObject.code_object == "ALL").one()
     datasets = list(datasets.values())
     additional_field = TAdditionalFields(
         field_name="test",
diff --git a/backend/geonature/tests/test_gn_meta.py b/backend/geonature/tests/test_gn_meta.py
index caab645a6a..68ce813dca 100644
--- a/backend/geonature/tests/test_gn_meta.py
+++ b/backend/geonature/tests/test_gn_meta.py
@@ -21,11 +21,6 @@
     TDatasets,
 )
 from geonature.core.gn_meta.routes import get_af_from_id
-from geonature.core.gn_permissions.models import (
-    CorRoleActionFilterModuleObject,
-    TActions,
-    TFilters,
-)
 from geonature.core.gn_synthese.models import Synthese
 from geonature.utils.env import db
 
diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index 09f17b7d4c..2ceded2fb0 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -5,11 +5,10 @@
 
 from geonature.core.gn_commons.models import TModules
 from geonature.core.gn_permissions.models import (
-    TObjects,
-    TFilters,
-    TActions,
-    BibFiltersType,
-    CorRoleActionFilterModuleObject as Permission,
+    PermObject,
+    PermAction,
+    PermFilterType,
+    Permission,
 )
 from geonature.core.gn_permissions.tools import get_scopes_by_action
 from geonature.utils.env import db
@@ -19,13 +18,7 @@
 
 @pytest.fixture(scope="class")
 def actions():
-    return {action.code_action: action for action in TActions.query.all()}
-
-
-@pytest.fixture(scope="class")
-def scopes():
-    scope_type = BibFiltersType.query.filter_by(code_filter_type="SCOPE").one()
-    return {f.value_filter: f for f in TFilters.query.filter_by(filter_type=scope_type).all()}
+    return {action.code_action: action for action in PermAction.query.all()}
 
 
 def create_module(label):
@@ -45,18 +38,18 @@ def module_gn():
 
 @pytest.fixture(scope="class")
 def object_all():
-    return TObjects.query.filter_by(code_object="ALL").one()
+    return PermObject.query.filter_by(code_object="ALL").one()
 
 
 @pytest.fixture(scope="class")
 def object_a():
-    obj = TObjects(code_object="object_a")
+    obj = PermObject(code_object="object_a")
     return obj
 
 
 @pytest.fixture(scope="class")
 def object_b():
-    obj = TObjects(code_object="object_b")
+    obj = PermObject(code_object="object_b")
     return obj
 
 
@@ -119,18 +112,23 @@ def cruved_dict(scopes):
 
 
 @pytest.fixture()
-def permissions(roles, groups, actions, scopes, module_gn):
+def permissions(roles, groups, actions, module_gn):
     roles = ChainMap(roles, groups)
 
     def _permissions(role, cruved, *, module=module_gn, **kwargs):
         role = roles[role]
+        scope_type = PermFilterType.query.filter_by(code_filter_type="SCOPE").one()
         with db.session.begin_nested():
             for a, s in zip("CRUVED", cruved):
                 if s == "-":
                     continue
+                elif s == "3":
+                    s = None
+                else:
+                    s = int(s)
                 db.session.add(
                     Permission(
-                        role=role, action=actions[a], filter=scopes[s], module=module, **kwargs
+                        role=role, action=actions[a], module=module, scope_value=s, **kwargs
                     )
                 )
 

From de88a8c03805fee1c96ab25c7ce39e02c1aaab64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Fri, 14 Apr 2023 15:47:37 +0200
Subject: [PATCH 059/209] permissions: add flask-admin

---
 backend/geonature/core/admin/__init__.py      |  1 +
 .../geonature/core/gn_permissions/admin.py    | 57 +++++++++++++++++++
 .../geonature/core/gn_permissions/models.py   |  6 ++
 3 files changed, 64 insertions(+)
 create mode 100644 backend/geonature/core/gn_permissions/admin.py

diff --git a/backend/geonature/core/admin/__init__.py b/backend/geonature/core/admin/__init__.py
index e69de29bb2..c31328c68b 100644
--- a/backend/geonature/core/admin/__init__.py
+++ b/backend/geonature/core/admin/__init__.py
@@ -0,0 +1 @@
+import geonature.core.gn_permissions.admin
diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
new file mode 100644
index 0000000000..01f19b80a5
--- /dev/null
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -0,0 +1,57 @@
+from flask_admin.contrib.sqla import ModelView
+
+from geonature.utils.env import db
+from geonature.core.admin.admin import admin
+from geonature.core.admin.utils import CruvedProtectedMixin
+from geonature.core.gn_permissions.models import PermObject, Permission
+
+
+class ObjectAdmin(CruvedProtectedMixin, ModelView):
+    module_code = "ADMIN"
+    object_code = "PERMISSIONS"
+
+    column_list = ("code_object", "description_object", "modules")
+    column_labels = {
+        "code_object": "Code",
+        "description_object": "Description",
+    }
+
+    can_create = False
+    can_edit = False
+    can_delete = False
+
+
+class PermissionAdmin(CruvedProtectedMixin, ModelView):
+    module_code = "ADMIN"
+    object_code = "PERMISSIONS"
+
+    column_list = ("role", "module", "object", "action", "scope")
+    column_labels = {
+        "role": "Rôle",
+        "scope": "Porté",
+        "object": "Objet",
+    }
+    column_formatters = {
+        "module": lambda v, c, m, p: m.module.module_code,
+        "object": lambda v, c, m, p: m.object.code_object,
+    }
+
+
+admin.add_view(
+    ObjectAdmin(
+        PermObject,
+        db.session,
+        name="Objets",
+        category="Permissions",
+    )
+)
+
+
+admin.add_view(
+    PermissionAdmin(
+        Permission,
+        db.session,
+        name="Permissions",
+        category="Permissions",
+    )
+)
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 0309a6fd1b..4f84ddf453 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -31,6 +31,9 @@ class PermScope(db.Model):
     label = db.Column(db.Unicode)
     description = db.Column(db.Unicode)
 
+    def __str__(self):
+        return self.description
+
 
 @serializable
 class PermAction(db.Model):
@@ -40,6 +43,9 @@ class PermAction(db.Model):
     code_action = db.Column(db.Unicode)
     description_action = db.Column(db.Unicode)
 
+    def __str__(self):
+        return self.description_action
+
 
 cor_object_module = db.Table(
     "cor_object_module",

From 969a1a0a0792bfbfc729b81b03c955308a79a749 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Fri, 14 Apr 2023 18:13:48 +0200
Subject: [PATCH 060/209] declaration of available permissions

And so, for each (module, object, action).
Thus, indicates if scope filter is supported.
---
 .../geonature/core/gn_permissions/admin.py    |  27 +++-
 .../geonature/core/gn_permissions/models.py   |  34 +++++
 .../f051b88a57fd_permissions_available.py     | 138 ++++++++++++++++++
 3 files changed, 198 insertions(+), 1 deletion(-)
 create mode 100644 backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 01f19b80a5..caaa2dab2a 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -3,7 +3,7 @@
 from geonature.utils.env import db
 from geonature.core.admin.admin import admin
 from geonature.core.admin.utils import CruvedProtectedMixin
-from geonature.core.gn_permissions.models import PermObject, Permission
+from geonature.core.gn_permissions.models import PermObject, Permission, PermissionAvailable
 
 
 class ObjectAdmin(CruvedProtectedMixin, ModelView):
@@ -37,6 +37,21 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
     }
 
 
+class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
+    module_code = "ADMIN"
+    object_code = "PERMISSIONS"
+
+    column_labels = {
+        "scope": "Portée",
+        "object": "Objet",
+        "scope_filter": "Filtre appartenance",
+    }
+    column_formatters = {
+        "module": lambda v, c, m, p: m.module.module_code,
+        "object": lambda v, c, m, p: m.object.code_object,
+    }
+
+
 admin.add_view(
     ObjectAdmin(
         PermObject,
@@ -55,3 +70,13 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         category="Permissions",
     )
 )
+
+
+admin.add_view(
+    PermissionAvailableAdmin(
+        PermissionAvailable,
+        db.session,
+        name="Permissions disponibles",
+        category="Permissions",
+    )
+)
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 4f84ddf453..8a23a981c0 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -84,6 +84,31 @@ def __str__(self):
 TObjects = PermObject
 
 
+class PermissionAvailable(db.Model):
+    __tablename__ = "t_permissions_available"
+    __table_args__ = {"schema": "gn_permissions"}
+    id_module = db.Column(
+        db.Integer, ForeignKey("gn_commons.t_modules.id_module"), primary_key=True
+    )
+    id_object = db.Column(
+        db.Integer,
+        ForeignKey(PermObject.id_object),
+        default=select([PermObject.id_object]).where(PermObject.code_object == "ALL"),
+        primary_key=True,
+    )
+    id_action = db.Column(db.Integer, ForeignKey(PermAction.id_action), primary_key=True)
+    label = db.Column(db.Unicode)
+
+    module = db.relationship("TModules")
+    object = db.relationship(PermObject)
+    action = db.relationship(PermAction)
+
+    scope_filter = db.Column(db.Boolean, server_default=sa.false())
+
+    def __str__(self):
+        return self.label
+
+
 @serializable
 class Permission(db.Model):
     __tablename__ = "t_permissions"
@@ -106,6 +131,15 @@ class Permission(db.Model):
     scope_value = db.Column(db.Integer, ForeignKey(PermScope.value), nullable=True)
     scope = db.relationship(PermScope)
 
+    availability = db.relationship(
+        PermissionAvailable,
+        primaryjoin=sa.and_(
+            foreign(id_module) == PermissionAvailable.id_module,
+            foreign(id_object) == PermissionAvailable.id_object,
+            foreign(id_action) == PermissionAvailable.id_action,
+        ),
+    )
+
     filters_fields = {
         "SCOPE": scope_value,
     }
diff --git a/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
new file mode 100644
index 0000000000..abca0ba106
--- /dev/null
+++ b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
@@ -0,0 +1,138 @@
+"""permissions available
+
+Revision ID: f051b88a57fd
+Revises: 7fe46b0e4729
+Create Date: 2023-04-14 17:19:36.490766
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.types import Integer, Boolean, Unicode
+
+
+# revision identifiers, used by Alembic.
+revision = "f051b88a57fd"
+down_revision = "7fe46b0e4729"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "t_permissions_available",
+        sa.Column(
+            "id_module",
+            Integer,
+            sa.ForeignKey("gn_commons.t_modules.id_module"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "id_object",
+            Integer,
+            sa.ForeignKey("gn_permissions.t_objects.id_object"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "id_action",
+            Integer,
+            sa.ForeignKey("gn_permissions.bib_actions.id_action"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "label",
+            Unicode,
+        ),
+        sa.Column(
+            "scope_filter",
+            Boolean,
+            server_default=sa.false(),
+        ),
+        schema="gn_permissions",
+    )
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     ('ADMIN', 'PERMISSIONS', 'C', False, 'Créer des permissions')
+                    ,('ADMIN', 'PERMISSIONS', 'R', False, 'Voir les permissions')
+                    ,('ADMIN', 'PERMISSIONS', 'U', False, 'Modifier les permissions')
+                    ,('ADMIN', 'PERMISSIONS', 'E', False, 'Exporter les permissions')
+                    ,('ADMIN', 'PERMISSIONS', 'D', False, 'Supprimer des permissions')
+                    ,('ADMIN', 'NOMENCLATURES', 'C', False, 'Créer des nomenclatures')
+                    ,('ADMIN', 'NOMENCLATURES', 'R', False, 'Voir les nomenclatures')
+                    ,('ADMIN', 'NOMENCLATURES', 'U', False, 'Modifier les nomenclatures')
+                    ,('ADMIN', 'NOMENCLATURES', 'E', False, 'Exporter les nomenclatures')
+                    ,('ADMIN', 'NOMENCLATURES', 'D', False, 'Supprimer des nomenclatures')
+                    ,('ADMIN', 'NOTIFICATIONS', 'C', False, 'Créer des entrées dans l’administration des notifications')
+                    ,('ADMIN', 'NOTIFICATIONS', 'R', False, 'Voir les entrées dans l’administration des notifications')
+                    ,('ADMIN', 'NOTIFICATIONS', 'U', False, 'Modifier des entrées dans l’administration des notifications')
+                    ,('ADMIN', 'NOTIFICATIONS', 'E', False, 'Exporter les entrées dans l’administration des notifications')
+                    ,('ADMIN', 'NOTIFICATIONS', 'D', False, 'Supprimer des entrées dans l’administration des notifications')
+                    ,('ADMIN', 'ADDITIONAL_FIELDS', 'C', False, 'Créer des champs additionnels')
+                    ,('ADMIN', 'ADDITIONAL_FIELDS', 'R', False, 'Voir les champs additionnels')
+                    ,('ADMIN', 'ADDITIONAL_FIELDS', 'U', False, 'Modifier les champs additionnels')
+                    ,('ADMIN', 'ADDITIONAL_FIELDS', 'E', False, 'Exporter les champs additionnels')
+                    ,('ADMIN', 'ADDITIONAL_FIELDS', 'D', False, 'Supprimer des champs additionnels')
+                    ,('METADATA', 'ALL', 'C', False, 'Créer des métadonnées')
+                    ,('METADATA', 'ALL', 'R', True, 'Voir les métadonnées')
+                    ,('METADATA', 'ALL', 'U', True, 'Modifier les métadonnées')
+                    ,('METADATA', 'ALL', 'D', True, 'Supprimer des métadonnées')
+                    ,('SYNTHESE', 'ALL', 'R', True, 'Voir les observations')
+                    ,('SYNTHESE', 'ALL', 'E', True, 'Exporter les observations')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code
+        """
+    )
+    op.execute(
+        """
+        WITH bad_permissions AS (
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_commons.t_modules m
+                    USING (id_module)
+            WHERE
+                m.module_code IN ('GEONATURE', 'ADMIN', 'METADATA', 'SYNTHESE')
+            EXCEPT
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_permissions.t_permissions_available pa ON
+                (p.id_module = pa.id_module
+                    AND p.id_object = pa.id_object
+                    AND p.id_action = pa.id_action)
+        )
+        DELETE
+        FROM
+            gn_permissions.t_permissions p
+                USING bad_permissions bp
+        WHERE
+            bp.id_permission = p.id_permission;
+        """
+    )
+
+
+def downgrade():
+    op.drop_table(schema="gn_permissions", table_name="t_permissions_available")

From 68fb58aa01309256f471bd3d5c4fcc9f9cf9b2dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 12:46:30 +0200
Subject: [PATCH 061/209] admin: improve permissions managment

---
 backend/geonature/core/admin/utils.py         | 20 +++++
 .../geonature/core/gn_permissions/admin.py    | 87 ++++++++++++++++++-
 2 files changed, 103 insertions(+), 4 deletions(-)

diff --git a/backend/geonature/core/admin/utils.py b/backend/geonature/core/admin/utils.py
index a0b9fae2f3..6bc577d4e6 100644
--- a/backend/geonature/core/admin/utils.py
+++ b/backend/geonature/core/admin/utils.py
@@ -1,3 +1,5 @@
+from functools import partial
+
 from flask import g
 from werkzeug.exceptions import Unauthorized
 
@@ -33,3 +35,21 @@ def can_delete(self):
     @property
     def can_export(self):
         return self._can_action("E")
+
+
+# https://github.com/flask-admin/flask-admin/issues/1807
+# https://stackoverflow.com/questions/54638047/correct-way-to-register-flask-admin-views-with-application-factory
+class ReloadingIterator:
+    def __init__(self, iterator_factory):
+        self.iterator_factory = iterator_factory
+
+    def __iter__(self):
+        return self.iterator_factory()
+
+
+class DynamicOptionsMixin:
+    def get_dynamic_options(self, view):
+        raise NotImplementedError
+
+    def get_options(self, view):
+        return ReloadingIterator(partial(self.get_dynamic_options, view))
diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index caaa2dab2a..d190f18ee4 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -1,9 +1,20 @@
+from flask import has_app_context, Markup
 from flask_admin.contrib.sqla import ModelView
+from flask_admin.contrib.sqla.filters import FilterEqual
 
 from geonature.utils.env import db
 from geonature.core.admin.admin import admin
-from geonature.core.admin.utils import CruvedProtectedMixin
-from geonature.core.gn_permissions.models import PermObject, Permission, PermissionAvailable
+from geonature.core.admin.utils import CruvedProtectedMixin, DynamicOptionsMixin
+from geonature.core.gn_permissions.models import (
+    PermObject,
+    PermAction,
+    PermScope,
+    Permission,
+    PermissionAvailable,
+)
+from geonature.core.gn_commons.models.base import TModules
+
+from pypnusershub.db.models import User
 
 
 class ObjectAdmin(CruvedProtectedMixin, ModelView):
@@ -21,20 +32,88 @@ class ObjectAdmin(CruvedProtectedMixin, ModelView):
     can_delete = False
 
 
+class RoleFilter(DynamicOptionsMixin, FilterEqual):
+    def get_dynamic_options(self, view):
+        if has_app_context():
+            yield from [(u.id_role, u.nom_complet) for u in User.query.all()]
+
+
+class ModuleFilter(DynamicOptionsMixin, FilterEqual):
+    def get_dynamic_options(self, view):
+        if has_app_context():
+            yield from [(m.id_module, m.module_code) for m in TModules.query.all()]
+
+
+class ObjectFilter(DynamicOptionsMixin, FilterEqual):
+    def get_dynamic_options(self, view):
+        if has_app_context():
+            yield from [(o.id_object, o.code_object) for o in PermObject.query.all()]
+
+
+class ActionFilter(DynamicOptionsMixin, FilterEqual):
+    def get_dynamic_options(self, view):
+        if has_app_context():
+            yield from [(a.id_action, a.code_action) for a in PermAction.query.all()]
+
+
+class ScopeFilter(DynamicOptionsMixin, FilterEqual):
+    def apply(self, query, value, alias=None):
+        column = self.get_column(alias)
+        if value:
+            return query.filter(column == value)
+        else:
+            return query.filter(column.is_(None))
+
+    def get_dynamic_options(self, view):
+        if has_app_context():
+            yield (None, "Sans restriction")
+            yield from [(a.value, a.label) for a in PermScope.query.all()]
+
+
 class PermissionAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
 
-    column_list = ("role", "module", "object", "action", "scope")
+    column_list = ("role", "module", "object", "action", "label", "filters")
     column_labels = {
         "role": "Rôle",
-        "scope": "Porté",
+        "filters": "Restrictions",
         "object": "Objet",
+        "role.identifiant": "identifiant du rôle",
+        "role.nom_complet": "nom du rôle",
+        "availability": "Permission disponible",
     }
+    column_searchable_list = ("role.identifiant", "role.nom_complet")
     column_formatters = {
+        "role": lambda v, c, m, p: Markup("<b>{}</b>".format(Markup.escape(m.role.nom_role)))
+        if m.role.groupe
+        else m.role.nom_complet,
         "module": lambda v, c, m, p: m.module.module_code,
         "object": lambda v, c, m, p: m.object.code_object,
+        "label": lambda v, c, m, p: m.availability.label if m.availability else None,
+        "filters": lambda v, c, m, p: m.scope.label if m.scope else None,
     }
+    column_filters = (
+        RoleFilter(column=Permission.id_role, name="Rôle"),
+        ModuleFilter(column=Permission.id_module, name="Module"),
+        ObjectFilter(column=Permission.id_object, name="Objet"),
+        ActionFilter(column=Permission.id_action, name="Action"),
+        ScopeFilter(column=Permission.scope_value, name="Scope"),
+    )
+    named_filter_urls = True
+    column_sortable_list = (
+        ("role", "role.nom_complet"),
+        ("module", "module.module_code"),
+        ("object", "object.code_object"),
+        ("action", "action.code_action"),
+    )
+    column_default_sort = [
+        ("role.nom_complet", True),
+        ("module.module_code", True),
+        ("object.code_object", True),
+        ("action.code_action", True),
+    ]
+    form_columns = ("role", "module", "object", "action", "scope")
 
 
 class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):

From 78d902326c39ade3a926bdc1287f3d4e4c0757e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 23:43:48 +0200
Subject: [PATCH 062/209] synthese: remove deprecated get_synthese route

---
 backend/geonature/core/gn_synthese/routes.py | 43 --------------------
 1 file changed, 43 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 13f1be5b66..e8fe27005a 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -248,49 +248,6 @@ def get_observations_for_web(scope):
     return jsonify(FeatureCollection(geojson_features))
 
 
-@routes.route("", methods=["GET"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
-@json_resp
-def get_synthese(scope):
-    """Return synthese row(s) filtered by form params. NOT USED ANY MORE FOR PERFORMANCE ISSUES
-
-    .. :quickref: Synthese; Deprecated
-
-    .. deprecated:: 2?
-    Use :route: /for_web instead
-
-    Params must have same synthese fields names
-
-    :returns dict[dict, int, bool]: See description above
-    """
-    # change all args in a list of value
-    filters = {key: request.args.getlist(key) for key, value in request.args.items()}
-    if "limit" in filters:
-        result_limit = filters.pop("limit")[0]
-    else:
-        result_limit = current_app.config["SYNTHESE"]["NB_MAX_OBS_MAP"]
-
-    query = select([VSyntheseForWebApp]).order_by(VSyntheseForWebApp.date_min.desc())
-    synthese_query_class = SyntheseQuery(VSyntheseForWebApp, query, filters)
-    synthese_query_class.filter_query_all_filters(g.current_user, scope)
-    data = DB.engine.execute(synthese_query_class.query.limit(result_limit))
-
-    # data = q.limit(result_limit)
-    columns = current_app.config["SYNTHESE"]["COLUMNS_API_SYNTHESE_WEB_APP"] + MANDATORY_COLUMNS
-    features = []
-    for d in data:
-        feature = d.as_geofeature(fields=columns)
-        feature["properties"]["nom_vern_or_lb_nom"] = (
-            d.lb_nom if d.nom_vern is None else d.nom_vern
-        )
-        features.append(feature)
-    return {
-        "data": FeatureCollection(features),
-        "nb_obs_limited": len(features) == current_app.config["SYNTHESE"]["NB_MAX_OBS_MAP"],
-        "nb_total": len(features),
-    }
-
-
 @routes.route("/vsynthese/<id_synthese>", methods=["GET"])
 @permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
 def get_one_synthese(scope, id_synthese):

From f5dc1cf31bf0ba41c434e436ed01d100a74b8a5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 20:30:45 +0200
Subject: [PATCH 063/209] synthese: protect some routes with @login_required

---
 backend/geonature/core/gn_synthese/routes.py | 18 ++++++---
 backend/geonature/tests/test_synthese.py     | 42 ++++++++++++++------
 2 files changed, 42 insertions(+), 18 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index e8fe27005a..1bcbe1a1ac 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -50,6 +50,7 @@
 from geonature.core.gn_synthese.utils.query_select_sqla import SyntheseQuery
 
 from geonature.core.gn_permissions import decorators as permissions
+from geonature.core.gn_permissions.decorators import login_required
 from geonature.core.gn_permissions.tools import get_scopes_by_action
 
 from ref_geo.models import LAreas, BibAreasTypes
@@ -719,6 +720,7 @@ def general_stats(scope):
 
 
 @routes.route("/taxons_tree", methods=["GET"])
+@login_required
 @json_resp
 def get_taxon_tree():
     """Get taxon tree.
@@ -733,6 +735,7 @@ def get_taxon_tree():
 
 
 @routes.route("/taxons_autocomplete", methods=["GET"])
+@login_required
 @json_resp
 def get_autocomplete_taxons_synthese():
     """Autocomplete taxon for web search (based on all taxon in Synthese).
@@ -773,6 +776,7 @@ def get_autocomplete_taxons_synthese():
 
 
 @routes.route("/sources", methods=["GET"])
+@login_required
 @json_resp
 def get_sources():
     """Get all sources.
@@ -785,6 +789,7 @@ def get_sources():
 
 
 @routes.route("/defaultsNomenclatures", methods=["GET"])
+@login_required
 def getDefaultsNomenclatures():
     """Get default nomenclatures
 
@@ -821,6 +826,7 @@ def getDefaultsNomenclatures():
 
 
 @routes.route("/color_taxon", methods=["GET"])
+@login_required
 def get_color_taxon():
     """Get color of taxon in areas (vue synthese.v_color_taxon_area).
 
@@ -864,6 +870,7 @@ def get_color_taxon():
 
 
 @routes.route("/taxa_count", methods=["GET"])
+@login_required
 @json_resp
 def get_taxa_count():
     """
@@ -890,6 +897,7 @@ def get_taxa_count():
 
 
 @routes.route("/observation_count", methods=["GET"])
+@login_required
 @json_resp
 def get_observation_count():
     """
@@ -918,9 +926,10 @@ def get_observation_count():
 
 
 @routes.route("/observations_bbox", methods=["GET"])
+@login_required
 def get_bbox():
     """
-    Get bbbox of observations
+    Get bbox of observations
 
     .. :quickref: Synthese;
 
@@ -1103,7 +1112,7 @@ def notify_new_report_change(synthese, user, id_roles, content):
 
 
 @routes.route("/reports/<int:id_report>", methods=["PUT"])
-@permissions.login_required
+@login_required
 @json_resp
 def update_content_report(id_report):
     """
@@ -1175,7 +1184,7 @@ def list_reports(scope):
 
 
 @routes.route("/reports/<int:id_report>", methods=["DELETE"])
-@permissions.login_required
+@login_required
 @json_resp
 def delete_report(id_report):
     reportItem = TReport.query.get_or_404(id_report)
@@ -1200,13 +1209,12 @@ def delete_report(id_report):
 
 
 @routes.route("/log", methods=["get"])
-@permissions.check_cruved_scope("R", module_code="SYNTHESE")
+@login_required
 def list_synthese_log_entries() -> dict:
     """Get log history from synthese
 
     Parameters
     ----------
-    scope
 
     Returns
     -------
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index a2fbf207db..546ed1d80f 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -117,13 +117,15 @@ def test_synthese_scope_filtering(self, app, users, synthese_data):
             app.preprocess_request()
             assert sq.filter_by_scope(0).all() == []
 
-    def test_list_sources(self, source):
+    def test_list_sources(self, source, users):
+        set_logged_user_cookie(self.client, users["self_user"])
         response = self.client.get(url_for("gn_synthese.get_sources"))
         assert response.status_code == 200
         data = response.get_json()
         assert len(data) > 0
 
-    def test_get_defaut_nomenclatures(self):
+    def test_get_defaut_nomenclatures(self, users):
+        set_logged_user_cookie(self.client, users["self_user"])
         response = self.client.get(url_for("gn_synthese.getDefaultsNomenclatures"))
         assert response.status_code == 200
 
@@ -461,8 +463,9 @@ def test_get_one_synthese_record(self, app, users, synthese_data):
         )
         assert response.status_code == Forbidden.code
 
-    def test_color_taxon(self, synthese_data):
+    def test_color_taxon(self, synthese_data, users):
         # Note: require grids 5×5!
+        set_logged_user_cookie(self.client, users["self_user"])
         response = self.client.get(url_for("gn_synthese.get_color_taxon"))
         assert response.status_code == 200
 
@@ -531,14 +534,17 @@ def test_taxa_distribution(self, synthese_data):
         assert response.status_code == 200
         assert len(response.json)
 
-    def test_get_taxa_count(self, synthese_data):
+    def test_get_taxa_count(self, synthese_data, users):
+        set_logged_user_cookie(self.client, users["self_user"])
+
         response = self.client.get(url_for("gn_synthese.get_taxa_count"))
 
         assert response.json >= len(set(synt.cd_nom for synt in synthese_data.values()))
 
-    def test_get_taxa_count_id_dataset(self, synthese_data, datasets, unexisted_id):
+    def test_get_taxa_count_id_dataset(self, synthese_data, users, datasets, unexisted_id):
         id_dataset = datasets["own_dataset"].id_dataset
         url = "gn_synthese.get_taxa_count"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response = self.client.get(url_for(url), query_string={"id_dataset": id_dataset})
         response_empty = self.client.get(url_for(url), query_string={"id_dataset": unexisted_id})
@@ -546,17 +552,19 @@ def test_get_taxa_count_id_dataset(self, synthese_data, datasets, unexisted_id):
         assert response.json == len(set(synt.cd_nom for synt in synthese_data.values()))
         assert response_empty.json == 0
 
-    def test_get_observation_count(self, synthese_data):
+    def test_get_observation_count(self, synthese_data, users):
         nb_observations = len(synthese_data)
+        set_logged_user_cookie(self.client, users["admin_user"])
 
         response = self.client.get(url_for("gn_synthese.get_observation_count"))
 
         assert response.json >= nb_observations
 
-    def test_get_observation_count_id_dataset(self, synthese_data, datasets, unexisted_id):
+    def test_get_observation_count_id_dataset(self, synthese_data, users, datasets, unexisted_id):
         id_dataset = datasets["own_dataset"].id_dataset
         nb_observations = len([s for s in synthese_data.values() if s.id_dataset == id_dataset])
         url = "gn_synthese.get_observation_count"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response = self.client.get(url_for(url), query_string={"id_dataset": id_dataset})
         response_empty = self.client.get(url_for(url), query_string={"id_dataset": unexisted_id})
@@ -564,15 +572,18 @@ def test_get_observation_count_id_dataset(self, synthese_data, datasets, unexist
         assert response.json == nb_observations
         assert response_empty.json == 0
 
-    def test_get_bbox(self, synthese_data):
+    def test_get_bbox(self, synthese_data, users):
+        set_logged_user_cookie(self.client, users["self_user"])
+
         response = self.client.get(url_for("gn_synthese.get_bbox"))
 
         assert response.status_code == 200
         assert response.json["type"] in ["Point", "Polygon"]
 
-    def test_get_bbox_id_dataset(self, synthese_data, datasets, unexisted_id):
+    def test_get_bbox_id_dataset(self, synthese_data, users, datasets, unexisted_id):
         id_dataset = datasets["own_dataset"].id_dataset
         url = "gn_synthese.get_bbox"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response = self.client.get(url_for(url), query_string={"id_dataset": id_dataset})
         assert response.status_code == 200
@@ -582,26 +593,29 @@ def test_get_bbox_id_dataset(self, synthese_data, datasets, unexisted_id):
         assert response_empty.status_code == 204
         assert response_empty.get_data(as_text=True) == ""
 
-    def test_get_bbox_id_source(self, synthese_data, source):
+    def test_get_bbox_id_source(self, synthese_data, users, source):
         id_source = source.id_source
         url = "gn_synthese.get_bbox"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response = self.client.get(url_for(url), query_string={"id_source": id_source})
 
         assert response.status_code == 200
         assert response.json["type"] == "Polygon"
 
-    def test_get_bbox_id_source_empty(self, unexisted_id_source):
+    def test_get_bbox_id_source_empty(self, users, unexisted_id_source):
         url = "gn_synthese.get_bbox"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response = self.client.get(url_for(url), query_string={"id_source": unexisted_id_source})
 
         assert response.status_code == 204
         assert response.json is None
 
-    def test_observation_count_per_column(self, synthese_data):
+    def test_observation_count_per_column(self, users, synthese_data):
         column_name_dataset = "id_dataset"
         column_name_cd_nom = "cd_nom"
+        set_logged_user_cookie(self.client, users["self_user"])
 
         response_dataset = self.client.get(
             url_for("gn_synthese.observation_count_per_column", column=column_name_dataset)
@@ -648,9 +662,11 @@ def test_observation_count_per_column(self, synthese_data):
                 if item["cd_nom"] == test_cd_nom["cd_nom"]:
                     assert item["count"] >= test_cd_nom["count"]
 
-    def test_get_autocomplete_taxons_synthese(self, synthese_data):
+    def test_get_autocomplete_taxons_synthese(self, synthese_data, users):
         seach_name = synthese_data["obs1"].nom_cite
 
+        set_logged_user_cookie(self.client, users["self_user"])
+
         response = self.client.get(
             url_for("gn_synthese.get_autocomplete_taxons_synthese"),
             query_string={"search_name": seach_name},

From 41057006d0352704d162340591a7d04757bb3887 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 17:57:45 +0200
Subject: [PATCH 064/209] permissions: add @permissions_required decorator

---
 .../core/gn_permissions/decorators.py         | 37 ++++++++++++++++---
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/decorators.py b/backend/geonature/core/gn_permissions/decorators.py
index 216b9c25ab..eb94666023 100644
--- a/backend/geonature/core/gn_permissions/decorators.py
+++ b/backend/geonature/core/gn_permissions/decorators.py
@@ -7,7 +7,16 @@
 from flask import request, g
 from werkzeug.exceptions import Unauthorized, Forbidden
 
-from geonature.core.gn_permissions.tools import get_scopes_by_action
+from geonature.core.gn_permissions.tools import get_permissions, get_scopes_by_action
+
+
+def _forbidden_message(action, module_code, object_code):
+    message = f"User {g.current_user.id_role} has no permissions to {action}"
+    if module_code:
+        message += f" in {module_code}"
+    if object_code:
+        message += f" on {object_code}"
+    return message
 
 
 def login_required(view_func):
@@ -47,10 +56,7 @@ def decorated_view(*args, **kwargs):
                 raise Unauthorized
             scope = get_scopes_by_action(module_code=module_code, object_code=object_code)[action]
             if not scope:
-                message = f"User {g.current_user.id_role} can not {action} in {module_code}"
-                if object_code:
-                    message += f" on {object_code}"
-                raise Forbidden(description=message)
+                raise Forbidden(description=_forbidden_message(action, module_code, object_code))
             if get_scope:
                 kwargs["scope"] = scope
             return view_func(*args, **kwargs)
@@ -58,3 +64,24 @@ def decorated_view(*args, **kwargs):
         return decorated_view
 
     return _check_cruved_scope
+
+
+def permissions_required(
+    action,
+    module_code=None,
+    object_code=None,
+):
+    def _permission_required(view_func):
+        @wraps(view_func)
+        def decorated_view(*args, **kwargs):
+            if g.current_user is None:
+                raise Unauthorized
+            permissions = get_permissions(action, module_code=module_code, object_code=object_code)
+            if not permissions:
+                raise Forbidden(description=_forbidden_message(action, module_code, object_code))
+            kwargs["permissions"] = permissions
+            return view_func(*args, **kwargs)
+
+        return decorated_view
+
+    return _permission_required

From fad7a6ebacc719047a5da1dd74a58f4b5494ea8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 20:30:05 +0200
Subject: [PATCH 065/209] synthese: switch to @permissions_required api

---
 backend/geonature/core/gn_synthese/models.py  | 25 ++++++++-
 backend/geonature/core/gn_synthese/routes.py  | 16 +++---
 .../gn_synthese/utils/query_select_sqla.py    | 53 +++++++++++++++++--
 3 files changed, 80 insertions(+), 14 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/models.py b/backend/geonature/core/gn_synthese/models.py
index 3d9686a111..374733d4ee 100644
--- a/backend/geonature/core/gn_synthese/models.py
+++ b/backend/geonature/core/gn_synthese/models.py
@@ -434,7 +434,7 @@ class Synthese(DB.Model):
 
     cor_observers = DB.relationship(User, secondary=cor_observer_synthese)
 
-    def has_instance_permission(self, scope):
+    def _has_scope_grant(self, scope):
         if scope == 0:
             return False
         elif scope in (1, 2):
@@ -446,6 +446,29 @@ def has_instance_permission(self, scope):
         elif scope == 3:
             return True
 
+    def _has_permissions_grant(self, permissions):
+        if not permissions:
+            return False
+        for perm in permissions:
+            if perm.has_other_filters_than("SCOPE"):
+                continue  # unsupported filters
+            if perm.scope_value:
+                if g.current_user == self.digitiser:
+                    return True
+                if g.current_user in self.cor_observers:
+                    return True
+                if self.dataset.has_instance_permission(perm.scope_value):
+                    return True
+                continue  # scope filter denied access, check next permission
+            return True  # no filter exclude this permission
+        return False
+
+    def has_instance_permission(self, permissions):
+        if type(permissions) == int:
+            return self._has_scope_grant(permissions)
+        else:
+            return self._has_permissions_grant(permissions)
+
 
 @serializable
 class DefaultsNomenclaturesValue(DB.Model):
diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 1bcbe1a1ac..8632703e1f 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -50,7 +50,7 @@
 from geonature.core.gn_synthese.utils.query_select_sqla import SyntheseQuery
 
 from geonature.core.gn_permissions import decorators as permissions
-from geonature.core.gn_permissions.decorators import login_required
+from geonature.core.gn_permissions.decorators import login_required, permissions_required
 from geonature.core.gn_permissions.tools import get_scopes_by_action
 
 from ref_geo.models import LAreas, BibAreasTypes
@@ -77,8 +77,8 @@
 
 
 @routes.route("/for_web", methods=["GET", "POST"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
-def get_observations_for_web(scope):
+@permissions_required("R", module_code="SYNTHESE")
+def get_observations_for_web(permissions):
     """Optimized route to serve data for the frontend with all filters.
 
     .. :quickref: Synthese; Get filtered observations
@@ -189,7 +189,7 @@ def get_observations_for_web(scope):
         obs_query,
         filters,
     )
-    synthese_query_class.filter_query_all_filters(g.current_user, scope)
+    synthese_query_class.filter_query_all_filters(g.current_user, permissions)
     obs_query = synthese_query_class.query
 
     if output_format == "grouped_geom_by_areas":
@@ -250,8 +250,8 @@ def get_observations_for_web(scope):
 
 
 @routes.route("/vsynthese/<id_synthese>", methods=["GET"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
-def get_one_synthese(scope, id_synthese):
+@permissions_required("R", module_code="SYNTHESE")
+def get_one_synthese(permissions, id_synthese):
     """Get one synthese record for web app with all decoded nomenclature"""
     synthese = Synthese.query.join_nomenclatures().options(
         joinedload("dataset").options(
@@ -310,7 +310,7 @@ def get_one_synthese(scope, id_synthese):
 
     synthese = synthese.get_or_404(id_synthese)
 
-    if not synthese.has_instance_permission(scope=scope):
+    if not synthese.has_instance_permission(permissions=permissions):
         raise Forbidden()
 
     geofeature = synthese.as_geofeature(fields=Synthese.nomenclature_fields + fields)
@@ -1190,7 +1190,7 @@ def delete_report(id_report):
     reportItem = TReport.query.get_or_404(id_report)
     # alert control to check cruved - allow validators only
     if reportItem.report_type.type in ["alert"]:
-        scope = get_scopes_by_action(module_code="VALIDATION")["C"]
+        scope = get_scopes_by_action(module_code="VALIDATION")["C"]  # FIXME
         if not reportItem.synthese.has_instance_permission(scope):
             raise Forbidden("Permission required to delete this report !")
     # only owner could delete a report for pin and discussion
diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 941988653d..86ba1168da 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -1,5 +1,5 @@
 """
-Utility function to manage cruved and all filter of Synthese
+Utility function to manage permissions and all filter of Synthese
 Use these functions rather than query.py
 Filter the query of synthese using SQLA expression language and 'select' object
 https://docs.sqlalchemy.org/en/latest/core/tutorial.html#selecting
@@ -10,6 +10,7 @@
 
 from flask import current_app
 
+import sqlalchemy as sa
 from sqlalchemy import func, or_, and_, select, distinct
 from sqlalchemy.sql import text
 from sqlalchemy.orm import aliased
@@ -125,6 +126,45 @@ def add_join_multiple_cond(self, right_table, conditions):
                 # push the joined table in _already_joined_table list
                 self._already_joined_table.append(right_table)
 
+    def filter_query_with_permissions(self, user, permissions):
+        """
+        Filter the query with the permissions of a user
+        """
+        subquery_observers = (
+            select([CorObserverSynthese.id_synthese])
+            .select_from(CorObserverSynthese)
+            .where(CorObserverSynthese.id_role == user.id_role)
+        )
+        datasets_by_scope = {}  # to avoid fetching datasets several time for same scope
+        permissions_filters = []
+        for perm in permissions:
+            if perm.has_other_filters_than("SCOPE"):
+                continue
+            perm_filters = []
+            if perm.scope_value:
+                if perm.scope_value not in datasets_by_scope:
+                    datasets_by_scope[perm.scope_value] = [
+                        d.id_dataset
+                        for d in TDatasets.query.filter_by_scope(perm.scope_value).all()
+                    ]
+                datasets = datasets_by_scope[perm.scope_value]
+                scope_filters = [
+                    self.model_id_syn_col.in_(subquery_observers),  # user is observer
+                    self.model_id_digitiser_column == user.id_role,  # user id digitizer
+                    self.model_id_dataset_column.in_(
+                        datasets
+                    ),  # user is dataset (or parent af) actor
+                ]
+                perm_filters.append(or_(*scope_filters))
+            if perm_filters:
+                permissions_filters.append(and_(*perm_filters))
+            else:
+                permissions_filters.append(sa.true())
+        if permissions_filters:
+            self.query = self.query.where(or_(*permissions_filters))
+        else:
+            self.query = self.query.where(sa.false())
+
     def filter_query_with_cruved(self, user, scope):
         """
         Filter the query with the cruved authorization of a user
@@ -405,8 +445,11 @@ def filter_other_filters(self, user):
                 else:
                     self.query = self.query.where(col.ilike("%{}%".format(value)))
 
-    def apply_all_filters(self, user, scope):
-        self.filter_query_with_cruved(user, scope)
+    def apply_all_filters(self, user, permissions):
+        if type(permissions) == int:  # scope
+            self.filter_query_with_cruved(user, scope=permissions)
+        else:
+            self.filter_query_with_permissions(user, permissions)
         self.filter_taxonomy()
         self.filter_other_filters(user)
 
@@ -415,7 +458,7 @@ def build_query(self):
             self.query = self.query.select_from(self.query_joins)
         return self.query
 
-    def filter_query_all_filters(self, user, scope):
+    def filter_query_all_filters(self, user, permissions):
         """High level function to manage query with all filters.
 
         Apply CRUVED, toxonomy and other filters.
@@ -430,7 +473,7 @@ def filter_query_all_filters(self, user, scope):
         sqlalchemy.orm.query.Query.filter
             Combined filter to apply.
         """
-        self.apply_all_filters(user, scope)
+        self.apply_all_filters(user, permissions)
         return self.build_query()
 
     def build_bdc_status_pr_nb_lateral_join(self, protection_status_value, red_list_filters):

From 70b7ac927daa17322a36f36f052c7748b22dd619 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Thu, 20 Apr 2023 17:11:13 +0200
Subject: [PATCH 066/209] permissions: ignore duplicate permissions

---
 backend/geonature/core/gn_permissions/tools.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index 7da07882e1..3f726c6e59 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -31,6 +31,13 @@ def _get_user_permissions(id_role):
         )
         # These ordering ensure groupby is working properly
         .order_by(Permission.id_action)
+        # remove duplicate permissions (defined at group and user level, or defined in several groups)
+        .distinct(
+            Permission.id_action,
+            Permission.id_module,
+            Permission.id_object,
+            *Permission.filters_fields.values(),
+        )
         .all()
     )
 

From 2366d5392b553d3097d89adcef12e57fabc6e0d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Thu, 20 Apr 2023 19:18:42 +0200
Subject: [PATCH 067/209] permissions: ignore supersed permissions

---
 .../geonature/core/gn_permissions/models.py   | 21 +++++++++++++++++++
 .../geonature/core/gn_permissions/tools.py    | 15 +++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 8a23a981c0..921dba8eb2 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -144,6 +144,27 @@ class Permission(db.Model):
         "SCOPE": scope_value,
     }
 
+    @staticmethod
+    def __SCOPE_le__(a, b):
+        return b is None or (a is not None and a <= b)
+
+    @staticmethod
+    def __default_le__(a, b):
+        return a == b or b is None
+
+    def __le__(self, other):
+        """
+        Return True if this permission is supersed by 'other' permission.
+        This requires all filters to be supersed by 'other' filters.
+        """
+        for name, field in self.filters_fields.items():
+            # Get filter comparison function or use default comparison function
+            __le_fct__ = getattr(self, f"__{name}_le__", Permission.__default_le__)
+            self_value, other_value = getattr(self, field.name), getattr(other, field.name)
+            if not __le_fct__(self_value, other_value):
+                return False
+        return True
+
     def has_other_filters_than(self, *expected_filters):
         for name, field in self.filters_fields.items():
             if name in expected_filters:
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index 3f726c6e59..b43e0d04d5 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -1,4 +1,4 @@
-from itertools import groupby
+from itertools import groupby, permutations
 
 import sqlalchemy as sa
 from sqlalchemy.orm import joinedload
@@ -73,7 +73,7 @@ def get_user_permissions_by_action(id_role=None):
 
 def get_permissions(action_code, id_role=None, module_code=None, object_code=None):
     """
-    This function returns a list of all the permissions that match (action_code, id_role, module_code, object_code).
+    This function returns a set of all the permissions that match (action_code, id_role, module_code, object_code).
     If module_code is None, it is set as the code of the current module or as "GEONATURE" if no current module found.
     If object_code is None, it is set as the code of the current object or as "ALL" if no current object found.
 
@@ -91,11 +91,18 @@ def get_permissions(action_code, id_role=None, module_code=None, object_code=Non
         else:
             object_code = "ALL"
 
-    return [
+    permissions = {
         p
         for p in get_user_permissions_by_action(id_role)[action_code]
         if p.module.module_code == module_code and p.object.code_object == object_code
-    ]
+    }
+
+    # Remove all permissions supersed by another permission
+    for p1, p2 in permutations(permissions, 2):
+        if p1 in permissions and p1 <= p2:
+            permissions.remove(p1)
+
+    return permissions
 
 
 def get_scope(action_code, id_role=None, module_code=None, object_code=None):

From d80b4cd438ea9a3802fb7ca6ff19043e12dce0dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 16:43:14 +0200
Subject: [PATCH 068/209] permissions: add sensitivity filter

---
 .../geonature/core/gn_permissions/admin.py    | 17 ++++-
 .../geonature/core/gn_permissions/models.py   |  8 +++
 .../f1dd984bff97_add_sensitivity_filter.py    | 69 +++++++++++++++++++
 3 files changed, 91 insertions(+), 3 deletions(-)
 create mode 100644 backend/geonature/migrations/versions/f1dd984bff97_add_sensitivity_filter.py

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index d190f18ee4..925ac04318 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -70,6 +70,15 @@ def get_dynamic_options(self, view):
             yield from [(a.value, a.label) for a in PermScope.query.all()]
 
 
+def filters_formatter(v, c, m, p):
+    filters = []
+    if m.scope:
+        filters.append(m.scope.label)
+    if m.sensitivity_filter:
+        filters.append("Données non sensibles")
+    return Markup("<ul>" + "".join(["<li>{}</li>".format(f) for f in filters]) + "</ul>")
+
+
 class PermissionAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
@@ -77,11 +86,12 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
     column_list = ("role", "module", "object", "action", "label", "filters")
     column_labels = {
         "role": "Rôle",
-        "filters": "Restrictions",
+        "filters": "Restriction(s)",
         "object": "Objet",
         "role.identifiant": "identifiant du rôle",
         "role.nom_complet": "nom du rôle",
         "availability": "Permission disponible",
+        "sensitivity_filter": "Exclure les données sensibles",
     }
     column_searchable_list = ("role.identifiant", "role.nom_complet")
     column_formatters = {
@@ -91,7 +101,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         "module": lambda v, c, m, p: m.module.module_code,
         "object": lambda v, c, m, p: m.object.code_object,
         "label": lambda v, c, m, p: m.availability.label if m.availability else None,
-        "filters": lambda v, c, m, p: m.scope.label if m.scope else None,
+        "filters": filters_formatter,
     }
     column_filters = (
         RoleFilter(column=Permission.id_role, name="Rôle"),
@@ -113,7 +123,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         ("object.code_object", True),
         ("action.code_action", True),
     ]
-    form_columns = ("role", "module", "object", "action", "scope")
+    form_columns = ("role", "module", "object", "action", "scope", "sensitivity_filter")
 
 
 class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
@@ -124,6 +134,7 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
         "scope": "Portée",
         "object": "Objet",
         "scope_filter": "Filtre appartenance",
+        "sensitivity_filter": "Filtre sensibilité",
     }
     column_formatters = {
         "module": lambda v, c, m, p: m.module.module_code,
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 921dba8eb2..4c53b7f2d5 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -104,6 +104,7 @@ class PermissionAvailable(db.Model):
     action = db.relationship(PermAction)
 
     scope_filter = db.Column(db.Boolean, server_default=sa.false())
+    sensitivity_filter = db.Column(db.Boolean, server_default=sa.false(), nullable=False)
 
     def __str__(self):
         return self.label
@@ -130,6 +131,7 @@ class Permission(db.Model):
 
     scope_value = db.Column(db.Integer, ForeignKey(PermScope.value), nullable=True)
     scope = db.relationship(PermScope)
+    sensitivity_filter = db.Column(db.Boolean, server_default=sa.false(), nullable=False)
 
     availability = db.relationship(
         PermissionAvailable,
@@ -142,12 +144,18 @@ class Permission(db.Model):
 
     filters_fields = {
         "SCOPE": scope_value,
+        "SENSITIVITY": sensitivity_filter,
     }
 
     @staticmethod
     def __SCOPE_le__(a, b):
         return b is None or (a is not None and a <= b)
 
+    @staticmethod
+    def __SENSITIVITY_le__(a, b):
+        # False only if: A is False and b is True
+        return (not a) <= (not b)
+
     @staticmethod
     def __default_le__(a, b):
         return a == b or b is None
diff --git a/backend/geonature/migrations/versions/f1dd984bff97_add_sensitivity_filter.py b/backend/geonature/migrations/versions/f1dd984bff97_add_sensitivity_filter.py
new file mode 100644
index 0000000000..34842153c4
--- /dev/null
+++ b/backend/geonature/migrations/versions/f1dd984bff97_add_sensitivity_filter.py
@@ -0,0 +1,69 @@
+"""add sensitivity filter
+
+Revision ID: f1dd984bff97
+Revises: f051b88a57fd
+Create Date: 2023-04-19 16:24:57.945428
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy import Column, Boolean
+
+
+# revision identifiers, used by Alembic.
+revision = "f1dd984bff97"
+down_revision = "f051b88a57fd"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column(
+        schema="gn_permissions",
+        table_name="t_permissions",
+        column=Column(
+            "sensitivity_filter",
+            Boolean,
+            server_default=sa.false(),
+        ),
+    )
+    op.add_column(
+        schema="gn_permissions",
+        table_name="t_permissions_available",
+        column=Column(
+            "sensitivity_filter",
+            Boolean,
+            server_default=sa.false(),
+        ),
+    )
+    op.execute(
+        """
+        UPDATE
+            gn_permissions.t_permissions_available pa
+        SET
+            sensitivity_filter = True
+        FROM
+            gn_commons.t_modules m,
+            gn_permissions.t_objects o,
+            gn_permissions.bib_actions a
+        WHERE
+            pa.id_module = m.id_module
+            AND
+            pa.id_object = o.id_object
+            AND
+            pa.id_action = a.id_action
+            AND
+            m.module_code = 'SYNTHESE' AND o.code_object = 'ALL' and a.code_action = 'R'
+        """
+    )
+
+
+def downgrade():
+    op.drop_column(
+        schema="gn_permissions", table_name="t_permissions", column_name="sensitivity_filter"
+    )
+    op.drop_column(
+        schema="gn_permissions",
+        table_name="t_permissions_available",
+        column_name="sensitivity_filter",
+    )

From 4a32a65e785ea530e8d1ddcde53774c202c91a5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 19 Apr 2023 20:31:24 +0200
Subject: [PATCH 069/209] synthese: support sensitivity filters

---
 backend/geonature/core/gn_synthese/models.py  |  4 +++-
 .../gn_synthese/utils/query_select_sqla.py    | 19 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/models.py b/backend/geonature/core/gn_synthese/models.py
index 374733d4ee..14b9f0d347 100644
--- a/backend/geonature/core/gn_synthese/models.py
+++ b/backend/geonature/core/gn_synthese/models.py
@@ -450,8 +450,10 @@ def _has_permissions_grant(self, permissions):
         if not permissions:
             return False
         for perm in permissions:
-            if perm.has_other_filters_than("SCOPE"):
+            if perm.has_other_filters_than("SCOPE", "SENSITIVITY"):
                 continue  # unsupported filters
+            if perm.sensitivity_filter and self.nomenclature_sensitivity.cd_nomenclature != "0":
+                continue  # sensitivity filter denied access, check next permission
             if perm.scope_value:
                 if g.current_user == self.digitiser:
                     return True
diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 86ba1168da..0ea07d104f 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -42,6 +42,7 @@
 )
 from ref_geo.models import LAreas, BibAreasTypes
 from utils_flask_sqla_geo.schema import FeatureSchema, FeatureCollectionSchema
+from pypnnomenclature.models import TNomenclatures, BibNomenclaturesTypes
 
 
 class SyntheseQuery:
@@ -137,10 +138,26 @@ def filter_query_with_permissions(self, user, permissions):
         )
         datasets_by_scope = {}  # to avoid fetching datasets several time for same scope
         permissions_filters = []
+        nomenclature_non_sensible = None
         for perm in permissions:
-            if perm.has_other_filters_than("SCOPE"):
+            if perm.has_other_filters_than("SCOPE", "SENSITIVITY"):
                 continue
             perm_filters = []
+            if perm.sensitivity_filter:
+                if nomenclature_non_sensible is None:
+                    nomenclature_non_sensible = (
+                        TNomenclatures.query.filter(
+                            TNomenclatures.nomenclature_type.has(
+                                BibNomenclaturesTypes.mnemonique == "SENSIBILITE"
+                            )
+                        )
+                        .filter(TNomenclatures.cd_nomenclature == "0")
+                        .one()
+                    )
+                perm_filters.append(
+                    self.model.id_nomenclature_sensitivity
+                    == nomenclature_non_sensible.id_nomenclature
+                )
             if perm.scope_value:
                 if perm.scope_value not in datasets_by_scope:
                     datasets_by_scope[perm.scope_value] = [

From 77e4163b8c118e7ec352131ad89336d86963984a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 11 Apr 2023 16:00:37 +0200
Subject: [PATCH 070/209] meta: get read perms from METADATA module

---
 backend/geonature/core/gn_meta/models.py | 4 ++--
 backend/geonature/core/gn_meta/routes.py | 7 ++-----
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/backend/geonature/core/gn_meta/models.py b/backend/geonature/core/gn_meta/models.py
index f943ea0d48..ad9b11efb6 100644
--- a/backend/geonature/core/gn_meta/models.py
+++ b/backend/geonature/core/gn_meta/models.py
@@ -250,7 +250,7 @@ class TDatasetsQuery(Query):
     def _get_read_scope(self, user=None):
         if user is None:
             user = g.current_user
-        cruved = get_scopes_by_action(id_role=user.id_role, module_code="GEONATURE")
+        cruved = get_scopes_by_action(id_role=user.id_role, module_code="METADATA")
         return cruved["R"]
 
     def _get_create_scope(self, module_code, user=None):
@@ -560,7 +560,7 @@ class TAcquisitionFrameworkQuery(Query):
     def _get_read_scope(self, user=None):
         if user is None:
             user = g.current_user
-        cruved = get_scopes_by_action(id_role=user.id_role, module_code="GEONATURE")
+        cruved = get_scopes_by_action(id_role=user.id_role, module_code="METADATA")
         return cruved["R"]
 
     def filter_by_scope(self, scope, user=None):
diff --git a/backend/geonature/core/gn_meta/routes.py b/backend/geonature/core/gn_meta/routes.py
index 97fe0fc318..4aebfe96e0 100644
--- a/backend/geonature/core/gn_meta/routes.py
+++ b/backend/geonature/core/gn_meta/routes.py
@@ -505,11 +505,8 @@ def get_export_pdf_dataset(id_dataset, scope):
 
 
 @routes.route("/acquisition_frameworks", methods=["GET", "POST"])
-@permissions.check_cruved_scope(
-    "R",
-    get_scope=True,
-)
-def get_acquisition_frameworks(scope):
+@login_required
+def get_acquisition_frameworks():
     """
     Get a simple list of AF without any nested relationships
     Use for AF select in form

From b07d9c45bc36ec8b1670f0406902ac86bf9afd30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 15 May 2023 13:14:22 +0200
Subject: [PATCH 071/209] =?UTF-8?q?places:=20check=5Fcruved=5Fscope=20?=
 =?UTF-8?q?=E2=86=92=20login=5Frequired?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/geonature/core/gn_commons/routes.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index 98eb005c31..e89168cc0f 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -226,7 +226,7 @@ def api_get_id_table_location(schema_dot_table):
 # Gestion des lieux (places) #
 ##############################
 @routes.route("/places", methods=["GET"])
-@permissions.check_cruved_scope("R")
+@login_required
 def list_places():
     places = TPlaces.query.filter_by(id_role=g.current_user.id_role).all()
     return jsonify([p.as_geofeature() for p in places])
@@ -234,7 +234,7 @@ def list_places():
 
 @routes.route("/place", methods=["POST"])  #  XXX best practices recommend plural nouns
 @routes.route("/places", methods=["POST"])
-@permissions.check_cruved_scope("C")
+@login_required
 def add_place():
     data = request.get_json()
     # FIXME check data validity!
@@ -260,7 +260,7 @@ def add_place():
     "/place/<int:id_place>", methods=["DELETE"]
 )  # XXX best practices recommend plural nouns
 @routes.route("/places/<int:id_place>", methods=["DELETE"])
-@permissions.check_cruved_scope("D")
+@login_required
 def delete_place(id_place):
     place = TPlaces.query.get_or_404(id_place)
     if g.current_user.id_role != place.id_role:

From 66020e267efd0308fbc1c131080ed2882ce87c85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 15 May 2023 13:23:42 +0200
Subject: [PATCH 072/209] synthese: add @login_required on unprotected routes

---
 backend/geonature/core/gn_synthese/routes.py | 14 +++++++++++---
 backend/geonature/tests/test_gn_commons.py   |  4 ----
 backend/geonature/tests/test_synthese.py     |  6 +++++-
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 8632703e1f..78803a5d7e 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -957,8 +957,16 @@ def get_bbox():
 
 
 @routes.route("/observation_count_per_column/<column>", methods=["GET"])
+@login_required
 def observation_count_per_column(column):
-    """Get observations count group by a given column"""
+    """
+    Get observations count group by a given column
+
+    This function was used to count observations per dataset,
+    but this usage have been replaced by
+    TDatasets.synthese_records_count.
+    Remove this function as it is very inefficient?
+    """
     if column not in sa.inspect(Synthese).column_attrs:
         raise BadRequest(f"No column name {column} in Synthese")
     synthese_column = getattr(Synthese, column)
@@ -974,7 +982,7 @@ def observation_count_per_column(column):
 
 
 @routes.route("/taxa_distribution", methods=["GET"])
-@json_resp
+@login_required
 def get_taxa_distribution():
     """
     Get taxa distribution for a given dataset or acquisition framework
@@ -1014,7 +1022,7 @@ def get_taxa_distribution():
         query = query.filter(Synthese.id_source == id_source)
 
     data = query.group_by(rank).all()
-    return [{"count": d[0], "group": d[1]} for d in data]
+    return jsonify([{"count": d[0], "group": d[1]} for d in data])
 
 
 @routes.route("/reports", methods=["POST"])
diff --git a/backend/geonature/tests/test_gn_commons.py b/backend/geonature/tests/test_gn_commons.py
index ccd3fed645..b6feec9bd2 100644
--- a/backend/geonature/tests/test_gn_commons.py
+++ b/backend/geonature/tests/test_gn_commons.py
@@ -390,10 +390,6 @@ def test_add_place(self, users):
         response = self.client.post(url_for("gn_commons.add_place"))
         assert response.status_code == Unauthorized.code
 
-        set_logged_user_cookie(self.client, users["noright_user"])
-        response = self.client.post(url_for("gn_commons.add_place"))
-        assert response.status_code == Forbidden.code
-
         set_logged_user_cookie(self.client, users["user"])
         response = self.client.post(url_for("gn_commons.add_place"), data=geofeature)
         assert response.status_code == 200
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 546ed1d80f..186f93d064 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -500,9 +500,13 @@ def test_color_taxon(self, synthese_data, users):
             },
         )
 
-    def test_taxa_distribution(self, synthese_data):
+    def test_taxa_distribution(self, users, synthese_data):
         s = synthese_data["p1_af1"]
 
+        response = self.client.get(url_for("gn_synthese.get_taxa_distribution"))
+        assert response.status_code == Unauthorized.code
+
+        set_logged_user_cookie(self.client, users["self_user"])
         response = self.client.get(url_for("gn_synthese.get_taxa_distribution"))
         assert response.status_code == 200
         assert len(response.json)

From 7b4a026d3922ca74ef58f5fc65fc599a557a52ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 16 May 2023 11:33:50 +0200
Subject: [PATCH 073/209] occtax: declare available permissions

---
 .../e170d1902137_declare_permissions.py       | 96 +++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 contrib/occtax/backend/occtax/migrations/e170d1902137_declare_permissions.py

diff --git a/contrib/occtax/backend/occtax/migrations/e170d1902137_declare_permissions.py b/contrib/occtax/backend/occtax/migrations/e170d1902137_declare_permissions.py
new file mode 100644
index 0000000000..2521b0cc0e
--- /dev/null
+++ b/contrib/occtax/backend/occtax/migrations/e170d1902137_declare_permissions.py
@@ -0,0 +1,96 @@
+"""declare permissions
+
+Revision ID: e170d1902137
+Revises: 1b4f44762020
+Create Date: 2023-05-16 09:55:41.005029
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "e170d1902137"
+down_revision = "1b4f44762020"
+branch_labels = None
+depends_on = ("f051b88a57fd",)
+
+
+def upgrade():
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     ('OCCTAX', 'ALL', 'C', True, 'Créer des relevés')
+                    ,('OCCTAX', 'ALL', 'R', True, 'Voir les relevés')
+                    ,('OCCTAX', 'ALL', 'U', True, 'Modifier les relevés')
+                    ,('OCCTAX', 'ALL', 'E', True, 'Exporter les relevés')
+                    ,('OCCTAX', 'ALL', 'D', True, 'Supprimer des relevés')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code
+        """
+    )
+    op.execute(
+        """
+        WITH bad_permissions AS (
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_commons.t_modules m
+                    USING (id_module)
+            WHERE
+                m.module_code = 'OCCTAX'
+            EXCEPT
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_permissions.t_permissions_available pa ON
+                (p.id_module = pa.id_module
+                    AND p.id_object = pa.id_object
+                    AND p.id_action = pa.id_action)
+        )
+        DELETE
+        FROM
+            gn_permissions.t_permissions p
+                USING bad_permissions bp
+        WHERE
+            bp.id_permission = p.id_permission;
+        """
+    )
+
+
+def downgrade():
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_permissions_available pa
+        USING
+            gn_commons.t_modules m
+        WHERE
+            pa.id_module = m.id_module
+            AND
+            module_code = 'OCCTAX'
+        """
+    )

From 868594d03965bbdeb9e77c3964bb95321e006a9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 15 May 2023 19:29:22 +0200
Subject: [PATCH 074/209] add Permissions.filters property

---
 .../geonature/core/gn_permissions/models.py   | 43 +++++++++++++------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 4c53b7f2d5..485a456d49 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -110,6 +110,22 @@ def __str__(self):
         return self.label
 
 
+class PermFilter:
+    def __init__(self, name, value):
+        self.name = name
+        self.value = value
+
+    def __str__(self):
+        if self.name == "SCOPE":
+            if self.value == 1:
+                return """<i class="fa fa-user" aria-hidden="true"></i> à moi"""
+            elif self.value == 2:
+                return """<i class="fa fa-users" aria-hidden="true"></i> de mon organisme"""
+        elif self.name == "SENSITIVITY":
+            if self.value:
+                return """<i class="fa fa-low-vision" aria-hidden="true"></i>  non sensible"""
+
+
 @serializable
 class Permission(db.Model):
     __tablename__ = "t_permissions"
@@ -173,19 +189,22 @@ def __le__(self, other):
                 return False
         return True
 
-    def has_other_filters_than(self, *expected_filters):
+    @property
+    def filters(self):
+        filters = []
         for name, field in self.filters_fields.items():
-            if name in expected_filters:
-                continue  # this filter is expected, defined or not
-            # for unexpected filters, return True if filter is set
             value = getattr(self, field.name)
             if field.nullable:
-                # for nullable field, consider filter in use if not None
-                if value is not None:
-                    return True
-            else:
-                # for non-nullable field, consider filter in use if value evaluate as True
-                # XXX may not be appropriate for futur non bool filters
-                if value:
-                    return True
+                if value is None:
+                    continue
+            if field.type.python_type == bool:
+                if not value:
+                    continue
+            filters.append(PermFilter(name, value))
+        return filters
+
+    def has_other_filters_than(self, *expected_filters):
+        for flt in self.filters:
+            if flt.name not in expected_filters:
+                return True
         return False

From d26d936c9d586860d7e93b4fc38ccb7dbafa73dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 15 May 2023 11:45:25 +0200
Subject: [PATCH 075/209] improve permissions admin with user/group access

---
 .../geonature/core/gn_permissions/admin.py    | 326 +++++++++++++++++-
 .../geonature/core/gn_permissions/models.py   |   2 +-
 2 files changed, 308 insertions(+), 20 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 925ac04318..b80ccd254f 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -1,6 +1,7 @@
-from flask import has_app_context, Markup
+from flask import url_for, has_app_context, Markup, request
 from flask_admin.contrib.sqla import ModelView
 from flask_admin.contrib.sqla.filters import FilterEqual
+from sqlalchemy.orm import contains_eager, joinedload
 
 from geonature.utils.env import db
 from geonature.core.admin.admin import admin
@@ -12,24 +13,13 @@
     Permission,
     PermissionAvailable,
 )
+from geonature.core.gn_permissions.tools import get_permissions
 from geonature.core.gn_commons.models.base import TModules
 
 from pypnusershub.db.models import User
 
 
-class ObjectAdmin(CruvedProtectedMixin, ModelView):
-    module_code = "ADMIN"
-    object_code = "PERMISSIONS"
-
-    column_list = ("code_object", "description_object", "modules")
-    column_labels = {
-        "code_object": "Code",
-        "description_object": "Description",
-    }
-
-    can_create = False
-    can_edit = False
-    can_delete = False
+### Filters
 
 
 class RoleFilter(DynamicOptionsMixin, FilterEqual):
@@ -70,6 +60,9 @@ def get_dynamic_options(self, view):
             yield from [(a.value, a.label) for a in PermScope.query.all()]
 
 
+### Formatters
+
+
 def filters_formatter(v, c, m, p):
     filters = []
     if m.scope:
@@ -79,6 +72,188 @@ def filters_formatter(v, c, m, p):
     return Markup("<ul>" + "".join(["<li>{}</li>".format(f) for f in filters]) + "</ul>")
 
 
+def modules_formatter(view, context, model, name):
+    modules = [
+        '<a href="{}">{}</a>'.format(
+            url_for("tmodules.details_view", id=module.id_module),
+            Markup.escape(module.module_code),
+        )
+        for module in model.modules
+    ]
+    return Markup(", ".join(modules))
+
+
+def groups_formatter(view, context, model, name):
+    groups = [
+        '<a href="{}">{}</a>'.format(
+            url_for("permissions/group.details_view", id=group.id_role), Markup.escape(group)
+        )
+        for group in model.groups
+    ]
+    return Markup(", ".join(groups))
+
+
+def role_formatter(view, context, model, name):
+    role = model.role
+    if role.groupe:
+        url = url_for("permissions/group.details_view", id=role.id_role)
+        nom = "<b>{}</b>".format(Markup.escape(role.nom_role))
+    else:
+        url = url_for("permissions/user.details_view", id=role.id_role)
+        nom = Markup.escape(role.nom_complet)
+    return Markup('<a href="{}">{}</a>'.format(url, nom))
+
+
+def permissions_formatter(view, context, model, name):
+    available_permissions = (
+        PermissionAvailable.query.join(PermissionAvailable.module)
+        .join(PermissionAvailable.object)
+        .join(PermissionAvailable.action)
+        .options(
+            contains_eager(PermissionAvailable.module),
+            contains_eager(PermissionAvailable.object),
+            contains_eager(PermissionAvailable.action),
+        )
+        .order_by(TModules.module_code, PermObject.id_object, PermAction.id_action)
+        .all()
+    )
+
+    o = '<table class="table">'
+    columns = ["Module", "Object", "Action", "Label"]
+    if model.groupe:
+        return_url = url_for("permissions/group.details_view", id=model.id_role)
+        columns += ["Permissions"]
+    else:
+        return_url = url_for("permissions/user.details_view", id=model.id_role)
+        columns += ["Permissions personnelles", "Permissions effectives"]
+    o += "<thead><tr>" + "".join([f"<th>{col}</th>" for col in columns]) + "</tr></thead>"
+    o += "<tbody>"
+    for ap in available_permissions:
+        own_permissions = list(
+            filter(
+                lambda p: p.module == ap.module
+                and p.object == ap.object
+                and p.action == ap.action,
+                model.permissions,
+            )
+        )
+        permissions = [(own_permissions, True)]
+        if not model.groupe:
+            effective_permissions = list(
+                get_permissions(
+                    id_role=model.id_role,
+                    module_code=ap.module.module_code,
+                    object_code=ap.object.code_object,
+                    action_code=ap.action.code_action,
+                )
+            )
+            permissions.append((effective_permissions, False))
+        o += "<tr>"
+        o += "".join(
+            [
+                f"<td>{col}</td>"
+                for col in [
+                    ap.module.module_code,
+                    ap.object.code_object,
+                    ap.action.code_action,
+                    ap.label,
+                ]
+            ]
+        )
+        for perms, managable in permissions:
+            o += "<td>"
+            if perms:
+                o += '<table class="table table-bordered table-sm" style="border-collapse: separate; border-spacing:0 8px;">'
+                for perm in perms:
+                    flts = perm.filters
+                    o += "<tr>"
+                    if not flts:
+                        o += '<td class="table-success">'
+                    else:
+                        o += '<td class="table-info">'
+                    o += """<div class="row"><div class="col">"""
+                    if not flts:
+                        o += """<i class="fa fa-check" aria-hidden="true"></i>"""
+                    else:
+                        o += "Restrictions :"
+                        o += """<ul class="list-group">"""
+                        for flt in flts:
+                            o += f"""<li class="list-group-item">{flt}</li>"""
+                        o += "</ul>"
+                    o += """</div></div>"""
+                    if managable:
+                        o += """<div class="row"><div class="col text-right">"""
+                        edit_url = url_for(
+                            "permissions/permission.edit_view",
+                            id=perm.id_permission,
+                            url=return_url,
+                        )
+                        delete_url = url_for(
+                            "permissions/permission.delete_view",
+                            id=perm.id_permission,
+                            url=return_url,
+                        )
+                        o += (
+                            f"""<form method="post" action="{delete_url}">"""
+                            f"""<a class="btn btn-primary btn-sm" href="{edit_url}">"""
+                            """<i class="fa fa-pencil" aria-hidden="true"></i>"""
+                            """</a>"""
+                            """<button class="btn btn-danger btn-sm" onclick="return faHelpers.safeConfirm('Supprimer cette permission ?');">"""
+                            """<i class="fa fa-trash" aria-hidden="true"></i>"""
+                            "</button>"
+                            "</form>"
+                        )
+                        o += """</div></div>"""
+                    o += "</td></tr>"
+                o += "</table>"
+            if managable:
+                add_url = url_for(
+                    "permissions/permission.create_view",
+                    id_role=model.id_role,
+                    module_code=ap.module.module_code,
+                    code_object=ap.object.code_object,
+                    code_action=ap.action.code_action,
+                    url=return_url,
+                )
+                o += (
+                    f"""<a class="btn btn-success btn-sm float-right" href="{add_url}">"""
+                    """<i class="fa fa-plus" aria-hidden="true"></i>"""
+                    """</a>"""
+                )
+            o += "</td>"
+        o += "</tr>"
+    o += "</tbody>"
+    o += "</table>"
+    return Markup(o)
+
+
+def permissions_count_formatter(view, context, model, name):
+    url = url_for("permissions/permission.index_view", flt1_rle_equals=model.id_role)
+    return Markup(f'<a href="{url}">{len(model.permissions)}</a>')
+
+
+### ModelViews
+
+
+class ObjectAdmin(CruvedProtectedMixin, ModelView):
+    module_code = "ADMIN"
+    object_code = "PERMISSIONS"
+
+    column_list = ("code_object", "description_object", "modules")
+    column_labels = {
+        "code_object": "Code",
+        "description_object": "Description",
+    }
+    column_default_sort = "id_object"
+    column_formatters = {
+        "modules": modules_formatter,
+    }
+
+    can_create = False
+    can_edit = False
+    can_delete = False
+
+
 class PermissionAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
@@ -95,9 +270,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
     }
     column_searchable_list = ("role.identifiant", "role.nom_complet")
     column_formatters = {
-        "role": lambda v, c, m, p: Markup("<b>{}</b>".format(Markup.escape(m.role.nom_role)))
-        if m.role.groupe
-        else m.role.nom_complet,
+        "role": role_formatter,
         "module": lambda v, c, m, p: m.module.module_code,
         "object": lambda v, c, m, p: m.object.code_object,
         "label": lambda v, c, m, p: m.availability.label if m.availability else None,
@@ -123,7 +296,30 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         ("object.code_object", True),
         ("action.code_action", True),
     ]
-    form_columns = ("role", "module", "object", "action", "scope", "sensitivity_filter")
+    form_columns = ("role", "availability", "scope", "sensitivity_filter")
+
+    def get_query(self):
+        return super().get_query().join(Permission.availability)
+
+    def create_form(self):
+        form = super().create_form()
+        if request.method == "GET":
+            # Set default values from request.args
+            if "id_role" in request.args:
+                form.role.data = User.query.get(request.args.get("id_role", type=int))
+            if {"module_code", "code_object", "code_action"}.issubset(request.args.keys()):
+                form.availability.data = (
+                    PermissionAvailable.query.join(PermissionAvailable.module)
+                    .join(PermissionAvailable.object)
+                    .join(PermissionAvailable.action)
+                    .filter(
+                        TModules.module_code == request.args.get("module_code"),
+                        PermObject.code_object == request.args.get("code_object"),
+                        PermAction.code_action == request.args.get("code_action"),
+                    )
+                    .one_or_none()
+                )
+        return form
 
 
 class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
@@ -142,12 +338,102 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
     }
 
 
+class RolePermAdmin(CruvedProtectedMixin, ModelView):
+    module_code = "ADMIN"
+    object_code = "PERMISSIONS"
+
+    can_create = False
+    can_edit = False
+    can_delete = False
+    can_export = False
+    can_view_details = True
+
+    column_select_related_list = ("permissions",)
+    column_labels = {
+        "nom_role": "Nom",
+        "prenom_role": "Prénom",
+        "groups": "Groupes",
+        "permissions": "Permissions",
+        "permissions_count": "Nombre de permissions",
+    }
+    column_formatters = {
+        "groups": groups_formatter,
+        "permissions_count": permissions_count_formatter,
+    }
+    column_formatters_detail = {
+        "groups": groups_formatter,
+        "permissions": permissions_formatter,
+        "permissions_count": permissions_count_formatter,
+    }
+
+
+class GroupPermAdmin(RolePermAdmin):
+    column_list = (
+        "nom_role",
+        "permissions_count",
+    )
+    column_details_list = ("nom_role", "permissions_count", "permissions")
+
+    def get_query(self):
+        # TODO: filter_by_app
+        return super().get_query().filter_by(groupe=True)
+
+
+class UserPermAdmin(RolePermAdmin):
+    column_list = (
+        "identifiant",
+        "nom_role",
+        "prenom_role",
+        "groups",
+        "permissions_count",
+    )
+    column_labels = {
+        **RolePermAdmin.column_labels,
+        "permissions_count": "Nombre de permissions non héritées",
+    }
+    column_details_list = (
+        "identifiant",
+        "nom_role",
+        "prenom_role",
+        "groups",
+        "permissions_count",
+        "permissions",
+    )
+
+    def get_query(self):
+        # TODO: filter_by_app
+        return super().get_query().filter_by(groupe=False)
+
+
+admin.add_view(
+    GroupPermAdmin(
+        User,
+        db.session,
+        name="Groupes",
+        category="Permissions",
+        endpoint="permissions/group",
+    )
+)
+
+
+admin.add_view(
+    UserPermAdmin(
+        User,
+        db.session,
+        name="Utilisateurs",
+        category="Permissions",
+        endpoint="permissions/user",
+    )
+)
+
+
 admin.add_view(
     ObjectAdmin(
         PermObject,
         db.session,
         name="Objets",
         category="Permissions",
+        endpoint="permissions/object",
     )
 )
 
@@ -156,8 +442,9 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
     PermissionAdmin(
         Permission,
         db.session,
-        name="Permissions",
+        name="Toutes les permissions",
         category="Permissions",
+        endpoint="permissions/permission",
     )
 )
 
@@ -168,5 +455,6 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
         db.session,
         name="Permissions disponibles",
         category="Permissions",
+        endpoint="permissions/availablepermission",
     )
 )
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 485a456d49..47f6fa3289 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -140,7 +140,7 @@ class Permission(db.Model):
         default=select([PermObject.id_object]).where(PermObject.code_object == "ALL"),
     )
 
-    role = db.relationship(User)
+    role = db.relationship(User, backref="permissions")
     action = db.relationship(PermAction)
     module = db.relationship("TModules")
     object = db.relationship(PermObject)

From f17285a9f5253b3d5e3a109e3a4e811f3dfcd762 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 14:14:57 +0200
Subject: [PATCH 076/209] optimize permissions with caching

---
 backend/geonature/app.py                      |  3 +-
 .../geonature/core/gn_permissions/tools.py    | 69 ++++++++-----------
 2 files changed, 31 insertions(+), 41 deletions(-)

diff --git a/backend/geonature/app.py b/backend/geonature/app.py
index 22b066d025..b2a7b4a018 100755
--- a/backend/geonature/app.py
+++ b/backend/geonature/app.py
@@ -162,7 +162,8 @@ def load_current_user():
             g.current_user = user_from_token(request.cookies["token"]).role
         except (KeyError, UnreadableAccessRightsError, AccessRightsExpiredError):
             g.current_user = None
-        g.permissions_by_action = {}
+        g._permissions_by_user = {}
+        g._permissions = {}
 
     if config.get("SENTRY_DSN"):
         from sentry_sdk import set_tag, set_user
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index b43e0d04d5..ac89fcb115 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -19,6 +19,8 @@
 def _get_user_permissions(id_role):
     return (
         Permission.query.options(
+            joinedload(Permission.module),
+            joinedload(Permission.object),
             joinedload(Permission.action),
         )
         .filter(
@@ -29,46 +31,41 @@ def _get_user_permissions(id_role):
                 Permission.role.has(User.members.any(User.id_role == id_role)),
             ),
         )
-        # These ordering ensure groupby is working properly
-        .order_by(Permission.id_action)
         # remove duplicate permissions (defined at group and user level, or defined in several groups)
+        .order_by(Permission.id_module, Permission.id_object, Permission.id_action)
         .distinct(
-            Permission.id_action,
             Permission.id_module,
             Permission.id_object,
+            Permission.id_action,
             *Permission.filters_fields.values(),
         )
         .all()
     )
 
 
-def _get_user_permissions_by_action(id_role):
-    permissions = _get_user_permissions(id_role)
-    # This ensures empty permissions list for action without permissions
-    permissions_by_action = {action.code_action: [] for action in PermAction.query.all()}
-    # Note: groupby require sorted data, which is done at SQL level
-    permissions_by_action.update(
-        {
-            action_code: list(perms)
-            for action_code, perms in groupby(permissions, key=lambda p: p.action.code_action)
-        }
-    )
-    return permissions_by_action
-
-
-def get_user_permissions_by_action(id_role=None):
-    """
-    This function add caching to _get_user_permissions_by_action
-    and use g.current_user as default role.
-    """
+def get_user_permissions(id_role=None):
     if id_role is None:
         id_role = g.current_user.id_role
-    if "permissions_by_action" in g:  # before_request have been called
-        if id_role not in g.permissions_by_action:
-            g.permissions_by_action[id_role] = _get_user_permissions_by_action(id_role)
-        return g.permissions_by_action[id_role]
-    else:
-        return _get_user_permissions_by_action(id_role)
+    if id_role not in g._permissions_by_user:
+        g._permissions_by_user[id_role] = _get_user_permissions(id_role)
+    return g._permissions_by_user[id_role]
+
+
+def _get_permissions(id_role, module_code, object_code, action_code):
+    permissions = {
+        p
+        for p in get_user_permissions(id_role)
+        if p.module.module_code == module_code
+        and p.object.code_object == object_code
+        and p.action.code_action == action_code
+    }
+
+    # Remove all permissions supersed by another permission
+    for p1, p2 in permutations(permissions, 2):
+        if p1 in permissions and p1 <= p2:
+            permissions.remove(p1)
+
+    return permissions
 
 
 def get_permissions(action_code, id_role=None, module_code=None, object_code=None):
@@ -91,18 +88,10 @@ def get_permissions(action_code, id_role=None, module_code=None, object_code=Non
         else:
             object_code = "ALL"
 
-    permissions = {
-        p
-        for p in get_user_permissions_by_action(id_role)[action_code]
-        if p.module.module_code == module_code and p.object.code_object == object_code
-    }
-
-    # Remove all permissions supersed by another permission
-    for p1, p2 in permutations(permissions, 2):
-        if p1 in permissions and p1 <= p2:
-            permissions.remove(p1)
-
-    return permissions
+    ident = (id_role, module_code, object_code, action_code)
+    if ident not in g._permissions:
+        g._permissions[ident] = _get_permissions(*ident)
+    return g._permissions[ident]
 
 
 def get_scope(action_code, id_role=None, module_code=None, object_code=None):

From 40bad6a78712884eb486e3b3aaa4f3431b0267e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 14:32:24 +0200
Subject: [PATCH 077/209] permissions admin: hide useless add/edit buttons

---
 backend/geonature/core/gn_permissions/admin.py  | 13 ++++++++-----
 backend/geonature/core/gn_permissions/models.py |  9 +++++++++
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index b80ccd254f..c50036832a 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -193,11 +193,14 @@ def permissions_formatter(view, context, model, name):
                             id=perm.id_permission,
                             url=return_url,
                         )
+                        o += f"""<form method="post" action="{delete_url}">"""
+                        if len(ap.filters) > 0:
+                            o += (
+                                f"""<a class="btn btn-primary btn-sm" href="{edit_url}">"""
+                                """<i class="fa fa-pencil" aria-hidden="true"></i>"""
+                                """</a>"""
+                            )
                         o += (
-                            f"""<form method="post" action="{delete_url}">"""
-                            f"""<a class="btn btn-primary btn-sm" href="{edit_url}">"""
-                            """<i class="fa fa-pencil" aria-hidden="true"></i>"""
-                            """</a>"""
                             """<button class="btn btn-danger btn-sm" onclick="return faHelpers.safeConfirm('Supprimer cette permission ?');">"""
                             """<i class="fa fa-trash" aria-hidden="true"></i>"""
                             "</button>"
@@ -206,7 +209,7 @@ def permissions_formatter(view, context, model, name):
                         o += """</div></div>"""
                     o += "</td></tr>"
                 o += "</table>"
-            if managable:
+            if managable and (not perms or len(ap.filters) > 1):
                 add_url = url_for(
                     "permissions/permission.create_view",
                     id_role=model.id_role,
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 47f6fa3289..d62877410e 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -106,6 +106,15 @@ class PermissionAvailable(db.Model):
     scope_filter = db.Column(db.Boolean, server_default=sa.false())
     sensitivity_filter = db.Column(db.Boolean, server_default=sa.false(), nullable=False)
 
+    filters_fields = {
+        "SCOPE": scope_filter,
+        "SENSITIVITY": sensitivity_filter,
+    }
+
+    @property
+    def filters(self):
+        return [k for k, v in self.filters_fields.items() if getattr(self, v.name)]
+
     def __str__(self):
         return self.label
 

From b66bff3e1fbd6030d46e934732ffe46fd277f8f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 16 May 2023 11:33:50 +0200
Subject: [PATCH 078/209] occhab: declare available permissions

---
 .../85efc9bb5a47_declare_permissions.py       | 96 +++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 contrib/gn_module_occhab/backend/gn_module_occhab/migrations/85efc9bb5a47_declare_permissions.py

diff --git a/contrib/gn_module_occhab/backend/gn_module_occhab/migrations/85efc9bb5a47_declare_permissions.py b/contrib/gn_module_occhab/backend/gn_module_occhab/migrations/85efc9bb5a47_declare_permissions.py
new file mode 100644
index 0000000000..bb3d430478
--- /dev/null
+++ b/contrib/gn_module_occhab/backend/gn_module_occhab/migrations/85efc9bb5a47_declare_permissions.py
@@ -0,0 +1,96 @@
+"""declare permissions
+
+Revision ID: 85efc9bb5a47
+Revises: 2984569d5df6
+Create Date: 2023-05-17 14:34:51.804258
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "85efc9bb5a47"
+down_revision = "2984569d5df6"
+branch_labels = None
+depends_on = ("f051b88a57fd",)
+
+
+def upgrade():
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     ('OCCHAB', 'ALL', 'C', True, 'Créer des habitats')
+                    ,('OCCHAB', 'ALL', 'R', True, 'Voir les habitats')
+                    ,('OCCHAB', 'ALL', 'U', True, 'Modifier les habitats')
+                    ,('OCCHAB', 'ALL', 'E', True, 'Exporter les habitats')
+                    ,('OCCHAB', 'ALL', 'D', True, 'Supprimer des habitats')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code
+        """
+    )
+    op.execute(
+        """
+        WITH bad_permissions AS (
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_commons.t_modules m
+                    USING (id_module)
+            WHERE
+                m.module_code = 'OCCHAB'
+            EXCEPT
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_permissions.t_permissions_available pa ON
+                (p.id_module = pa.id_module
+                    AND p.id_object = pa.id_object
+                    AND p.id_action = pa.id_action)
+        )
+        DELETE
+        FROM
+            gn_permissions.t_permissions p
+                USING bad_permissions bp
+        WHERE
+            bp.id_permission = p.id_permission;
+        """
+    )
+
+
+def downgrade():
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_permissions_available pa
+        USING
+            gn_commons.t_modules m
+        WHERE
+            pa.id_module = m.id_module
+            AND
+            module_code = 'OCCHAB'
+        """
+    )

From ede52474d4826a103fbb5e6a5e77bf8839f0803a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 17:51:48 +0200
Subject: [PATCH 079/209] permissions corrections in some routes

---
 .../core/gn_commons/validation/routes.py       |  2 +-
 backend/geonature/core/users/routes.py         | 10 ++++------
 backend/geonature/tests/test_pr_occhab.py      |  5 ++++-
 .../backend/gn_module_occhab/blueprint.py      |  1 +
 .../backend/gn_module_validation/blueprint.py  | 18 +++++++++++++-----
 5 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/backend/geonature/core/gn_commons/validation/routes.py b/backend/geonature/core/gn_commons/validation/routes.py
index 6c975dc3a9..3a1ad3bcc9 100644
--- a/backend/geonature/core/gn_commons/validation/routes.py
+++ b/backend/geonature/core/gn_commons/validation/routes.py
@@ -18,7 +18,7 @@
 
 
 @routes.route("/history/<uuid_attached_row>", methods=["GET"])
-@permissions.check_cruved_scope("R")
+@permissions.check_cruved_scope("R", module_code="SYNTHESE")
 @json_resp
 def get_hist(uuid_attached_row):
     # Test if uuid_attached_row is uuid
diff --git a/backend/geonature/core/users/routes.py b/backend/geonature/core/users/routes.py
index e69f210d4d..55d2fdece5 100644
--- a/backend/geonature/core/users/routes.py
+++ b/backend/geonature/core/users/routes.py
@@ -317,7 +317,7 @@ def after_confirmation():
 
 
 @routes.route("/role", methods=["PUT"])
-@permissions.check_cruved_scope("R")
+@permissions.login_required
 @json_resp
 def update_role():
     """
@@ -362,9 +362,9 @@ def update_role():
 
 
 @routes.route("/password/change", methods=["PUT"])
-@check_auth(1, True)
+@permissions.login_required
 @json_resp
-def change_password(id_role):
+def change_password():
     """
     Modifie le mot de passe de l'utilisateur connecté et de son ancien mdp
     Fait appel à l'API UsersHub
@@ -372,9 +372,7 @@ def change_password(id_role):
     if not current_app.config["ACCOUNT_MANAGEMENT"].get("ENABLE_USER_MANAGEMENT", False):
         return {"message": "Page introuvable"}, 404
 
-    user = DB.session.query(User).get(id_role)
-    if not user:
-        return {"msg": "Droit insuffisant"}, 403
+    user = g.current_user
     data = request.get_json()
 
     init_password = data.get("init_password", None)
diff --git a/backend/geonature/tests/test_pr_occhab.py b/backend/geonature/tests/test_pr_occhab.py
index 0eb602cdd2..4396459717 100644
--- a/backend/geonature/tests/test_pr_occhab.py
+++ b/backend/geonature/tests/test_pr_occhab.py
@@ -376,6 +376,9 @@ def test_delete_station(self, users, station):
             Station.query.filter_by(id_station=station.id_station).exists()
         ).scalar()
 
-    def test_get_default_nomenclatures(self):
+    def test_get_default_nomenclatures(self, users):
+        response = self.client.get(url_for("occhab.get_default_nomenclatures"))
+        assert response.status_code == Unauthorized.code
+        set_logged_user_cookie(self.client, users["user"])
         response = self.client.get(url_for("occhab.get_default_nomenclatures"))
         assert response.status_code == 200
diff --git a/contrib/gn_module_occhab/backend/gn_module_occhab/blueprint.py b/contrib/gn_module_occhab/backend/gn_module_occhab/blueprint.py
index 4da942ddb2..c8a4df64cf 100644
--- a/contrib/gn_module_occhab/backend/gn_module_occhab/blueprint.py
+++ b/contrib/gn_module_occhab/backend/gn_module_occhab/blueprint.py
@@ -260,6 +260,7 @@ def export_all_habitats(
 
 
 @blueprint.route("/defaultNomenclatures", methods=["GET"])
+@login_required
 def get_default_nomenclatures():
     """Get default nomenclatures define in occhab module
 
diff --git a/contrib/gn_module_validation/backend/gn_module_validation/blueprint.py b/contrib/gn_module_validation/backend/gn_module_validation/blueprint.py
index 9b4b9786b5..0bbde8d737 100644
--- a/contrib/gn_module_validation/backend/gn_module_validation/blueprint.py
+++ b/contrib/gn_module_validation/backend/gn_module_validation/blueprint.py
@@ -4,6 +4,7 @@
 
 from flask import Blueprint, request, jsonify, current_app, g
 from flask.json import jsonify
+from werkzeug.exceptions import Forbidden
 import sqlalchemy as sa
 from sqlalchemy.orm import aliased, contains_eager, selectinload
 from marshmallow import ValidationError
@@ -28,7 +29,7 @@
 
 
 @blueprint.route("", methods=["GET", "POST"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="VALIDATION")
+@permissions.check_cruved_scope("C", get_scope=True, module_code="VALIDATION")
 def get_synthese_data(scope):
     """
     Return synthese and t_validations data filtered by form params
@@ -193,7 +194,7 @@ def get_synthese_data(scope):
 
 
 @blueprint.route("/statusNames", methods=["GET"])
-@permissions.check_cruved_scope("R", module_code="VALIDATION")
+@permissions.check_cruved_scope("C", module_code="VALIDATION")
 def get_statusNames():
     nomenclatures = (
         TNomenclatures.query.join(BibNomenclaturesTypes)
@@ -212,8 +213,8 @@ def get_statusNames():
 
 
 @blueprint.route("/<id_synthese>", methods=["POST"])
-@permissions.check_cruved_scope("C", module_code="VALIDATION")
-def post_status(id_synthese):
+@permissions.check_cruved_scope("C", get_scope=True, module_code="VALIDATION")
+def post_status(scope, id_synthese):
     data = dict(request.get_json())
     try:
         id_validation_status = data["statut"]
@@ -232,6 +233,10 @@ def post_status(id_synthese):
 
         # t_validations.uuid_attached_row:
         synthese = Synthese.query.get_or_404(int(id))
+
+        if not synthese.has_instance_permission(scope):
+            raise Forbidden
+
         uuid = synthese.unique_id_sinp
 
         # t_validations.id_validator:
@@ -269,12 +274,15 @@ def post_status(id_synthese):
 
 
 @blueprint.route("/date/<uuid:uuid>", methods=["GET"])
-def get_validation_date(uuid):
+@permissions.check_cruved_scope("C", get_scope=True, module_code="VALIDATION")
+def get_validation_date(scope, uuid):
     """
     Retourne la date de validation
     pour l'observation uuid
     """
     s = Synthese.query.filter_by(unique_id_sinp=uuid).lateraljoin_last_validation().first_or_404()
+    if not s.has_instance_permission(scope):
+        raise Forbidden
     if s.last_validation:
         return jsonify(str(s.last_validation.validation_date))
     else:

From cb9571a193c77fe9d7f06f76af2725dd09509863 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 15:45:38 +0200
Subject: [PATCH 080/209] validation: declare available permissions

---
 .../migrations/__init__.py                    |  0
 .../df93a68242ee_declare_permissions.py       | 92 +++++++++++++++++++
 contrib/gn_module_validation/setup.py         |  1 +
 3 files changed, 93 insertions(+)
 create mode 100644 contrib/gn_module_validation/backend/gn_module_validation/migrations/__init__.py
 create mode 100644 contrib/gn_module_validation/backend/gn_module_validation/migrations/df93a68242ee_declare_permissions.py

diff --git a/contrib/gn_module_validation/backend/gn_module_validation/migrations/__init__.py b/contrib/gn_module_validation/backend/gn_module_validation/migrations/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/contrib/gn_module_validation/backend/gn_module_validation/migrations/df93a68242ee_declare_permissions.py b/contrib/gn_module_validation/backend/gn_module_validation/migrations/df93a68242ee_declare_permissions.py
new file mode 100644
index 0000000000..49f837c7b0
--- /dev/null
+++ b/contrib/gn_module_validation/backend/gn_module_validation/migrations/df93a68242ee_declare_permissions.py
@@ -0,0 +1,92 @@
+"""declare permissions
+
+Revision ID: df93a68242ee
+Revises: 85efc9bb5a47
+Create Date: 2023-05-17 15:15:38.833529
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = "df93a68242ee"
+down_revision = None
+branch_labels = ("validation",)
+depends_on = ("f051b88a57fd",)
+
+
+def upgrade():
+    op.execute(
+        """
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     ('VALIDATION', 'ALL', 'C', True, 'Valider les observations')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code
+        """
+    )
+    op.execute(
+        """
+        WITH bad_permissions AS (
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_commons.t_modules m
+                    USING (id_module)
+            WHERE
+                m.module_code = 'VALIDATION'
+            EXCEPT
+            SELECT
+                p.id_permission
+            FROM
+                gn_permissions.t_permissions p
+            JOIN gn_permissions.t_permissions_available pa ON
+                (p.id_module = pa.id_module
+                    AND p.id_object = pa.id_object
+                    AND p.id_action = pa.id_action)
+        )
+        DELETE
+        FROM
+            gn_permissions.t_permissions p
+                USING bad_permissions bp
+        WHERE
+            bp.id_permission = p.id_permission;
+        """
+    )
+
+
+def downgrade():
+    op.execute(
+        """
+        DELETE FROM
+            gn_permissions.t_permissions_available pa
+        USING
+            gn_commons.t_modules m
+        WHERE
+            pa.id_module = m.id_module
+            AND
+            module_code = 'VALIDATION'
+        """
+    )
diff --git a/contrib/gn_module_validation/setup.py b/contrib/gn_module_validation/setup.py
index f3a9214e4e..893582f2f8 100644
--- a/contrib/gn_module_validation/setup.py
+++ b/contrib/gn_module_validation/setup.py
@@ -29,6 +29,7 @@
             "picto = gn_module_validation:MODULE_PICTO",
             "blueprint = gn_module_validation.blueprint:blueprint",
             "config_schema = gn_module_validation.conf_schema_toml:GnModuleSchemaConf",
+            "migrations = gn_module_validation:migrations",
         ],
     },
     classifiers=[

From fbbf4178b0516147a12bcb38ffaeace84283736f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 17 May 2023 19:24:27 +0200
Subject: [PATCH 081/209] improve permissions admin

---
 .../geonature/core/gn_permissions/admin.py    | 56 +++++++++++--------
 .../geonature/core/gn_permissions/models.py   | 51 ++++++++++++++++-
 2 files changed, 82 insertions(+), 25 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index c50036832a..b428e061cd 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -1,6 +1,7 @@
 from flask import url_for, has_app_context, Markup, request
 from flask_admin.contrib.sqla import ModelView
 from flask_admin.contrib.sqla.filters import FilterEqual
+import sqlalchemy as sa
 from sqlalchemy.orm import contains_eager, joinedload
 
 from geonature.utils.env import db
@@ -105,18 +106,7 @@ def role_formatter(view, context, model, name):
 
 
 def permissions_formatter(view, context, model, name):
-    available_permissions = (
-        PermissionAvailable.query.join(PermissionAvailable.module)
-        .join(PermissionAvailable.object)
-        .join(PermissionAvailable.action)
-        .options(
-            contains_eager(PermissionAvailable.module),
-            contains_eager(PermissionAvailable.object),
-            contains_eager(PermissionAvailable.action),
-        )
-        .order_by(TModules.module_code, PermObject.id_object, PermAction.id_action)
-        .all()
-    )
+    available_permissions = PermissionAvailable.query.nice_order().all()
 
     o = '<table class="table">'
     columns = ["Module", "Object", "Action", "Label"]
@@ -163,6 +153,8 @@ def permissions_formatter(view, context, model, name):
         for perms, managable in permissions:
             o += "<td>"
             if perms:
+                if len(perms) > 1:
+                    o += f"{len(perms)} permissions :"
                 o += '<table class="table table-bordered table-sm" style="border-collapse: separate; border-spacing:0 8px;">'
                 for perm in perms:
                     flts = perm.filters
@@ -242,6 +234,10 @@ class ObjectAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
 
+    can_create = False
+    can_edit = False
+    can_delete = False
+
     column_list = ("code_object", "description_object", "modules")
     column_labels = {
         "code_object": "Code",
@@ -252,10 +248,6 @@ class ObjectAdmin(CruvedProtectedMixin, ModelView):
         "modules": modules_formatter,
     }
 
-    can_create = False
-    can_edit = False
-    can_delete = False
-
 
 class PermissionAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
@@ -271,6 +263,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         "availability": "Permission disponible",
         "sensitivity_filter": "Exclure les données sensibles",
     }
+    column_select_related_list = ("availability",)
     column_searchable_list = ("role.identifiant", "role.nom_complet")
     column_formatters = {
         "role": role_formatter,
@@ -294,15 +287,17 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         ("action", "action.code_action"),
     )
     column_default_sort = [
-        ("role.nom_complet", True),
-        ("module.module_code", True),
-        ("object.code_object", True),
-        ("action.code_action", True),
+        ("role.nom_complet", False),
+        ("module.module_code", False),
+        ("object.code_object", False),
+        ("id_action", False),
     ]
     form_columns = ("role", "availability", "scope", "sensitivity_filter")
-
-    def get_query(self):
-        return super().get_query().join(Permission.availability)
+    form_args = dict(
+        availability=dict(
+            query_factory=lambda: PermissionAvailable.query.nice_order(),
+        )
+    )
 
     def create_form(self):
         form = super().create_form()
@@ -329,6 +324,10 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
 
+    can_create = False
+    can_delete = False
+    can_export = False
+
     column_labels = {
         "scope": "Portée",
         "object": "Objet",
@@ -339,6 +338,17 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
         "module": lambda v, c, m, p: m.module.module_code,
         "object": lambda v, c, m, p: m.object.code_object,
     }
+    column_sortable_list = (
+        ("module", "module.module_code"),
+        ("object", "object.code_object"),
+        ("action", "action.code_action"),
+    )
+    column_default_sort = [
+        ("module.module_code", False),
+        ("object.code_object", False),
+        ("id_action", False),
+    ]
+    form_columns = ("scope_filter", "sensitivity_filter")
 
 
 class RolePermAdmin(CruvedProtectedMixin, ModelView):
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index d62877410e..9a81ef5c9d 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -1,11 +1,18 @@
 """
 Models of gn_permissions schema
 """
+from packaging import version
 
 import sqlalchemy as sa
 from sqlalchemy import ForeignKey
 from sqlalchemy.sql import select
-from sqlalchemy.orm import foreign
+from sqlalchemy.orm import foreign, joinedload, contains_eager
+import flask_sqlalchemy
+
+if version.parse(flask_sqlalchemy.__version__) >= version.parse("3"):
+    from flask_sqlalchemy.query import Query
+else:
+    from flask_sqlalchemy import BaseQuery as Query
 
 from utils_flask_sqla.serializers import serializable
 from pypnusershub.db.models import User
@@ -84,9 +91,42 @@ def __str__(self):
 TObjects = PermObject
 
 
+def _nice_order(model, qs):
+    from geonature.core.gn_commons.models import TModules
+
+    return (
+        qs.join(model.module)
+        .join(model.object)
+        .join(model.action)
+        .options(
+            contains_eager(model.module),
+            contains_eager(model.object),
+            contains_eager(model.action),
+        )
+        .order_by(
+            TModules.module_code,
+            # ensure ALL at first:
+            sa.case([(PermObject.code_object == "ALL", "1")], else_=PermObject.code_object),
+            model.id_action,
+        )
+    )
+
+
+class PermissionAvailableQuery(Query):
+    def nice_order(self):
+        return _nice_order(PermissionAvailable, self)
+
+
+class PermissionQuery(Query):
+    def nice_order(self):
+        return _nice_order(Permission, self)
+
+
 class PermissionAvailable(db.Model):
     __tablename__ = "t_permissions_available"
     __table_args__ = {"schema": "gn_permissions"}
+    query_class = PermissionAvailableQuery
+
     id_module = db.Column(
         db.Integer, ForeignKey("gn_commons.t_modules.id_module"), primary_key=True
     )
@@ -116,7 +156,12 @@ def filters(self):
         return [k for k, v in self.filters_fields.items() if getattr(self, v.name)]
 
     def __str__(self):
-        return self.label
+        s = self.module.module_label
+        if self.object.code_object != "ALL":
+            object_label = self.object.code_object.title().replace("_", " ")
+            s += f" | {object_label}"
+        s += f" | {self.label}"
+        return s
 
 
 class PermFilter:
@@ -139,6 +184,8 @@ def __str__(self):
 class Permission(db.Model):
     __tablename__ = "t_permissions"
     __table_args__ = {"schema": "gn_permissions"}
+    query_class = PermissionQuery
+
     id_permission = db.Column(db.Integer, primary_key=True)
     id_role = db.Column(db.Integer, ForeignKey("utilisateurs.t_roles.id_role"))
     id_action = db.Column(db.Integer, ForeignKey(PermAction.id_action))

From 487d886432fe0695388013f02b7f03c87bc95e17 Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Mon, 22 May 2023 16:14:15 +0200
Subject: [PATCH 082/209] permission admin: Hide unnecessary fields

---
 .../geonature/core/gn_permissions/admin.py    | 45 +++++++++++++++++++
 backend/static/js/hide_unnecessary_filters.js | 16 +++++++
 2 files changed, 61 insertions(+)
 create mode 100644 backend/static/js/hide_unnecessary_filters.js

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index b428e061cd..05f38a236e 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -2,6 +2,8 @@
 from flask_admin.contrib.sqla import ModelView
 from flask_admin.contrib.sqla.filters import FilterEqual
 import sqlalchemy as sa
+from flask_admin.contrib.sqla.fields import QuerySelectField
+from flask_admin.form.widgets import Select2Widget
 from sqlalchemy.orm import contains_eager, joinedload
 
 from geonature.utils.env import db
@@ -227,6 +229,43 @@ def permissions_count_formatter(view, context, model, name):
     return Markup(f'<a href="{url}">{len(model.permissions)}</a>')
 
 
+### Widgets
+
+
+class OptionSelect2Widget(Select2Widget):
+    @classmethod
+    def render_option(cls, value, label, options):
+        return super().render_option(value, label, options.pop("selected"), **options)
+
+
+### Fields
+
+
+class OptionQuerySelectField(QuerySelectField):
+    """
+    Overrides the QuerySelectField class from flask admin to allow
+    other attributes on a select option.
+
+    options_additional_values is added in form_args, it is a list of
+    strings, each element is the name of the attribute in the model
+    which will be added on the option
+    """
+
+    widget = OptionSelect2Widget()
+
+    def __init__(self, *args, **kwargs):
+        self.options_additional_values = kwargs.pop("options_additional_values")
+        super().__init__(*args, **kwargs)
+
+    def iter_choices(self):
+        if self.allow_blank:
+            yield ("__None", self.blank_text, {"selected": self.data is None})
+        for pk, obj in self._get_object_list():
+            options = {k: getattr(obj, k) for k in self.options_additional_values}
+            options["selected"] = obj == self.data
+            yield (pk, self.get_label(obj), options)
+
+
 ### ModelViews
 
 
@@ -293,12 +332,18 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         ("id_action", False),
     ]
     form_columns = ("role", "availability", "scope", "sensitivity_filter")
+    form_overrides = dict(availability=OptionQuerySelectField)
     form_args = dict(
         availability=dict(
             query_factory=lambda: PermissionAvailable.query.nice_order(),
+            options_additional_values=["sensitivity_filter", "scope_filter"],
         )
     )
 
+    def render(self, template, **kwargs):
+        self.extra_js = [url_for("static", filename="js/hide_unnecessary_filters.js")]
+        return super().render(template, **kwargs)
+
     def create_form(self):
         form = super().create_form()
         if request.method == "GET":
diff --git a/backend/static/js/hide_unnecessary_filters.js b/backend/static/js/hide_unnecessary_filters.js
new file mode 100644
index 0000000000..b652685d54
--- /dev/null
+++ b/backend/static/js/hide_unnecessary_filters.js
@@ -0,0 +1,16 @@
+$('#availability').on('change', function() {
+    if ($(this).find(":selected")[0].hasAttribute("sensitivity_filter"))
+        $("#sensitivity_filter").parent().show();
+    else
+        $("#sensitivity_filter").parent().hide();
+        $('#sensitivity_filter').prop('checked', false);
+
+    if ($(this).find(":selected")[0].hasAttribute("scope_filter"))
+        $("#scope").parent().show();
+    else {
+        $("#scope").parent().hide();
+        $("#scope").val("__None").trigger("change");
+    }
+});
+
+$('#availability').trigger('change');

From 5962ab7e1b208bb334256bb05ebae5dc2a374097 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 16:10:25 +0200
Subject: [PATCH 083/209] add geonature permissions supergrant command

---
 .../geonature/core/gn_permissions/commands.py | 69 +++++++++++++++++++
 .../geonature/core/gn_permissions/models.py   |  1 +
 .../geonature/core/gn_permissions/routes.py   |  5 +-
 3 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 backend/geonature/core/gn_permissions/commands.py

diff --git a/backend/geonature/core/gn_permissions/commands.py b/backend/geonature/core/gn_permissions/commands.py
new file mode 100644
index 0000000000..7ea1515a4e
--- /dev/null
+++ b/backend/geonature/core/gn_permissions/commands.py
@@ -0,0 +1,69 @@
+import click
+from click import UsageError
+import sqlalchemy as sa
+from sqlalchemy.orm import contains_eager, joinedload
+from sqlalchemy.orm.exc import MultipleResultsFound, NoResultFound
+
+from pypnusershub.db.models import User
+
+from geonature.utils.env import db
+from geonature.core.gn_permissions.models import Permission, PermissionAvailable
+
+
+@click.command(
+    help="Ajouter des permissions administrateurs sur tous les modules pour un utilisateur ou un groupe."
+)
+@click.option("--id", "id_role", type=int)
+@click.option("--nom", "nom_role")
+@click.option("--prenom", "prenom_role")
+@click.option("--group", "groupe", flag_value=True, default=None, help="Le rôle est un groupe.")
+@click.option(
+    "--user", "groupe", flag_value=False, default=None, help="Le rôle est un utilisateur."
+)
+@click.option(
+    "--skip-existing",
+    is_flag=True,
+    help="Ne pas ajouter de permission administrateur s’il existe déjà une permission",
+)
+@click.option(
+    "--dry-run",
+    is_flag=True,
+    help="Uniquement afficher les permissions nécessaires, sans les ajouter en base",
+)
+def supergrant(skip_existing, dry_run, **filters):
+    filters = {k: v for k, v in filters.items() if v is not None}
+    if not filters:
+        raise UsageError("Veuillez sélectionner le rôle à promouvoir.")
+    try:
+        role = User.query.filter_by(**filters).one()
+    except MultipleResultsFound:
+        raise UsageError("Plusieurs rôles correspondent à vos filtres, veuillez les affiner.")
+    except NoResultFound:
+        raise UsageError("Aucun rôle ne correspond à vos filtres, veuillez les corriger.")
+    if not click.confirm(
+        f"Ajouter les permissions administrateur au rôle {role.id_role} ({role.nom_complet}) ?"
+    ):
+        raise click.Abort()
+
+    for ap in PermissionAvailable.query.outerjoin(
+        Permission, sa.and_(PermissionAvailable.permissions, Permission.id_role == role.id_role)
+    ).options(
+        contains_eager(PermissionAvailable.permissions),
+        joinedload(PermissionAvailable.module),
+        joinedload(PermissionAvailable.object),
+        joinedload(PermissionAvailable.action),
+    ):
+        for perm in ap.permissions:
+            if skip_existing or not perm.filters:
+                break
+        else:
+            # The role does not have any permission of this type,
+            # or only permissions with at least one filter.
+            # We add an new permission without any filters.
+            click.echo(
+                f"Nouvelle permission : module '{ap.module.module_code}', "
+                f"objet '{ap.object.code_object}', action '{ap.action.code_action}'"
+            )
+            db.session.add(Permission(availability=ap, role=role))
+    if not dry_run:
+        db.session.commit()
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 9a81ef5c9d..3d3fad2369 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -212,6 +212,7 @@ class Permission(db.Model):
             foreign(id_object) == PermissionAvailable.id_object,
             foreign(id_action) == PermissionAvailable.id_action,
         ),
+        backref="permissions",
     )
 
     filters_fields = {
diff --git a/backend/geonature/core/gn_permissions/routes.py b/backend/geonature/core/gn_permissions/routes.py
index 3cc5a6bc61..6c1c4485ea 100644
--- a/backend/geonature/core/gn_permissions/routes.py
+++ b/backend/geonature/core/gn_permissions/routes.py
@@ -12,9 +12,12 @@
 from utils_flask_sqla.response import json_resp
 from geonature.core.gn_commons.models import TModules
 from geonature.core.gn_permissions import decorators as permissions
+from geonature.core.gn_permissions.commands import supergrant
 
 
-routes = Blueprint("gn_permissions", __name__)
+routes = Blueprint("gn_permissions", __name__, cli_group="permissions")
+
+routes.cli.add_command(supergrant)
 
 
 @routes.route("/logout_cruved", methods=["GET"])

From dcba75873d8d5a692be6db3b33b766e78c6ac2c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 16:24:34 +0200
Subject: [PATCH 084/209] grant Grp_admin at installation

---
 install/03_create_db.sh          | 2 ++
 install/04_install_gn_modules.sh | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/install/03_create_db.sh b/install/03_create_db.sh
index 15122407f5..8ff8d55c5f 100755
--- a/install/03_create_db.sh
+++ b/install/03_create_db.sh
@@ -79,3 +79,5 @@ if [[ "${MODE}" == "dev" ]]; then
 fi
 
 . ${SCRIPT_DIR}/03b_populate_db.sh |& tee -a "${LOG_FILE}"
+
+geonature permissions supergrant --group --nom "Grp_admin"
diff --git a/install/04_install_gn_modules.sh b/install/04_install_gn_modules.sh
index 64106b7305..ce1a38a1be 100755
--- a/install/04_install_gn_modules.sh
+++ b/install/04_install_gn_modules.sh
@@ -30,5 +30,8 @@ if [ "$install_module_validation" = true ]; then
     geonature install-gn-module "${BASE_DIR}/contrib/gn_module_validation" VALIDATION --build false
 fi
 
+# Grant admin group permissions on new installed modules
+geonature permissions supergrant --group --nom "Grp_admin"
+
 echo "Désactivation du virtual env"
 deactivate

From b298b597aeb4229d2dbf505347b58e124c3eecae Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Wed, 17 May 2023 16:00:04 +0200
Subject: [PATCH 085/209] use new permissions in synthese exports

- export_observations_web
- export_taxon_web

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/core/gn_synthese/routes.py  | 77 ++++++++++---------
 .../gn_synthese/utils/query_select_sqla.py    |  2 +-
 2 files changed, 42 insertions(+), 37 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 78803a5d7e..2dae343407 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -323,8 +323,8 @@ def get_one_synthese(permissions, id_synthese):
 
 
 @routes.route("/export_taxons", methods=["POST"])
-@permissions.check_cruved_scope("E", get_scope=True, module_code="SYNTHESE")
-def export_taxon_web(scope):
+@permissions_required("E", module_code="SYNTHESE")
+def export_taxon_web(permissions):
     """Optimized route for taxon web export.
 
     .. :quickref: Synthese;
@@ -364,7 +364,6 @@ def export_taxon_web(scope):
 
     id_list = request.get_json()
 
-    # check R and E CRUVED to know if we filter with cruved
     cruved = get_scopes_by_action(module_code="SYNTHESE")
     sub_query = (
         select(
@@ -385,9 +384,7 @@ def export_taxon_web(scope):
         {},
     )
 
-    if cruved["R"] > cruved["E"]:
-        # filter on cruved
-        synthese_query_class.filter_query_with_cruved(g.current_user, scope)
+    synthese_query_class.filter_query_all_filters(g.current_user, permissions)
 
     subq = synthese_query_class.query.alias("subq")
 
@@ -403,8 +400,8 @@ def export_taxon_web(scope):
 
 
 @routes.route("/export_observations", methods=["POST"])
-@permissions.check_cruved_scope("E", get_scope=True, module_code="SYNTHESE")
-def export_observations_web(scope):
+@permissions_required("E", module_code="SYNTHESE")
+def export_observations_web(permissions):
     """Optimized route for observations web export.
 
     .. :quickref: Synthese;
@@ -418,13 +415,28 @@ def export_observations_web(scope):
 
     """
     params = request.args
+    # set default to csv
     export_format = params.get("export_format", "csv")
     # Test export_format
     if not export_format in current_app.config["SYNTHESE"]["EXPORT_FORMAT"]:
         raise BadRequest("Unsupported format")
 
+    # get list of id synthese from POST
+    id_list = request.get_json()
+
+    # Get the SRID for the export
     srid = DB.session.execute(func.Find_SRID("gn_synthese", "synthese", "the_geom_local")).scalar()
-    # set default to csv
+
+    # Get the CTE for synthese filtered by user permissions
+    synthese_query_class = SyntheseQuery(
+        Synthese,
+        select([Synthese.id_synthese]),
+        {},
+    )
+    synthese_query_class.filter_query_all_filters(g.current_user, permissions)
+    cte_synthese_filtered = synthese_query_class.build_query().cte("cte_synthese_filtered")
+
+    # Get the view for export
     export_view = GenericTableGeo(
         tableName="v_synthese_for_export",
         schemaName="gn_synthese",
@@ -433,8 +445,26 @@ def export_observations_web(scope):
         srid=srid,
     )
 
-    # get list of id synthese from POST
-    id_list = request.get_json()
+    # Get the query for export
+    export_query = (
+        select([export_view.tableDef])
+        .select_from(
+            export_view.tableDef.join(
+                cte_synthese_filtered,
+                cte_synthese_filtered.c.id_synthese == export_view.tableDef.c.id_synthese,
+            )
+        )
+        .where(
+            export_view.tableDef.columns[
+                current_app.config["SYNTHESE"]["EXPORT_ID_SYNTHESE_COL"]
+            ].in_(id_list)
+        )
+    )
+
+    # Get the results for export
+    results = DB.session.execute(
+        export_query.limit(current_app.config["SYNTHESE"]["NB_MAX_OBS_EXPORT"])
+    )
 
     db_cols_for_shape = []
     columns_to_serialize = []
@@ -444,37 +474,12 @@ def export_observations_web(scope):
             db_cols_for_shape.append(db_col)
             columns_to_serialize.append(db_col.key)
 
-    query = select([export_view.tableDef]).where(
-        export_view.tableDef.columns[current_app.config["SYNTHESE"]["EXPORT_ID_SYNTHESE_COL"]].in_(
-            id_list
-        )
-    )
-    synthese_query_class = SyntheseQuery(
-        export_view.tableDef,
-        query,
-        {},
-        id_synthese_column=current_app.config["SYNTHESE"]["EXPORT_ID_SYNTHESE_COL"],
-        id_dataset_column=current_app.config["SYNTHESE"]["EXPORT_ID_DATASET_COL"],
-        observers_column=current_app.config["SYNTHESE"]["EXPORT_OBSERVERS_COL"],
-        id_digitiser_column=current_app.config["SYNTHESE"]["EXPORT_ID_DIGITISER_COL"],
-        with_generic_table=True,
-    )
-    # check R and E CRUVED to know if we filter with cruved
-    cruved = get_scopes_by_action(module_code="SYNTHESE")
-    if cruved["R"] > cruved["E"]:
-        synthese_query_class.filter_query_with_cruved(g.current_user, scope)
-
-    results = DB.session.execute(
-        synthese_query_class.query.limit(current_app.config["SYNTHESE"]["NB_MAX_OBS_EXPORT"])
-    )
-
     file_name = datetime.datetime.now().strftime("%Y_%m_%d_%Hh%Mm%S")
     file_name = filemanager.removeDisallowedFilenameChars(file_name)
 
     if export_format == "csv":
         formated_data = [export_view.as_dict(d, columns=columns_to_serialize) for d in results]
         return to_csv_resp(file_name, formated_data, separator=";", columns=columns_to_serialize)
-
     elif export_format == "geojson":
         features = []
         for r in results:
diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 0ea07d104f..af3bf091bc 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -478,7 +478,7 @@ def build_query(self):
     def filter_query_all_filters(self, user, permissions):
         """High level function to manage query with all filters.
 
-        Apply CRUVED, toxonomy and other filters.
+        Apply CRUVED, taxonomy and other filters.
 
         Parameters
         ----------

From 5973ad3bb4a9392108934a1651cd958be0d74e8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Tue, 23 May 2023 10:39:14 +0200
Subject: [PATCH 086/209] admin(permissions): improve displaying

---
 backend/geonature/core/gn_permissions/admin.py  | 7 +++++--
 backend/geonature/core/gn_permissions/models.py | 8 ++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 05f38a236e..4fbd15c4d8 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -15,6 +15,7 @@
     PermScope,
     Permission,
     PermissionAvailable,
+    PermFilter,
 )
 from geonature.core.gn_permissions.tools import get_permissions
 from geonature.core.gn_commons.models.base import TModules
@@ -169,9 +170,10 @@ def permissions_formatter(view, context, model, name):
                     if not flts:
                         o += """<i class="fa fa-check" aria-hidden="true"></i>"""
                     else:
-                        o += "Restrictions :"
                         o += """<ul class="list-group">"""
-                        for flt in flts:
+                        for flt_name in perm.availability.filters:
+                            flt_field = Permission.filters_fields[flt_name]
+                            flt = PermFilter(flt_name, getattr(perm, flt_field.name))
                             o += f"""<li class="list-group-item">{flt}</li>"""
                         o += "</ul>"
                     o += """</div></div>"""
@@ -300,6 +302,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         "role.identifiant": "identifiant du rôle",
         "role.nom_complet": "nom du rôle",
         "availability": "Permission disponible",
+        "scope": "Appartenance des données",
         "sensitivity_filter": "Exclure les données sensibles",
     }
     column_select_related_list = ("availability",)
diff --git a/backend/geonature/core/gn_permissions/models.py b/backend/geonature/core/gn_permissions/models.py
index 3d3fad2369..237e95cce2 100644
--- a/backend/geonature/core/gn_permissions/models.py
+++ b/backend/geonature/core/gn_permissions/models.py
@@ -171,13 +171,17 @@ def __init__(self, name, value):
 
     def __str__(self):
         if self.name == "SCOPE":
-            if self.value == 1:
+            if self.value is None:
+                return """<i class="fa fa-users" aria-hidden="true"></i> de tout le monde"""
+            elif self.value == 1:
                 return """<i class="fa fa-user" aria-hidden="true"></i> à moi"""
             elif self.value == 2:
-                return """<i class="fa fa-users" aria-hidden="true"></i> de mon organisme"""
+                return """<i class="fa fa-user-circle" aria-hidden="true"></i> de mon organisme"""
         elif self.name == "SENSITIVITY":
             if self.value:
                 return """<i class="fa fa-low-vision" aria-hidden="true"></i>  non sensible"""
+            else:
+                return """<i class="fa fa-eye" aria-hidden="true"></i>  sensible et non sensible"""
 
 
 @serializable

From 2c035efecdf8d177c66815fd774dfcea0dffabcc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 24 May 2023 14:18:12 +0200
Subject: [PATCH 087/209] front: remove link to removed backoffice

Thus, fix flask-admin link displaying condition
---
 .../src/app/adminModule/admin.component.html    | 17 ++---------------
 frontend/src/app/adminModule/admin.component.ts |  6 ++----
 2 files changed, 4 insertions(+), 19 deletions(-)

diff --git a/frontend/src/app/adminModule/admin.component.html b/frontend/src/app/adminModule/admin.component.html
index 82036f3e0e..a1a3eb6c5d 100644
--- a/frontend/src/app/adminModule/admin.component.html
+++ b/frontend/src/app/adminModule/admin.component.html
@@ -3,11 +3,11 @@
     <h3 class="underlined main-color">Module d'administration de GeoNature</h3>
   </div>
 
-  <div class="card-body" *ngIf="_cruvedStore.cruved?.ADMIN?.module_objects.NOMENCLATURES">
+  <div class="card-body">
     <h5 class="underlined second-color">Backoffice GeoNature</h5>
 
     <li class="no-bullet">
-      <a target="_blank" [href]="URL_NOMENCLATURE_ADMIN" class="nomenclature">
+      <a target="_blank" [href]="URL_ADMIN" class="nomenclature">
         <button mat-raised-button color="primary" class="uppercase">
           Backoffice
           <mat-icon>create</mat-icon>
@@ -15,17 +15,4 @@ <h5 class="underlined second-color">Backoffice GeoNature</h5>
       </a>
     </li>
   </div>
-
-  <div class="card-body" *ngIf="_cruvedStore.cruved?.ADMIN?.module_objects?.PERMISSIONS">
-    <h5 class="underlined second-color">Administration des permissions (CRUVED)</h5>
-
-    <li class="no-bullet">
-      <a target="_blank" [href]="URL_BACKOFFICE_PERM" class="nomenclature">
-        <button mat-raised-button class="uppercase" color="primary">
-          Permissions
-          <mat-icon>create</mat-icon>
-        </button>
-      </a>
-    </li>
-  </div>
 </div>
diff --git a/frontend/src/app/adminModule/admin.component.ts b/frontend/src/app/adminModule/admin.component.ts
index 0a1a523fdf..5929957e61 100644
--- a/frontend/src/app/adminModule/admin.component.ts
+++ b/frontend/src/app/adminModule/admin.component.ts
@@ -9,12 +9,10 @@ import { ConfigService } from '@geonature/services/config.service';
   providers: [],
 })
 export class AdminComponent implements OnInit {
-  URL_NOMENCLATURE_ADMIN = null;
-  URL_BACKOFFICE_PERM = null;
+  URL_ADMIN = null;
 
   constructor(public _cruvedStore: CruvedStoreService, public config: ConfigService) {
-    this.URL_NOMENCLATURE_ADMIN = this.config.API_ENDPOINT + '/admin/';
-    this.URL_BACKOFFICE_PERM = this.config.API_ENDPOINT + '/permissions_backoffice/users';
+    this.URL_ADMIN = this.config.API_ENDPOINT + '/admin/';
   }
 
   ngOnInit() {}

From c460c1f5760d116be3c59140c346f42385a88c70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 21:22:44 +0200
Subject: [PATCH 088/209] admin(permission): hiding available permissions

When user already have a permission, hide it in list of available permission.
---
 .../geonature/core/gn_permissions/admin.py    | 53 +++++++++++++++++++
 .../admin/hide_select2_options_create.html    |  6 +++
 .../admin/hide_select2_options_edit.html      |  6 +++
 backend/static/css/hide_select2_options.css   |  3 ++
 backend/static/js/hide_unnecessary_filters.js | 44 ++++++++++++++-
 5 files changed, 110 insertions(+), 2 deletions(-)
 create mode 100644 backend/geonature/templates/admin/hide_select2_options_create.html
 create mode 100644 backend/geonature/templates/admin/hide_select2_options_edit.html
 create mode 100644 backend/static/css/hide_select2_options.css

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 4fbd15c4d8..399d737c93 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -2,7 +2,9 @@
 from flask_admin.contrib.sqla import ModelView
 from flask_admin.contrib.sqla.filters import FilterEqual
 import sqlalchemy as sa
+from flask_admin.contrib.sqla.tools import get_primary_key
 from flask_admin.contrib.sqla.fields import QuerySelectField
+from flask_admin.contrib.sqla.ajax import QueryAjaxModelLoader
 from flask_admin.form.widgets import Select2Widget
 from sqlalchemy.orm import contains_eager, joinedload
 
@@ -268,6 +270,41 @@ def iter_choices(self):
             yield (pk, self.get_label(obj), options)
 
 
+### ModelLoader
+
+
+class UserAjaxModelLoader(QueryAjaxModelLoader):
+    def format(self, user):
+        if not user:
+            return None
+
+        def format_availability(availability):
+            return ":".join(
+                [str(getattr(availability, attr)) for attr in get_primary_key(PermissionAvailable)]
+            )
+
+        def filter_availability(availability):
+            filters_count = sum(
+                [
+                    getattr(availability, field.name)
+                    for field in PermissionAvailable.filters_fields.values()
+                ]
+            )
+            return filters_count < 2
+
+        availabilities = {p.availability for p in user.permissions if p.availability}
+        excluded_availabilities = filter(filter_availability, availabilities)
+        excluded_availabilities = map(format_availability, excluded_availabilities)
+        return super().format(user) + (list(excluded_availabilities),)
+
+    def get_query(self):
+        return (
+            super()
+            .get_query()
+            .options(joinedload(User.permissions).joinedload(Permission.availability))
+        )
+
+
 ### ModelViews
 
 
@@ -342,6 +379,22 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
             options_additional_values=["sensitivity_filter", "scope_filter"],
         )
     )
+    create_template = "admin/hide_select2_options_create.html"
+    edit_template = "admin/hide_select2_options_edit.html"
+    form_ajax_refs = {
+        "role": UserAjaxModelLoader(
+            "role",
+            db.session,
+            User,
+            fields=(
+                "identifiant",
+                "nom_role",
+                "prenom_role",
+            ),
+            placeholder="Veuillez sélectionner un utilisateur ou un groupe",
+            minimum_input_length=0,
+        ),
+    }
 
     def render(self, template, **kwargs):
         self.extra_js = [url_for("static", filename="js/hide_unnecessary_filters.js")]
diff --git a/backend/geonature/templates/admin/hide_select2_options_create.html b/backend/geonature/templates/admin/hide_select2_options_create.html
new file mode 100644
index 0000000000..1e4b5cefe4
--- /dev/null
+++ b/backend/geonature/templates/admin/hide_select2_options_create.html
@@ -0,0 +1,6 @@
+{% extends 'admin/model/create.html' %}
+
+{% block head_css %}
+  {{ super() }}
+  <link rel="stylesheet" href="{{ url_for('static', filename='css/hide_select2_options.css') }}">
+{% endblock %}
\ No newline at end of file
diff --git a/backend/geonature/templates/admin/hide_select2_options_edit.html b/backend/geonature/templates/admin/hide_select2_options_edit.html
new file mode 100644
index 0000000000..081635f402
--- /dev/null
+++ b/backend/geonature/templates/admin/hide_select2_options_edit.html
@@ -0,0 +1,6 @@
+{% extends 'admin/model/edit.html' %}
+
+{% block head_css %}
+  {{ super() }}
+  <link rel="stylesheet" href="{{ url_for('static', filename='css/hide_select2_options.css') }}">
+{% endblock %}
\ No newline at end of file
diff --git a/backend/static/css/hide_select2_options.css b/backend/static/css/hide_select2_options.css
new file mode 100644
index 0000000000..08f7bea161
--- /dev/null
+++ b/backend/static/css/hide_select2_options.css
@@ -0,0 +1,3 @@
+.select2-disabled {
+    display: none !important;
+}
\ No newline at end of file
diff --git a/backend/static/js/hide_unnecessary_filters.js b/backend/static/js/hide_unnecessary_filters.js
index b652685d54..b090943de2 100644
--- a/backend/static/js/hide_unnecessary_filters.js
+++ b/backend/static/js/hide_unnecessary_filters.js
@@ -1,11 +1,14 @@
+let roles = []
+
 $('#availability').on('change', function() {
-    if ($(this).find(":selected")[0].hasAttribute("sensitivity_filter"))
+    let selected = $(this).find(":selected")[0];
+    if (selected && selected.hasAttribute("sensitivity_filter"))
         $("#sensitivity_filter").parent().show();
     else
         $("#sensitivity_filter").parent().hide();
         $('#sensitivity_filter').prop('checked', false);
 
-    if ($(this).find(":selected")[0].hasAttribute("scope_filter"))
+    if (selected && selected.hasAttribute("scope_filter"))
         $("#scope").parent().show();
     else {
         $("#scope").parent().hide();
@@ -14,3 +17,40 @@ $('#availability').on('change', function() {
 });
 
 $('#availability').trigger('change');
+
+$(document).ajaxSuccess(function(event, xhr, options){
+    roles = xhr.responseJSON;
+});
+
+let startingRole = $("#role").attr('data-json');
+let startingAvailability = $("#availability :selected").val();
+if (startingRole) {
+    startingRole = JSON.parse(startingRole);
+    hideAvailability(startingRole);
+}
+
+$("#role").on('change', function() {
+    let data = $("#role").select2("data");
+    $("#availability option").prop('disabled', false);
+    if (data) {
+        let role = roles.find(r => r[0] === data.id);
+        hideAvailability(role)
+    }
+});
+
+function hideAvailability(role) {
+    if (Array.isArray(role[2])) {
+        for (i in role[2]) {
+            const key = role[2][i];
+            const selectedOption = $('#availability').select2("data");
+            let option = $("#availability option").filter((i, e) => {return $(e).val() === key});
+
+            if (!(startingAvailability === key && role[0] === startingRole[0]))
+                option.prop('disabled', true);
+            
+            if (selectedOption && selectedOption.id === key && option.prop('disabled')) {
+                $("#availability").select2("val", "").trigger('change');
+            }
+        }
+    }
+}

From 96b70ba506c055fc02990435f6069f04e64257fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 24 May 2023 15:34:36 +0200
Subject: [PATCH 089/209] migration: manually upgrade validation alembic branch

---
 install/migration/migration.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/install/migration/migration.sh b/install/migration/migration.sh
index 16601b7179..46ac714b52 100755
--- a/install/migration/migration.sh
+++ b/install/migration/migration.sh
@@ -218,6 +218,8 @@ echo "Mise à jour de la base de données…"
 geonature db heads | grep "(occtax)" > /dev/null && geonature db upgrade occtax@4c97453a2d1a
 geonature db autoupgrade || exit 1
 geonature upgrade-modules-db || exit 1
+# Mise à jour manuel de validation, la branche Alambic ayant été rajouté avec GN 2.13
+geonature db heads | grep "(validation)" > /dev/null && geonature db upgrade validation@head
 
 # On déplace les médias à la fin de la migration, pour ne pas se retrouver avec une nouvelle installation
 # GeoNature cassé mais les médias déjà déplacé de l’ancien GN au nouveau GN non fonctionnel.

From d4f8a702e2b965aa696b6942e8246f92a75369a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 24 May 2023 15:48:46 +0200
Subject: [PATCH 090/209] fix synthese reports permissions

---
 backend/geonature/core/gn_synthese/routes.py | 71 ++++++++++----------
 1 file changed, 36 insertions(+), 35 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 2dae343407..f651ee2e5c 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -51,7 +51,7 @@
 
 from geonature.core.gn_permissions import decorators as permissions
 from geonature.core.gn_permissions.decorators import login_required, permissions_required
-from geonature.core.gn_permissions.tools import get_scopes_by_action
+from geonature.core.gn_permissions.tools import get_scopes_by_action, get_permissions
 
 from ref_geo.models import LAreas, BibAreasTypes
 
@@ -1031,9 +1031,9 @@ def get_taxa_distribution():
 
 
 @routes.route("/reports", methods=["POST"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
+@permissions_required("R", module_code="SYNTHESE")
 @json_resp
-def create_report(scope):
+def create_report(permissions):
     """
     Create a report (e.g report) for a given synthese id
 
@@ -1050,35 +1050,36 @@ def create_report(scope):
         type_name = data["type"]
         id_synthese = data["item"]
         content = data["content"]
-        if not id_synthese:
-            raise BadRequest("id_synthese is missing from the request")
-        if not type_name:
-            raise BadRequest("Report type is missing from the request")
-        if not content and type_name == "discussion":
-            raise BadRequest("Discussion content is required")
-        type_exists = BibReportsTypes.query.filter_by(type=type_name).first()
-        if not type_exists:
-            raise BadRequest("This report type does not exist")
-        synthese = Synthese.query.options(
-            Load(Synthese).raiseload("*"),
-            joinedload("cor_observers"),
-            joinedload("digitiser"),
-            joinedload("dataset"),
-        ).get_or_404(id_synthese)
-        if not synthese.has_instance_permission(scope):
-            raise Forbidden
-
-        report_query = TReport.query.filter(
-            TReport.id_synthese == id_synthese,
-            TReport.report_type.has(BibReportsTypes.type == type_name),
-        )
-        # only allow one alert by id_synthese
-        if type_name in ["alert", "pin"]:
-            alert_exists = report_query.one_or_none()
-            if alert_exists is not None:
-                raise Conflict("This type already exists for this id")
     except KeyError:
         raise BadRequest("Empty request data")
+    if not id_synthese:
+        raise BadRequest("id_synthese is missing from the request")
+    if not type_name:
+        raise BadRequest("Report type is missing from the request")
+    if not content and type_name == "discussion":
+        raise BadRequest("Discussion content is required")
+    type_exists = BibReportsTypes.query.filter_by(type=type_name).first()
+    if not type_exists:
+        raise BadRequest("This report type does not exist")
+
+    synthese = Synthese.query.options(
+        Load(Synthese).raiseload("*"),
+        joinedload("cor_observers"),
+        joinedload("digitiser"),
+        joinedload("dataset"),
+    ).get_or_404(id_synthese)
+    if not synthese.has_instance_permission(permissions):
+        raise Forbidden
+
+    report_query = TReport.query.filter(
+        TReport.id_synthese == id_synthese,
+        TReport.report_type.has(BibReportsTypes.type == type_name),
+    )
+    # only allow one alert by id_synthese
+    if type_name in ["alert", "pin"]:
+        alert_exists = report_query.one_or_none()
+        if alert_exists is not None:
+            raise Conflict("This type already exists for this id")
     new_entry = TReport(
         id_synthese=id_synthese,
         id_role=g.current_user.id_role,
@@ -1147,14 +1148,14 @@ def update_content_report(id_report):
 
 
 @routes.route("/reports", methods=["GET"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
-def list_reports(scope):
+@permissions_required("R", module_code="SYNTHESE")
+def list_reports(permissions):
     type_name = request.args.get("type")
     id_synthese = request.args.get("idSynthese")
     sort = request.args.get("sort")
     # VERIFY ID SYNTHESE
     synthese = Synthese.query.get_or_404(id_synthese)
-    if not synthese.has_instance_permission(scope):
+    if not synthese.has_instance_permission(permissions):
         raise Forbidden
     # START REQUEST
     req = TReport.query.filter(TReport.id_synthese == id_synthese)
@@ -1203,8 +1204,8 @@ def delete_report(id_report):
     reportItem = TReport.query.get_or_404(id_report)
     # alert control to check cruved - allow validators only
     if reportItem.report_type.type in ["alert"]:
-        scope = get_scopes_by_action(module_code="VALIDATION")["C"]  # FIXME
-        if not reportItem.synthese.has_instance_permission(scope):
+        permissions = get_permissions(module_code="SYNTHESE", action_code="R")
+        if not reportItem.synthese.has_instance_permission(permissions):
             raise Forbidden("Permission required to delete this report !")
     # only owner could delete a report for pin and discussion
     if reportItem.id_role != g.current_user.id_role and reportItem.report_type.type in [

From 80c894b16a2ff77ed7d77d05696f8ebdaf6dc5e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 24 May 2023 15:56:47 +0200
Subject: [PATCH 091/209] synthese general stats: use advanced permissions

---
 backend/geonature/core/gn_synthese/routes.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index f651ee2e5c..66d881df5d 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -690,9 +690,9 @@ def export_status(scope):
 
 
 @routes.route("/general_stats", methods=["GET"])
-@permissions.check_cruved_scope("R", get_scope=True, module_code="SYNTHESE")
+@permissions_required("R", module_code="SYNTHESE")
 @json_resp
-def general_stats(scope):
+def general_stats(permissions):
     """Return stats about synthese.
 
     .. :quickref: Synthese;
@@ -711,7 +711,7 @@ def general_stats(scope):
         ]
     )
     synthese_query_obj = SyntheseQuery(Synthese, q, {})
-    synthese_query_obj.filter_query_with_cruved(g.current_user, scope)
+    synthese_query_obj.filter_query_with_cruved(g.current_user, permissions)
     result = DB.session.execute(synthese_query_obj.query)
     synthese_counts = result.fetchone()
 

From b57572fd407adea80a8868fba1fbfac3fc61d82d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?=
 <elie.bouttier@ecrins-parcnational.fr>
Date: Wed, 24 May 2023 17:43:37 +0200
Subject: [PATCH 092/209] admin: add objects for mobile apps and modules

---
 backend/geonature/core/gn_commons/admin.py    |  4 +--
 ...5a5099e084_add_additional_fields_object.py | 33 ++++++++++++++-----
 .../f051b88a57fd_permissions_available.py     |  8 +++++
 3 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/backend/geonature/core/gn_commons/admin.py b/backend/geonature/core/gn_commons/admin.py
index d747c9f3df..f44583b8a3 100644
--- a/backend/geonature/core/gn_commons/admin.py
+++ b/backend/geonature/core/gn_commons/admin.py
@@ -110,7 +110,7 @@ class BibFieldAdmin(CruvedProtectedMixin, ModelView):
 
 class TMobileAppsAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
-    object_code = "ALL"
+    object_code = "MOBILE_APPS"
 
     column_list = (
         "app_code",
@@ -132,7 +132,7 @@ class TMobileAppsAdmin(CruvedProtectedMixin, ModelView):
 
 class TModulesAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
-    object_code = "ALL"
+    object_code = "MODULES"
 
     can_view_details = True
     action_disallowed_list = ["delete"]
diff --git a/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py b/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py
index fa78d8e5d6..44325b3a2f 100644
--- a/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py
+++ b/backend/geonature/migrations/versions/df5a5099e084_add_additional_fields_object.py
@@ -21,23 +21,40 @@ def upgrade():
         """
         INSERT INTO
             gn_permissions.t_objects (code_object, description_object)
-        VALUES (
-            'ADDITIONAL_FIELDS',
-            'Gestion du backoffice des champs additionnels'
-        )
+        VALUES
+            (
+                'ADDITIONAL_FIELDS',
+                'Gestion du backoffice des champs additionnels'
+            ), (
+                'MOBILE_APPS',
+                'Gestion des applications mobiles'
+            ), (
+                'MODULES',
+                'Gestion des modules'
+            )
         """
     )
     op.execute(
         """
         INSERT INTO
             gn_permissions.cor_object_module (id_object, id_module)
-        VALUES (
-            (SELECT id_object FROM gn_permissions.t_objects WHERE code_object = 'ADDITIONAL_FIELDS'),
+        SELECT
+            o.id_object,
             (SELECT id_module FROM gn_commons.t_modules WHERE module_code = 'ADMIN')
-        )
+        FROM
+            (
+                VALUES ('ADDITIONAL_FIELDS'), ('MOBILE_APPS'), ('MODULES')
+            ) AS v (code_object)
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.code_object
         """
     )
 
 
 def downgrade():
-    op.execute("DELETE FROM gn_permissions.t_objects WHERE code_object = 'ADDITIONAL_FIELDS'")
+    op.execute(
+        """
+        DELETE FROM gn_permissions.t_objects
+        WHERE code_object IN ('ADDITIONAL_FIELDS', 'MOBILE_APPS', 'MODULES')
+        """
+    )
diff --git a/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
index abca0ba106..198700392b 100644
--- a/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
+++ b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
@@ -88,6 +88,14 @@ def upgrade():
                     ,('ADMIN', 'ADDITIONAL_FIELDS', 'U', False, 'Modifier les champs additionnels')
                     ,('ADMIN', 'ADDITIONAL_FIELDS', 'E', False, 'Exporter les champs additionnels')
                     ,('ADMIN', 'ADDITIONAL_FIELDS', 'D', False, 'Supprimer des champs additionnels')
+                    ,('ADMIN', 'MODULES', 'R', False, 'Voir les modules')
+                    ,('ADMIN', 'MODULES', 'U', False, 'Modifier les modules')
+                    ,('ADMIN', 'MODULES', 'E', False, 'Exporter les modules')
+                    ,('ADMIN', 'MOBILE_APPS', 'C', False, 'Déclarer des applications mobiles')
+                    ,('ADMIN', 'MOBILE_APPS', 'R', False, 'Voir les applications mobiles')
+                    ,('ADMIN', 'MOBILE_APPS', 'U', False, 'Modifier les applications mobiles')
+                    ,('ADMIN', 'MOBILE_APPS', 'E', False, 'Exporter les applications mobiles')
+                    ,('ADMIN', 'MOBILE_APPS', 'D', False, 'Supprimer des applications mobiles')
                     ,('METADATA', 'ALL', 'C', False, 'Créer des métadonnées')
                     ,('METADATA', 'ALL', 'R', True, 'Voir les métadonnées')
                     ,('METADATA', 'ALL', 'U', True, 'Modifier les métadonnées')

From cb1c61c13c7d8537c627dee4f29298a1b1b3e1c2 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 09:54:19 +0200
Subject: [PATCH 093/209] changelog

---
 docs/CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 679777ce6a..a2b0fccbf1 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -24,6 +24,8 @@ CHANGELOG
 - Admin : rajout de l’objet NOTIFICATIONS afin de pouvoir en définir ses permissions (#2490)
 - Login : désactivation du spinner après une tentative de login échouée
 
+Note de version : 
+Si vous utilisiez des champs additionnels avec des checkbox, lors de leur changement de type (recommandé dans les notes de version de la 2.12.0) il est important que les valeurs du champ `field_values` continue à avoir des "string" dans la clé values : [{"label": "Un", "value": "1"}] sans quoi il y aura des problème à l'édition. Pour les nouveaux champs additionnels, il est cependant bien possible de mettre des entiers dans la clé `value` [{"label": "Un", "value": 1}]
 
 2.12.1 (2023-04-11)
 -------------------

From b7a964ca0164a7bfae042b313e3d1abaae3d5aff Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 11:55:24 +0200
Subject: [PATCH 094/209] update changelog

---
 docs/CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 23f7ddd937..6c520913fb 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -20,6 +20,7 @@ CHANGELOG
 
 Si vous utilisez la page de maintenance, celle-ci a été revue, [référez vous à la documentation](https://docs.geonature.fr/installation.html#configuration-apache) afin de la mettre à jour.
 
+Si vous utilisiez des champs additionnels avec des checkbox, lors de leur changement de type (recommandé dans les notes de version de la 2.12.0) il est important que les valeurs du champ `field_values` continue à avoir des "string" dans la clé values : [{"label": "Un", "value": "1"}] sans quoi il y aura des problème à l'édition. Pour les nouveaux champs additionnels, il est cependant bien possible de mettre des entiers dans la clé `value` [{"label": "Un", "value": 1}]
 
 2.12.2 (2023-04-18)
 -------------------
@@ -44,8 +45,7 @@ Si vous utilisez la page de maintenance, celle-ci a été revue, [référez vous
 - Admin : rajout de l’objet NOTIFICATIONS afin de pouvoir en définir ses permissions (#2490)
 - Login : désactivation du spinner après une tentative de login échouée
 
-Note de version : 
-Si vous utilisiez des champs additionnels avec des checkbox, lors de leur changement de type (recommandé dans les notes de version de la 2.12.0) il est important que les valeurs du champ `field_values` continue à avoir des "string" dans la clé values : [{"label": "Un", "value": "1"}] sans quoi il y aura des problème à l'édition. Pour les nouveaux champs additionnels, il est cependant bien possible de mettre des entiers dans la clé `value` [{"label": "Un", "value": 1}]
+
 
 2.12.1 (2023-04-11)
 -------------------

From 479a93ac37b7ff8d1bff133036d4f44d63eaa124 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 11:59:12 +0200
Subject: [PATCH 095/209] changelog

---
 docs/CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 6c520913fb..2b5a74b5f6 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -16,6 +16,9 @@ CHANGELOG
 - Correction et amélioration de la page de maintenance (#2535)
 - Correction de la synchronisation des JDD et de l’association aux modules (#2532 par @VincentCauchois)
 
+**💻 Développement**
+- La fonction `geonature.core.gn_permissions.tools.cruved_scope_for_user_in_module` est remplacée par `geonature.core.gn_permissions.tools.get_scopes_by_action`
+
 **⚠️ Notes de version**
 
 Si vous utilisez la page de maintenance, celle-ci a été revue, [référez vous à la documentation](https://docs.geonature.fr/installation.html#configuration-apache) afin de la mettre à jour.

From 6377e9131be71cef90b7f5a519ea2885f71c3285 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 12:18:16 +0200
Subject: [PATCH 096/209] add filters on permission admin

---
 backend/geonature/core/gn_permissions/admin.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 399d737c93..d4406b570f 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -444,6 +444,9 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
         ("object", "object.code_object"),
         ("action", "action.code_action"),
     )
+    column_filters = (
+        ModuleFilter(column=PermissionAvailable.id_module, name="Module"),
+    )
     column_default_sort = [
         ("module.module_code", False),
         ("object.code_object", False),
@@ -470,6 +473,7 @@ class RolePermAdmin(CruvedProtectedMixin, ModelView):
         "permissions": "Permissions",
         "permissions_count": "Nombre de permissions",
     }
+    column_searchable_list = ("identifiant", "nom_complet")
     column_formatters = {
         "groups": groups_formatter,
         "permissions_count": permissions_count_formatter,

From a58aa6d8c0ed4df13a2842692baa468e0cb72d1f Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 12:39:37 +0200
Subject: [PATCH 097/209] black

---
 backend/geonature/core/gn_permissions/admin.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index d4406b570f..708c9c5212 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -444,9 +444,7 @@ class PermissionAvailableAdmin(CruvedProtectedMixin, ModelView):
         ("object", "object.code_object"),
         ("action", "action.code_action"),
     )
-    column_filters = (
-        ModuleFilter(column=PermissionAvailable.id_module, name="Module"),
-    )
+    column_filters = (ModuleFilter(column=PermissionAvailable.id_module, name="Module"),)
     column_default_sort = [
         ("module.module_code", False),
         ("object.code_object", False),

From f44bae884be7ea11935f8a6ebb7bc2813cb2150e Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 17:11:08 +0200
Subject: [PATCH 098/209] order module in admin filters

---
 backend/geonature/core/gn_permissions/admin.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 708c9c5212..af866d4586 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -37,7 +37,7 @@ def get_dynamic_options(self, view):
 class ModuleFilter(DynamicOptionsMixin, FilterEqual):
     def get_dynamic_options(self, view):
         if has_app_context():
-            yield from [(m.id_module, m.module_code) for m in TModules.query.all()]
+            yield from [(m.id_module, m.module_code) for m in TModules.query.order_by(TModules.module_code).all()]
 
 
 class ObjectFilter(DynamicOptionsMixin, FilterEqual):

From 863ecb7f61e51f0887fa40fcb162b3b4703e3277 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 25 May 2023 17:35:27 +0200
Subject: [PATCH 099/209] black

---
 backend/geonature/core/gn_permissions/admin.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index af866d4586..4df5176bdb 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -37,7 +37,10 @@ def get_dynamic_options(self, view):
 class ModuleFilter(DynamicOptionsMixin, FilterEqual):
     def get_dynamic_options(self, view):
         if has_app_context():
-            yield from [(m.id_module, m.module_code) for m in TModules.query.order_by(TModules.module_code).all()]
+            yield from [
+                (m.id_module, m.module_code)
+                for m in TModules.query.order_by(TModules.module_code).all()
+            ]
 
 
 class ObjectFilter(DynamicOptionsMixin, FilterEqual):

From 9ab8941bdde2f06f7a35645109fa230ab2beb64b Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 31 May 2023 10:16:52 +0200
Subject: [PATCH 100/209] Improve help text #2540

---
 backend/geonature/core/gn_commons/admin.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/core/gn_commons/admin.py b/backend/geonature/core/gn_commons/admin.py
index f44583b8a3..319ea495f3 100644
--- a/backend/geonature/core/gn_commons/admin.py
+++ b/backend/geonature/core/gn_commons/admin.py
@@ -99,7 +99,7 @@ class BibFieldAdmin(CruvedProtectedMixin, ModelView):
         "field_name": "Nom du champ en base de donnée",
         "field_values": """Obligatoire si widget = select/multiselect/checkbox,radio (Format JSON : tableau de 'value/label'.Utilisez des doubles quotes pour les valeurs et les clés). 
             Exemple [{"label": "trois", "value": 3}, {"label": "quatre", "value": 4}]""",
-        "default_value": "La valeur par défaut doit être une des valeurs du champs 'Valeurs' ci dessus",
+        "default_value": "La valeur par défaut doit être une des valeurs du champs 'Valeurs' ci dessus. Pour les valeurs textuelle, il n'est pas necessaire de remettre la valeur entre guillement",
         "id_list": "Identifiant en BDD de la liste (pour Type widget = taxonomy/observers)",
         "field_order": "Numéro d'ordonnancement du champs (si plusieurs champs pour le même module/objet/JDD)",
         "modules": "Module(s) auquel le champs est rattaché. *Obligatoire",

From f89c72ac93e1c2cedf2e099f3b5d96529017d3bc Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Fri, 2 Jun 2023 12:15:27 +0200
Subject: [PATCH 101/209] add doc on duplicate occtax

---
 docs/admin-manual.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index f766bd1467..5cb23c904e 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -1783,6 +1783,16 @@ Associer des jeux de données et des champs additionnels
 
 Dans le module Métadonnées (formulaire des jeux de données), associez les jeux de données que vous souhaitez rendre saissisables au nouveau module dupliqué.
 
+Ajouter le nouveau module dans la liste des modules implémentés
+```````````````````````````````````````````````````````````````
+
+Dans le fichier de configuration de GeoNature (geonature_config.toml) ajoutez une section `ADDITIONAL_FIELDS` qui contient tableau `IMPLEMENTED_MODULES` listant les modules qui implémentent les champs additionnels (Occtax doit y figurer en plus du nouveau module)
+
+::
+
+    [ADDITIONAL_FIELDS]
+      IMPLEMENTED_MODULES = ["OCCTAX", "FLORE_STATION"]
+
 Vous pouvez ensuite créer des nouveaux champs additionnels et les associer à ce module. De la même manière que dans Occtax, on peut les associer aux trois niveaux du formulaire (relevé, occurrence, dénombrement).
 
 

From 3259a81028bcde5d1271a46ed7c1e06e471607c5 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Mon, 5 Jun 2023 17:19:08 +0200
Subject: [PATCH 102/209] fix(install): add `gettext` linux package for
 `envsubst` command

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 install/install_all/install_all.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/install_all/install_all.sh b/install/install_all/install_all.sh
index 99bd0a35df..175f9c1a5e 100755
--- a/install/install_all/install_all.sh
+++ b/install/install_all/install_all.sh
@@ -57,7 +57,7 @@ echo "############### Installation des paquets systèmes ###############"
 
 # Installing required environment for GeoNature and TaxHub
 echo "Installation de l'environnement logiciel..."
-sudo apt-get install -y unzip git postgresql-postgis postgis python3-pip python3-venv python3-dev libpq-dev libgdal-dev libffi-dev libpangocairo-1.0-0 apache2 redis || exit 1
+sudo apt-get install -y unzip git postgresql-postgis postgis python3-pip python3-venv python3-dev libpq-dev libgdal-dev libffi-dev libpangocairo-1.0-0 apache2 redis gettext-base || exit 1
 
 if [ "${mode}" = "dev" ]; then
     sudo apt-get install -y xvfb || exit 1

From f385dce6fb17010d1bb47f541f0ef4798080925e Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Thu, 1 Jun 2023 17:04:47 +0200
Subject: [PATCH 103/209] Orthographic correction: `taxonomie.bdc_statut_text`
 instead of: `taxonomie.bdc_statut_texte`.

---
 docs/admin-manual.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index 5cb23c904e..a70157b449 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -2136,7 +2136,7 @@ Pour chaque dictionnaire, voici le détail des champs (ils sont tous obligatoire
 * ``status_type`` : pour les statuts de protection cela correspond à une liste des codes de types de statuts de protections à afficher dans la liste déroulante. Les codes existant sont consultables dans le champ ``cd_type_statut`` de la table ``taxonomie.bdc_statut_type``. Pour les listes rouges, il faut seulement indiquer le code de la liste.
 
 Au niveau de la base de données, il est possible de limiter les recherches uniquement aux textes correspondant à la zone géographique des observations de votre installation.  
-Pour cela, il suffit de mettre une valeur ``false`` dans le champ ``enable`` de la table ``taxonomie.bdc_statut_texte`` pour tous les textes que vous ne souhaitez pas prendre en compte. Si vous avez une grande quantité d'observations, cette étape est fortement recommandée !
+Pour cela, il suffit de mettre une valeur ``false`` dans le champ ``enable`` de la table ``taxonomie.bdc_statut_text`` pour tous les textes que vous ne souhaitez pas prendre en compte. Si vous avez une grande quantité d'observations, cette étape est fortement recommandée !
 
 Exemple de requête de mise à jour de la table ``taxonomie.bdc_statut_text`` pour désactiver les textes des DOM-TOM : :
 

From 5c11a521a7fe3b01dbd34f3abb55d1be88f21fb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?= <elie@bouttier.eu>
Date: Sat, 3 Jun 2023 20:18:13 +0200
Subject: [PATCH 104/209] doc: @permissions_required, get_permissions

---
 docs/development.rst | 121 ++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 113 insertions(+), 8 deletions(-)

diff --git a/docs/development.rst b/docs/development.rst
index 81df651894..cac963c50a 100644
--- a/docs/development.rst
+++ b/docs/development.rst
@@ -1128,7 +1128,7 @@ Utiliser le décorateur ``@login_required`` :
 Si l’utilisateur n’est pas authentifié, celui-ci est redirigé vers une page d’authentification, à moins que la requête contienne un header ``Accept: application/json`` (requête effectuée par le frontend) auquel cas une erreur 401 (Unauthorized) est levé.
 
 
-Restreindre une route aux utilisateurs ayant certains droits
+Restreindre une route aux utilisateurs avec un certain scope
 """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 Utiliser le décorateur ``@check_cruved_scope`` :
@@ -1138,10 +1138,9 @@ Utiliser le décorateur ``@check_cruved_scope`` :
    :param action: Type d'action effectuée par la route
                   (Create, Read, Update, Validate, Export, Delete)
    :type action: str["C", "R", "U", "V", "E", "D"]
-   :param module_code: Code du module sur lequel on veut vérifier la portée.
-    Si non fourni, on vérifie le CRUVED de GeoNature.
-   :type module_code: str, optional
-   :param object_code: Code de l’objet sur lequel on veut vérifié la portée.
+   :param module_code: Code du module sur lequel on veut vérifier les permissions.
+   :type module_code: str
+   :param object_code: Code de l’objet sur lequel on veut vérifier les permissions.
     Si non fourni, on vérifie la portée sur l’objet ``ALL``.
    :type object_code: str, optional
    :param get_scope: si ``True``, ajoute le scope aux kwargs de la vue
@@ -1174,10 +1173,29 @@ Exemple d’utilisation :
             raise Forbidden
 
 
-Récupération manuelle des permissions
-"""""""""""""""""""""""""""""""""""""
+Récupération manuelle du scope
+""""""""""""""""""""""""""""""
+
+La fonction suivante permet de récupérer manuellement le scope pour un rôle, une action et un module donnés :
+
+.. py:function:: get_scope(action_code, id_role, module_code, object_code)
+
+   Retourne le scope de l’utilisateur donnée une action dans le module demandé.
+
+   :param action_code: Code de l’action.
+   :type action_code: str["C", "R", "U", "V", "E", "D"]
+   :param id_role: Identifiant du role. Utilisation de ``g.current_user`` si non spécifié
+                   (nécessite de se trouver dans une route authentifiée).
+   :type id_role: int, optional
+   :param module_code: Code du module. Si non spécifié, utilisation de ``g.current_module``
+   :type module_code: str, optional
+   :param object_code: Code de l’objet. Si non spécifié, utilisation de ``g.current_object``,
+                       ``ALL`` à défaut.
+   :type object_code: str, optional
+   :return: Valeur du scope
+   :rtype: int[0, 1, 2, 3]
 
-La fonction suivante permet de récupérer manuellement le scope pour chaque actions pour un rôle et un module donnés :
+Il est également possible de récupérer les scopes pour l’ensemble des actions possibles grâce à la fonction suivante :
 
 .. py:function:: get_scopes_by_action(id_role, module_code, object_code)
 
@@ -1201,6 +1219,93 @@ Exemple d’usage :
     {'C': 3, 'R': 3, 'U': 3, 'V': 3, 'E': 3, 'D': 3}
 
 
+Restreindre une route aux utilisateurs avec des permissions avancées
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+
+Utiliser le décorateur ``@permissions_required`` :
+
+.. py:decorator:: permissions_required
+
+   :param action: Type d'action effectuée par la route
+                  (Create, Read, Update, Validate, Export, Delete)
+   :type action: str["C", "R", "U", "V", "E", "D"]
+   :param module_code: Code du module sur lequel on veut vérifier les permissions.
+   :type module_code: str
+   :param object_code: Code de l’objet sur lequel on veut vérifier les permissions.
+    Si non fourni, on vérifie la portée sur l’objet ``ALL``.
+   :type object_code: str, optional
+
+Lorsque l’utilisateur n’est pas connecté, le comportement est le même que le décorateur ``@login_required``.
+Lorsque celui-ci est connecté, le décorateur va récupérer l’ensemble des permissions pour l’action donnée dans le module donnée (et éventuellement l’objet donnée).
+Si aucune permission n’est trouvée, alors une erreur 403 (Forbidden) est levée.
+
+.. warning::
+
+    Le décorateur ne vérifie pas si le jeu de permissions est suffisant pour accéder
+    aux ressources demandées. C’est à votre route d’implémenter cette vérification,
+    celle-ci recevant le jeu de permissions en argument.
+
+
+Exemple d’utilisation :
+
+.. code-block:: python
+
+    from geonature.core.gn_permissions.decorators import permissions_required
+
+    @blueprint.route('/mysensibleview', methods=['GET'])
+    @permissions_required(
+            'R',
+            module_code="SYNTHESE"
+    )
+    def my_sensible_view(permissions):
+        for perm in permissions:
+            if perm.has_other_filters_than("SCOPE", "SENSITIVITY"):
+                continue
+            if perm.scope_value > 2 and not perm.sensitivity_filter:
+                break
+        else:
+            raise Forbidden
+
+
+Récupération manuelle des permissions avancées
+""""""""""""""""""""""""""""""""""""""""""""""
+
+Utiliser la fonction ``get_permissions`` :
+
+.. py:function:: get_permissions(action_code, id_role, module_code, object_code)
+
+   Retourne l’ensemble des permissions de l’utilisateur donnée pour l’action, le module et l’objet précisé.
+
+   :param action_code: Code de l’action.
+   :type action_code: str["C", "R", "U", "V", "E", "D"]
+   :param id_role: Identifiant du role. Utilisation de ``g.current_user`` si non spécifié
+                   (nécessite de se trouver dans une route authentifiée).
+   :type id_role: int, optional
+   :param module_code: Code du module. Si non spécifié, utilisation de ``g.current_module``
+   :type module_code: str, optional
+   :param object_code: Code de l’objet. Si non spécifié, utilisation de ``g.current_object``,
+                       ``ALL`` à défaut.
+   :type object_code: str, optional
+   :return: Liste de permissions
+   :rtype: list[Permission]
+
+
+À propos de l’API « scope »
+"""""""""""""""""""""""""""
+
+Certains modules supportent des permissions avec plusieurs types de filtres (par exemple, filtre d’appartenance et filtre de sensibilité), ce qui amène à devoir définir plusieurs permissions pour une même action dans un module donnée (par exemple, droit de lecteur des données de mon organisme sans restriction de sensibilité + droit de lecteur des données non sensible sans restriction d’appartenance).
+
+Cependant, cet usage est très peu répandu, la plupart des modules acceptant uniquement un filtre d’appartenance, voir aucun filtre.
+Ainsi, l’API « scope » (décorateur ``@check_cruved_scope``, fonctions ``get_scope`` et ``get_scopes_by_action``) visent à simplifier l’usage des permissions dans ces modules en résumant les droits de l’utilisateur par un entier de 0 à 4 :
+
+- 0 : aucune donnée (pas de permission)
+- 1 : données m’appartenant
+- 2 : données appartenant à mon organisme
+- 3 : toutes les données (permission sans filtre d’appartenance)
+
+L’utilisateur héritant des permissions des différents groupes auquel il appartient en plus de ses permissions personnelles, l’API « scope » s’occupe de calculer le scope maximal de l’utilisateur.
+
+
 Développement Frontend
 ----------------------
 

From cb7c227d47591e665302ed252a7346e81f68aa6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?= <elie@bouttier.eu>
Date: Mon, 5 Jun 2023 11:20:43 +0200
Subject: [PATCH 105/209] doc: how to add a new permission filter

---
 docs/development.rst | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/docs/development.rst b/docs/development.rst
index cac963c50a..1f922d7c63 100644
--- a/docs/development.rst
+++ b/docs/development.rst
@@ -1306,6 +1306,38 @@ Ainsi, l’API « scope » (décorateur ``@check_cruved_scope``, fonctions ``get
 L’utilisateur héritant des permissions des différents groupes auquel il appartient en plus de ses permissions personnelles, l’API « scope » s’occupe de calculer le scope maximal de l’utilisateur.
 
 
+Rajouter un nouveau type de filtre
+""""""""""""""""""""""""""""""""""
+
+On suppose souhaiter l’ajout d’un nouveau type de filtre « foo ».
+
+1. Rajouter une colonne dans la table ``t_permissions`` nommé ``foo_filter`` du type désiré (booléen, entier, …) avec éventuellement une contrainte de clé étrangère.
+   Dans le cas où le filtre peut contenir une liste de valeur contrôlées par une Foreign Key, on préfèrera l’ajout d’une nouvelle table contenant une Foreign Key vers ``t_permissions.id_permission`` (par exemple, filtre géographique avec liste d’``id_area`` ou filtre taxonomique avec liste de ``cd_nom``).
+
+2. Rajouter une colonne booléenne dans la table ``t_permissions_available`` nommé ``foo_filter``.
+
+3. Faire évoluer les modèles Python ``Permission`` et ``PermissionAvailable`` pour refléter les changements du schéma de base de données.
+
+4. Compléter ``Permission.filters_fields`` et ``PermissionAvailable.filters_fields`` (*e.g.* ``"FOO": foo_filter``).
+
+5. Vérifier que la propriété ``Permission.filters`` fonctionne correctement avec le nouveau filtre : celui-ci doit être renvoyé uniquement s’il est défini.
+   Le cas d’une relationship n’a encore jamais été traité.
+
+6. Optionel : Rajouter une méthode statique ``Permission.__FOO_le__(a, b)``.
+   Celle-ci reçoit en argument 2 filtres FOO et doit renvoyer ``True`` lorsque le filtre ``a`` est plus restrictif (au autant) que le filtre ``b``.
+   Par exemple, dans le cas d’un filtre géographique, on renvera ``True`` si ``b`` vaut ``None`` (pas de restriction géographique) ou si la liste des zonages ``a`` est un sous-ensemble de la liste des zonages ``b``.
+   Cette méthode permet d’optimiser le jeu de permission en supprimant les permissions redondantes.
+
+7. Compléter la classe ``PermFilter`` qui permet l’affichage des permissions dans Flask-Admin (permissions des utilisateurs et des groupes).
+   Attention, Flask-Admin utilise FontAwesome version **4**.
+
+8. Faire évoluer Flask-Admin (classes ``PermissionAdmin`` et ``PermissionAvailableAdmin``) pour prendre en charge le nouveau type de filtre.
+
+9. Implémenter le support de son nouveau filtre à l’endroit voulu (typiquement la synthèse).
+
+10. Compléter ou faire évoluer la table ``t_permissions_available`` pour déclarer le nouveau filtre comme disponible pour son module.
+
+
 Développement Frontend
 ----------------------
 

From ec00f9db7fe3c0f52c8b4c5faab217ed38fc4e6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?= <elie@bouttier.eu>
Date: Sun, 11 Jun 2023 16:04:25 +0200
Subject: [PATCH 106/209] add Debian 12 to CI matrix

---
 .github/workflows/pytest.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 60a4b370f9..d533b3d286 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -19,7 +19,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        debian-version: [ '10', '11' ]
+        debian-version: [ '10', '11', '12' ]
         include:
           - debian-version: '10'
             python-version: '3.7'
@@ -29,6 +29,10 @@ jobs:
             python-version: '3.9'
             postgres-version: '13'
             postgis-version: '3.2'
+          - debian-version: '12'
+            python-version: '3.11'
+            postgres-version: '15'
+            postgis-version: '3.3'
 
     name: Debian ${{ matrix.debian-version }}
 

From 42659eb57bc2a4caf679afddafdfbd9d97e963e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?= <elie@bouttier.eu>
Date: Mon, 12 Jun 2023 13:42:33 +0200
Subject: [PATCH 107/209] bump fiona to 1.8.22

compat. Debian 10, 11 & 12
---
 backend/requirements-common.in | 2 +-
 backend/requirements-dev.txt   | 5 ++++-
 backend/requirements.txt       | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/backend/requirements-common.in b/backend/requirements-common.in
index 42429d23f6..91a188eb0b 100644
--- a/backend/requirements-common.in
+++ b/backend/requirements-common.in
@@ -1,6 +1,6 @@
 celery[redis]
 click>=7.0
-fiona
+fiona>=1.8.22,<1.9
 flask
 flask-cors
 flask-mail
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index 25be7ef4dd..7314627a73 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -120,7 +120,7 @@ dnspython==2.2.1
     # via email-validator
 email-validator==1.3.0
     # via wtforms-components
-fiona==1.8.21
+fiona==1.8.22
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
@@ -333,9 +333,12 @@ sqlalchemy==1.3.24
     #   flask-sqlalchemy
     #   geoalchemy2
     #   marshmallow-sqlalchemy
+    #   pypn-habref-api
     #   pypn-ref-geo
+    #   pypnnomenclature
     #   pypnusershub
     #   taxhub
+    #   utils-flask-sqlalchemy
     #   utils-flask-sqlalchemy-geo
     #   wtforms-sqlalchemy
 tinycss2==1.1.1
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 21e59843ba..53ccbd6cb8 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -81,7 +81,7 @@ defusedxml==0.7.1
     # via cairosvg
 deprecated==1.2.13
     # via redis
-fiona==1.8.21
+fiona==1.8.22
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
@@ -294,6 +294,7 @@ sqlalchemy==1.3.24
     #   pypnnomenclature
     #   pypnusershub
     #   taxhub
+    #   utils-flask-sqlalchemy
     #   utils-flask-sqlalchemy-geo
     #   wtforms-sqlalchemy
 taxhub==1.11.1

From 80ff10e1dc5b7ee2af796648db5fae1654b48cf6 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 31 May 2023 14:28:59 +0200
Subject: [PATCH 108/209] register enhancement

---
 .../core/users/register_post_actions.py       |  9 +++---
 backend/geonature/core/users/routes.py        | 23 ++++++++++++++-
 .../email_admin_validate_account.html         |  4 +++
 .../login/sign-up/sign-up.component.html      |  3 ++
 .../login/sign-up/sign-up.component.ts        | 28 +++++++++++++------
 5 files changed, 54 insertions(+), 13 deletions(-)

diff --git a/backend/geonature/core/users/register_post_actions.py b/backend/geonature/core/users/register_post_actions.py
index 7889da92a7..0f8c8fa9e2 100644
--- a/backend/geonature/core/users/register_post_actions.py
+++ b/backend/geonature/core/users/register_post_actions.py
@@ -47,14 +47,15 @@ def validate_temp_user(data):
         recipients = [current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]]
     url_validation = url_for("users.confirmation", token=user.token_role, _external=True)
 
+    additional_fields = [
+        {"key": key, "value": value} for key, value in (user_dict.get("champs_addi") or {}).items()
+    ]
+
     msg_html = render_template(
         template,
         url_validation=url_validation,
         user=user_dict,
-        additional_fields=[
-            {"key": key, "value": value}
-            for key, value in (user_dict.get("champs_addi") or {}).items()
-        ],
+        additional_fields=additional_fields,
     )
 
     send_mail(recipients, subject, msg_html)
diff --git a/backend/geonature/core/users/routes.py b/backend/geonature/core/users/routes.py
index 55d2fdece5..1194fede50 100644
--- a/backend/geonature/core/users/routes.py
+++ b/backend/geonature/core/users/routes.py
@@ -300,7 +300,28 @@ def confirmation():
     if r.status_code != 200:
         return Response(r), r.status_code
 
-    return redirect(config["URL_APPLICATION"], code=302)
+    new_user = r.json()
+
+    txt_champs_addi = ""
+    for key in new_user["champs_addi"]:
+        txt_champs_addi += (
+            f"&nbsp;&nbsp;&nbsp;&nbsp;- <b>{key}</b>: {new_user['champs_addi'][key]}<br>"
+        )
+
+    return (
+        f"""Le compte suivant à bien été ajouté à l'application GeoNature<br>
+    <br>
+    - <b>Nom</b>: {new_user['nom_role']}<br>
+    - <b>Prénom</b>: {new_user['prenom_role']}<br>
+    - <b>Identifiant</b>: {new_user['identifiant']}<br>
+    - <b>Email</b>: {new_user['email']}<br>
+    - <b>Champs additionnels</b>:<br>
+    {txt_champs_addi}
+    <br>
+    <a href="{config["URL_APPLICATION"]}">Retour à l'application GeoNature</a>
+        """,
+        200,
+    )
 
 
 @routes.route("/after_confirmation", methods=["POST"])
diff --git a/backend/geonature/core/users/templates/email_admin_validate_account.html b/backend/geonature/core/users/templates/email_admin_validate_account.html
index a92c44d413..7379afc5b2 100644
--- a/backend/geonature/core/users/templates/email_admin_validate_account.html
+++ b/backend/geonature/core/users/templates/email_admin_validate_account.html
@@ -10,6 +10,10 @@
   <li><b>Prénom :</b> {{user.prenom_role}}</li>
   <li><b>Identifiant :</b> {{user.identifiant}}</li>
   <li><b>Email :</b> {{user.email}}</li>
+{% if  user.remarques %}
+  <li><b>Remarques :</b> {{user.remarques}}</li>
+{% endif%}
+
 </ul>
 
 {% if additional_fields | length > 0 %}
diff --git a/frontend/src/app/modules/login/sign-up/sign-up.component.html b/frontend/src/app/modules/login/sign-up/sign-up.component.html
index ea6e1dd8c0..d3a38b78ed 100644
--- a/frontend/src/app/modules/login/sign-up/sign-up.component.html
+++ b/frontend/src/app/modules/login/sign-up/sign-up.component.html
@@ -214,6 +214,9 @@ <h5>Informations complémentaires</h5>
                 </button>
               </div>
             </form>
+            <ngb-alert type="danger" *ngIf="errorMsg">
+              {{errorMsg}}
+            </ngb-alert>
           </div>
         </div>
       </div>
diff --git a/frontend/src/app/modules/login/sign-up/sign-up.component.ts b/frontend/src/app/modules/login/sign-up/sign-up.component.ts
index b3674c79fb..c421b0478a 100644
--- a/frontend/src/app/modules/login/sign-up/sign-up.component.ts
+++ b/frontend/src/app/modules/login/sign-up/sign-up.component.ts
@@ -7,7 +7,6 @@ import { CommonService } from '@geonature_common/service/common.service';
 
 import { AuthService } from '../../../components/auth/auth.service';
 import { ConfigService } from '@geonature/services/config.service';
-
 @Component({
   selector: 'pnx-signup',
   templateUrl: './sign-up.component.html',
@@ -19,6 +18,7 @@ export class SignUpComponent implements OnInit {
   public disableSubmit = false;
   public formControlBuilded = false;
   public FORM_CONFIG = null;
+  public errorMsg = '';
 
   constructor(
     private fb: UntypedFormBuilder,
@@ -57,21 +57,33 @@ export class SignUpComponent implements OnInit {
 
   save() {
     if (this.form.valid) {
+      this.errorMsg = ''; // raz de l'erreur
       this.disableSubmit = true;
       const finalForm = Object.assign({}, this.form.value);
       // concatenate two forms
+      finalForm['champs_addi'] = {};
       if (this.config.ACCOUNT_MANAGEMENT.ACCOUNT_FORM.length > 0) {
         finalForm['champs_addi'] = this.dynamicFormGroup.value;
       }
+      // ajout de organisme aux champs addi
+      finalForm['champs_addi']['organisme'] = this.form.value['organisme'];
       this._authService
         .signupUser(finalForm)
-        .subscribe(() => {
-          const callbackMessage = this.config.ACCOUNT_MANAGEMENT.AUTO_ACCOUNT_CREATION
-            ? 'AutoAccountEmailConfirmation'
-            : 'AdminAccountEmailConfirmation';
-          this._commonService.translateToaster('info', callbackMessage);
-          this._router.navigate(['/login']);
-        })
+        .subscribe(
+          () => {
+            const callbackMessage = this.config.ACCOUNT_MANAGEMENT.AUTO_ACCOUNT_CREATION
+              ? 'AutoAccountEmailConfirmation'
+              : 'AdminAccountEmailConfirmation';
+            this._commonService.translateToaster('info', callbackMessage);
+            this._router.navigate(['/login']);
+          },
+          (error) => {
+            // affichage de l'erreur renvoyé par l'api
+            if (error.error.msg) {
+              this.errorMsg = error.error.msg;
+            }
+          }
+        )
         .add(() => {
           this.disableSubmit = false;
         });

From de3c8fe5b9bfeb86c49fac0e177217cbf24ee2b5 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 31 May 2023 14:57:53 +0200
Subject: [PATCH 109/209] fix send mail to multiple validators ref #2389

---
 .../core/users/register_post_actions.py         | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/users/register_post_actions.py b/backend/geonature/core/users/register_post_actions.py
index 0f8c8fa9e2..5332bb2a9b 100644
--- a/backend/geonature/core/users/register_post_actions.py
+++ b/backend/geonature/core/users/register_post_actions.py
@@ -20,6 +20,15 @@
 from geonature.utils.env import db, DB
 
 
+def validators_emails():
+    return (
+        current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]
+        .replace(" ", "")
+        .replace("\n", "")
+        .split(",")
+    )
+
+
 def validate_temp_user(data):
     """
     Send an email after the action of account creation.
@@ -44,7 +53,7 @@ def validate_temp_user(data):
         recipients = [user.email]
     else:
         template = "email_admin_validate_account.html"
-        recipients = [current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]]
+        recipients = validators_emails()
     url_validation = url_for("users.confirmation", token=user.token_role, _external=True)
 
     additional_fields = [
@@ -152,7 +161,11 @@ def inform_user(user):
         text_addon=html_text_addon,
     )
     subject = f"Confirmation inscription {app_name}"
-    send_mail([user["email"]], subject, msg_html)
+    recipients = [user["email"]]
+    # dans le cas ou on a plusieurs validateurs et on veut prévenir tout le monde
+    # de la validation du compte ????????
+    # recipients + validators_emails()
+    send_mail(recipients, subject, msg_html)
 
 
 def send_email_for_recovery(data):

From 585767b34517cee20489adf0aa8c560968243672 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Thu, 1 Jun 2023 12:16:39 +0200
Subject: [PATCH 110/209] error validation temp user return msg if exists

---
 backend/geonature/core/users/routes.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/backend/geonature/core/users/routes.py b/backend/geonature/core/users/routes.py
index 1194fede50..c952c511b5 100644
--- a/backend/geonature/core/users/routes.py
+++ b/backend/geonature/core/users/routes.py
@@ -298,6 +298,8 @@ def confirmation():
     )
 
     if r.status_code != 200:
+        if r.json() and r.json().get("msg"):
+            return r.json().get("msg"), r.status_code
         return Response(r), r.status_code
 
     new_user = r.json()

From fc4365121fa2c387960a305b4b65b711f1988529 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Mon, 12 Jun 2023 10:12:19 +0200
Subject: [PATCH 111/209] fix validators mails

---
 .../geonature/core/users/register_post_actions.py  | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/backend/geonature/core/users/register_post_actions.py b/backend/geonature/core/users/register_post_actions.py
index 5332bb2a9b..df0a8c477e 100644
--- a/backend/geonature/core/users/register_post_actions.py
+++ b/backend/geonature/core/users/register_post_actions.py
@@ -21,12 +21,11 @@
 
 
 def validators_emails():
-    return (
-        current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]
-        .replace(" ", "")
-        .replace("\n", "")
-        .split(",")
-    )
+    """
+    On souhaite récupérer une liste de mails
+    """
+    emails = current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]
+    return emails if isinstance(emails, list) else [emails]
 
 
 def validate_temp_user(data):
@@ -162,9 +161,6 @@ def inform_user(user):
     )
     subject = f"Confirmation inscription {app_name}"
     recipients = [user["email"]]
-    # dans le cas ou on a plusieurs validateurs et on veut prévenir tout le monde
-    # de la validation du compte ????????
-    # recipients + validators_emails()
     send_mail(recipients, subject, msg_html)
 
 

From 11baa5a2ccf4a46ad97472eb7aaca0a29906dbc6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89lie=20Bouttier?= <elie@bouttier.eu>
Date: Sun, 11 Jun 2023 15:31:45 +0200
Subject: [PATCH 112/209] fix create db: pass extensions on stdin

psql is executed as postgres user which does not necessarily have
permission to read add_pg_extensions.sql file.
---
 install/03_create_db.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/03_create_db.sh b/install/03_create_db.sh
index 8ff8d55c5f..8032d24796 100755
--- a/install/03_create_db.sh
+++ b/install/03_create_db.sh
@@ -59,7 +59,7 @@ write_log "Creating GeoNature database..."
 sudo -u postgres -s createdb -O $user_pg $db_name -T template0 -E UTF-8 -l $my_local |& tee -a "${LOG_FILE}"
 
 write_log "Adding PostgreSQL extensions"
-sudo -u postgres -s psql -d $db_name -f "${SCRIPT_DIR}/assets/db/add_pg_extensions.sql" |& tee -a "${LOG_FILE}"
+cat "${SCRIPT_DIR}/assets/db/add_pg_extensions.sql" | sudo -u postgres -s psql -d $db_name |& tee -a "${LOG_FILE}"
 
 
 # Mise en place de la structure de la BDD et des données permettant son fonctionnement avec l'application

From 56ceef99dea50c61407c2dcf758a9bb67282eec0 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 10:48:33 +0200
Subject: [PATCH 113/209] Add --yes flag to skip prompt on supergrant command
 Use this flag for installation script

---
 .github/workflows/cypress.yml                   |  4 +++-
 .../geonature/core/gn_permissions/commands.py   | 17 +++++++++++------
 install/03_create_db.sh                         |  2 +-
 install/04_install_gn_modules.sh                |  2 +-
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml
index 99d2c85043..520d0e6cd9 100644
--- a/.github/workflows/cypress.yml
+++ b/.github/workflows/cypress.yml
@@ -5,6 +5,7 @@ on:
       - master
       - hotfixes
       - develop
+      - fixtestfront
   pull_request:
     branches:
       - master
@@ -104,6 +105,7 @@ jobs:
           geonature install-gn-module contrib/gn_module_occhab OCCHAB --build=false
           geonature db upgrade occhab-samples@head
           geonature install-gn-module contrib/gn_module_validation VALIDATION --build=false
+          geonature permissions supergrant --group --nom "Grp_admin" --yes
         env:
           GEONATURE_CONFIG_FILE: config/test_config.toml
       - name: Run GeoNature backend
@@ -119,7 +121,7 @@ jobs:
       - name: Cypress run
         uses: cypress-io/github-action@v5
         with:
-          record: false
+          record: true
           working-directory: ./frontend
           start: npm run start
           wait-on: http://127.0.0.1:4200
diff --git a/backend/geonature/core/gn_permissions/commands.py b/backend/geonature/core/gn_permissions/commands.py
index 7ea1515a4e..1d9c84e892 100644
--- a/backend/geonature/core/gn_permissions/commands.py
+++ b/backend/geonature/core/gn_permissions/commands.py
@@ -30,7 +30,12 @@
     is_flag=True,
     help="Uniquement afficher les permissions nécessaires, sans les ajouter en base",
 )
-def supergrant(skip_existing, dry_run, **filters):
+@click.option(
+    "--yes",
+    is_flag=True,
+    help="Répond automatiquement oui à la confirmation",
+)
+def supergrant(skip_existing, dry_run, yes, **filters):
     filters = {k: v for k, v in filters.items() if v is not None}
     if not filters:
         raise UsageError("Veuillez sélectionner le rôle à promouvoir.")
@@ -40,11 +45,11 @@ def supergrant(skip_existing, dry_run, **filters):
         raise UsageError("Plusieurs rôles correspondent à vos filtres, veuillez les affiner.")
     except NoResultFound:
         raise UsageError("Aucun rôle ne correspond à vos filtres, veuillez les corriger.")
-    if not click.confirm(
-        f"Ajouter les permissions administrateur au rôle {role.id_role} ({role.nom_complet}) ?"
-    ):
-        raise click.Abort()
-
+    if not yes:
+        if not click.confirm(
+            f"Ajouter les permissions administrateur au rôle {role.id_role} ({role.nom_complet}) ?",
+        ):
+            raise click.Abort()
     for ap in PermissionAvailable.query.outerjoin(
         Permission, sa.and_(PermissionAvailable.permissions, Permission.id_role == role.id_role)
     ).options(
diff --git a/install/03_create_db.sh b/install/03_create_db.sh
index 8ff8d55c5f..ec4529740c 100755
--- a/install/03_create_db.sh
+++ b/install/03_create_db.sh
@@ -80,4 +80,4 @@ fi
 
 . ${SCRIPT_DIR}/03b_populate_db.sh |& tee -a "${LOG_FILE}"
 
-geonature permissions supergrant --group --nom "Grp_admin"
+geonature permissions supergrant --group --nom "Grp_admin" --yes
diff --git a/install/04_install_gn_modules.sh b/install/04_install_gn_modules.sh
index ce1a38a1be..81ef3cc3dc 100755
--- a/install/04_install_gn_modules.sh
+++ b/install/04_install_gn_modules.sh
@@ -31,7 +31,7 @@ if [ "$install_module_validation" = true ]; then
 fi
 
 # Grant admin group permissions on new installed modules
-geonature permissions supergrant --group --nom "Grp_admin"
+geonature permissions supergrant --group --nom "Grp_admin" --yes
 
 echo "Désactivation du virtual env"
 deactivate

From c350e13fbc97a04d11f6a06112efe45009ec2834 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 12:12:08 +0200
Subject: [PATCH 114/209] declare available perms for duplicate occtax module

---
 .../migrations/data/sample_data_test.sql      | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/contrib/occtax/backend/occtax/migrations/data/sample_data_test.sql b/contrib/occtax/backend/occtax/migrations/data/sample_data_test.sql
index f685b4abe8..bf40c834a6 100644
--- a/contrib/occtax/backend/occtax/migrations/data/sample_data_test.sql
+++ b/contrib/occtax/backend/occtax/migrations/data/sample_data_test.sql
@@ -34,6 +34,38 @@ SELECT
     (SELECT id_module FROM gn_commons.t_modules WHERE module_code = 'OCCTAX_DS')
 FROM s;
 
+---- Ajouter permissions disponibles pour les nouveau module
+
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     ('OCCTAX_DS', 'ALL', 'C', True, 'Créer des relevés')
+                    ,('OCCTAX_DS', 'ALL', 'R', True, 'Voir les relevés')
+                    ,('OCCTAX_DS', 'ALL', 'U', True, 'Modifier les relevés')
+                    ,('OCCTAX_DS', 'ALL', 'E', True, 'Exporter les relevés')
+                    ,('OCCTAX_DS', 'ALL', 'D', True, 'Supprimer des relevés')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code;
+
 
 -- Insérer un cadre d'acquisition d'exemple
 

From 59d51bc0bd119f8e72579c9d761f85bff57d7c21 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 13:45:55 +0200
Subject: [PATCH 115/209] remove cypress record

---
 .github/workflows/cypress.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cypress.yml b/.github/workflows/cypress.yml
index 520d0e6cd9..cbdb334fb3 100644
--- a/.github/workflows/cypress.yml
+++ b/.github/workflows/cypress.yml
@@ -121,7 +121,7 @@ jobs:
       - name: Cypress run
         uses: cypress-io/github-action@v5
         with:
-          record: true
+          record: false
           working-directory: ./frontend
           start: npm run start
           wait-on: http://127.0.0.1:4200

From 1ab22a20380f0bd69bf088dd7a78320295d020f6 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 14:03:07 +0200
Subject: [PATCH 116/209] gitignore cache

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 10d17ece8a..0e74f5cb0d 100755
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@ backend/static/node_modules
 backend/media
 
 backend/run.py
+cache/*
 
 .vscode
 

From 57781f769f8a46595df15847a0317109286226d3 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 14:07:11 +0200
Subject: [PATCH 117/209] Bump TaxHub to 1.11.2

---
 backend/dependencies/TaxHub | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/dependencies/TaxHub b/backend/dependencies/TaxHub
index c08e8f3f22..5c5354ffed 160000
--- a/backend/dependencies/TaxHub
+++ b/backend/dependencies/TaxHub
@@ -1 +1 @@
-Subproject commit c08e8f3f2248a8cc493136b6a2285bc513024a9f
+Subproject commit 5c5354ffedc8b4242ae7d69d01bc3ba3ba19033a

From ca818b28fe0cecb190d939206a451d8b622e9aec Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 14:22:34 +0200
Subject: [PATCH 118/209] Doc on permissions when install module doc on
 duplicate module

---
 docs/admin-manual.rst | 35 +++++++++++++++++++++++++++++++++++
 docs/installation.rst |  7 +++++++
 2 files changed, 42 insertions(+)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index a70157b449..a8bf4adb3c 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -1778,6 +1778,41 @@ Dans l'exemple ci-dessous, remplacez ``<MODULE_PATH>`` par le contenu de la colo
     INSERT INTO gn_synthese.t_sources (name_source,desc_source,entity_source_pk_field,url_source,,id_module) VALUES
     ('Flore station (sous-module Occtax)','Données issues du protocole Flore station','pr_occtax.cor_counting_occtax.id_counting_occtax','#/<MODULE_PATH>/info/id_counting', <ID_MODULE>);
 
+Bien que le module soit une copie d'Occtax, il est tout de même nécessaire de définir les permissions disponibles pour ce module (ce sont les mêmes qu'Occtax). Jouez le scrit SQL suivant en remplacant :MODULE_CODE par le code du module que vous venez de créer.
+
+::
+
+    INSERT INTO
+        gn_permissions.t_permissions_available (
+            id_module,
+            id_object,
+            id_action,
+            label,
+            scope_filter
+        )
+    SELECT
+        m.id_module,
+        o.id_object,
+        a.id_action,
+        v.label,
+        v.scope_filter
+    FROM
+        (
+            VALUES
+                  (':MODULE_CODE', 'ALL', 'C', True, 'Créer des relevés')
+                ,(':MODULE_CODE', 'ALL', 'R', True, 'Voir les relevés')
+                ,(':MODULE_CODE', 'ALL', 'U', True, 'Modifier les relevés')
+                ,(':MODULE_CODE', 'ALL', 'E', True, 'Exporter les relevés')
+                ,(':MODULE_CODE', 'ALL', 'D', True, 'Supprimer des relevés')
+        ) AS v (module_code, object_code, action_code, scope_filter, label)
+    JOIN
+        gn_commons.t_modules m ON m.module_code = v.module_code
+    JOIN
+        gn_permissions.t_objects o ON o.code_object = v.object_code
+    JOIN
+        gn_permissions.bib_actions a ON a.code_action = v.action_code;
+
+
 Associer des jeux de données et des champs additionnels
 ```````````````````````````````````````````````````````
 
diff --git a/docs/installation.rst b/docs/installation.rst
index c9c8e4f19d..1c86012484 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -161,6 +161,13 @@ Exemple pour le module Import :
     source ~/GeoNature/backend/venv/bin/activate
     geonature install-gn-module ~/gn_module_import/ IMPORT
 
+Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, lancez la commande suivante pour vous ajoutez des droits. Vous pourrez ensuite definir des droits à vos utilisateurs
+
+.. code-block:: bash
+    # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé
+    geonature permissions supergrant --group --nom "Grp_admin"
+
+
 Puis relancer GeoNature :
 
 .. code-block:: bash

From 37fc66b391ec114afd99f5d21234ea4ad5e9c907 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 14 Jun 2023 15:34:02 +0200
Subject: [PATCH 119/209] bump dependencies and submodules + doc on release

---
 .../UsersHub-authentification-module          |   2 +-
 backend/dependencies/Utils-Flask-SQLAlchemy   |   2 +-
 .../dependencies/Utils-Flask-SQLAlchemy-Geo   |   2 +-
 backend/requirements-common.in                |   5 +-
 backend/requirements-dependencies.in          |   8 +-
 backend/requirements-dev.txt                  | 106 +++++++++--------
 backend/requirements.txt                      | 108 +++++++++---------
 docs/development.rst                          |   8 +-
 8 files changed, 120 insertions(+), 121 deletions(-)

diff --git a/backend/dependencies/UsersHub-authentification-module b/backend/dependencies/UsersHub-authentification-module
index 529a497e21..3f6b3a62c4 160000
--- a/backend/dependencies/UsersHub-authentification-module
+++ b/backend/dependencies/UsersHub-authentification-module
@@ -1 +1 @@
-Subproject commit 529a497e218f09edff708eddcb07aae225ce60cf
+Subproject commit 3f6b3a62c4d6ef069e53fbd9fa7b042f5d0e727d
diff --git a/backend/dependencies/Utils-Flask-SQLAlchemy b/backend/dependencies/Utils-Flask-SQLAlchemy
index 4a1d299100..71fbdbefc8 160000
--- a/backend/dependencies/Utils-Flask-SQLAlchemy
+++ b/backend/dependencies/Utils-Flask-SQLAlchemy
@@ -1 +1 @@
-Subproject commit 4a1d299100fa3076caab81b1274ae9750d37bd9c
+Subproject commit 71fbdbefc80d1efc0287a4887efa03a1a2131f15
diff --git a/backend/dependencies/Utils-Flask-SQLAlchemy-Geo b/backend/dependencies/Utils-Flask-SQLAlchemy-Geo
index ed2a05f04f..2b5002bf13 160000
--- a/backend/dependencies/Utils-Flask-SQLAlchemy-Geo
+++ b/backend/dependencies/Utils-Flask-SQLAlchemy-Geo
@@ -1 +1 @@
-Subproject commit ed2a05f04f562be41cfc482c28bfc5aa30382b6b
+Subproject commit 2b5002bf13762d1c49b5d18516cd72d82861f12c
diff --git a/backend/requirements-common.in b/backend/requirements-common.in
index 91a188eb0b..3c9e3421ab 100644
--- a/backend/requirements-common.in
+++ b/backend/requirements-common.in
@@ -4,14 +4,15 @@ fiona>=1.8.22,<1.9
 flask
 flask-cors
 flask-mail
-flask-marshmallow
+flask-marshmallow<0.15.0
 flask-migrate
 flask-sqlalchemy
 flask-weasyprint
 flask_wtf
 geojson
 gunicorn>=19.8.0
-importlib_metadata;python_version<"3.10"
+importlib_metadata==4.13.0;python_version<"3.10"
+importlib_metadata;python_version>"3.10"
 lxml
 marshmallow
 marshmallow-sqlalchemy
diff --git a/backend/requirements-dependencies.in b/backend/requirements-dependencies.in
index 795c8a8425..92e584921e 100644
--- a/backend/requirements-dependencies.in
+++ b/backend/requirements-dependencies.in
@@ -1,7 +1,7 @@
-pypnusershub>=1.6.5,<2
+pypnusershub>=1.6.7,<2
 pypnnomenclature>=1.5.4,<2
 pypn_habref_api>=0.3.2,<1
-utils-flask-sqlalchemy-geo>=0.2.7,<1
-utils-flask-sqlalchemy>=0.3.3,<1
-taxhub>=1.11.1,<2
+utils-flask-sqlalchemy-geo>=0.2.8,<1
+utils-flask-sqlalchemy>=0.3.4,<1
+taxhub>=1.11.2,<2
 pypn-ref-geo>=1.3.0,<2
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index 7314627a73..d25c281ceb 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.7
 # by the following command:
 #
-#    pip-compile requirements-dev.in
+#    pip-compile --resolver=backtracking requirements-dev.in
 #
 -e file:dependencies/Habref-api-module#egg=pypn_habref_api
     # via -r requirements-submodules.in
@@ -37,7 +37,7 @@
     # via
     #   -r requirements-submodules.in
     #   pypn-ref-geo
-alembic==1.8.1
+alembic==1.11.1
     # via
     #   flask-migrate
     #   pypn-ref-geo
@@ -46,33 +46,33 @@ amqp==5.1.1
     # via kombu
 async-timeout==4.0.2
     # via redis
-attrs==22.1.0
+attrs==23.1.0
     # via fiona
-authlib==1.0.1
+authlib==1.2.0
     # via pypnusershub
-bcrypt==4.0.0
+bcrypt==4.0.1
     # via pypnusershub
 billiard==3.6.4.0
     # via celery
-blinker==1.5
+blinker==1.6.2
     # via flask-mail
-boto3==1.24.64
+boto3==1.26.153
     # via taxhub
-botocore==1.27.64
+botocore==1.29.153
     # via
     #   boto3
     #   s3transfer
 cached-property==1.5.2
     # via kombu
-cairocffi==1.3.0
+cairocffi==1.6.0
     # via
     #   cairosvg
     #   weasyprint
-cairosvg==2.5.2
+cairosvg==2.7.0
     # via weasyprint
 celery[redis]==5.2.7
     # via -r requirements-common.in
-certifi==2022.6.15
+certifi==2023.5.7
     # via
     #   fiona
     #   requests
@@ -81,7 +81,7 @@ cffi==1.15.1
     #   cairocffi
     #   cryptography
     #   weasyprint
-charset-normalizer==2.1.1
+charset-normalizer==3.1.0
     # via requests
 click==8.1.3
     # via
@@ -104,9 +104,9 @@ click-repl==0.2.0
     # via celery
 cligj==0.7.2
     # via fiona
-cryptography==37.0.4
+cryptography==41.0.1
     # via authlib
-cssselect2==0.6.0
+cssselect2==0.7.0
     # via
     #   cairosvg
     #   weasyprint
@@ -114,17 +114,15 @@ decorator==5.1.1
     # via validators
 defusedxml==0.7.1
     # via cairosvg
-deprecated==1.2.13
-    # via redis
-dnspython==2.2.1
+dnspython==2.3.0
     # via email-validator
-email-validator==1.3.0
+email-validator==2.0.0.post2
     # via wtforms-components
 fiona==1.8.22
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
-flask==2.2.2
+flask==2.2.5
     # via
     #   -r requirements-common.in
     #   flask-admin
@@ -142,7 +140,7 @@ flask==2.2.2
     #   taxhub
     #   usershub
     #   utils-flask-sqlalchemy
-flask-admin==1.6.0
+flask-admin==1.6.1
     # via pypnnomenclature
 flask-cors==3.0.10
     # via
@@ -156,7 +154,7 @@ flask-marshmallow==0.14.0
     #   pypn-habref-api
     #   pypnnomenclature
     #   pypnusershub
-flask-migrate==3.1.0
+flask-migrate==4.0.4
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -177,13 +175,13 @@ flask-sqlalchemy==2.5.1
     #   utils-flask-sqlalchemy
 flask-weasyprint==1.0.0
     # via -r requirements-common.in
-flask-wtf==1.0.1
+flask-wtf==1.1.1
     # via
     #   -r requirements-common.in
     #   usershub
 geoalchemy2==0.11.1
     # via utils-flask-sqlalchemy-geo
-geojson==2.5.0
+geojson==3.0.1
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
@@ -194,21 +192,23 @@ gunicorn==20.1.0
     #   usershub
 html5lib==1.1
     # via weasyprint
-idna==3.3
+idna==3.4
     # via
     #   email-validator
     #   requests
-importlib-metadata==4.12.0 ; python_version < "3.10"
+importlib-metadata==4.13.0 ; python_version < "3.10"
     # via
     #   -r requirements-common.in
     #   alembic
+    #   attrs
     #   celery
     #   click
     #   flask
     #   kombu
     #   mako
+    #   munch
     #   redis
-importlib-resources==5.9.0
+importlib-resources==5.12.0
     # via alembic
 infinity==1.5
     # via intervals
@@ -226,18 +226,18 @@ jmespath==1.0.1
     #   botocore
 kombu==5.2.4
     # via celery
-lxml==4.9.1
+lxml==4.9.2
     # via -r requirements-common.in
-mako==1.2.2
+mako==1.2.4
     # via alembic
-markupsafe==2.1.1
+markupsafe==2.1.3
     # via
     #   jinja2
     #   mako
     #   werkzeug
     #   wtforms
     #   wtforms-components
-marshmallow==3.17.1
+marshmallow==3.19.0
     # via
     #   -r requirements-common.in
     #   flask-marshmallow
@@ -245,9 +245,9 @@ marshmallow==3.17.1
     #   marshmallow-sqlalchemy
     #   pypn-habref-api
     #   utils-flask-sqlalchemy
-marshmallow-geojson==0.3.0
+marshmallow-geojson==0.4.0
     # via utils-flask-sqlalchemy-geo
-marshmallow-sqlalchemy==0.28.1
+marshmallow-sqlalchemy==0.28.2
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -256,24 +256,23 @@ marshmallow-sqlalchemy==0.28.1
     #   taxhub
     #   usershub
     #   utils-flask-sqlalchemy-geo
-munch==2.5.0
+munch==3.0.0
     # via fiona
-packaging==21.3
+packaging==23.1
     # via
     #   -r requirements-common.in
     #   geoalchemy2
     #   marshmallow
     #   marshmallow-sqlalchemy
-    #   redis
-pillow==9.2.0
+pillow==9.5.0
     # via
     #   -r requirements-common.in
     #   cairosvg
     #   taxhub
     #   weasyprint
-prompt-toolkit==3.0.31
+prompt-toolkit==3.0.38
     # via click-repl
-psycopg2==2.9.3
+psycopg2==2.9.6
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -284,9 +283,7 @@ psycopg2==2.9.3
     #   usershub
 pycparser==2.21
     # via cffi
-pyparsing==3.0.9
-    # via packaging
-pyphen==0.13.0
+pyphen==0.14.0
     # via weasyprint
 python-dateutil==2.8.2
     # via
@@ -294,24 +291,24 @@ python-dateutil==2.8.2
     #   botocore
     #   usershub
     #   utils-flask-sqlalchemy
-python-dotenv==0.20.0
+python-dotenv==0.21.1
     # via
     #   pypn-habref-api
     #   pypn-ref-geo
     #   pypnnomenclature
     #   taxhub
     #   usershub
-pytz==2022.2.1
+pytz==2023.3
     # via celery
-redis==4.3.4
+redis==4.5.5
     # via celery
-requests==2.28.1
+requests==2.31.0
     # via
     #   pypn-habref-api
     #   pypnusershub
-s3transfer==0.6.0
+s3transfer==0.6.1
     # via boto3
-shapely==1.8.4
+shapely==1.8.5.post1
     # via
     #   -r requirements-common.in
     #   pypnnomenclature
@@ -341,19 +338,20 @@ sqlalchemy==1.3.24
     #   utils-flask-sqlalchemy
     #   utils-flask-sqlalchemy-geo
     #   wtforms-sqlalchemy
-tinycss2==1.1.1
+tinycss2==1.2.1
     # via
     #   cairosvg
     #   cssselect2
     #   weasyprint
 toml==0.10.2
     # via -r requirements-common.in
-typing-extensions==4.3.0
+typing-extensions==4.6.3
     # via
+    #   alembic
     #   async-timeout
     #   importlib-metadata
     #   redis
-urllib3==1.26.12
+urllib3==1.26.16
     # via
     #   botocore
     #   requests
@@ -365,7 +363,7 @@ vine==5.0.0
     #   amqp
     #   celery
     #   kombu
-wcwidth==0.2.5
+wcwidth==0.2.6
     # via prompt-toolkit
 weasyprint==52.5
     # via
@@ -376,10 +374,8 @@ webencodings==0.5.1
     #   cssselect2
     #   html5lib
     #   tinycss2
-werkzeug==2.2.2
+werkzeug==2.2.3
     # via flask
-wrapt==1.14.1
-    # via deprecated
 wtforms==3.0.1
     # via
     #   -r requirements-common.in
@@ -394,7 +390,7 @@ wtforms-sqlalchemy==0.3
     # via -r requirements-common.in
 xmltodict==0.13.0
     # via -r requirements-common.in
-zipp==3.8.1
+zipp==3.15.0
     # via
     #   importlib-metadata
     #   importlib-resources
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 53ccbd6cb8..b5b25202a9 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -2,9 +2,9 @@
 # This file is autogenerated by pip-compile with Python 3.7
 # by the following command:
 #
-#    pip-compile requirements.in
+#    pip-compile --resolver=backtracking requirements.in
 #
-alembic==1.8.1
+alembic==1.11.1
     # via
     #   flask-migrate
     #   pypn-ref-geo
@@ -13,33 +13,33 @@ amqp==5.1.1
     # via kombu
 async-timeout==4.0.2
     # via redis
-attrs==22.1.0
+attrs==23.1.0
     # via fiona
-authlib==1.0.1
+authlib==1.2.0
     # via pypnusershub
-bcrypt==4.0.0
+bcrypt==4.0.1
     # via pypnusershub
 billiard==3.6.4.0
     # via celery
-blinker==1.5
+blinker==1.6.2
     # via flask-mail
-boto3==1.24.64
+boto3==1.26.153
     # via taxhub
-botocore==1.27.64
+botocore==1.29.153
     # via
     #   boto3
     #   s3transfer
 cached-property==1.5.2
     # via kombu
-cairocffi==1.3.0
+cairocffi==1.6.0
     # via
     #   cairosvg
     #   weasyprint
-cairosvg==2.5.2
+cairosvg==2.7.0
     # via weasyprint
 celery[redis]==5.2.7
     # via -r requirements-common.in
-certifi==2022.6.15
+certifi==2023.5.7
     # via
     #   fiona
     #   requests
@@ -48,7 +48,7 @@ cffi==1.15.1
     #   cairocffi
     #   cryptography
     #   weasyprint
-charset-normalizer==2.1.1
+charset-normalizer==3.1.0
     # via requests
 click==8.1.3
     # via
@@ -71,21 +71,19 @@ click-repl==0.2.0
     # via celery
 cligj==0.7.2
     # via fiona
-cryptography==37.0.4
+cryptography==41.0.1
     # via authlib
-cssselect2==0.6.0
+cssselect2==0.7.0
     # via
     #   cairosvg
     #   weasyprint
 defusedxml==0.7.1
     # via cairosvg
-deprecated==1.2.13
-    # via redis
 fiona==1.8.22
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
-flask==2.2.2
+flask==2.2.5
     # via
     #   -r requirements-common.in
     #   flask-admin
@@ -102,7 +100,7 @@ flask==2.2.2
     #   pypnusershub
     #   taxhub
     #   utils-flask-sqlalchemy
-flask-admin==1.6.0
+flask-admin==1.6.1
     # via pypnnomenclature
 flask-cors==3.0.10
     # via
@@ -116,7 +114,7 @@ flask-marshmallow==0.14.0
     #   pypn-habref-api
     #   pypnnomenclature
     #   pypnusershub
-flask-migrate==3.1.0
+flask-migrate==4.0.4
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -135,11 +133,11 @@ flask-sqlalchemy==2.5.1
     #   utils-flask-sqlalchemy
 flask-weasyprint==1.0.0
     # via -r requirements-common.in
-flask-wtf==1.0.1
+flask-wtf==1.1.1
     # via -r requirements-common.in
 geoalchemy2==0.11.1
     # via utils-flask-sqlalchemy-geo
-geojson==2.5.0
+geojson==3.0.1
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
@@ -149,17 +147,19 @@ gunicorn==20.1.0
     #   taxhub
 html5lib==1.1
     # via weasyprint
-idna==3.3
+idna==3.4
     # via requests
-importlib-metadata==4.12.0 ; python_version < "3.10"
+importlib-metadata==4.13.0 ; python_version < "3.10"
     # via
     #   -r requirements-common.in
     #   alembic
+    #   attrs
     #   celery
     #   click
     #   flask
     #   kombu
     #   mako
+    #   munch
     #   redis
 importlib-resources==5.12.0
     # via alembic
@@ -175,17 +175,17 @@ jmespath==1.0.1
     #   botocore
 kombu==5.2.4
     # via celery
-lxml==4.9.1
+lxml==4.9.2
     # via -r requirements-common.in
-mako==1.2.2
+mako==1.2.4
     # via alembic
-markupsafe==2.1.1
+markupsafe==2.1.3
     # via
     #   jinja2
     #   mako
     #   werkzeug
     #   wtforms
-marshmallow==3.17.1
+marshmallow==3.19.0
     # via
     #   -r requirements-common.in
     #   flask-marshmallow
@@ -193,9 +193,9 @@ marshmallow==3.17.1
     #   marshmallow-sqlalchemy
     #   pypn-habref-api
     #   utils-flask-sqlalchemy
-marshmallow-geojson==0.3.0
+marshmallow-geojson==0.4.0
     # via utils-flask-sqlalchemy-geo
-marshmallow-sqlalchemy==0.28.1
+marshmallow-sqlalchemy==0.28.2
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -203,24 +203,23 @@ marshmallow-sqlalchemy==0.28.1
     #   pypnusershub
     #   taxhub
     #   utils-flask-sqlalchemy-geo
-munch==2.5.0
+munch==3.0.0
     # via fiona
-packaging==21.3
+packaging==23.1
     # via
     #   -r requirements-common.in
     #   geoalchemy2
     #   marshmallow
     #   marshmallow-sqlalchemy
-    #   redis
-pillow==9.2.0
+pillow==9.5.0
     # via
     #   -r requirements-common.in
     #   cairosvg
     #   taxhub
     #   weasyprint
-prompt-toolkit==3.0.31
+prompt-toolkit==3.0.38
     # via click-repl
-psycopg2==2.9.5
+psycopg2==2.9.6
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -230,9 +229,7 @@ psycopg2==2.9.5
     #   taxhub
 pycparser==2.21
     # via cffi
-pyparsing==3.0.9
-    # via packaging
-pyphen==0.13.0
+pyphen==0.14.0
     # via weasyprint
 pypn-habref-api==0.3.2
     # via -r requirements-dependencies.in
@@ -242,7 +239,7 @@ pypn-ref-geo==1.3.0
     #   taxhub
 pypnnomenclature==1.5.4
     # via -r requirements-dependencies.in
-pypnusershub==1.6.5
+pypnusershub==1.6.7
     # via
     #   -r requirements-dependencies.in
     #   pypnnomenclature
@@ -252,23 +249,23 @@ python-dateutil==2.8.2
     #   -r requirements-common.in
     #   botocore
     #   utils-flask-sqlalchemy
-python-dotenv==0.20.0
+python-dotenv==0.21.1
     # via
     #   pypn-habref-api
     #   pypn-ref-geo
     #   pypnnomenclature
     #   taxhub
-pytz==2022.2.1
+pytz==2023.3
     # via celery
-redis==4.3.4
+redis==4.5.5
     # via celery
-requests==2.28.1
+requests==2.31.0
     # via
     #   pypn-habref-api
     #   pypnusershub
-s3transfer==0.6.0
+s3transfer==0.6.1
     # via boto3
-shapely==1.8.4
+shapely==1.8.5.post1
     # via
     #   -r requirements-common.in
     #   pypnnomenclature
@@ -297,28 +294,29 @@ sqlalchemy==1.3.24
     #   utils-flask-sqlalchemy
     #   utils-flask-sqlalchemy-geo
     #   wtforms-sqlalchemy
-taxhub==1.11.1
+taxhub==1.11.2
     # via
     #   -r requirements-dependencies.in
     #   pypnnomenclature
-tinycss2==1.1.1
+tinycss2==1.2.1
     # via
     #   cairosvg
     #   cssselect2
     #   weasyprint
 toml==0.10.2
     # via -r requirements-common.in
-typing-extensions==4.5.0
+typing-extensions==4.6.3
     # via
+    #   alembic
     #   async-timeout
     #   importlib-metadata
     #   redis
-urllib3==1.26.12
+urllib3==1.26.16
     # via
     #   botocore
     #   requests
     #   taxhub
-utils-flask-sqlalchemy==0.3.3
+utils-flask-sqlalchemy==0.3.4
     # via
     #   -r requirements-dependencies.in
     #   pypn-habref-api
@@ -327,7 +325,7 @@ utils-flask-sqlalchemy==0.3.3
     #   pypnusershub
     #   taxhub
     #   utils-flask-sqlalchemy-geo
-utils-flask-sqlalchemy-geo==0.2.7
+utils-flask-sqlalchemy-geo==0.2.8
     # via
     #   -r requirements-dependencies.in
     #   pypn-ref-geo
@@ -336,7 +334,7 @@ vine==5.0.0
     #   amqp
     #   celery
     #   kombu
-wcwidth==0.2.5
+wcwidth==0.2.6
     # via prompt-toolkit
 weasyprint==52.5
     # via
@@ -347,10 +345,8 @@ webencodings==0.5.1
     #   cssselect2
     #   html5lib
     #   tinycss2
-werkzeug==2.2.2
+werkzeug==2.2.3
     # via flask
-wrapt==1.14.1
-    # via deprecated
 wtforms==3.0.1
     # via
     #   -r requirements-common.in
@@ -361,7 +357,7 @@ wtforms-sqlalchemy==0.3
     # via -r requirements-common.in
 xmltodict==0.13.0
     # via -r requirements-common.in
-zipp==3.8.1
+zipp==3.15.0
     # via
     #   importlib-metadata
     #   importlib-resources
diff --git a/docs/development.rst b/docs/development.rst
index 1f922d7c63..27cb145809 100644
--- a/docs/development.rst
+++ b/docs/development.rst
@@ -1675,7 +1675,13 @@ Release
 Pour sortir une nouvelle version de GeoNature :
 
 - Faites les éventuelles Releases des dépendances (UsersHub, TaxHub, UsersHub-authentification-module, Nomenclature-api-module, RefGeo, Utils-Flask-SQLAlchemy, Utils-Flask-SQLAlchemy-Geo)
-- Assurez-vous que les sous-modules git de GeoNature pointent sur les bonnes versions des dépendances
+- Assurez-vous que les sous-modules git de GeoNature pointent sur les bonnes versions des dépendances et que le  `requirements-dependencies.in` a bien été MAJ.
+- Regénérer les `requirements.txt` et `requirements-dev.txt` avec les commandes suivantes dans la plus petite version de python supportée par GeoNature
+::
+    
+    pip-compile requirements.in > requirements.txt
+    pip-compile requirements-dev.in > requirements-dev.txt
+
 - Mettez à jour la version de GeoNature et éventuellement des dépendances dans ``install/install_all/install_all.ini``, ``backend/requirements-dependencies.in`` (puis regénérer ``backend/requirements.txt`` avec ``pip compile``)
 - Complétez le fichier ``docs/CHANGELOG.md`` (en comparant les branches https://github.com/PnX-SI/GeoNature/compare/develop) et dater la version à sortir
 - Mettez à jour le fichier ``VERSION``

From 850edbae2d4478c480009a14bce9268206ce7bef Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 15 Jun 2023 17:45:36 +0200
Subject: [PATCH 120/209] Admin permission simplification

---
 .../geonature/core/gn_permissions/admin.py    | 52 ++++++++++---------
 1 file changed, 28 insertions(+), 24 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 4df5176bdb..2b02432244 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -330,6 +330,8 @@ class ObjectAdmin(CruvedProtectedMixin, ModelView):
     }
 
 
+# self.allow_blank = (True,)
+# self.blank_test = "lalala"
 class PermissionAdmin(CruvedProtectedMixin, ModelView):
     module_code = "ADMIN"
     object_code = "PERMISSIONS"
@@ -342,7 +344,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         "role.identifiant": "identifiant du rôle",
         "role.nom_complet": "nom du rôle",
         "availability": "Permission disponible",
-        "scope": "Appartenance des données",
+        "scope": "Filtre sur l'appartenance des données",
         "sensitivity_filter": "Exclure les données sensibles",
     }
     column_select_related_list = ("availability",)
@@ -375,12 +377,14 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         ("id_action", False),
     ]
     form_columns = ("role", "availability", "scope", "sensitivity_filter")
-    form_overrides = dict(availability=OptionQuerySelectField)
+    form_overrides = dict(
+        availability=OptionQuerySelectField,
+    )
     form_args = dict(
         availability=dict(
             query_factory=lambda: PermissionAvailable.query.nice_order(),
             options_additional_values=["sensitivity_filter", "scope_filter"],
-        )
+        ),
     )
     create_template = "admin/hide_select2_options_create.html"
     edit_template = "admin/hide_select2_options_edit.html"
@@ -545,35 +549,35 @@ def get_query(self):
     )
 )
 
-
-admin.add_view(
-    ObjectAdmin(
-        PermObject,
-        db.session,
-        name="Objets",
-        category="Permissions",
-        endpoint="permissions/object",
-    )
-)
+# Retirer pour plus de lisibilité de l'interface des permissions
+# admin.add_view(
+#     ObjectAdmin(
+#         PermObject,
+#         db.session,
+#         name="Objets",
+#         category="Permissions",
+#         endpoint="permissions/object",
+#     )
+# )
 
 
 admin.add_view(
     PermissionAdmin(
         Permission,
         db.session,
-        name="Toutes les permissions",
+        name="Permissions",
         category="Permissions",
         endpoint="permissions/permission",
     )
 )
 
-
-admin.add_view(
-    PermissionAvailableAdmin(
-        PermissionAvailable,
-        db.session,
-        name="Permissions disponibles",
-        category="Permissions",
-        endpoint="permissions/availablepermission",
-    )
-)
+# Retirer pour plus de lisibilité de l'interface des permissions
+# admin.add_view(
+#     PermissionAvailableAdmin(
+#         PermissionAvailable,
+#         db.session,
+#         name="Permissions disponibles",
+#         category="Permissions",
+#         endpoint="permissions/availablepermission",
+#     )
+# )

From 367b67ea3ca4d929ade15441138add838f6b29a8 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 15 Jun 2023 18:04:55 +0200
Subject: [PATCH 121/209] Permissions: filter user with GN app

---
 backend/geonature/core/gn_permissions/admin.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 2b02432244..2e7dd3c084 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -524,8 +524,7 @@ class UserPermAdmin(RolePermAdmin):
     )
 
     def get_query(self):
-        # TODO: filter_by_app
-        return super().get_query().filter_by(groupe=False)
+        return User.query.filter_by(groupe=False).filter_by_app()
 
 
 admin.add_view(

From 742efbf826f5f7df51f32c500ca9daed4c38e8a1 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Wed, 21 Jun 2023 15:32:47 +0200
Subject: [PATCH 122/209] Remove check set of permission has other permission
 than scope + test

---
 .../geonature/core/gn_permissions/tools.py    |  4 +-
 backend/geonature/tests/test_permissions.py   | 50 ++++++++++++++++++-
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index ac89fcb115..467fd17a61 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -106,8 +106,8 @@ def get_scope(action_code, id_role=None, module_code=None, object_code=None):
     permissions = get_permissions(action_code, id_role, module_code, object_code)
     max_scope = 0
     for permission in permissions:
-        if permission.has_other_filters_than("SCOPE"):
-            continue
+        # if permission.has_other_filters_than("SCOPE"):
+        #     continue
         if permission.scope_value is None:
             max_scope = 3
         else:
diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index 2ceded2fb0..d808f5ef62 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -3,12 +3,15 @@
 
 import pytest
 
+from flask import g
+
 from geonature.core.gn_commons.models import TModules
 from geonature.core.gn_permissions.models import (
     PermObject,
     PermAction,
     PermFilterType,
     Permission,
+    PermissionAvailable,
 )
 from geonature.core.gn_permissions.tools import get_scopes_by_action
 from geonature.utils.env import db
@@ -135,6 +138,31 @@ def _permissions(role, cruved, *, module=module_gn, **kwargs):
     return _permissions
 
 
+@pytest.fixture()
+def permissions_available(object_all, actions):
+    def _permissions_available(
+        module, str_actions, object=object_all, scope=False, sensitivity=False
+    ):
+        with db.session.begin_nested():
+            for action in str_actions:
+                if action == "-":
+                    continue
+            else:
+                print(actions)
+
+                db.session.add(
+                    PermissionAvailable(
+                        id_module=module.id_module,
+                        id_object=object.id_object,
+                        id_action=actions[action].id_action,
+                        scope_filter=scope,
+                        sensitivity_filter=sensitivity,
+                    )
+                )
+
+    return _permissions_available
+
+
 @pytest.fixture()
 def assert_cruved(roles):
     def _assert_cruved(role, cruved, module=None, object=None):
@@ -148,9 +176,19 @@ def _assert_cruved(role, cruved, module=None, object=None):
     return _assert_cruved
 
 
-@pytest.mark.usefixtures("temporary_transaction")
+@pytest.fixture(scope="class")
+def g_permissions():
+    """
+    Fixture to initialize flask g variable
+    Mandatory if we want to run this test file standalone
+    """
+    g._permissions_by_user = {}
+    g._permissions = {}
+
+
+@pytest.mark.usefixtures("temporary_transaction", "g_permissions")
 class TestPermissions:
-    def test_no_right(self, assert_cruved, module_gn, module_a, object_a):
+    def test_no_right(self, assert_cruved, module_gn, module_a, object_a, g_permissions):
         assert_cruved("r1", "000000")
         assert_cruved("g1_r1", "000000", module_a)
         assert_cruved("r1", "000000", module_gn, object_a)
@@ -223,3 +261,11 @@ def test_object_perm(self, permissions, assert_cruved, module_a, module_b, objec
         assert_cruved("r1", "010001", module_a, object_a)
         assert_cruved("r1", "001000", module_b, object_a)
         assert_cruved("r1", "000100", module_a, object_b)
+
+    def test_multiple_scope_with_permissions_available(
+        self, permissions, permissions_available, assert_cruved, module_a
+    ):
+        # scope cruved must be 3 even if other permissions that scope are declared
+        permissions_available(module_a, "CRUVED", scope=True, sensitivity=True)
+        permissions("r1", "333333", module=module_a, sensitivity_filter=True)
+        assert_cruved("r1", "333333", module_a)

From 82171638d2865fab804e8e2eb38c97ffc226c36f Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 15:18:43 +0200
Subject: [PATCH 123/209] add flask-admin in requirements-common.in

---
 backend/requirements-common.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/requirements-common.in b/backend/requirements-common.in
index 3c9e3421ab..c942f32d0f 100644
--- a/backend/requirements-common.in
+++ b/backend/requirements-common.in
@@ -2,6 +2,7 @@ celery[redis]
 click>=7.0
 fiona>=1.8.22,<1.9
 flask
+flask-admin
 flask-cors
 flask-mail
 flask-marshmallow<0.15.0

From afb79587c656434157ecfaeb593e4ab749e505a9 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 16:53:06 +0200
Subject: [PATCH 124/209] render template for account validation

---
 backend/geonature/core/users/routes.py        | 24 +++----------------
 .../core/users/templates/account_created.html | 21 ++++++++++++++++
 2 files changed, 24 insertions(+), 21 deletions(-)
 create mode 100644 backend/geonature/core/users/templates/account_created.html

diff --git a/backend/geonature/core/users/routes.py b/backend/geonature/core/users/routes.py
index c952c511b5..0ade5c3937 100644
--- a/backend/geonature/core/users/routes.py
+++ b/backend/geonature/core/users/routes.py
@@ -3,7 +3,7 @@
 import json
 
 
-from flask import Blueprint, request, current_app, Response, redirect, g
+from flask import Blueprint, request, current_app, Response, redirect, g, render_template
 from sqlalchemy.sql import distinct, and_
 from werkzeug.exceptions import NotFound, BadRequest, Forbidden
 
@@ -303,26 +303,8 @@ def confirmation():
         return Response(r), r.status_code
 
     new_user = r.json()
-
-    txt_champs_addi = ""
-    for key in new_user["champs_addi"]:
-        txt_champs_addi += (
-            f"&nbsp;&nbsp;&nbsp;&nbsp;- <b>{key}</b>: {new_user['champs_addi'][key]}<br>"
-        )
-
-    return (
-        f"""Le compte suivant à bien été ajouté à l'application GeoNature<br>
-    <br>
-    - <b>Nom</b>: {new_user['nom_role']}<br>
-    - <b>Prénom</b>: {new_user['prenom_role']}<br>
-    - <b>Identifiant</b>: {new_user['identifiant']}<br>
-    - <b>Email</b>: {new_user['email']}<br>
-    - <b>Champs additionnels</b>:<br>
-    {txt_champs_addi}
-    <br>
-    <a href="{config["URL_APPLICATION"]}">Retour à l'application GeoNature</a>
-        """,
-        200,
+    return render_template(
+        "account_created.html", user=new_user, redirect_url=config["URL_APPLICATION"]
     )
 
 
diff --git a/backend/geonature/core/users/templates/account_created.html b/backend/geonature/core/users/templates/account_created.html
new file mode 100644
index 0000000000..b9f6d96b7c
--- /dev/null
+++ b/backend/geonature/core/users/templates/account_created.html
@@ -0,0 +1,21 @@
+<html>
+
+    <body>
+        <h2>Création de compte validée</h2>
+        <p>Le compte suivant a bien été validé:  </p>
+        <ul>
+            <li> <b> Nom : </b>  {{user.nom_role}} </li>
+            <li> <b> Prénom : </b>  {{user.prenom_role}} </li>
+            <li> <b> Identifiant : </b>  {{user.identifiant}} </li>
+            <li> <b> Email : </b>  {{user.email}} </li>
+                {% for key, value in user.champs_addi.items() %} 
+                <li>
+                    <b> {{key}} :  </b> {{value}} 
+                </li>
+                {% endfor %}
+        </ul>
+
+        <a href=" {{redirect_url}} ">Retour à l'application GeoNature</a>
+
+    </body>
+</html>
\ No newline at end of file

From 2a0e87ba6407c5496b54c9166af57ac346a1eef1 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 17:09:35 +0200
Subject: [PATCH 125/209] admin.py - Typo

---
 backend/geonature/core/gn_commons/admin.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_commons/admin.py b/backend/geonature/core/gn_commons/admin.py
index 319ea495f3..3457d22b65 100644
--- a/backend/geonature/core/gn_commons/admin.py
+++ b/backend/geonature/core/gn_commons/admin.py
@@ -97,9 +97,9 @@ class BibFieldAdmin(CruvedProtectedMixin, ModelView):
         "bib_nomenclature_type": "Si Type widget = Nomenclature",
         "field_label": "Label du champ en interface",
         "field_name": "Nom du champ en base de donnée",
-        "field_values": """Obligatoire si widget = select/multiselect/checkbox,radio (Format JSON : tableau de 'value/label'.Utilisez des doubles quotes pour les valeurs et les clés). 
+        "field_values": """Obligatoire si widget = select/multiselect/checkbox,radio (Format JSON : tableau de 'value/label'. Utilisez des doubles quotes pour les valeurs et les clés). 
             Exemple [{"label": "trois", "value": 3}, {"label": "quatre", "value": 4}]""",
-        "default_value": "La valeur par défaut doit être une des valeurs du champs 'Valeurs' ci dessus. Pour les valeurs textuelle, il n'est pas necessaire de remettre la valeur entre guillement",
+        "default_value": "La valeur par défaut doit être une des valeurs du champs 'Valeurs' ci-dessus. Pour les valeurs textuelles, il n'est pas nécessaire de remettre la valeur entre guillement",
         "id_list": "Identifiant en BDD de la liste (pour Type widget = taxonomy/observers)",
         "field_order": "Numéro d'ordonnancement du champs (si plusieurs champs pour le même module/objet/JDD)",
         "modules": "Module(s) auquel le champs est rattaché. *Obligatoire",

From 90faf938fbea406896fa8981aa7507ca0ed75e5f Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 17:14:24 +0200
Subject: [PATCH 126/209] fix email validation

---
 backend/geonature/core/users/register_post_actions.py | 2 +-
 backend/geonature/utils/config_schema.py              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/users/register_post_actions.py b/backend/geonature/core/users/register_post_actions.py
index df0a8c477e..caa223cd6c 100644
--- a/backend/geonature/core/users/register_post_actions.py
+++ b/backend/geonature/core/users/register_post_actions.py
@@ -52,7 +52,7 @@ def validate_temp_user(data):
         recipients = [user.email]
     else:
         template = "email_admin_validate_account.html"
-        recipients = validators_emails()
+        recipients = current_app.config["ACCOUNT_MANAGEMENT"]["VALIDATOR_EMAIL"]
     url_validation = url_for("users.confirmation", token=user.token_role, _external=True)
 
     additional_fields = [
diff --git a/backend/geonature/utils/config_schema.py b/backend/geonature/utils/config_schema.py
index 4afe91bc2d..018d6ca5bd 100644
--- a/backend/geonature/utils/config_schema.py
+++ b/backend/geonature/utils/config_schema.py
@@ -28,7 +28,7 @@ class EmailStrOrListOfEmailStrField(fields.Field):
     def _deserialize(self, value, attr, data, **kwargs):
         if isinstance(value, str):
             self._check_email(value)
-            return value
+            return [value]
         elif isinstance(value, list) and all(isinstance(x, str) for x in value):
             self._check_email(value)
             return value

From d2595e3386b745eb3232d79765557ec315953950 Mon Sep 17 00:00:00 2001
From: Andria Capai <andria_capai@natural-solutions.eu>
Date: Wed, 24 May 2023 18:25:41 +0200
Subject: [PATCH 127/209] feat: Unaccent on observers filter

---
 .../gn_synthese/utils/query_select_sqla.py    | 19 +++++--
 backend/geonature/tests/test_synthese.py      | 54 +++++++++++++++++--
 .../synthese-form.component.html              | 20 +++----
 3 files changed, 78 insertions(+), 15 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index af3bf091bc..71ccbe121d 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -6,6 +6,7 @@
 much more efficient
 """
 import datetime
+import unicodedata
 import uuid
 
 from flask import current_app
@@ -338,10 +339,17 @@ def filter_other_filters(self, user):
                 self.model.id_dataset.in_(self.filters.pop("id_dataset"))
             )
         if "observers" in self.filters:
-            # découpe des éléments saisies par les espaces
-            observers = self.filters.pop("observers").split()
+            # découpe des éléments saisies par des ","
+            observers = self.filters.pop("observers").split(",")
             self.query = self.query.where(
-                and_(*[self.model.observers.ilike("%" + observer + "%") for observer in observers])
+                or_(
+                    *[
+                        func.unaccent(self.model.observers).ilike(
+                            "%" + remove_accents(observer) + "%"
+                        )
+                        for observer in observers
+                    ]
+                )
             )
 
         if "observers_list" in self.filters:
@@ -589,3 +597,8 @@ def build_bdc_status_pr_nb_lateral_join(self, protection_status_value, red_list_
                 == (len(protection_status_value) + len(red_list_filters)),
             ],
         )
+
+
+def remove_accents(input_str):
+    nfkd_form = unicodedata.normalize("NFKD", input_str)
+    return "".join([c for c in nfkd_form if not unicodedata.combining(c)])
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 186f93d064..b95984ee98 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -1,5 +1,6 @@
 import pytest
 import json
+import datetime
 import itertools
 from collections import Counter
 
@@ -7,18 +8,21 @@
 from sqlalchemy import func
 from werkzeug.exceptions import Forbidden, BadRequest, Unauthorized
 from jsonschema import validate as validate_json
-from geoalchemy2.shape import to_shape
-from geojson import Point
+from geoalchemy2.shape import to_shape, from_shape
+from shapely.geometry import Point
 
 from geonature.utils.env import db
 from geonature.core.gn_meta.models import TDatasets
-from geonature.core.gn_synthese.models import Synthese, TSources
+from geonature.core.gn_synthese.models import Synthese, TSources, VSyntheseForWebApp
 
 from pypnusershub.tests.utils import logged_user_headers, set_logged_user_cookie
 from ref_geo.models import BibAreasTypes, LAreas
 from apptax.tests.fixtures import noms_example, attribut_example
+from apptax.taxonomie.models import Taxref
+
 
 from .fixtures import *
+from .fixtures import create_synthese
 from .utils import jsonschema_definitions
 
 
@@ -55,6 +59,34 @@ def taxon_attribut(noms_example, attribut_example, synthese_data):
     return c
 
 
+@pytest.fixture()
+def synthese_for_observers(source, datasets):
+    """
+    Seems redondant with synthese_data fixture, but synthese data
+    insert in cor_observers_synthese and run a trigger which override the observers_txt field
+    """
+    now = datetime.datetime.now()
+    taxon = Taxref.query.first()
+    point = Point(5.486786, 42.832182)
+    geom = from_shape(point, srid=4326)
+    with db.session.begin_nested():
+        for obs in ["Vincent", "Camille", "Camille, Xavier"]:
+            db.session.add(
+                Synthese(
+                    id_source=source.id_source,
+                    nom_cite=taxon.lb_nom,
+                    cd_nom=taxon.cd_nom,
+                    dataset=datasets["own_dataset"],
+                    date_min=now,
+                    date_max=now,
+                    observers=obs,
+                    the_geom_4326=geom,
+                    the_geom_point=geom,
+                    the_geom_local=func.st_transform(geom, 2154),
+                )
+            )
+
+
 synthese_properties = {
     "type": "object",
     "properties": {
@@ -144,6 +176,7 @@ def test_get_observations_for_web(self, users, synthese_data, taxon_attribut):
 
         r = self.client.get(url)
         assert r.status_code == 200
+        print(r.json)
         validate_json(instance=r.json, schema=schema)
 
         # test on synonymy and taxref attrs
@@ -299,6 +332,21 @@ def test_get_observations_for_web_filter_id_source(self, users, synthese_data, s
         response_data = {feature["properties"]["id"] for feature in r.json["features"]}
         assert expected_data.issubset(response_data)
 
+    @pytest.mark.parametrize(
+        "observer_input,expected_length_synthese",
+        [("Vincent", 1), ("Camillé", 2), ("Camille, Elie", 2), ("Jane Doe", 0)],
+    )
+    def test_get_observations_for_web_filter_observers(
+        self, users, synthese_for_observers, observer_input, expected_length_synthese
+    ):
+        set_logged_user_cookie(self.client, users["admin_user"])
+
+        filters = {"observers": observer_input}
+        r = self.client.get(url_for("gn_synthese.get_observations_for_web"), json=filters)
+        for s in r.json["features"]:
+            print(s)
+        assert len(r.json["features"]) == expected_length_synthese
+
     def test_get_synthese_data_cruved(self, app, users, synthese_data, datasets):
         set_logged_user_cookie(self.client, users["self_user"])
 
diff --git a/frontend/src/app/GN2CommonModule/form/synthese-form/synthese-form.component.html b/frontend/src/app/GN2CommonModule/form/synthese-form/synthese-form.component.html
index de10cd1565..f5478cfe29 100644
--- a/frontend/src/app/GN2CommonModule/form/synthese-form/synthese-form.component.html
+++ b/frontend/src/app/GN2CommonModule/form/synthese-form/synthese-form.component.html
@@ -286,17 +286,19 @@ <h2 class="h6 mb-1"><small>Champs avancé(s) sélectionné(s) :</small></h2>
     <legend>Qui ?</legend>
 
     <ng-container *ngIf="config.SYNTHESE.SEARCH_OBSERVER_WITH_LIST; else observersTxtBlock">
+      
       <pnx-observers
-        [multiSelect]="true"
-        [parentFormControl]="formService.searchForm.get('observers_list')"
-        [idMenu]="config.SYNTHESE.ID_SEARCH_OBSERVER_LIST"
-        [label]="'Releve.Observers' | translate"
-        [bindAllItem]="true"
+      [multiSelect]="true"
+      [parentFormControl]="formService.searchForm.get('observers_list')"
+      [idMenu]="config.SYNTHESE.ID_SEARCH_OBSERVER_LIST"
+      [label]="'Releve.Observers' | translate"
+      [bindAllItem]="true"
       >
-      </pnx-observers>
-    </ng-container>
-
-    <ng-template #observersTxtBlock>
+    </pnx-observers>
+  </ng-container>
+  
+  <ng-template #observersTxtBlock>
+      <i class="fa fa-question-circle" matTooltip="Pour rechercher plusieurs observateurs, séparez-les par des virgules"></i>
       <pnx-observers-text
         [label]="'Releve.Observer' | translate"
         [parentFormControl]="formService.searchForm.get('observers')"

From 6658ea7618be039eefedc6a07f6ca689d6084c89 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 18:15:30 +0200
Subject: [PATCH 128/209] fix user and group count

---
 backend/geonature/core/gn_permissions/admin.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 2e7dd3c084..4dc74b90b3 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -343,7 +343,7 @@ class PermissionAdmin(CruvedProtectedMixin, ModelView):
         "object": "Objet",
         "role.identifiant": "identifiant du rôle",
         "role.nom_complet": "nom du rôle",
-        "availability": "Permission disponible",
+        "availability": "Permission",
         "scope": "Filtre sur l'appartenance des données",
         "sensitivity_filter": "Exclure les données sensibles",
     }
@@ -498,8 +498,10 @@ class GroupPermAdmin(RolePermAdmin):
     column_details_list = ("nom_role", "permissions_count", "permissions")
 
     def get_query(self):
-        # TODO: filter_by_app
-        return super().get_query().filter_by(groupe=True)
+        return User.query.filter_by(groupe=True).filter_by_app()
+
+    def get_count_query(self):
+        return self.session.query(sa.func.count("*")).filter(User.groupe == True)
 
 
 class UserPermAdmin(RolePermAdmin):
@@ -526,12 +528,16 @@ class UserPermAdmin(RolePermAdmin):
     def get_query(self):
         return User.query.filter_by(groupe=False).filter_by_app()
 
+    def get_count_query(self):
+        # FIXME : must filter by app
+        return self.session.query(sa.func.count("*")).filter(User.groupe == False)
+
 
 admin.add_view(
     GroupPermAdmin(
         User,
         db.session,
-        name="Groupes",
+        name="Par groupes",
         category="Permissions",
         endpoint="permissions/group",
     )
@@ -542,7 +548,7 @@ def get_query(self):
     UserPermAdmin(
         User,
         db.session,
-        name="Utilisateurs",
+        name="Par utilisateurs",
         category="Permissions",
         endpoint="permissions/user",
     )

From c12a5025459fbdd779d2c9e58f66251939143ca2 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 21:18:55 +0200
Subject: [PATCH 129/209] Enable install_all.sh on Debian 12

---
 install/install_all/install_all.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/install/install_all/install_all.sh b/install/install_all/install_all.sh
index 175f9c1a5e..4b54c25a09 100755
--- a/install/install_all/install_all.sh
+++ b/install/install_all/install_all.sh
@@ -38,9 +38,9 @@ then
     exit 1
 fi
 
-if [ "$OS_VERSION" != "10" ] && [ "$OS_VERSION" != "11" ]
+if [ "$OS_VERSION" != "10" ] && [ "$OS_VERSION" != "11" ] && [ "$OS_VERSION" != "12" ]
 then
-    echo -e "\e[91m\e[1mLe script d'installation n'est prévu que pour Debian 10 et Debian 11\e[0m" >&2
+    echo -e "\e[91m\e[1mLe script d'installation n'est prévu que pour Debian 10, 11 ou 12\e[0m" >&2
     exit 1
 fi
 

From 3be6a07ee1e1a18b68d7a7ca235ff721441b2de1 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 23:26:02 +0200
Subject: [PATCH 130/209] Doc admin - Permissions V2

---
 docs/admin-manual.rst | 50 +++++++++++++++++--------------------------
 1 file changed, 20 insertions(+), 30 deletions(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index a8bf4adb3c..911057b242 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -390,62 +390,52 @@ Gestion des droits
 Accès à GeoNature et CRUVED
 ```````````````````````````
 
-Les comptes des utilisateurs, leur mot de passe, email, groupes et leur accès à l'application GeoNature est géré de manière centralisée dans UsersHub. Pour qu'un rôle (utilisateur ou groupe) ait accès à GeoNature, il faut lui attribuer un profil de "Lecteur" dans l'application GeoNature, grâce à l'application UsersHub.
+Les comptes des utilisateurs, leur mot de passe, email, groupes et leur accès à l'application GeoNature sont gérés de manière centralisée dans l'application UsersHub. Pour qu'un rôle (utilisateur ou groupe) ait accès à GeoNature, il faut lui attribuer un profil de "Lecteur" dans l'application GeoNature, grâce à l'application UsersHub.
 
-La gestion des droits (permissions) des rôles, spécifique à GeoNature, est ensuite gérée dans un schéma (``gn_permissions``) et un module de GeoNature dédié. 
+La gestion des droits (permissions) des rôles, spécifique à GeoNature, est ensuite gérée dans un schéma (``gn_permissions``) depuis le module ADMIN de GeoNature. 
 
-Les permissions des groupes et utilisateurs peuvent en effet être administrées dans le module "Admin / Administration des permissions" de GeoNature.
-Dans la version 1 de GeoNature, il était possible d'attribuer des droits selon 6 niveaux à des rôles (utilisateurs ou groupes). Pour la version 2 de GeoNature, des évolutions ont été réalisées pour étendre les possibilités d'attribution de droits et les rendre plus génériques.
+La gestion des droits dans GeoNature, comme dans beaucoup d'applications, est liée à des actions (Create / Read / Update / Delete aka CRUD). Pour les besoins  métiers de l'application nous avons rajouté deux actions : "Exporter" et "Valider" (non utilisée), ce qui donne le CRUVED : Create / Read / Update / Validate / Export / Delete.
 
-La gestion des droits dans GeoNature, comme dans beaucoup d'applications, est liée à des actions (Create / Read / Update / Delete aka CRUD). Pour les besoins  métiers de l'application nous avons rajouté deux actions : "Valider" et "Exporter", ce qui donne le CRUVED : Create / Read / Update / Validate / Export / Delete.
+Chaque module peut utiliser toutes ou certaines de ces actions.
 
-Sur ces actions, on peut appliquer des "portées":
+Selon les modules, on peut appliquer des filtres sur ces actions. Notamment des filtres d'appartenance (portées / scope) 
 
-- Portée 1 = "Mes données". Cela concerne les données sur lesquels je suis :
+- Portée 1 = Seulement mes données. Cela concerne les données sur lesquels je suis :
    - observateur 
-   - personne ayant effectuée la saisie de la données
-   - personnelement acteur du jeu de données de la donnée
+   - personne ayant effectuée la saisie de la donnée
+   - personnellement acteur du jeu de données de la donnée
    - personne ayant saisi le JDD de la donnée
 - Portée 2 = Les données de mon organisme. Portée 1 + :
-   - les données sur lesquels mon organisme est acteur du JDD de la donnée
-- Portée 3 = Toute les données
-   - Toute les données : aucun filtre n'est appliqué
-
+   - les données sur lesquelles mon organisme est acteur du JDD de la donnée
 
 Exemple :
 
-- Utilisateur 1 peut effectuer l'action "DELETE" sur la portée "SES DONNEES"
-- Utilisateur Admin peut effectuer l'action "UPDATE" sur la portée "TOUTES LES DONNEES"
-
-Enfin ces permissions vont pouvoir s'attribuer à l'ensemble de l'application GeoNature et/ou à un module.
+- Utilisateur 1 peut effectuer l'action "DELETE" sur "SES DONNEES"
+- Utilisateur Admin peut effectuer l'action "UPDATE" sur "TOUTES LES DONNEES" (sans filtre d'appartenance)
 
-On a donc le quatriptique : Un utilisateur / Une action / Une portée / Un module
-
-**NB** : certains objets comme les JDD et CA sont transversal à tout GeoNature (ils sont utilisés dans tous les modules: saisie, synthese, métadonnées, dashbord), il sont donc contrôlé par les permissions du "module" GeoNature
+Ces permissions sont attribuées module par module, et éventuellement sur des objets de certains modules.
 
 Cas particulier de l'action "C"
 ```````````````````````````````
 
-| Dans les modules de saisie, on veut que des utilisateurs puissent saisir uniquement dans certains JDD.
-| La liste des JDD ouvert à la saisie est contrôlée par l'action "CREATE" du module dans lequel on se trouve. 
-| Comme il n'est pas "normal" de pouvoir saisir dans des JDD sur lesquels on n'a pas les droit de lecture, la portée de l'action "CREATE" vient simplement réduire la liste des JDD surlesquels on a les droits de lecture ("READ").
-| Même si la portée de l'action "CREATE" sur le module est supérieure à l'action "READ", l'utilisateur ne vera que les JDD surlesquels il a des droits de lecture
+| Dans les modules de saisie (comme Occtax), on veut que des utilisateurs puissent saisir uniquement dans certains JDD.
+| La liste des JDD ouverts à la saisie est contrôlée par l'action "CREATE" du module dans lequel on se trouve. 
+| Comme il n'est pas "normal" de pouvoir saisir dans des JDD sur lesquels on n'a pas les droits de lecture, la portée de l'action "CREATE" vient simplement réduire la liste des JDD sur lesquels on a les droits de lecture ("READ").
+| Même si la portée de l'action "CREATE" sur le module est supérieure à celle de l'action "READ", l'utilisateur ne verra que les JDD sur lesquels il a des droits de lecture
 
 Récapitulatif
 `````````````
 
-- Dans GeoNature V2 on peut attribuer à un role des actions possibles, sur lesquels on peut ajouter des filtres, dans un module ou sur toute l'application GeoNature (définis dans ``gn_permissions.cor_role_action_filter_module_object``).
+- Dans GeoNature on peut attribuer à un role des actions possibles dans un module, sur lesquels on peut ajouter des filtres (définis dans la table ``gn_permissions.t_permissions``).
 - 6 actions sont possibles dans GeoNature : Create / Read / Update / Validate / Export / Delete (aka CRUVED).
-- Différents types de filtre existent. Le plus courant est le filtre de type "SCOPE" (portée) : 3 portées sont attribuables à des actions: Mes données / Les données de mon organisme / Toutes les données.
+- Différents types de filtre existent. Le plus courant est le filtre d'appartenace (portée) : 2 filtres d'appartenance sont attribuables à des actions : Mes données / Les données de mon organisme. La synthèse dispose aussi d'un filtre de sensibilité.
 - Des fonctions PostgreSQL ont aussi été intégrées pour faciliter la récupération de ces informations (``gn_permissions.cruved_for_user_in_module``, ``gn_permissions.does_user_have_scope_permission``, ...)
-- Si un utilisateur n'a aucune action possible sur un module, alors il ne lui sera pas affiché et il ne pourra pas y accéder
+- Si un utilisateur n'a aucune permission sur un module, alors il ne lui sera pas affiché dans le menu latéral et il ne pourra pas y accéder
 - Il est aussi possible de ne pas utiliser UsersHub pour gérer les utilisateurs et de connecter GeoNature à un CAS (voir configuration). Actuellement ce paramétrage est fonctionnel en se connectant au CAS de l'INPN (MNHN)
 
 .. image :: _static/schema_cruved.png
 
-A noter que toutes les actions et toutes les portées n'ont pas été implémentées dans tous les modules. Elles le sont en fonction des besoins de chaque module.
-
-TODO : Lister les permissions implémentées dans chaque module.
+A noter que toutes les actions et tous les filtres n'ont pas été implémentées dans tous les modules. Elles le sont en fonction des besoins de chaque module. Chaque module définit la liste de ses permissions disponibles (actions et filtres).
 
 Nomenclatures
 """""""""""""

From 15e7012cbe8ea121695084ac0043e1308f7a8969 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Sun, 25 Jun 2023 21:45:57 +0200
Subject: [PATCH 131/209] Review doc admin permissions

---
 docs/admin-manual.rst | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index 911057b242..b84ecd0d57 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -392,7 +392,7 @@ Accès à GeoNature et CRUVED
 
 Les comptes des utilisateurs, leur mot de passe, email, groupes et leur accès à l'application GeoNature sont gérés de manière centralisée dans l'application UsersHub. Pour qu'un rôle (utilisateur ou groupe) ait accès à GeoNature, il faut lui attribuer un profil de "Lecteur" dans l'application GeoNature, grâce à l'application UsersHub.
 
-La gestion des droits (permissions) des rôles, spécifique à GeoNature, est ensuite gérée dans un schéma (``gn_permissions``) depuis le module ADMIN de GeoNature. 
+La gestion des droits (permissions) des rôles, spécifique à GeoNature, est ensuite gérée dans un schéma (``gn_permissions``) depuis le module ADMIN de GeoNature. Voir https://github.com/PnX-SI/GeoNature/issues/2605.
 
 La gestion des droits dans GeoNature, comme dans beaucoup d'applications, est liée à des actions (Create / Read / Update / Delete aka CRUD). Pour les besoins  métiers de l'application nous avons rajouté deux actions : "Exporter" et "Valider" (non utilisée), ce qui donne le CRUVED : Create / Read / Update / Validate / Export / Delete.
 
@@ -401,12 +401,15 @@ Chaque module peut utiliser toutes ou certaines de ces actions.
 Selon les modules, on peut appliquer des filtres sur ces actions. Notamment des filtres d'appartenance (portées / scope) 
 
 - Portée 1 = Seulement mes données. Cela concerne les données sur lesquels je suis :
-   - observateur 
-   - personne ayant effectuée la saisie de la donnée
-   - personnellement acteur du jeu de données de la donnée
-   - personne ayant saisi le JDD de la donnée
+
+  - observateur 
+  - personne ayant effectuée la saisie de la donnée
+  - personnellement acteur du jeu de données de la donnée
+  - personne ayant saisi le JDD de la donnée
+
 - Portée 2 = Les données de mon organisme. Portée 1 + :
-   - les données sur lesquelles mon organisme est acteur du JDD de la donnée
+
+  - les données sur lesquelles mon organisme est acteur du JDD de la donnée
 
 Exemple :
 
@@ -433,8 +436,6 @@ Récapitulatif
 - Si un utilisateur n'a aucune permission sur un module, alors il ne lui sera pas affiché dans le menu latéral et il ne pourra pas y accéder
 - Il est aussi possible de ne pas utiliser UsersHub pour gérer les utilisateurs et de connecter GeoNature à un CAS (voir configuration). Actuellement ce paramétrage est fonctionnel en se connectant au CAS de l'INPN (MNHN)
 
-.. image :: _static/schema_cruved.png
-
 A noter que toutes les actions et tous les filtres n'ont pas été implémentées dans tous les modules. Elles le sont en fonction des besoins de chaque module. Chaque module définit la liste de ses permissions disponibles (actions et filtres).
 
 Nomenclatures

From ae3b0fef19fb253c63fa0170c1999156df41fd60 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 26 Jun 2023 12:09:09 +0200
Subject: [PATCH 132/209] add warning on get_scope rather than return 0

---
 backend/geonature/core/gn_commons/routes.py   | 21 +++++++----
 .../geonature/core/gn_permissions/tools.py    | 35 +++++++++++++++++--
 2 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index e89168cc0f..d76e20cae1 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -24,7 +24,7 @@
 from geonature.utils.config import config_frontend, config
 from geonature.core.gn_permissions import decorators as permissions
 from geonature.core.gn_permissions.decorators import login_required
-from geonature.core.gn_permissions.tools import get_scopes_by_action
+from geonature.core.gn_permissions.tools import get_scope
 import geonature.core.gn_commons.tasks  # noqa: F401
 
 from shapely.geometry import asShape
@@ -69,7 +69,11 @@ def list_modules():
             continue
         module_allowed = False
         module_dict = module.as_dict(fields=["objects"])
-        module_dict["cruved"] = get_scopes_by_action(module_code=module.module_code)
+        # TODO : use has_any_permissions instead - must refactor the front
+        module_dict["cruved"] = {
+            action: get_scope(action, module_code=module.module_code, bypass_warning=True)
+            for action in "CRUVED"
+        }
         if any(module_dict["cruved"].values()):
             module_allowed = True
         if module.active_frontend:
@@ -82,10 +86,15 @@ def list_modules():
         # get cruved for each object
         for obj_dict in module_dict["objects"]:
             obj_code = obj_dict["code_object"]
-            obj_dict["cruved"] = get_scopes_by_action(
-                module_code=module.module_code,
-                object_code=obj_code,
-            )
+            obj_dict["cruved"] = {
+                action: get_scope(
+                    action,
+                    module_code=module.module_code,
+                    object_code=obj_code,
+                    bypass_warning=True,
+                )
+                for action in "CRUVED"
+            }
             if any(obj_dict["cruved"].values()):
                 module_allowed = True
             module_dict["module_objects"][obj_code] = obj_dict
diff --git a/backend/geonature/core/gn_permissions/tools.py b/backend/geonature/core/gn_permissions/tools.py
index 467fd17a61..659f5df50c 100644
--- a/backend/geonature/core/gn_permissions/tools.py
+++ b/backend/geonature/core/gn_permissions/tools.py
@@ -1,3 +1,5 @@
+import logging
+
 from itertools import groupby, permutations
 
 import sqlalchemy as sa
@@ -15,6 +17,8 @@
 
 from pypnusershub.db.models import User
 
+log = logging.getLogger()
+
 
 def _get_user_permissions(id_role):
     return (
@@ -94,7 +98,7 @@ def get_permissions(action_code, id_role=None, module_code=None, object_code=Non
     return g._permissions[ident]
 
 
-def get_scope(action_code, id_role=None, module_code=None, object_code=None):
+def get_scope(action_code, id_role=None, module_code=None, object_code=None, bypass_warning=False):
     """
     This function gets the final scope permission.
 
@@ -106,8 +110,11 @@ def get_scope(action_code, id_role=None, module_code=None, object_code=None):
     permissions = get_permissions(action_code, id_role, module_code, object_code)
     max_scope = 0
     for permission in permissions:
-        # if permission.has_other_filters_than("SCOPE"):
-        #     continue
+        if permission.has_other_filters_than("SCOPE") and not bypass_warning:
+            log.warning(
+                f"""WARNING : You are trying to get scope permission for a module ({module_code}) which implements other permissions type. Please use get_permission instead
+            """
+            )
         if permission.scope_value is None:
             max_scope = 3
         else:
@@ -126,3 +133,25 @@ def get_scopes_by_action(id_role=None, module_code=None, object_code=None):
         action_code: get_scope(action_code, id_role, module_code, object_code)
         for action_code in "CRUVED"
     }
+
+
+def has_any_permissions(action_code, id_role=None, module_code=None, object_code=None) -> bool:
+    """
+    This function return the scope for an action, a module and an object as a Boolean
+    Use for frontend
+    """
+    permissions = get_permissions(action_code, id_role, module_code, object_code)
+    return True if len(permissions) > 0 else False
+
+
+def has_any_permissions_by_action(id_role=None, module_code=None, object_code=None):
+    """
+    This function gets the scopes permissions for each one of the 6 actions in "CRUVED",
+    that match (id_role, module_code, object_code)
+
+    :returns : (dict) A dict of the boolean for each one of the 6 actions (the char in "CRUVED")
+    """
+    return {
+        action_code: has_any_permissions(action_code, id_role, module_code, object_code)
+        for action_code in "CRUVED"
+    }

From 787b724b9bf6350df9c3f500b180132c92b18d62 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 26 Jun 2023 16:56:39 +0200
Subject: [PATCH 133/209] add test

---
 backend/geonature/tests/test_permissions.py | 22 ++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/tests/test_permissions.py b/backend/geonature/tests/test_permissions.py
index d808f5ef62..85f15938df 100644
--- a/backend/geonature/tests/test_permissions.py
+++ b/backend/geonature/tests/test_permissions.py
@@ -13,7 +13,7 @@
     Permission,
     PermissionAvailable,
 )
-from geonature.core.gn_permissions.tools import get_scopes_by_action
+from geonature.core.gn_permissions.tools import get_scopes_by_action, has_any_permissions_by_action
 from geonature.utils.env import db
 
 from pypnusershub.db.models import User
@@ -114,6 +114,10 @@ def cruved_dict(scopes):
     }
 
 
+def b_cruved(code: str) -> dict:
+    return {action: bool(int(b)) for action, b in zip("CRUVED", code)}
+
+
 @pytest.fixture()
 def permissions(roles, groups, actions, module_gn):
     roles = ChainMap(roles, groups)
@@ -269,3 +273,19 @@ def test_multiple_scope_with_permissions_available(
         permissions_available(module_a, "CRUVED", scope=True, sensitivity=True)
         permissions("r1", "333333", module=module_a, sensitivity_filter=True)
         assert_cruved("r1", "333333", module_a)
+
+    def test_has_any_perms(
+        self, permissions, permissions_available, assert_cruved, module_a, roles
+    ):
+        # scope cruved must be 3 even if other permissions that scope are declared
+        permissions_available(module_a, "CRUVED", scope=True, sensitivity=True)
+        permissions("r1", "333---", module=module_a, sensitivity_filter=False)
+
+        assert has_any_permissions_by_action(
+            id_role=roles["r1"].id_role, module_code=module_a.module_code
+        ) == b_cruved("111000")
+
+        permissions("r2", "333333", module=module_a, sensitivity_filter=True)
+        assert has_any_permissions_by_action(
+            id_role=roles["r2"].id_role, module_code=module_a.module_code
+        ) == b_cruved("111111")

From 3068860df3c3f8a7cc23ee8070acb54f9dc089f2 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 26 Jun 2023 17:02:42 +0200
Subject: [PATCH 134/209] bump deps

---
 .../UsersHub-authentification-module          |  2 +-
 backend/requirements-dependencies.in          |  2 +-
 backend/requirements.txt                      | 20 +++++++++----------
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/backend/dependencies/UsersHub-authentification-module b/backend/dependencies/UsersHub-authentification-module
index 3f6b3a62c4..d9765a0f20 160000
--- a/backend/dependencies/UsersHub-authentification-module
+++ b/backend/dependencies/UsersHub-authentification-module
@@ -1 +1 @@
-Subproject commit 3f6b3a62c4d6ef069e53fbd9fa7b042f5d0e727d
+Subproject commit d9765a0f20b273894ad4e78ea91880e923a3cc4a
diff --git a/backend/requirements-dependencies.in b/backend/requirements-dependencies.in
index 92e584921e..5241ef0117 100644
--- a/backend/requirements-dependencies.in
+++ b/backend/requirements-dependencies.in
@@ -1,4 +1,4 @@
-pypnusershub>=1.6.7,<2
+pypnusershub>=1.6.8,<2
 pypnnomenclature>=1.5.4,<2
 pypn_habref_api>=0.3.2,<1
 utils-flask-sqlalchemy-geo>=0.2.8,<1
diff --git a/backend/requirements.txt b/backend/requirements.txt
index b5b25202a9..77724517be 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -15,7 +15,7 @@ async-timeout==4.0.2
     # via redis
 attrs==23.1.0
     # via fiona
-authlib==1.2.0
+authlib==1.2.1
     # via pypnusershub
 bcrypt==4.0.1
     # via pypnusershub
@@ -23,9 +23,9 @@ billiard==3.6.4.0
     # via celery
 blinker==1.6.2
     # via flask-mail
-boto3==1.26.153
+boto3==1.26.160
     # via taxhub
-botocore==1.29.153
+botocore==1.29.160
     # via
     #   boto3
     #   s3transfer
@@ -67,7 +67,7 @@ click-plugins==1.1.1
     # via
     #   celery
     #   fiona
-click-repl==0.2.0
+click-repl==0.3.0
     # via celery
 cligj==0.7.2
     # via fiona
@@ -101,8 +101,10 @@ flask==2.2.5
     #   taxhub
     #   utils-flask-sqlalchemy
 flask-admin==1.6.1
-    # via pypnnomenclature
-flask-cors==3.0.10
+    # via
+    #   -r requirements-common.in
+    #   pypnnomenclature
+flask-cors==4.0.0
     # via
     #   -r requirements-common.in
     #   taxhub
@@ -239,7 +241,7 @@ pypn-ref-geo==1.3.0
     #   taxhub
 pypnnomenclature==1.5.4
     # via -r requirements-dependencies.in
-pypnusershub==1.6.7
+pypnusershub==1.6.8
     # via
     #   -r requirements-dependencies.in
     #   pypnnomenclature
@@ -257,7 +259,7 @@ python-dotenv==0.21.1
     #   taxhub
 pytz==2023.3
     # via celery
-redis==4.5.5
+redis==4.6.0
     # via celery
 requests==2.31.0
     # via
@@ -272,9 +274,7 @@ shapely==1.8.5.post1
     #   utils-flask-sqlalchemy-geo
 six==1.16.0
     # via
-    #   click-repl
     #   fiona
-    #   flask-cors
     #   flask-marshmallow
     #   html5lib
     #   munch

From b7b2cbd77da7152431add4197ebdcb15a6c0c52a Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 27 Jun 2023 00:24:59 +0200
Subject: [PATCH 135/209] install_all / Bump TH & UH

---
 install/install_all/install_all.ini | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/install/install_all/install_all.ini b/install/install_all/install_all.ini
index 29c074256b..72cb18aef5 100644
--- a/install/install_all/install_all.ini
+++ b/install/install_all/install_all.ini
@@ -27,7 +27,7 @@ user_pg_pass=monpassachanger
 # Installation de l'application UsersHub
 install_usershub_app=true
 # Version de UsersHub
-usershub_release=2.3.3
+usershub_release=2.3.4
 
 ### CONFIGURATION GEONATURE ###
 
@@ -70,7 +70,7 @@ proxy_https=
 ### CONFIGURATION TAXHUB ###
 
 # Version de TaxHub
-taxhub_release=1.11.1
+taxhub_release=1.11.3
 # Pour des questions de performances de GeoNature, il n'y a pas de base de données spécifique pour TaxHub
 # Le schéma "taxonomie" de TaxHub est intégré dans la BDD de GeoNature pour que les requêtes ne soient pas trop pénalisées
 # par un accès à une BDD distante.

From d8e5e24c35a20234b3d3fec500be8a20ff461707 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 27 Jun 2023 13:55:17 +0200
Subject: [PATCH 136/209] Bump VERSION - 2.13.0-beta1

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index ccc99d0214..fb609bc25c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.12.3
+2.13.0-beta1

From a1fdcdccee649640006822288298ba2f2c60bc88 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Fri, 19 May 2023 16:40:33 +0200
Subject: [PATCH 137/209] Add fixture `synthese_sensitive_data` for sensitive
 data in synthese:

Function `create_synthese`:
- modify function to add any field for Synthese, with kwargs

Fixture `synthese_sensitive_data`:
- retrieve (cd_nom, id_area) for a sensitivity rule, take centroid of
the area as point for obs_sensitive, add a criteria (bio status or
behaviour) if needed for the sensitivity rule.
- assert that the obs inserted is actually sensitive.

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/fixtures.py | 84 ++++++++++++++++++++++++++++-
 1 file changed, 83 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 231e9096da..40e7352c70 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -26,6 +26,7 @@
     CorAcquisitionFrameworkActor,
 )
 from geonature.core.gn_synthese.models import TSources, Synthese, TReport, BibReportsTypes
+from geonature.core.sensitivity.models import SensitivityRule
 
 from pypnusershub.db.models import (
     User,
@@ -43,6 +44,7 @@
     "datasets",
     "acquisition_frameworks",
     "synthese_data",
+    "synthese_sensitive_data",
     "source",
     "reports_data",
     "medium",
@@ -286,8 +288,9 @@ def source():
     return source
 
 
-def create_synthese(geom, taxon, user, dataset, source, uuid, cor_observers):
+def create_synthese(geom, taxon, user, dataset, source, uuid, cor_observers, **kwargs):
     now = datetime.datetime.now()
+
     return Synthese(
         id_source=source.id_source,
         unique_id_sinp=uuid,
@@ -302,6 +305,7 @@ def create_synthese(geom, taxon, user, dataset, source, uuid, cor_observers):
         date_min=now,
         date_max=now,
         cor_observers=cor_observers,
+        **kwargs,
     )
 
 
@@ -342,6 +346,84 @@ def synthese_data(app, users, datasets, source):
     return data
 
 
+@pytest.fixture()
+def synthese_sensitive_data(app, users, datasets, source):
+    data = {}
+
+    # Retrieve a cd_nom and point for a sensitivity rule
+    sensitivity_rule = SensitivityRule.query.filter(
+        SensitivityRule.active == True,
+        SensitivityRule.areas.any(),
+        SensitivityRule.criterias.any(),
+    ).first()
+    sensitive_cd_nom = sensitivity_rule.cd_nom
+    sensitive_area = sensitivity_rule.areas[0]
+    # Get one point in the geom : the first point of the bounding, assuming its a MULTIPOLYGON
+    sensitive_point = db.session.query(
+        func.ST_Centroid(func.ST_Transform(sensitive_area.geom, 4326))
+    ).first()[0]
+    id_nomenclature_bio_status = None
+    id_type_nomenclature_bio_status = (
+        BibNomenclaturesTypes.query.filter(BibNomenclaturesTypes.mnemonique == "STATUT_BIO")
+        .one()
+        .id_type
+    )
+    id_nomenclature_behaviour = None
+    id_type_nomenclature_behaviour = (
+        BibNomenclaturesTypes.query.filter(BibNomenclaturesTypes.mnemonique == "OCC_COMPORTEMENT")
+        .one()
+        .id_type
+    )
+    # Add a criteria to the sensitivity rule if needed
+    list_criterias_for_sensitivity_rule = sensitivity_rule.criterias
+    if list_criterias_for_sensitivity_rule:
+        one_critera_for_sensitive_rule = list_criterias_for_sensitivity_rule[0]
+        id_type_criteria_for_sensitive_rule = one_critera_for_sensitive_rule.id_type
+        if id_type_criteria_for_sensitive_rule == id_type_nomenclature_bio_status:
+            id_nomenclature_bio_status = one_critera_for_sensitive_rule.id_nomenclature
+        elif id_type_criteria_for_sensitive_rule == id_type_nomenclature_behaviour:
+            id_nomenclature_behaviour = one_critera_for_sensitive_rule.id_nomenclature
+
+    with db.session.begin_nested():
+        for name, cd_nom, point, ds, comment_description in [
+            (
+                "obs1",
+                sensitive_cd_nom,
+                sensitive_point,
+                datasets["own_dataset"],
+                "obs_sensitive_1",
+            ),
+        ]:
+            unique_id_sinp = func.uuid_generate_v4()
+            geom = point
+            taxon = Taxref.query.filter_by(cd_nom=cd_nom).one()
+            kwargs = {}
+            if id_nomenclature_bio_status:
+                kwargs["id_nomenclature_bio_status"] = id_nomenclature_bio_status
+            elif id_nomenclature_behaviour:
+                kwargs["id_nomenclature_behaviour"] = id_nomenclature_behaviour
+            kwargs["comment_description"] = comment_description
+            s = create_synthese(
+                geom, taxon, users["self_user"], ds, source, unique_id_sinp, [], **kwargs
+            )
+            db.session.add(s)
+            data[name] = s
+
+    # Assert that obs_sensitive_1 is a sensitive observation
+    id_nomenclature_sensitive = (
+        TNomenclatures.query.filter(
+            TNomenclatures.nomenclature_type.has(BibNomenclaturesTypes.mnemonique == "SENSIBILITE")
+        )
+        .filter(TNomenclatures.cd_nomenclature == "4")
+        .one()
+    ).id_nomenclature
+    Synthese.query.filter(
+        Synthese.cd_nom == sensitive_cd_nom
+    ).first().id_nomenclature_sensitivity != id_nomenclature_sensitive
+
+    return data
+
+
 def create_media(media_path=""):
     photo_type = TNomenclatures.query.filter(
         BibNomenclaturesTypes.mnemonique == "TYPE_MEDIA", TNomenclatures.mnemonique == "Photo"

From fc05dd865e1316af5b73df2e33cbf31f819a29c3 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 12:43:09 +0200
Subject: [PATCH 138/209] Modify fixture `synthese_sensitive_data`: include
 protection status:

Fixture `synthese_sensitive_data`:
- "obs_sensitive_protected": sensitive and protected obs
- "obs_protected_not_sensitive": sensitive but not protected obs
- assert that the two observations are actually protected, and
that the first is sensitive while the second is not

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/fixtures.py | 145 +++++++++++++++++++++++-----
 1 file changed, 121 insertions(+), 24 deletions(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 40e7352c70..f0e7d45563 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -26,7 +26,7 @@
     CorAcquisitionFrameworkActor,
 )
 from geonature.core.gn_synthese.models import TSources, Synthese, TReport, BibReportsTypes
-from geonature.core.sensitivity.models import SensitivityRule
+from geonature.core.sensitivity.models import SensitivityRule, cor_sensitivity_area
 
 from pypnusershub.db.models import (
     User,
@@ -36,9 +36,19 @@
     UserApplicationRight,
 )
 from pypnnomenclature.models import TNomenclatures, BibNomenclaturesTypes
-from apptax.taxonomie.models import Taxref
+from apptax.taxonomie.models import (
+    Taxref,
+    TaxrefBdcStatutTaxon,
+    TaxrefBdcStatutCorTextValues,
+    bdc_statut_cor_text_area,
+    TaxrefBdcStatutText,
+)
+from ref_geo.models import LAreas
+
 from utils_flask_sqla.tests.utils import JSONClient
 
+import sqlalchemy as sa
+
 
 __all__ = [
     "datasets",
@@ -350,18 +360,60 @@ def synthese_data(app, users, datasets, source):
 def synthese_sensitive_data(app, users, datasets, source):
     data = {}
 
-    # Retrieve a cd_nom and point for a sensitivity rule
+    # Retrieve all the taxa with a protection status, and the corresponding areas
+    cte_taxa_area_with_status = (
+        db.session.query(TaxrefBdcStatutTaxon.cd_nom, LAreas.id_area)
+        .select_from(TaxrefBdcStatutTaxon, LAreas)
+        .join(
+            TaxrefBdcStatutCorTextValues,
+            TaxrefBdcStatutTaxon.id_value_text == TaxrefBdcStatutCorTextValues.id_value_text,
+        )
+        .join(
+            bdc_statut_cor_text_area,
+            LAreas.id_area == bdc_statut_cor_text_area.c.id_area,
+        )
+        .join(
+            TaxrefBdcStatutText, bdc_statut_cor_text_area.c.id_text == TaxrefBdcStatutText.id_text
+        )
+        .filter(bdc_statut_cor_text_area.c.id_text == TaxrefBdcStatutCorTextValues.id_text)
+        .filter(TaxrefBdcStatutText.enable == True)
+    ).cte("taxa_with_status")
+
+    # Retrieve all the taxa with a sensitivity rule, and the corresponding areas
+    cte_taxa_area_with_sensitivity = (
+        db.session.query(SensitivityRule.cd_nom, cor_sensitivity_area.c.id_area)
+        .select_from(SensitivityRule)
+        .join(cor_sensitivity_area, SensitivityRule.id == cor_sensitivity_area.c.id_sensitivity)
+        .filter(SensitivityRule.active == True)
+    ).cte("taxa_with_sensitivity")
+
+    # Retrieve a cd_nom and point that fit both a sensitivity rule and a protection status
+    sensitive_protected_cd_nom, sensitive_protected_id_area = (
+        db.session.query(
+            cte_taxa_area_with_status.c.cd_nom,
+            cte_taxa_area_with_status.c.id_area,
+        )
+        .join(
+            cte_taxa_area_with_sensitivity,
+            sa.and_(
+                cte_taxa_area_with_status.c.cd_nom == cte_taxa_area_with_sensitivity.c.cd_nom,
+                cte_taxa_area_with_status.c.id_area == cte_taxa_area_with_sensitivity.c.id_area,
+            ),
+        )
+        .first()
+    )
     sensitivity_rule = SensitivityRule.query.filter(
-        SensitivityRule.active == True,
-        SensitivityRule.areas.any(),
-        SensitivityRule.criterias.any(),
+        SensitivityRule.cd_nom == sensitive_protected_cd_nom,
+        SensitivityRule.areas.any(LAreas.id_area == sensitive_protected_id_area),
     ).first()
-    sensitive_cd_nom = sensitivity_rule.cd_nom
-    sensitive_area = sensitivity_rule.areas[0]
-    # Get one point in the geom : the first point of the bounding, assuming its a MULTIPOLYGON
-    sensitive_point = db.session.query(
-        func.ST_Centroid(func.ST_Transform(sensitive_area.geom, 4326))
+    sensitive_protected_area = LAreas.query.filter(
+        LAreas.id_area == sensitive_protected_id_area
+    ).first()
+    # Get one point inside the area : the centroid (assuming the area is convex)
+    sensitive_protected_point = db.session.query(
+        func.ST_Centroid(func.ST_Transform(sensitive_protected_area.geom, 4326))
     ).first()[0]
+    # Add a criteria to the sensitivity rule if needed
     id_nomenclature_bio_status = None
     id_type_nomenclature_bio_status = (
         BibNomenclaturesTypes.query.filter(BibNomenclaturesTypes.mnemonique == "STATUT_BIO")
@@ -374,24 +426,47 @@ def synthese_sensitive_data(app, users, datasets, source):
         .one()
         .id_type
     )
-    # Add a criteria to the sensitivity rule if needed
+    # Get one criteria for the sensitivity rule if needed
     list_criterias_for_sensitivity_rule = sensitivity_rule.criterias
     if list_criterias_for_sensitivity_rule:
-        one_critera_for_sensitive_rule = list_criterias_for_sensitivity_rule[0]
-        id_type_criteria_for_sensitive_rule = one_critera_for_sensitive_rule.id_type
+        one_criteria_for_sensitive_rule = list_criterias_for_sensitivity_rule[0]
+        id_type_criteria_for_sensitive_rule = one_criteria_for_sensitive_rule.id_type
         if id_type_criteria_for_sensitive_rule == id_type_nomenclature_bio_status:
-            id_nomenclature_bio_status = one_critera_for_sensitive_rule.id_nomenclature
+            id_nomenclature_bio_status = one_criteria_for_sensitive_rule.id_nomenclature
         elif id_type_criteria_for_sensitive_rule == id_type_nomenclature_behaviour:
-            id_nomenclature_behaviour = one_critera_for_sensitive_rule.id_nomenclature
+            id_nomenclature_behaviour = one_criteria_for_sensitive_rule.id_nomenclature
+
+    # Retrieve a cd_nom and point that fit a protection status but no sensitivity rule
+    protected_not_sensitive_cd_nom, protected_not_sensitive_id_area = (
+        db.session.query(cte_taxa_area_with_status.c.cd_nom, cte_taxa_area_with_status.c.id_area)
+        .filter(
+            cte_taxa_area_with_status.c.cd_nom.notin_([cte_taxa_area_with_sensitivity.c.cd_nom])
+        )
+        .first()
+    )
+    protected_not_sensitive_area = LAreas.query.filter(
+        LAreas.id_area == protected_not_sensitive_id_area
+    ).first()
+    # Get one point inside the area : the centroid (assuming the area is convex)
+    protected_not_sensitive_point = db.session.query(
+        func.ST_Centroid(func.ST_Transform(protected_not_sensitive_area.geom, 4326))
+    ).first()[0]
 
     with db.session.begin_nested():
         for name, cd_nom, point, ds, comment_description in [
             (
-                "obs1",
-                sensitive_cd_nom,
-                sensitive_point,
+                "obs_sensitive_protected",
+                sensitive_protected_cd_nom,
+                sensitive_protected_point,
+                datasets["own_dataset"],
+                "obs_sensitive_protected",
+            ),
+            (
+                "obs_protected_not_sensitive",
+                protected_not_sensitive_cd_nom,
+                protected_not_sensitive_point,
                 datasets["own_dataset"],
-                "obs_sensitive_1",
+                "obs_protected_not_sensitive",
             ),
         ]:
             unique_id_sinp = func.uuid_generate_v4()
@@ -409,8 +484,8 @@ def synthese_sensitive_data(app, users, datasets, source):
             db.session.add(s)
             data[name] = s
 
-    # Assert that obs_sensitive_1 is a sensitive observation
-    id_nomenclature_sensitive = (
+    # Assert that obs_sensitive_protected is a sensitive observation
+    id_nomenclature_not_sensitive = (
         TNomenclatures.query.filter(
             TNomenclatures.nomenclature_type.has(BibNomenclaturesTypes.mnemonique == "SENSIBILITE")
         )
@@ -418,8 +493,30 @@ def synthese_sensitive_data(app, users, datasets, source):
         .one()
     ).id_nomenclature
     Synthese.query.filter(
-        Synthese.cd_nom == sensitive_cd_nom
-    ).first().id_nomenclature_sensitivity != id_nomenclature_sensitive
+        Synthese.cd_nom == sensitive_protected_cd_nom
+    ).first().id_nomenclature_sensitivity != id_nomenclature_not_sensitive
+
+    # Assert that obs_protected_not_sensitive is not a sensitive observation
+    Synthese.query.filter(
+        Synthese.cd_nom == protected_not_sensitive_cd_nom
+    ).first().id_nomenclature_sensitivity == id_nomenclature_not_sensitive
+
+    ## Assert that obs_sensitive_protected and obs_protected_not_sensitive are protected observation
+    def assert_observation_is_protected(name_observation):
+        observation_synthese = data[name_observation]
+        list_areas_observation = [area.id_area for area in observation_synthese.areas]
+        cd_nom = observation_synthese.cd_nom
+        list_id_areas_with_status_for_cd_nom = [
+            tuple_id_area[0]
+            for tuple_id_area in db.session.query(cte_taxa_area_with_status.c.id_area)
+            .filter(cte_taxa_area_with_status.c.cd_nom == cd_nom)
+            .all()
+        ]
+        # assert that intersection of the two lists is not empty
+        assert set(list_areas_observation).intersection(set(list_id_areas_with_status_for_cd_nom))
+
+    assert_observation_is_protected("obs_sensitive_protected")
+    assert_observation_is_protected("obs_protected_not_sensitive")
 
     return data
 

From fd8e31925811955590c3a62d527e61f33257d10c Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 11:28:09 +0200
Subject: [PATCH 139/209] Modify fixture `synthese_data`: comment_description
 field in synthese: to uniquely identify and easily retrieve each observation.

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/fixtures.py | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index f0e7d45563..106cdc1282 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -326,22 +326,24 @@ def synthese_data(app, users, datasets, source):
     point3 = Point(-3.486786, 48.832182)
     data = {}
     with db.session.begin_nested():
-        for name, cd_nom, point, ds in [
-            ("obs1", 713776, point1, datasets["own_dataset"]),
-            ("obs2", 212, point2, datasets["own_dataset"]),
-            ("obs3", 2497, point3, datasets["own_dataset"]),
-            ("p1_af1", 713776, point1, datasets["belong_af_1"]),
-            ("p1_af1_2", 212, point1, datasets["belong_af_1"]),
-            ("p1_af2", 212, point1, datasets["belong_af_2"]),
-            ("p2_af2", 2497, point2, datasets["belong_af_2"]),
-            ("p2_af1", 2497, point2, datasets["belong_af_1"]),
-            ("p3_af3", 2497, point3, datasets["belong_af_3"]),
+        for name, cd_nom, point, ds, comment_description in [
+            ("obs1", 713776, point1, datasets["own_dataset"], "obs1"),
+            ("obs2", 212, point2, datasets["own_dataset"], "obs2"),
+            ("obs3", 2497, point3, datasets["own_dataset"], "obs3"),
+            ("p1_af1", 713776, point1, datasets["belong_af_1"], "p1_af1"),
+            ("p1_af1_2", 212, point1, datasets["belong_af_1"], "p1_af1_2"),
+            ("p1_af2", 212, point1, datasets["belong_af_2"], "p1_af2"),
+            ("p2_af2", 2497, point2, datasets["belong_af_2"], "p2_af2"),
+            ("p2_af1", 2497, point2, datasets["belong_af_1"], "p2_af1"),
+            ("p3_af3", 2497, point3, datasets["belong_af_3"], "p3_af3"),
         ]:
             unique_id_sinp = (
                 "f4428222-d038-40bc-bc5c-6e977bbbc92b" if not data else func.uuid_generate_v4()
             )
             geom = from_shape(point, srid=4326)
             taxon = Taxref.query.filter_by(cd_nom=cd_nom).one()
+            kwargs = {}
+            kwargs["comment_description"] = comment_description
             s = create_synthese(
                 geom,
                 taxon,
@@ -350,6 +352,7 @@ def synthese_data(app, users, datasets, source):
                 source,
                 unique_id_sinp,
                 [users["admin_user"], users["user"]],
+                **kwargs,
             )
             db.session.add(s)
             data[name] = s

From 847a26bf9b057a0edf7011425997d12d59043e7b Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 11:37:45 +0200
Subject: [PATCH 140/209] Modify fixture `create_user`: user with scope 2 and
 sensitive excluded: user named "associate_2_user_exclude_sensitive".

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/fixtures.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 106cdc1282..23a97a76cb 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -129,7 +129,7 @@ def users(app):
 
     actions = {code: PermAction.query.filter_by(code_action=code).one() for code in "CRUVED"}
 
-    def create_user(username, organisme=None, scope=None):
+    def create_user(username, organisme=None, scope=None, sensitivity_filter=False):
         # do not commit directly on current transaction, as we want to rollback all changes at the end of tests
         with db.session.begin_nested():
             user = User(
@@ -158,6 +158,7 @@ def create_user(username, organisme=None, scope=None):
                                 module=module,
                                 object=obj,
                                 scope_value=scope if scope != 3 else None,
+                                sensitivity_filter=sensitivity_filter,
                             )
                             db.session.add(permission)
         return user
@@ -174,6 +175,7 @@ def create_user(username, organisme=None, scope=None):
         ("self_user", organisme, 1),
         ("user", organisme, 2),
         ("admin_user", organisme, 3),
+        ("associate_user_2_exclude_sensitive", organisme, 2, True),
     ]
 
     for username, *args in users_to_create:

From d10e387255089ac6a7c513a94dc10da6284e42d8 Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 15:18:07 +0200
Subject: [PATCH 141/209] Add fixtures data to have a dataset with sensitive
 observations only:

Fixture `datasets`:
- dataset "associate_2_dataset_sensitive", associated to digitizer
"associate_user_2_exclude_sensitive"

Fixture `synthese_sensitive_data`:
- Observation "obs_sensitive_protected_2", associated to the
dataset "associate_2_dataset_sensitive", sensitive and protected

Test `test_datasets_permissions`:
- Fix the test, taking into account the new dataset

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/fixtures.py     | 12 ++++++++++++
 backend/geonature/tests/test_gn_meta.py |  1 +
 2 files changed, 13 insertions(+)

diff --git a/backend/geonature/tests/fixtures.py b/backend/geonature/tests/fixtures.py
index 23a97a76cb..411d934f75 100644
--- a/backend/geonature/tests/fixtures.py
+++ b/backend/geonature/tests/fixtures.py
@@ -282,6 +282,11 @@ def create_dataset(name, id_af, digitizer=None, modules=writable_module):
             ("belong_af_1", af_1.id_acquisition_framework, users["stranger_user"]),
             ("belong_af_2", af_2.id_acquisition_framework, users["stranger_user"]),
             ("belong_af_3", af_3.id_acquisition_framework, users["stranger_user"]),
+            (
+                "associate_2_dataset_sensitive",
+                af.id_acquisition_framework,
+                users["associate_user_2_exclude_sensitive"],
+            ),
         ]
     }
     datasets["with_module_1"] = create_dataset(
@@ -473,6 +478,13 @@ def synthese_sensitive_data(app, users, datasets, source):
                 datasets["own_dataset"],
                 "obs_protected_not_sensitive",
             ),
+            (
+                "obs_sensitive_protected_2",
+                sensitive_protected_cd_nom,
+                sensitive_protected_point,
+                datasets["associate_2_dataset_sensitive"],
+                "obs_sensitive_protected_2",
+            ),
         ]:
             unique_id_sinp = func.uuid_generate_v4()
             geom = point
diff --git a/backend/geonature/tests/test_gn_meta.py b/backend/geonature/tests/test_gn_meta.py
index 68ce813dca..a8fca40ad6 100644
--- a/backend/geonature/tests/test_gn_meta.py
+++ b/backend/geonature/tests/test_gn_meta.py
@@ -542,6 +542,7 @@ def test_datasets_permissions(self, app, datasets, users):
                 [
                     datasets["own_dataset"],
                     datasets["associate_dataset"],
+                    datasets["associate_2_dataset_sensitive"],
                 ]
             )
             assert set(qs.filter_by_scope(3).all()) == set(datasets.values())

From 188f88be95d4e0120bd21ebeaa577e5e6879081a Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 12:13:04 +0200
Subject: [PATCH 142/209] Refact route `export_observations_web` + add
 `test_export_observations`:

Route `export_observations_web`:
- Use @permissions_required, instead of check_cruved_scope
- Add the filter given permissions, with scope and sensitivity
- Use a CTE to retrieve Synthese IDs, filtered by user permissions
- Use a query from the export_view on `v_synthese_for_export`, joined
with the CTE, and filtering with list of ID (POST parameter)
- Rearrange order of executions and update comments

Test `test_export_observations`:
- Use the two fixtures `synthese_data` and `synthese_sensitive_data`
- Make the assert robust to future additions of data: do not check
exact match between response and expected, but rather check that
expected data is contained in the response

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/tests/test_synthese.py | 187 +++++++++++++++++++++++
 1 file changed, 187 insertions(+)

diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index b95984ee98..9822972d91 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -21,6 +21,9 @@
 from apptax.taxonomie.models import Taxref
 
 
+from pypnusershub.db.models import User
+from pypnnomenclature.models import TNomenclatures, BibNomenclaturesTypes
+
 from .fixtures import *
 from .fixtures import create_synthese
 from .utils import jsonschema_definitions
@@ -441,6 +444,190 @@ def test_export(self, users):
         )
         assert response.status_code == 200
 
+    def test_export_observations(self, users, synthese_data, synthese_sensitive_data):
+        data_synthese = synthese_data.values()
+        data_synthese_sensitive = synthese_sensitive_data.values()
+        list_id_synthese = [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese]
+        list_id_synthese.extend(
+            [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese_sensitive]
+        )
+
+        expected_columns_exports = [
+            '"id_synthese"',
+            '"date_debut"',
+            '"date_fin"',
+            '"heure_debut"',
+            '"heure_fin"',
+            '"cd_nom"',
+            '"cd_ref"',
+            '"nom_valide"',
+            '"nom_vernaculaire"',
+            '"nom_cite"',
+            '"regne"',
+            '"group1_inpn"',
+            '"group2_inpn"',
+            '"classe"',
+            '"ordre"',
+            '"famille"',
+            '"rang_taxo"',
+            '"nombre_min"',
+            '"nombre_max"',
+            '"alti_min"',
+            '"alti_max"',
+            '"prof_min"',
+            '"prof_max"',
+            '"observateurs"',
+            '"determinateur"',
+            '"communes"',
+            '"geometrie_wkt_4326"',
+            '"x_centroid_4326"',
+            '"y_centroid_4326"',
+            '"nom_lieu"',
+            '"comment_releve"',
+            '"comment_occurrence"',
+            '"validateur"',
+            '"niveau_validation"',
+            '"date_validation"',
+            '"comment_validation"',
+            '"preuve_numerique_url"',
+            '"preuve_non_numerique"',
+            '"jdd_nom"',
+            '"jdd_uuid"',
+            '"jdd_id"',
+            '"ca_nom"',
+            '"ca_uuid"',
+            '"ca_id"',
+            '"cd_habref"',
+            '"cd_habitat"',
+            '"nom_habitat"',
+            '"precision_geographique"',
+            '"nature_objet_geo"',
+            '"type_regroupement"',
+            '"methode_regroupement"',
+            '"technique_observation"',
+            '"biologique_statut"',
+            '"etat_biologique"',
+            '"biogeographique_statut"',
+            '"naturalite"',
+            '"preuve_existante"',
+            '"niveau_precision_diffusion"',
+            '"stade_vie"',
+            '"sexe"',
+            '"objet_denombrement"',
+            '"type_denombrement"',
+            '"niveau_sensibilite"',
+            '"statut_observation"',
+            '"floutage_dee"',
+            '"statut_source"',
+            '"type_info_geo"',
+            '"methode_determination"',
+            '"comportement"',
+            '"reference_biblio"',
+            '"id_origine"',
+            '"uuid_perm_sinp"',
+            '"uuid_perm_grp_sinp"',
+            '"date_creation"',
+            '"date_modification"',
+            '"champs_additionnels"',
+        ]
+
+        def assert_export_results(user, expected_id_synthese_list):
+            set_logged_user_cookie(self.client, user)
+            response = self.client.post(
+                url_for("gn_synthese.export_observations_web"),
+                json=list_id_synthese,
+                query_string={"export_format": "csv"},
+            )
+            assert response.status_code == 200
+
+            rows_data_response = response.data.decode("utf-8").split("\r\n")[0:-1]
+            row_header = rows_data_response[0]
+            rows_synthese_data_response = rows_data_response[1:]
+
+            assert row_header.split(";") == expected_columns_exports
+
+            expected_response_data_synthese = [
+                obs_data_synthese
+                for obs_data_synthese in data_synthese
+                if obs_data_synthese.id_synthese in expected_id_synthese_list
+            ]
+            expected_response_data_synthese.extend(
+                [
+                    obs_data_synthese
+                    for obs_data_synthese in data_synthese_sensitive
+                    if obs_data_synthese.id_synthese in expected_id_synthese_list
+                ]
+            )
+            nb_expected_synthese_data = len(expected_response_data_synthese)
+            assert len(rows_synthese_data_response) >= nb_expected_synthese_data
+            list_id_synthese_data_response = [
+                row.split(";")[0] for row in rows_synthese_data_response
+            ]
+            assert set(
+                f'"{expected_id_synthese}"' for expected_id_synthese in expected_id_synthese_list
+            ).issubset(set(list_id_synthese_data_response))
+            # Some checks on the data of the response : cd_nom, comment_occurrence (comment_description in synthese)
+            for expected_obs_data_synthese in expected_response_data_synthese:
+                id_synthese_expected_obs_data_synthese = expected_obs_data_synthese.id_synthese
+                row_response_obs_data_synthese = [
+                    row
+                    for row in rows_synthese_data_response
+                    if row.split(";")[0] == f'"{id_synthese_expected_obs_data_synthese}"'
+                ][0]
+                # Check cd_nom
+                expected_cd_nom = expected_obs_data_synthese.cd_nom
+                index_cd_nom_response = expected_columns_exports.index('"cd_nom"')
+                response_cd_nom = row_response_obs_data_synthese.split(";")[index_cd_nom_response]
+                assert response_cd_nom == f'"{expected_cd_nom}"'
+                # Check comment_occurrence
+                expected_comment_occurrence = expected_obs_data_synthese.comment_description
+                index_comment_occurrence_response = expected_columns_exports.index(
+                    '"comment_occurrence"'
+                )
+                response_comment_occurrence = row_response_obs_data_synthese.split(";")[
+                    index_comment_occurrence_response
+                ]
+                assert response_comment_occurrence == f'"{expected_comment_occurrence}"'
+
+        ## "self_user" : scope 1 and include sensitive data
+        user = users["self_user"]
+        expected_id_synthese_list = [
+            synthese_data[name_obs].id_synthese
+            for name_obs in [
+                "obs1",
+                "obs2",
+                "obs3",
+                "p1_af1",
+                "p1_af1_2",
+                "p1_af2",
+                "p2_af2",
+                "p2_af1",
+                "p3_af3",
+            ]
+        ]
+        expected_id_synthese_list.extend(
+            [
+                synthese_sensitive_data[name_obs].id_synthese
+                for name_obs in [
+                    "obs_sensitive_protected",
+                    "obs_protected_not_sensitive",
+                    "obs_sensitive_protected_2",
+                ]
+            ]
+        )
+        assert_export_results(user, expected_id_synthese_list)
+
+        ## "associate_user_2_exclude_sensitive" : scope 2 and exclude sensitive data
+        user = users["associate_user_2_exclude_sensitive"]
+        expected_id_synthese_list = [synthese_data[name_obs].id_synthese for name_obs in ["obs1"]]
+        expected_id_synthese_list.extend(
+            [
+                synthese_sensitive_data[name_obs].id_synthese
+                for name_obs in ["obs_protected_not_sensitive"]
+            ]
+        )
+        assert_export_results(user, expected_id_synthese_list)
+
     def test_export_status(self, users):
         set_logged_user_cookie(self.client, users["self_user"])
 

From 6ddcf58da5f556aa40e42ec7e5e82e2401fb407f Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 12:15:53 +0200
Subject: [PATCH 143/209] Refact route `export_taxon_web` + add
 `test_export_taxons`:

Route `export_taxon_web`:
- Use @permissions_required, instead of check_cruved_scope
- Add the filter given permissions, with scope and sensitivity

Test `test_export_taxons`:
- Use the two fixtures `synthese_data` and `synthese_sensitive_data`
- Make the assert robust to future additions of data: do not check
exact match between response and expected, but rather check that
expected data is contained in the response

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/core/gn_synthese/routes.py |   4 +-
 backend/geonature/tests/test_synthese.py     | 100 +++++++++++++++++++
 2 files changed, 102 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 66d881df5d..73bb26c6a7 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -344,10 +344,10 @@ def export_taxon_web(permissions):
         engine=DB.engine,
     )
     columns = taxon_view.tableDef.columns
+
     # Test de conformité de la vue v_synthese_for_export_view
     try:
         assert hasattr(taxon_view.tableDef.columns, "cd_ref")
-
     except AssertionError as e:
         return (
             {
@@ -364,7 +364,6 @@ def export_taxon_web(permissions):
 
     id_list = request.get_json()
 
-    cruved = get_scopes_by_action(module_code="SYNTHESE")
     sub_query = (
         select(
             [
@@ -391,6 +390,7 @@ def export_taxon_web(permissions):
     q = DB.session.query(*columns, subq.c.nb_obs, subq.c.date_min, subq.c.date_max).join(
         subq, subq.c.cd_ref == columns.cd_ref
     )
+
     return to_csv_resp(
         datetime.datetime.now().strftime("%Y_%m_%d_%Hh%Mm%S"),
         data=serializeQuery(q.all(), q.column_descriptions),
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 9822972d91..ce122bde12 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -22,6 +22,7 @@
 
 
 from pypnusershub.db.models import User
+from apptax.taxonomie.models import Taxref
 from pypnnomenclature.models import TNomenclatures, BibNomenclaturesTypes
 
 from .fixtures import *
@@ -628,6 +629,105 @@ def assert_export_results(user, expected_id_synthese_list):
         )
         assert_export_results(user, expected_id_synthese_list)
 
+    def test_export_taxons(self, users, synthese_data, synthese_sensitive_data):
+        data_synthese = synthese_data.values()
+        data_synthese_sensitive = synthese_sensitive_data.values()
+        list_id_synthese = [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese]
+        list_id_synthese.extend(
+            [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese_sensitive]
+        )
+
+        expected_columns_exports = [
+            '"nom_valide"',
+            '"cd_ref"',
+            '"nom_vern"',
+            '"group1_inpn"',
+            '"group2_inpn"',
+            '"regne"',
+            '"phylum"',
+            '"classe"',
+            '"ordre"',
+            '"famille"',
+            '"id_rang"',
+            '"nb_obs"',
+            '"date_min"',
+            '"date_max"',
+        ]
+        index_colummn_cd_ref = expected_columns_exports.index('"cd_ref"')
+
+        def assert_export_taxons_results(user, set_expected_cd_ref):
+            set_logged_user_cookie(self.client, user)
+
+            response = self.client.post(
+                url_for("gn_synthese.export_taxon_web"),
+                json=list_id_synthese,
+            )
+
+            assert response.status_code == 200
+
+            rows_data_response = response.data.decode("utf-8").split("\r\n")[0:-1]
+            row_header = rows_data_response[0]
+            rows_taxons_data_response = rows_data_response[1:]
+
+            assert row_header.split(";") == expected_columns_exports
+
+            nb_expected_cd_noms = len(set_expected_cd_ref)
+
+            assert len(rows_taxons_data_response) >= nb_expected_cd_noms
+
+            set_cd_ref_data_response = set(
+                row.split(";")[index_colummn_cd_ref] for row in rows_taxons_data_response
+            )
+
+            assert set(f'"{expected_cd_ref}"' for expected_cd_ref in set_expected_cd_ref).issubset(
+                set_cd_ref_data_response
+            )
+
+        ## "self_user" : scope 1 and include sensitive data
+        user = users["self_user"]
+        set_expected_cd_ref = set(
+            Taxref.query.filter(Taxref.cd_nom == synthese_data[name_obs].cd_nom).one().cd_ref
+            for name_obs in [
+                "obs1",
+                "obs2",
+                "obs3",
+                "p1_af1",
+                "p1_af1_2",
+                "p1_af2",
+                "p2_af2",
+                "p2_af1",
+                "p3_af3",
+            ]
+        )
+        set_expected_cd_ref.update(
+            set(
+                Taxref.query.filter(Taxref.cd_nom == synthese_sensitive_data[name_obs].cd_nom)
+                .one()
+                .cd_ref
+                for name_obs in [
+                    "obs_sensitive_protected",
+                    "obs_protected_not_sensitive",
+                    "obs_sensitive_protected_2",
+                ]
+            )
+        )
+        assert_export_taxons_results(user, set_expected_cd_ref)
+
+        ## "associate_user_2_exclude_sensitive" : scope 2 and exclude sensitive data
+        user = users["associate_user_2_exclude_sensitive"]
+        set_expected_cd_ref = set(
+            Taxref.query.filter(Taxref.cd_nom == synthese_data[name_obs].cd_nom).one().cd_ref
+            for name_obs in ["obs1"]
+        )
+        set_expected_cd_ref.add(
+            Taxref.query.filter(
+                Taxref.cd_nom == synthese_sensitive_data["obs_protected_not_sensitive"].cd_nom
+            )
+            .one()
+            .cd_ref
+        )
+        assert_export_taxons_results(user, set_expected_cd_ref)
+
     def test_export_status(self, users):
         set_logged_user_cookie(self.client, users["self_user"])
 

From 8ad082886a72b3ae0db1b95d5d98c56b2c722efe Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 12:48:15 +0200
Subject: [PATCH 144/209] Refact route `export_status` + add
 `test_export_status`:

Route `export_status`:
- Use @permissions_required, instead of check_cruved_scope
- Add the filter given permissions, with scope and sensitivity
- Use DB.session.execute, rather than DB.engine.execute

Test `test_export_status`:
- Use the two fixtures `synthese_data` and `synthese_sensitive_data`
- Make the assert robust to future additions of data: do not check
exact match between response and expected, but rather check that
expected data is contained in the response

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/core/gn_synthese/routes.py |  9 +--
 backend/geonature/tests/test_synthese.py     | 69 ++++++++++++++++++--
 2 files changed, 70 insertions(+), 8 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 73bb26c6a7..9a6a73d7a2 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -563,8 +563,8 @@ def export_metadata(scope):
 
 
 @routes.route("/export_statuts", methods=["POST"])
-@permissions.check_cruved_scope("E", get_scope=True, module_code="SYNTHESE")
-def export_status(scope):
+@permissions_required("E", module_code="SYNTHESE")
+def export_status(permissions):
     """Route to get all the protection status of a synthese search
 
     .. :quickref: Synthese;
@@ -598,7 +598,8 @@ def export_status(scope):
     # Initialize SyntheseQuery class
     synthese_query = SyntheseQuery(VSyntheseForWebApp, q, filters)
 
-    synthese_query.apply_all_filters(g.current_user, scope)
+    # Filter query with permissions
+    synthese_query.filter_query_all_filters(g.current_user, permissions)
 
     # Add join
     synthese_query.add_join(Taxref, Taxref.cd_nom, VSyntheseForWebApp.cd_nom)
@@ -641,7 +642,7 @@ def export_status(scope):
     q = q.where(TaxrefBdcStatutText.enable == True)
 
     protection_status = []
-    data = DB.engine.execute(q)
+    data = DB.session.execute(q)
     for d in data:
         row = OrderedDict(
             [
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index ce122bde12..5a48837bac 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -728,12 +728,73 @@ def assert_export_taxons_results(user, set_expected_cd_ref):
         )
         assert_export_taxons_results(user, set_expected_cd_ref)
 
-    def test_export_status(self, users):
-        set_logged_user_cookie(self.client, users["self_user"])
+    def test_export_status(self, users, synthese_data, synthese_sensitive_data):
+        expected_columns_exports = [
+            '"nom_complet"',
+            '"nom_vern"',
+            '"cd_nom"',
+            '"cd_ref"',
+            '"type_regroupement"',
+            '"type"',
+            '"territoire_application"',
+            '"intitule_doc"',
+            '"code_statut"',
+            '"intitule_statut"',
+            '"remarque"',
+            '"url_doc"',
+        ]
+        index_column_cd_nom = expected_columns_exports.index('"cd_nom"')
 
-        response = self.client.post(url_for("gn_synthese.export_status"))
+        def assert_export_status_results(user, set_expected_cd_ref):
+            set_logged_user_cookie(self.client, user)
 
-        assert response.status_code == 200
+            response = self.client.post(
+                url_for("gn_synthese.export_status"),
+            )
+
+            assert response.status_code == 200
+
+            rows_data_response = response.data.decode("utf-8").split("\r\n")[0:-1]
+            row_header = rows_data_response[0]
+            rows_taxons_data_response = rows_data_response[1:]
+
+            assert row_header.split(";") == expected_columns_exports
+
+            nb_expected_cd_ref = len(set_expected_cd_ref)
+            set_cd_ref_data_response = set(
+                row.split(";")[index_column_cd_nom] for row in rows_taxons_data_response
+            )
+            nb_cd_ref_response = len(set_cd_ref_data_response)
+
+            assert nb_cd_ref_response >= nb_expected_cd_ref
+
+            assert set(f'"{expected_cd_ref}"' for expected_cd_ref in set_expected_cd_ref).issubset(
+                set_cd_ref_data_response
+            )
+
+        ## "self_user" : scope 1 and include sensitive data
+        user = users["self_user"]
+        set_expected_cd_ref = set(
+            Taxref.query.filter(Taxref.cd_nom == synthese_sensitive_data[name_obs].cd_nom)
+            .one()
+            .cd_ref
+            for name_obs in [
+                "obs_sensitive_protected",
+                "obs_protected_not_sensitive",
+                "obs_sensitive_protected_2",
+            ]
+        )
+        assert_export_status_results(user, set_expected_cd_ref)
+
+        ## "associate_user_2_exclude_sensitive" : scope 2 and exclude sensitive data
+        user = users["associate_user_2_exclude_sensitive"]
+        set_expected_cd_ref = set(
+            Taxref.query.filter(Taxref.cd_nom == synthese_sensitive_data[name_obs].cd_nom)
+            .one()
+            .cd_ref
+            for name_obs in ["obs_protected_not_sensitive"]
+        )
+        assert_export_status_results(user, set_expected_cd_ref)
 
     def test_export_metadata(self, users):
         set_logged_user_cookie(self.client, users["self_user"])

From c1889a3022f519daa237b2db72f876ad3f1b753b Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 12:51:07 +0200
Subject: [PATCH 145/209] Refact route `export_metadata` + add
 `test_export_metadata`:

Route `export_taxon_metadata`:
- Use @permissions_required, instead of check_cruved_scope
- Add the filter given permissions, with scope and sensitivity
- Rename 'nombre_obs' column into 'nombre_total_obs'
- Use DB.session.execute, rather than DB.engine.execute
- Add a check to assert "jdd_id" is in v_metadata_for_export columns
- Remove some useless lines : redondant construct of 'q'

Test `test_export_metadata`:
- Check returned `id_synthese` and `nombre_obs`
- Use the two fixtures `synthese_data` and `synthese_sensitive_data`
- Make the assert robust to future additions of data: do not check
exact match between response and expected, but rather check that
expected data is contained in the response

Signed-off-by: VincentCauchois <vincent.cauchois@mnhn.fr>
---
 backend/geonature/core/gn_synthese/routes.py |  58 +++++---
 backend/geonature/tests/test_synthese.py     | 132 ++++++++++++++++++-
 2 files changed, 171 insertions(+), 19 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 9a6a73d7a2..953b73cc54 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -516,8 +516,8 @@ def export_observations_web(permissions):
 
 
 @routes.route("/export_metadata", methods=["GET", "POST"])
-@permissions.check_cruved_scope("E", get_scope=True, module_code="SYNTHESE")
-def export_metadata(scope):
+@permissions_required("E", module_code="SYNTHESE")
+def export_metadata(permissions):
     """Route to export the metadata in CSV
 
     .. :quickref: Synthese;
@@ -530,19 +530,35 @@ def export_metadata(scope):
     filters = request.json if request.is_json else {}
 
     metadata_view = GenericTable(
-        tableName="v_metadata_for_export", schemaName="gn_synthese", engine=DB.engine
+        tableName="v_metadata_for_export",
+        schemaName="gn_synthese",
+        engine=DB.engine,
     )
-    q = DB.session.query(distinct(VSyntheseForWebApp.id_dataset), metadata_view.tableDef).join(
-        metadata_view.tableDef,
-        getattr(
-            metadata_view.tableDef.columns,
-            current_app.config["SYNTHESE"]["EXPORT_METADATA_ID_DATASET_COL"],
+
+    # Test de conformité de la vue v_metadata_for_export
+    try:
+        assert hasattr(metadata_view.tableDef.columns, "jdd_id")
+    except AssertionError as e:
+        return (
+            {
+                "msg": """
+                        View v_metadata_for_export
+                        must have a jdd_id column \n
+                        trace: {}
+                        """.format(
+                    str(e)
+                )
+            },
+            500,
         )
-        == VSyntheseForWebApp.id_dataset,
-    )
 
     q = select([distinct(VSyntheseForWebApp.id_dataset), metadata_view.tableDef])
-    synthese_query_class = SyntheseQuery(VSyntheseForWebApp, q, filters)
+
+    synthese_query_class = SyntheseQuery(
+        VSyntheseForWebApp,
+        q,
+        filters,
+    )
     synthese_query_class.add_join(
         metadata_view.tableDef,
         getattr(
@@ -551,14 +567,26 @@ def export_metadata(scope):
         ),
         VSyntheseForWebApp.id_dataset,
     )
-    synthese_query_class.filter_query_all_filters(g.current_user, scope)
 
-    data = DB.engine.execute(synthese_query_class.query)
+    # Filter query with permissions (scope, sensitivity, ...)
+    synthese_query_class.filter_query_all_filters(g.current_user, permissions)
+
+    data = DB.session.execute(synthese_query_class.query)
+
+    # Define the header of the csv file
+    columns = [db_col.key for db_col in metadata_view.tableDef.columns]
+    columns[columns.index("nombre_obs")] = "nombre_total_obs"
+
+    # Retrieve the data to write in the csv file
+    data = [metadata_view.as_dict(d) for d in data]
+    for d in data:
+        d["nombre_total_obs"] = d.pop("nombre_obs")
+
     return to_csv_resp(
         datetime.datetime.now().strftime("%Y_%m_%d_%Hh%Mm%S"),
-        data=[metadata_view.as_dict(d) for d in data],
+        data=data,
         separator=";",
-        columns=[db_col.key for db_col in metadata_view.tableDef.columns],
+        columns=columns,
     )
 
 
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 5a48837bac..941625d72d 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -796,12 +796,136 @@ def assert_export_status_results(user, set_expected_cd_ref):
         )
         assert_export_status_results(user, set_expected_cd_ref)
 
-    def test_export_metadata(self, users):
-        set_logged_user_cookie(self.client, users["self_user"])
+    def test_export_metadata(self, users, synthese_data, synthese_sensitive_data):
+        data_synthese = synthese_data.values()
+        data_synthese_sensitive = synthese_sensitive_data.values()
+        list_id_synthese = [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese]
+        list_id_synthese.extend(
+            [obs_data_synthese.id_synthese for obs_data_synthese in data_synthese_sensitive]
+        )
 
-        response = self.client.get(url_for("gn_synthese.export_metadata"))
+        expected_columns_exports = [
+            '"jeu_donnees"',
+            '"jdd_id"',
+            '"jdd_uuid"',
+            '"cadre_acquisition"',
+            '"ca_uuid"',
+            '"acteurs"',
+            '"nombre_total_obs"',
+        ]
+        index_column_jdd_id = expected_columns_exports.index('"jdd_id"')
 
-        assert response.status_code == 200
+        def assert_export_metadata_results(user, dict_expected_datasets):
+            set_logged_user_cookie(self.client, user)
+
+            response = self.client.post(
+                url_for("gn_synthese.export_metadata"),
+            )
+
+            assert response.status_code == 200
+
+            rows_data_response = response.data.decode("utf-8").split("\r\n")[0:-1]
+            row_header = rows_data_response[0]
+            rows_datasets_data_response = rows_data_response[1:]
+
+            assert row_header.split(";") == expected_columns_exports
+
+            nb_expected_datasets = len(dict_expected_datasets)
+            set_id_datasets_data_response = set(
+                row.split(";")[index_column_jdd_id] for row in rows_datasets_data_response
+            )
+            nb_datasets_response = len(set_id_datasets_data_response)
+
+            assert nb_datasets_response >= nb_expected_datasets
+
+            set_expected_id_datasets = set(dict_expected_datasets.keys())
+            assert set(
+                f'"{expected_id_dataset}"' for expected_id_dataset in set_expected_id_datasets
+            ).issubset(set_id_datasets_data_response)
+
+            for expected_id_dataset, expected_nb_obs in dict_expected_datasets.items():
+                row_dataset_data_response = [
+                    row
+                    for row in rows_datasets_data_response
+                    if row.split(";")[index_column_jdd_id] == f'"{expected_id_dataset}"'
+                ][0]
+                nb_obs_response = row_dataset_data_response.split(";")[-1]
+                assert nb_obs_response >= f'"{expected_nb_obs}"'
+
+        ## "self_user" : scope 1 and include sensitive data
+        user = users["self_user"]
+        # Create a dict (id_dataset, nb_obs) for the expected data
+        dict_expected_datasets = {}
+        expected_data_synthese = [
+            obs_synthese
+            for name_obs, obs_synthese in synthese_data.items()
+            if name_obs
+            in [
+                "obs1",
+                "obs2",
+                "obs3",
+                "p1_af1",
+                "p1_af1_2",
+                "p1_af2",
+                "p2_af2",
+                "p2_af1",
+                "p3_af3",
+            ]
+        ]
+        for obs_data_synthese in expected_data_synthese:
+            id_dataset = obs_data_synthese.id_dataset
+            if id_dataset in dict_expected_datasets:
+                dict_expected_datasets[id_dataset] += 1
+            else:
+                dict_expected_datasets[id_dataset] = 1
+        expected_data_synthese = [
+            obs_synthese
+            for name_obs, obs_synthese in synthese_sensitive_data.items()
+            if name_obs
+            in [
+                "obs_sensitive_protected",
+                "obs_protected_not_sensitive",
+                "obs_sensitive_protected_2",
+            ]
+        ]
+        for obs_data_synthese in expected_data_synthese:
+            id_dataset = obs_data_synthese.id_dataset
+            if id_dataset in dict_expected_datasets:
+                dict_expected_datasets[id_dataset] += 1
+            else:
+                dict_expected_datasets[id_dataset] = 1
+        assert_export_metadata_results(user, dict_expected_datasets)
+
+        ## "associate_user_2_exclude_sensitive" : scope 2 and exclude sensitive data
+        user = users["associate_user_2_exclude_sensitive"]
+        # Create a dict (id_dataset, nb_obs) for the expected data
+        dict_expected_datasets = {}
+        expected_data_synthese = [
+            obs_synthese
+            for name_obs, obs_synthese in synthese_data.items()
+            if name_obs in ["obs1"]
+        ]
+        for obs_data_synthese in expected_data_synthese:
+            id_dataset = obs_data_synthese.id_dataset
+            if id_dataset in dict_expected_datasets:
+                dict_expected_datasets[id_dataset] += 1
+            else:
+                dict_expected_datasets[id_dataset] = 1
+        expected_data_synthese = [
+            obs_synthese
+            for name_obs, obs_synthese in synthese_sensitive_data.items()
+            if name_obs
+            in [
+                "obs_protected_not_sensitive",
+            ]
+        ]
+        for obs_data_synthese in expected_data_synthese:
+            id_dataset = obs_data_synthese.id_dataset
+            if id_dataset in dict_expected_datasets:
+                dict_expected_datasets[id_dataset] += 1
+            else:
+                dict_expected_datasets[id_dataset] = 1
+        assert_export_metadata_results(user, dict_expected_datasets)
 
     def test_general_stat(self, users):
         set_logged_user_cookie(self.client, users["self_user"])

From 8bb2969f51e5ba5226c46e610f885e40f15c195f Mon Sep 17 00:00:00 2001
From: VincentCauchois <vincent.cauchois@mnhn.fr>
Date: Tue, 30 May 2023 15:20:48 +0200
Subject: [PATCH 146/209] [WIP] Refact exports routes in synthese

TODO:
- Fix: Make `test_export_*` succeed when executing pytest at
upper level (class TestSynthes, all tests, ...)
- Routes `export_*`: Choose route methods (GET, POST)
- Routes `export_*`: Allow list_id_synthese as POST parameter ?
- `test_export_*`: assert data that should be excluded actually is
---
 backend/geonature/core/gn_synthese/routes.py | 2 ++
 backend/geonature/tests/test_synthese.py     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 953b73cc54..44fd370701 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -515,6 +515,7 @@ def export_observations_web(permissions):
         )
 
 
+# TODO: Change the following line to set method as "POST" only ?
 @routes.route("/export_metadata", methods=["GET", "POST"])
 @permissions_required("E", module_code="SYNTHESE")
 def export_metadata(permissions):
@@ -525,6 +526,7 @@ def export_metadata(permissions):
     The table synthese is join with gn_synthese.v_metadata_for_export
     The column jdd_id is mandatory in the view gn_synthese.v_metadata_for_export
 
+    TODO: Remove the following comment line ? or add the where clause for id_synthese in id_list ?
     POST parameters: Use a list of id_synthese (in POST parameters) to filter the v_synthese_for_export_view
     """
     filters = request.json if request.is_json else {}
diff --git a/backend/geonature/tests/test_synthese.py b/backend/geonature/tests/test_synthese.py
index 941625d72d..b5c3089557 100644
--- a/backend/geonature/tests/test_synthese.py
+++ b/backend/geonature/tests/test_synthese.py
@@ -815,6 +815,7 @@ def test_export_metadata(self, users, synthese_data, synthese_sensitive_data):
         ]
         index_column_jdd_id = expected_columns_exports.index('"jdd_id"')
 
+        # TODO: assert that some data is excluded from the response
         def assert_export_metadata_results(user, dict_expected_datasets):
             set_logged_user_cookie(self.client, user)
 
@@ -925,6 +926,7 @@ def assert_export_metadata_results(user, dict_expected_datasets):
                 dict_expected_datasets[id_dataset] += 1
             else:
                 dict_expected_datasets[id_dataset] = 1
+        # TODO: s'assurer qu'on ne récupère pas le dataset "associate_2_dataset_sensitive", car ne contient que des données sensibles, bien que l'utilisateur ait le scope nécessaire par ailleurs (scope 2, et ce dataset lui est associé)
         assert_export_metadata_results(user, dict_expected_datasets)
 
     def test_general_stat(self, users):

From af1a10ade210f2546ebeb1893ec36e59f008ab4d Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Mon, 19 Jun 2023 16:00:40 +0200
Subject: [PATCH 147/209] feat(permissions): fixture scop from class to
 function

---
 backend/geonature/tests/test_sensitivity.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/geonature/tests/test_sensitivity.py b/backend/geonature/tests/test_sensitivity.py
index 3e9f4501f4..27ed8b39c8 100644
--- a/backend/geonature/tests/test_sensitivity.py
+++ b/backend/geonature/tests/test_sensitivity.py
@@ -21,7 +21,7 @@
 from pypnnomenclature.models import TNomenclatures, BibNomenclaturesTypes
 
 
-@pytest.fixture(scope="class")
+@pytest.fixture(scope="function")
 def clean_all_sensitivity_rules():
     db.session.execute(sa.delete(CorSensitivityCriteria))
     db.session.execute(sa.delete(cor_sensitivity_area))

From 4a226c218df4dcc5afb9c6c95dcf04a6b71acd6f Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Fri, 30 Jun 2023 11:18:44 +0200
Subject: [PATCH 148/209] fix(permissions): adding missing permission in
 metadata

---
 .../migrations/versions/f051b88a57fd_permissions_available.py    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
index 198700392b..01a0255c21 100644
--- a/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
+++ b/backend/geonature/migrations/versions/f051b88a57fd_permissions_available.py
@@ -99,6 +99,7 @@ def upgrade():
                     ,('METADATA', 'ALL', 'C', False, 'Créer des métadonnées')
                     ,('METADATA', 'ALL', 'R', True, 'Voir les métadonnées')
                     ,('METADATA', 'ALL', 'U', True, 'Modifier les métadonnées')
+                    ,('METADATA', 'ALL', 'E', True, 'Exporter les métadonnées')
                     ,('METADATA', 'ALL', 'D', True, 'Supprimer des métadonnées')
                     ,('SYNTHESE', 'ALL', 'R', True, 'Voir les observations')
                     ,('SYNTHESE', 'ALL', 'E', True, 'Exporter les observations')

From 2b145153a1ee5641875b13f07b5b7bb48d327e2a Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 3 Jul 2023 12:01:55 +0200
Subject: [PATCH 149/209] feat(front): use local storage to keep base layer

Store the name of the selected BaseLayer in the local storage, so that
it can be set on map creation. Only the name is stored since the actual
base layer can be retrieved from it.
Checks have been set to prevent errors when the layer does not exist or
if the localStorage is empty
---
 frontend/src/app/GN2CommonModule/map/map.component.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/frontend/src/app/GN2CommonModule/map/map.component.ts b/frontend/src/app/GN2CommonModule/map/map.component.ts
index 6706a6a4cf..cbd42d3976 100644
--- a/frontend/src/app/GN2CommonModule/map/map.component.ts
+++ b/frontend/src/app/GN2CommonModule/map/map.component.ts
@@ -207,6 +207,15 @@ export class MapComponent implements OnInit {
       this.mapService.loadOverlay(overlay);
     });
 
+    map.on('baselayerchange', (layer) => {
+      localStorage.setItem('MapLayer', layer.name);
+    });
+
+    const userMapLayer = localStorage.getItem('MapLayer');
+    if (userMapLayer !== null && baseControl[userMapLayer] !== undefined) {
+      map.addLayer(baseControl[userMapLayer]);
+    }
+
     setTimeout(() => {
       this.map.invalidateSize();
     }, 50);

From ae9c1d6e161044d94098a27e9225baedb0fe53ab Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Wed, 28 Jun 2023 10:37:52 +0200
Subject: [PATCH 150/209] fix(CA): added get to the route also opened the file
 in a new tab and fixed the flashing link when the ca is not closed

---
 backend/geonature/core/gn_meta/routes.py                  | 4 +++-
 frontend/src/app/metadataModule/af/af-card.component.html | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_meta/routes.py b/backend/geonature/core/gn_meta/routes.py
index 4aebfe96e0..bf03454541 100644
--- a/backend/geonature/core/gn_meta/routes.py
+++ b/backend/geonature/core/gn_meta/routes.py
@@ -617,7 +617,9 @@ def get_acquisition_frameworks_list(scope):
     )
 
 
-@routes.route("/acquisition_frameworks/export_pdf/<id_acquisition_framework>", methods=["POST"])
+@routes.route(
+    "/acquisition_frameworks/export_pdf/<id_acquisition_framework>", methods=["POST", "GET"]
+)
 @permissions.check_cruved_scope("E", module_code="METADATA")
 def get_export_pdf_acquisition_frameworks(id_acquisition_framework):
     """
diff --git a/frontend/src/app/metadataModule/af/af-card.component.html b/frontend/src/app/metadataModule/af/af-card.component.html
index 3559b161ce..18f6ec47e9 100644
--- a/frontend/src/app/metadataModule/af/af-card.component.html
+++ b/frontend/src/app/metadataModule/af/af-card.component.html
@@ -41,12 +41,13 @@ <h4>
             <mat-icon>file_download</mat-icon>
           </button>
           <br />
-          <span *ngIf="!af?.opened">
+          <span *ngIf="af && !af?.opened">
             <b> {{ config.METADATA.AF_SHEET_CLOSED_LINK_NAME }} </b> :
             <a
               href="{{ config.API_ENDPOINT }}/meta/acquisition_frameworks/export_pdf/{{
                 af?.id_acquisition_framework
               }}"
+              target="_blank"
             >
               {{ config.API_ENDPOINT }}/meta/acquisition_frameworks/export_pdf/{{
                 af?.id_acquisition_framework

From 9c71034fd54aa906c4ebba41e329d4fa6a904167 Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Thu, 29 Jun 2023 10:58:03 +0200
Subject: [PATCH 151/209] fix(CA): fix the chart and the pdf

---
 backend/static/css/metadata_pdf.css                  |  2 +-
 .../src/app/metadataModule/af/af-card.component.html |  8 +++++---
 .../src/app/metadataModule/af/af-card.component.ts   | 12 ++++++++----
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/backend/static/css/metadata_pdf.css b/backend/static/css/metadata_pdf.css
index debf4edfc6..5e4f882eae 100644
--- a/backend/static/css/metadata_pdf.css
+++ b/backend/static/css/metadata_pdf.css
@@ -161,7 +161,7 @@ div.titre {
   height:600px;
 }
 
-.zone, .repartition {
+.zone {
   height: 40%;
 }
 
diff --git a/frontend/src/app/metadataModule/af/af-card.component.html b/frontend/src/app/metadataModule/af/af-card.component.html
index 18f6ec47e9..a89fb6466c 100644
--- a/frontend/src/app/metadataModule/af/af-card.component.html
+++ b/frontend/src/app/metadataModule/af/af-card.component.html
@@ -269,11 +269,13 @@ <h5>Répartition des espèces</h5>
           <div style="display: block">
             <canvas
               baseChart
-              [data]="pieChartData"
+              *ngIf="pieChartData[0].data.length"
+              [options]="pieChartOptions"
+              [datasets]="pieChartData"
               [labels]="pieChartLabels"
-              [chartType]="pieChartType"
+              [type]="pieChartType"
               [colors]="pieChartColors"
-              [options]="pieChartOptions"
+              [plugins]="pieChartOptions.plugins"
               padding="20px"
             >
             </canvas>
diff --git a/frontend/src/app/metadataModule/af/af-card.component.ts b/frontend/src/app/metadataModule/af/af-card.component.ts
index b0b3e641ea..9d72f6f249 100644
--- a/frontend/src/app/metadataModule/af/af-card.component.ts
+++ b/frontend/src/app/metadataModule/af/af-card.component.ts
@@ -24,12 +24,17 @@ export class AfCardComponent implements OnInit {
   // Tableau contenant les labels du graphe
   public pieChartLabels = [];
   // Tableau contenant les données du graphe
-  public pieChartData = [];
+  public pieChartData = [
+    {
+      data: [],
+    },
+  ];
   // Tableau contenant les couleurs et la taille de bordure du graphe
   public pieChartColors = [];
   // Dictionnaire contenant les options à implémenter sur le graphe (calcul des pourcentages notamment)
   public pieChartOptions = {
     cutoutPercentage: 80,
+    responsive: true,
     legend: {
       display: 'true',
       position: 'left',
@@ -127,12 +132,11 @@ export class AfCardComponent implements OnInit {
       .getTaxaDistribution('group2_inpn', { id_af: this.id_af })
       .pipe(tap(() => (this.spinner = false)))
       .subscribe((res) => {
-        this.pieChartData.length = 0;
         this.pieChartLabels.length = 0;
-        this.pieChartData = [];
+        this.pieChartData[0].data = [];
         this.pieChartLabels = [];
         for (let row of res) {
-          this.pieChartData.push(row['count']);
+          this.pieChartData[0].data.push(row['count']);
           this.pieChartLabels.push(row['group']);
         }
 

From 475a84a3943250296e54d6c91982a6b6049b7265 Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Tue, 27 Jun 2023 18:01:10 +0200
Subject: [PATCH 152/209] move npm @type/leafet from dev to prod

---
 frontend/package-lock.json | 16 +++++++---------
 frontend/package.json      |  2 +-
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 12b37c4204..3a7101ece2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -30,6 +30,7 @@
         "@popperjs/core": "^2.11.6",
         "@swimlane/ngx-datatable": "^20.0.0",
         "@tmcw/togeojson": "^5.6.0",
+        "@types/leaflet": "^1.9.3",
         "bootstrap": "4.3.1",
         "chart.js": "^4.2.1",
         "chartjs-plugin-datalabels": "^2.2.0",
@@ -55,7 +56,6 @@
         "@angular-devkit/core": "^15.1.2",
         "@angular/compiler-cli": "15.1.1",
         "@types/geojson": "^7946.0.7",
-        "@types/leaflet": "^1.4.3",
         "@types/leaflet-draw": "^0.4.13",
         "@types/leaflet.markercluster": "^1.4.0",
         "@types/node": "^18.0.0",
@@ -4177,10 +4177,9 @@
       "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ=="
     },
     "node_modules/@types/leaflet": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@types/leaflet/-/leaflet-1.9.0.tgz",
-      "integrity": "sha512-7LeOSj7EloC5UcyOMo+1kc3S1UT3MjJxwqsMT1d2PTyvQz53w0Y0oSSk9nwZnOZubCmBvpSNGceucxiq+ZPEUw==",
-      "dev": true,
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/@types/leaflet/-/leaflet-1.9.3.tgz",
+      "integrity": "sha512-Caa1lYOgKVqDkDZVWkto2Z5JtVo09spEaUt2S69LiugbBpoqQu92HYFMGUbYezZbnBkyOxMNPXHSgRrRY5UyIA==",
       "dependencies": {
         "@types/geojson": "*"
       }
@@ -15503,10 +15502,9 @@
       "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ=="
     },
     "@types/leaflet": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@types/leaflet/-/leaflet-1.9.0.tgz",
-      "integrity": "sha512-7LeOSj7EloC5UcyOMo+1kc3S1UT3MjJxwqsMT1d2PTyvQz53w0Y0oSSk9nwZnOZubCmBvpSNGceucxiq+ZPEUw==",
-      "dev": true,
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/@types/leaflet/-/leaflet-1.9.3.tgz",
+      "integrity": "sha512-Caa1lYOgKVqDkDZVWkto2Z5JtVo09spEaUt2S69LiugbBpoqQu92HYFMGUbYezZbnBkyOxMNPXHSgRrRY5UyIA==",
       "requires": {
         "@types/geojson": "*"
       }
diff --git a/frontend/package.json b/frontend/package.json
index 26123e10e5..a27a66e76c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -34,6 +34,7 @@
     "@popperjs/core": "^2.11.6",
     "@swimlane/ngx-datatable": "^20.0.0",
     "@tmcw/togeojson": "^5.6.0",
+    "@types/leaflet": "^1.9.3",
     "bootstrap": "4.3.1",
     "chart.js": "^4.2.1",
     "chartjs-plugin-datalabels": "^2.2.0",
@@ -59,7 +60,6 @@
     "@angular-devkit/core": "^15.1.2",
     "@angular/compiler-cli": "15.1.1",
     "@types/geojson": "^7946.0.7",
-    "@types/leaflet": "^1.4.3",
     "@types/leaflet-draw": "^0.4.13",
     "@types/leaflet.markercluster": "^1.4.0",
     "@types/node": "^18.0.0",

From a7ab404f3e0ab340b6e6df23c21801cba811446d Mon Sep 17 00:00:00 2001
From: "joel.clement" <joelclems@gmail.com>
Date: Wed, 28 Jun 2023 10:51:46 +0200
Subject: [PATCH 153/209] fix validator_mail schema

---
 backend/geonature/utils/config_schema.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/backend/geonature/utils/config_schema.py b/backend/geonature/utils/config_schema.py
index 018d6ca5bd..395bc4e347 100644
--- a/backend/geonature/utils/config_schema.py
+++ b/backend/geonature/utils/config_schema.py
@@ -27,14 +27,15 @@
 class EmailStrOrListOfEmailStrField(fields.Field):
     def _deserialize(self, value, attr, data, **kwargs):
         if isinstance(value, str):
-            self._check_email(value)
-            return [value]
-        elif isinstance(value, list) and all(isinstance(x, str) for x in value):
-            self._check_email(value)
-            return value
-        else:
+            value = list(map(lambda x: x.replace("\n", "").strip(), value.split(",")))
+
+        if not isinstance(value, list) and all(isinstance(x, str) for x in value):
             raise ValidationError("Field should be str or list of str")
 
+        self._check_email(value)
+
+        return value
+
     def _check_email(self, value):
         recipients = clean_recipients(value)
         for recipient in recipients:

From 3216e26cebbbff70ab75e2d0aa6302f1a72c48a6 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 10:41:28 +0200
Subject: [PATCH 154/209] Add Debian 12 support in installation doc

---
 docs/installation.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/installation.rst b/docs/installation.rst
index 1c86012484..dbc6404a91 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -23,7 +23,7 @@ Prérequis
 
 - Ressources minimum serveur :
 
-  - Un serveur Debian 10 ou Debian 11 architecture 64-bits
+  - Un serveur Debian 10, 11 ou 12, architecture 64-bits
   - 4 Go RAM
   - 20 Go d’espace disque
 

From d71ef1509b4b66641869771b2f9e691577edc489 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 10:39:09 +0200
Subject: [PATCH 155/209] fix frontend lint

---
 .github/workflows/lint.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3441e63874..051174e220 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,8 +18,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+      - uses: actions/setup-node@v3
       - name: Frontend code formatting check (Prettier)
-        uses: creyD/prettier_action@v4.3
-        with:
-          dry: True
-          prettier_options: --config frontend/.prettierrc --ignore-path frontend/.prettierignore --check frontend/**/*.ts contrib/*/frontend/**/*.ts
+        run: npm install prettier && npm run format:check
+        working-directory: ./frontend
\ No newline at end of file

From 685afaf027fcf337a29cbfa465033d7d886ec8ff Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Fri, 9 Jun 2023 17:35:44 +0200
Subject: [PATCH 156/209] perf(backend): optimized taxons_autocomplete

By doing the same modifications as in taxhub v1.11.2
---
 backend/geonature/core/gn_synthese/routes.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/routes.py b/backend/geonature/core/gn_synthese/routes.py
index 44fd370701..a49a3ee210 100644
--- a/backend/geonature/core/gn_synthese/routes.py
+++ b/backend/geonature/core/gn_synthese/routes.py
@@ -788,7 +788,7 @@ def get_autocomplete_taxons_synthese():
     q = (
         DB.session.query(
             VMTaxrefListForautocomplete,
-            func.similarity(VMTaxrefListForautocomplete.search_name, search_name).label(
+            func.similarity(VMTaxrefListForautocomplete.unaccent_search_name, search_name).label(
                 "idx_trgm"
             ),
         )
@@ -796,7 +796,7 @@ def get_autocomplete_taxons_synthese():
         .join(Synthese, Synthese.cd_nom == VMTaxrefListForautocomplete.cd_nom)
     )
     search_name = search_name.replace(" ", "%")
-    q = q.filter(VMTaxrefListForautocomplete.search_name.ilike("%" + search_name + "%"))
+    q = q.filter(VMTaxrefListForautocomplete.unaccent_search_name.ilike("%" + search_name + "%"))
     regne = request.args.get("regne")
     if regne:
         q = q.filter(VMTaxrefListForautocomplete.regne == regne)

From 2b2cdbe45f0c81a9f18413cb4976dfd3b77bd187 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 15:14:16 +0200
Subject: [PATCH 157/209] fix module doc

---
 backend/geonature/core/gn_commons/routes.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/backend/geonature/core/gn_commons/routes.py b/backend/geonature/core/gn_commons/routes.py
index d76e20cae1..16bf7b2fdc 100644
--- a/backend/geonature/core/gn_commons/routes.py
+++ b/backend/geonature/core/gn_commons/routes.py
@@ -68,6 +68,9 @@ def list_modules():
         if module.module_code in current_app.config["DISABLED_MODULES"]:
             continue
         module_allowed = False
+        # HACK : on a besoin d'avoir le module GeoNature en front pour l'URL de la doc
+        if module.module_code == "GEONATURE":
+            module_allowed = True
         module_dict = module.as_dict(fields=["objects"])
         # TODO : use has_any_permissions instead - must refactor the front
         module_dict["cruved"] = {

From 8fbc397cd9a24ffa7436f40333835c29bba4ebbd Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Tue, 11 Jul 2023 11:45:05 +0200
Subject: [PATCH 158/209] feat(notification): modify migration to set comment
 notification by default

---
 .../95acee9f0452_add_comment_notification.py  | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
index d7b76ea03d..ae78ace0d1 100644
--- a/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
+++ b/backend/geonature/migrations/versions/95acee9f0452_add_comment_notification.py
@@ -18,7 +18,7 @@
 revision = "95acee9f0452"
 down_revision = "e2a94808cf76"
 branch_labels = None
-depends_on = None
+depends_on = ("09a637f06b96",)  # Geonature Notifications
 
 CATEGORY_CODE = "OBSERVATION-COMMENT"
 EMAIL_CONTENT = (
@@ -55,6 +55,16 @@ def upgrade():
 
     session.commit()
 
+    op.execute(
+        f"""
+        INSERT INTO 
+            gn_notifications.t_notifications_rules (code_category, code_method)
+        VALUES
+            ('{CATEGORY_CODE}', 'DB'),
+            ('{CATEGORY_CODE}', 'EMAIL')
+        """
+    )
+
 
 def downgrade():
     bind = op.get_bind()
@@ -77,3 +87,14 @@ def downgrade():
 
         session.delete(category)
         session.commit()
+
+    op.execute(
+        f"""
+        DELETE FROM
+            gn_notifications.t_notifications_rules
+        WHERE
+            code_category = '{CATEGORY_CODE}'
+        AND
+            id_role IS NULL
+        """
+    )

From d2886cdbef5dffb53779ea79242159663dd60612 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 15:32:55 +0200
Subject: [PATCH 159/209] fix test

---
 backend/geonature/tests/test_gn_commons.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/tests/test_gn_commons.py b/backend/geonature/tests/test_gn_commons.py
index b6feec9bd2..3eda70a129 100644
--- a/backend/geonature/tests/test_gn_commons.py
+++ b/backend/geonature/tests/test_gn_commons.py
@@ -318,16 +318,16 @@ def test_header_content_type_wrong(self, medium, test_media_type, test_content_t
 @pytest.mark.usefixtures("client_class", "temporary_transaction")
 class TestCommons:
     def test_list_modules(self, users):
-        response = self.client.get(url_for("gn_commons.list_modules"))
+        response = self.client.get(url_for("gn_commons.list_modules", exclude="GEONATURE"))
         assert response.status_code == Unauthorized.code
 
         set_logged_user_cookie(self.client, users["noright_user"])
-        response = self.client.get(url_for("gn_commons.list_modules"))
+        response = self.client.get(url_for("gn_commons.list_modules", exclude="GEONATURE"))
         assert response.status_code == 200
         assert len(response.json) == 0
 
         set_logged_user_cookie(self.client, users["admin_user"])
-        response = self.client.get(url_for("gn_commons.list_modules"))
+        response = self.client.get(url_for("gn_commons.list_modules", exclude="GEONATURE"))
         assert response.status_code == 200
         assert len(response.json) > 0
 

From c1a1d628c36d93d4eacb381d5a39644a516b53a7 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 15:35:31 +0200
Subject: [PATCH 160/209] DOC admin - Mention obsolete schema

---
 docs/admin-manual.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index b84ecd0d57..0bc9ea6129 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -906,6 +906,8 @@ Pour configurer GeoNature, actuellement il y a :
 - Une configuration optionnelle par module : placée dans le dossier de configuration de GeoNature (``<GEONATURE_DIRECTORY>/config/``)
 - Une table ``gn_commons.t_parameters`` pour des paramètres gérés dans la BDD
 
+TODO : Partie "Configuration applicative" du schéma à mettre à jour, car caduque.
+
 .. image :: https://geonature.fr/docs/img/admin-manual/administration-geonature.png
 
 Configuration générale de l'application

From 539cbbb6c2f66af688645bb65f56ab264bbefa24 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 14:53:28 +0200
Subject: [PATCH 161/209] fix route getOneCounting

---
 backend/geonature/tests/test_pr_occtax.py  | 11 +++++++++++
 contrib/occtax/backend/occtax/blueprint.py |  2 +-
 contrib/occtax/backend/occtax/models.py    |  3 +--
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/backend/geonature/tests/test_pr_occtax.py b/backend/geonature/tests/test_pr_occtax.py
index c4f27a7344..39f718480e 100644
--- a/backend/geonature/tests/test_pr_occtax.py
+++ b/backend/geonature/tests/test_pr_occtax.py
@@ -240,6 +240,17 @@ def test_get_defaut_nomenclatures(self, users):
         response = self.client.get(url_for("pr_occtax.getDefaultNomenclatures"))
         assert response.status_code == 200
 
+    def test_get_one_counting(self, occurrence, users):
+        print(occurrence.cor_counting_occtax)
+        set_logged_user_cookie(self.client, users["admin_user"])
+        response = self.client.get(
+            url_for(
+                "pr_occtax.getOneCounting",
+                id_counting=occurrence.cor_counting_occtax[0].id_counting_occtax,
+            )
+        )
+        assert response.status_code == 200
+
 
 @pytest.mark.usefixtures("client_class", "temporary_transaction")
 class TestOcctaxGetReleveFilter:
diff --git a/contrib/occtax/backend/occtax/blueprint.py b/contrib/occtax/backend/occtax/blueprint.py
index 2950e99d08..dbe36d9166 100644
--- a/contrib/occtax/backend/occtax/blueprint.py
+++ b/contrib/occtax/backend/occtax/blueprint.py
@@ -141,7 +141,7 @@ def getOneCounting(scope, id_counting):
     :rtype: dict<CorCountingOccurrence>
     """
     ccc = CorCountingOccurrence.query.get_or_404(id_counting)
-    if not ccc.occurrence.releve.has_instance_permissions(scope):
+    if not ccc.occurrence.releve.has_instance_permission(scope):
         raise Forbidden
 
     try:
diff --git a/contrib/occtax/backend/occtax/models.py b/contrib/occtax/backend/occtax/models.py
index 8a35e08157..149c30eb4c 100644
--- a/contrib/occtax/backend/occtax/models.py
+++ b/contrib/occtax/backend/occtax/models.py
@@ -68,7 +68,7 @@ class CorCountingOccurrence(DB.Model):
 
     # additional fields dans occtax MET 14/10/2020
     additional_fields = DB.Column(JSONB)
-
+    occurrence = db.relationship("TOccurrencesOccurrence")
     readonly_fields = [
         "id_counting_occtax",
         "unique_id_sinp_occtax",
@@ -127,7 +127,6 @@ class TOccurrencesOccurrence(DB.Model):
         lazy="joined",
         cascade="all,delete-orphan",
         uselist=True,
-        backref=DB.backref("occurence", lazy="joined"),
     )
 
     taxref = relationship(Taxref, lazy="joined")

From f6f00e98218848b9e1e2709c3f4b33420c594311 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 15:27:35 +0200
Subject: [PATCH 162/209] bump

---
 backend/dependencies/TaxHub          |  2 +-
 backend/requirements-dependencies.in |  2 +-
 backend/requirements-dev.txt         | 33 ++++++++++++++--------------
 backend/requirements.txt             | 21 +++++++++---------
 install/install_all/install_all.ini  |  2 +-
 5 files changed, 29 insertions(+), 31 deletions(-)

diff --git a/backend/dependencies/TaxHub b/backend/dependencies/TaxHub
index 5c5354ffed..7929f8e491 160000
--- a/backend/dependencies/TaxHub
+++ b/backend/dependencies/TaxHub
@@ -1 +1 @@
-Subproject commit 5c5354ffedc8b4242ae7d69d01bc3ba3ba19033a
+Subproject commit 7929f8e491945af83be4115f48a9dd91432e66bf
diff --git a/backend/requirements-dependencies.in b/backend/requirements-dependencies.in
index 5241ef0117..a541b222d0 100644
--- a/backend/requirements-dependencies.in
+++ b/backend/requirements-dependencies.in
@@ -3,5 +3,5 @@ pypnnomenclature>=1.5.4,<2
 pypn_habref_api>=0.3.2,<1
 utils-flask-sqlalchemy-geo>=0.2.8,<1
 utils-flask-sqlalchemy>=0.3.4,<1
-taxhub>=1.11.2,<2
+taxhub>=1.12.0,<2
 pypn-ref-geo>=1.3.0,<2
diff --git a/backend/requirements-dev.txt b/backend/requirements-dev.txt
index d25c281ceb..7a06f60e53 100644
--- a/backend/requirements-dev.txt
+++ b/backend/requirements-dev.txt
@@ -48,7 +48,7 @@ async-timeout==4.0.2
     # via redis
 attrs==23.1.0
     # via fiona
-authlib==1.2.0
+authlib==1.2.1
     # via pypnusershub
 bcrypt==4.0.1
     # via pypnusershub
@@ -56,9 +56,9 @@ billiard==3.6.4.0
     # via celery
 blinker==1.6.2
     # via flask-mail
-boto3==1.26.153
+boto3==1.28.2
     # via taxhub
-botocore==1.29.153
+botocore==1.31.2
     # via
     #   boto3
     #   s3transfer
@@ -81,9 +81,9 @@ cffi==1.15.1
     #   cairocffi
     #   cryptography
     #   weasyprint
-charset-normalizer==3.1.0
+charset-normalizer==3.2.0
     # via requests
-click==8.1.3
+click==8.1.4
     # via
     #   -r requirements-common.in
     #   celery
@@ -100,11 +100,11 @@ click-plugins==1.1.1
     # via
     #   celery
     #   fiona
-click-repl==0.2.0
+click-repl==0.3.0
     # via celery
 cligj==0.7.2
     # via fiona
-cryptography==41.0.1
+cryptography==41.0.2
     # via authlib
 cssselect2==0.7.0
     # via
@@ -141,8 +141,10 @@ flask==2.2.5
     #   usershub
     #   utils-flask-sqlalchemy
 flask-admin==1.6.1
-    # via pypnnomenclature
-flask-cors==3.0.10
+    # via
+    #   -r requirements-common.in
+    #   pypnnomenclature
+flask-cors==4.0.0
     # via
     #   -r requirements-common.in
     #   taxhub
@@ -226,7 +228,7 @@ jmespath==1.0.1
     #   botocore
 kombu==5.2.4
     # via celery
-lxml==4.9.2
+lxml==4.9.3
     # via -r requirements-common.in
 mako==1.2.4
     # via alembic
@@ -256,7 +258,7 @@ marshmallow-sqlalchemy==0.28.2
     #   taxhub
     #   usershub
     #   utils-flask-sqlalchemy-geo
-munch==3.0.0
+munch==4.0.0
     # via fiona
 packaging==23.1
     # via
@@ -270,7 +272,7 @@ pillow==9.5.0
     #   cairosvg
     #   taxhub
     #   weasyprint
-prompt-toolkit==3.0.38
+prompt-toolkit==3.0.39
     # via click-repl
 psycopg2==2.9.6
     # via
@@ -300,7 +302,7 @@ python-dotenv==0.21.1
     #   usershub
 pytz==2023.3
     # via celery
-redis==4.5.5
+redis==4.6.0
     # via celery
 requests==2.31.0
     # via
@@ -315,12 +317,9 @@ shapely==1.8.5.post1
     #   utils-flask-sqlalchemy-geo
 six==1.16.0
     # via
-    #   click-repl
     #   fiona
-    #   flask-cors
     #   flask-marshmallow
     #   html5lib
-    #   munch
     #   python-dateutil
     #   wtforms-components
 sqlalchemy==1.3.24
@@ -345,7 +344,7 @@ tinycss2==1.2.1
     #   weasyprint
 toml==0.10.2
     # via -r requirements-common.in
-typing-extensions==4.6.3
+typing-extensions==4.7.1
     # via
     #   alembic
     #   async-timeout
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 77724517be..a3643d3942 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -23,9 +23,9 @@ billiard==3.6.4.0
     # via celery
 blinker==1.6.2
     # via flask-mail
-boto3==1.26.160
+boto3==1.28.2
     # via taxhub
-botocore==1.29.160
+botocore==1.31.2
     # via
     #   boto3
     #   s3transfer
@@ -48,9 +48,9 @@ cffi==1.15.1
     #   cairocffi
     #   cryptography
     #   weasyprint
-charset-normalizer==3.1.0
+charset-normalizer==3.2.0
     # via requests
-click==8.1.3
+click==8.1.4
     # via
     #   -r requirements-common.in
     #   celery
@@ -71,7 +71,7 @@ click-repl==0.3.0
     # via celery
 cligj==0.7.2
     # via fiona
-cryptography==41.0.1
+cryptography==41.0.2
     # via authlib
 cssselect2==0.7.0
     # via
@@ -177,7 +177,7 @@ jmespath==1.0.1
     #   botocore
 kombu==5.2.4
     # via celery
-lxml==4.9.2
+lxml==4.9.3
     # via -r requirements-common.in
 mako==1.2.4
     # via alembic
@@ -205,7 +205,7 @@ marshmallow-sqlalchemy==0.28.2
     #   pypnusershub
     #   taxhub
     #   utils-flask-sqlalchemy-geo
-munch==3.0.0
+munch==4.0.0
     # via fiona
 packaging==23.1
     # via
@@ -219,7 +219,7 @@ pillow==9.5.0
     #   cairosvg
     #   taxhub
     #   weasyprint
-prompt-toolkit==3.0.38
+prompt-toolkit==3.0.39
     # via click-repl
 psycopg2==2.9.6
     # via
@@ -277,7 +277,6 @@ six==1.16.0
     #   fiona
     #   flask-marshmallow
     #   html5lib
-    #   munch
     #   python-dateutil
 sqlalchemy==1.3.24
     # via
@@ -294,7 +293,7 @@ sqlalchemy==1.3.24
     #   utils-flask-sqlalchemy
     #   utils-flask-sqlalchemy-geo
     #   wtforms-sqlalchemy
-taxhub==1.11.2
+taxhub==1.12.0
     # via
     #   -r requirements-dependencies.in
     #   pypnnomenclature
@@ -305,7 +304,7 @@ tinycss2==1.2.1
     #   weasyprint
 toml==0.10.2
     # via -r requirements-common.in
-typing-extensions==4.6.3
+typing-extensions==4.7.1
     # via
     #   alembic
     #   async-timeout
diff --git a/install/install_all/install_all.ini b/install/install_all/install_all.ini
index 72cb18aef5..ad8c1a2568 100644
--- a/install/install_all/install_all.ini
+++ b/install/install_all/install_all.ini
@@ -70,7 +70,7 @@ proxy_https=
 ### CONFIGURATION TAXHUB ###
 
 # Version de TaxHub
-taxhub_release=1.11.3
+taxhub_release=1.12.0
 # Pour des questions de performances de GeoNature, il n'y a pas de base de données spécifique pour TaxHub
 # Le schéma "taxonomie" de TaxHub est intégré dans la BDD de GeoNature pour que les requêtes ne soient pas trop pénalisées
 # par un accès à une BDD distante.

From 80c65269890f10f64a6cdf1566e894c213e716f0 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 17:45:48 +0200
Subject: [PATCH 163/209] Marker : zoom on layer on edition

---
 .../app/occtax-form/map/occtax-map.service.ts | 20 ++++++++++---------
 .../map/marker/marker.component.ts            | 10 +++++++---
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
index 13c2957c7a..1944db10ab 100644
--- a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
+++ b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
@@ -1,10 +1,10 @@
-import { Injectable } from '@angular/core';
-import { UntypedFormControl, Validators } from '@angular/forms';
-import { isEqual } from 'lodash';
-import { BehaviorSubject, Observable, of } from 'rxjs';
-import { filter, map, switchMap } from 'rxjs/operators';
-import { OcctaxFormService } from '../occtax-form.service';
-import { OcctaxFormParamService } from '../form-param/form-param.service';
+import { Injectable } from "@angular/core";
+import { UntypedFormControl, Validators } from "@angular/forms";
+import { isEqual } from "lodash";
+import { BehaviorSubject, Observable, of } from "rxjs";
+import { filter, map, switchMap } from "rxjs/operators";
+import { OcctaxFormService } from "../occtax-form.service";
+import { OcctaxFormParamService } from "../form-param/form-param.service";
 
 @Injectable()
 export class OcctaxFormMapService {
@@ -35,7 +35,7 @@ export class OcctaxFormMapService {
 
   setGeometryFromAPI(geojson) {
     this.manageGeometryChange(geojson);
-    if (geojson.type == 'Point') {
+    if (geojson.type == "Point") {
       this.markerCoordinates = geojson.coordinates;
     } else {
       this.leafletDrawGeoJson = geojson;
@@ -59,7 +59,9 @@ export class OcctaxFormMapService {
       .pipe(
         switchMap((editionMode: boolean) => {
           //Le switch permet, selon si édition ou creation, de récuperer les valeur par defaut ou celle de l'API
-          return editionMode ? this.releveGeojsonValue : of(this.occtaxParamS.get('geometry'));
+          return editionMode
+            ? this.releveGeojsonValue
+            : of(this.occtaxParamS.get("geometry"));
         }),
         filter((geojson) => geojson != null)
       )
diff --git a/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts b/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
index 05ef264755..a61780d5f4 100644
--- a/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
+++ b/frontend/src/app/GN2CommonModule/map/marker/marker.component.ts
@@ -76,7 +76,7 @@ export class MarkerComponent implements OnInit, OnChanges {
       .pipe(filter((coords) => this.map !== undefined && coords != null))
       .subscribe((coords) => {
         this.previousCoord = coords;
-        this.generateMarkerAndEvent(coords[0], coords[1], false);
+        this.generateMarkerAndEvent(coords[0], coords[1], false, true);
       });
   }
 
@@ -102,11 +102,11 @@ export class MarkerComponent implements OnInit, OnChanges {
       if (this.map.getZoom() < this.zoomLevel) {
         this._commonService.translateToaster('warning', 'Map.ZoomWarning');
       } else {
-        this.generateMarkerAndEvent(e.latlng.lng, e.latlng.lat);
+        this.generateMarkerAndEvent(e.latlng.lng, e.latlng.lat, true);
       }
     });
   }
-  generateMarkerAndEvent(x, y, withEvents = true) {
+  generateMarkerAndEvent(x, y, withEvents = true, zoomOnLayer = false) {
     if (this.mapservice.marker !== undefined) {
       this.mapservice.marker.remove();
       this.mapservice.marker = this.mapservice.createMarker(x, y, true).addTo(this.map);
@@ -124,6 +124,10 @@ export class MarkerComponent implements OnInit, OnChanges {
       this.mapservice.setGeojsonCoord(geojsonMarker);
       this.markerChanged.emit(geojsonMarker);
     }
+
+    if (zoomOnLayer) {
+      this.mapservice.zoomOnMarker([x, y]);
+    }
   }
 
   markerMoveEvent(marker: Marker) {

From 00e05a030633dab87cddf1ee58b44bdaa471a562 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 11 Jul 2023 17:56:39 +0200
Subject: [PATCH 164/209] lint

---
 .../app/occtax-form/map/occtax-map.service.ts | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
index 1944db10ab..13c2957c7a 100644
--- a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
+++ b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
@@ -1,10 +1,10 @@
-import { Injectable } from "@angular/core";
-import { UntypedFormControl, Validators } from "@angular/forms";
-import { isEqual } from "lodash";
-import { BehaviorSubject, Observable, of } from "rxjs";
-import { filter, map, switchMap } from "rxjs/operators";
-import { OcctaxFormService } from "../occtax-form.service";
-import { OcctaxFormParamService } from "../form-param/form-param.service";
+import { Injectable } from '@angular/core';
+import { UntypedFormControl, Validators } from '@angular/forms';
+import { isEqual } from 'lodash';
+import { BehaviorSubject, Observable, of } from 'rxjs';
+import { filter, map, switchMap } from 'rxjs/operators';
+import { OcctaxFormService } from '../occtax-form.service';
+import { OcctaxFormParamService } from '../form-param/form-param.service';
 
 @Injectable()
 export class OcctaxFormMapService {
@@ -35,7 +35,7 @@ export class OcctaxFormMapService {
 
   setGeometryFromAPI(geojson) {
     this.manageGeometryChange(geojson);
-    if (geojson.type == "Point") {
+    if (geojson.type == 'Point') {
       this.markerCoordinates = geojson.coordinates;
     } else {
       this.leafletDrawGeoJson = geojson;
@@ -59,9 +59,7 @@ export class OcctaxFormMapService {
       .pipe(
         switchMap((editionMode: boolean) => {
           //Le switch permet, selon si édition ou creation, de récuperer les valeur par defaut ou celle de l'API
-          return editionMode
-            ? this.releveGeojsonValue
-            : of(this.occtaxParamS.get("geometry"));
+          return editionMode ? this.releveGeojsonValue : of(this.occtaxParamS.get('geometry'));
         }),
         filter((geojson) => geojson != null)
       )

From 450b36c504cce647c3dbae88fedef0838c2c5cbc Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Tue, 11 Jul 2023 16:53:54 +0200
Subject: [PATCH 165/209] fix(admin): sorted the users in the permission form

---
 backend/geonature/core/gn_permissions/admin.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 4dc74b90b3..c209153468 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -305,6 +305,7 @@ def get_query(self):
             super()
             .get_query()
             .options(joinedload(User.permissions).joinedload(Permission.availability))
+            .order_by(User.groupe.desc(), User.nom_role)
         )
 
 

From 652a7fd7bef366aef0c3c0587b55bd55d2e52a3d Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 18 Jul 2023 12:00:35 +0200
Subject: [PATCH 166/209] doc

---
 docs/admin-manual.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index 0bc9ea6129..c7d0c8905a 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -1174,6 +1174,11 @@ Customisation
 
 Tous les fichiers par défaut présents dans le dossier ``geonature/backend/static/`` peuvent être surcouchés, en placant un fichier du même nom dans ``geonature/custom/``.
 
+Customisation CSS
+"""""""""""""""""
+
+Pour customiser l'apparence de l'application, créer ou éditer le fichier `geonature/custom/css/frontend.css`
+
 Intégrer son logo
 """""""""""""""""
 

From 279fe6c18dc248f6c987612416037440f965f976 Mon Sep 17 00:00:00 2001
From: Cendrine HOARAU <c.hoarau@cbn-alpin.fr>
Date: Wed, 12 Jul 2023 09:35:43 +0200
Subject: [PATCH 167/209] fix synthese: resolve multipoint error

---
 .../synthese-carte.component.ts               | 57 +++++++------------
 1 file changed, 20 insertions(+), 37 deletions(-)

diff --git a/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts b/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
index 20662a1298..35d23f25ca 100644
--- a/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
+++ b/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
@@ -264,16 +264,6 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     }
   }
 
-  markerStyle(layer, countObs) {
-    layer.setIcon(this.defaultIcon);
-    layer.bindTooltip(`${countObs}`, {
-      permanent: true,
-      direction: 'center',
-      offset: L.point({ x: 0, y: -25 }),
-      className: 'number-obs',
-    });
-  }
-
   layerEvent(feature, layer, idSyntheseIds) {
     layer.on({
       click: (e) => {
@@ -287,17 +277,12 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
   }
 
   onEachFeature(feature, layer) {
-    let countObs = feature.properties.observations.id.length;
     // make a cache a layers in a dict with id key
     this.layerDictCache(feature.properties.observations.id, layer);
     // set style
     if (this.areasEnable) {
       this.setAreasStyle(layer, feature.properties.observations.id.length);
     }
-    if (feature.geometry.type == 'Point' || feature.geometry.type == 'MultiPoint') {
-      this.markerStyle(layer, countObs);
-    }
-    // set events
     this.layerEvent(feature, layer, feature.properties.observations.id);
   }
 
@@ -307,8 +292,8 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
   clusterCountOverrideFn(cluster) {
     const obsChildCount = cluster
       .getAllChildMarkers()
-      .map((marker) => {
-        return marker.feature.properties.observations.id.length;
+      .map((layer) => {
+        return layer.nb_obs;
       })
       .reduce((previous, next) => previous + next);
     const clusterSize = obsChildCount > 100 ? 'large' : obsChildCount > 10 ? 'medium' : 'small';
@@ -336,6 +321,19 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
           })
         : new L.FeatureGroup();
       const geojsonLayer = new L.GeoJSON(change.inputSyntheseData.currentValue, {
+        pointToLayer: (feature, latlng) => {
+          const circleMarker = L.circleMarker(latlng);
+          let countObs = feature.properties.observations.id.length;
+          (circleMarker as any).nb_obs = countObs;
+          circleMarker.bindTooltip(`${countObs}`, {
+            permanent: true,
+            direction: 'center',
+            offset: L.point({ x: 0, y: 0 }),
+            className: 'number-obs',
+          });
+
+          return circleMarker;
+        },
         onEachFeature: this.onEachFeature.bind(this),
       });
       this.cluserOrSimpleFeatureGroup.addLayer(geojsonLayer);
@@ -378,22 +376,15 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     // restore initial style
     let originStyle = this.areasEnable ? this.originAreasStyle : this.originDefaultStyle;
     let selectedStyle = this.areasEnable ? this.selectedAreasStyle : this.selectedDefaultStyle;
+
     if (this.selectedLayers.length > 0) {
       this.selectedLayers.forEach((layer) => {
-        if ('setStyle' in layer) {
-          (layer as L.GeoJSON).setStyle(originStyle);
-        } else {
-          (layer as L.Marker).setIcon(this.defaultIcon);
-        }
+        (layer as L.GeoJSON).setStyle(originStyle);
       });
     }
     // set selected style
-    if (this.areasEnable || !(feature.geometry.type == 'Point')) {
-      layer.setStyle(selectedStyle);
-    } else {
-      layer.setIcon(this.selectedIcon);
-    }
 
+    layer.setStyle(selectedStyle);
     this.selectedLayers = [layer];
   }
 
@@ -402,11 +393,7 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     let originStyle = this.areasEnable ? this.originAreasStyle : this.originDefaultStyle;
     if (this.selectedLayers.length > 0) {
       this.selectedLayers.forEach((layer) => {
-        if ('setStyle' in layer) {
-          (layer as L.GeoJSON).setStyle(originStyle);
-        } else {
-          (layer as L.Marker).setIcon(this.defaultIcon);
-        }
+        (layer as L.GeoJSON).setStyle(originStyle);
       });
     }
     // Apply new selected layer
@@ -414,11 +401,7 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
 
     let selectedStyle = this.areasEnable ? this.selectedAreasStyle : this.selectedDefaultStyle;
     this.selectedLayers.forEach((layer) => {
-      if ('setStyle' in layer) {
-        (layer as any).setStyle(selectedStyle);
-      } else {
-        (layer as L.Marker).setIcon(this.selectedIcon);
-      }
+      (layer as L.GeoJSON).setStyle(selectedStyle);
     });
   }
 

From 8fb213c66e2d2fad56decf1048d054df91d124d8 Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Tue, 18 Jul 2023 11:57:29 +0200
Subject: [PATCH 168/209] fix(synthese): fix default filters default
 nomenclature where not working

---
 frontend/src/app/syntheseModule/synthese.component.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/app/syntheseModule/synthese.component.ts b/frontend/src/app/syntheseModule/synthese.component.ts
index 1dd12b735c..a007e26db9 100644
--- a/frontend/src/app/syntheseModule/synthese.component.ts
+++ b/frontend/src/app/syntheseModule/synthese.component.ts
@@ -1,4 +1,4 @@
-import { Component, OnInit } from '@angular/core';
+import { Component, OnInit, ChangeDetectorRef } from '@angular/core';
 import { SyntheseDataService } from '@geonature_common/form/synthese-form/synthese-data.service';
 
 import { MapListService } from '@geonature_common/map-list/map-list.service';
@@ -35,6 +35,7 @@ export class SyntheseComponent implements OnInit {
     private _toasterService: ToastrService,
     private _route: ActivatedRoute,
     private _ngModal: NgbModal,
+    private _changeDetector: ChangeDetectorRef,
     public config: ConfigService
   ) {}
 
@@ -77,6 +78,7 @@ export class SyntheseComponent implements OnInit {
         .subscribe((processedDefaultFilters) => {
           this._fs.searchForm.patchValue(this._fs.processedDefaultFilters);
           this._fs.processedDefaultFilters = processedDefaultFilters;
+          this._changeDetector.detectChanges();
 
           this.loadAndStoreData(this._fs.formatParams());
         });

From 0566c8d6936548a4bf2fd4f8dce53a04a47a3aac Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 11:20:24 +0200
Subject: [PATCH 169/209] bump utils-flask-sqla

---
 backend/dependencies/Utils-Flask-SQLAlchemy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/dependencies/Utils-Flask-SQLAlchemy b/backend/dependencies/Utils-Flask-SQLAlchemy
index 71fbdbefc8..106a75cc60 160000
--- a/backend/dependencies/Utils-Flask-SQLAlchemy
+++ b/backend/dependencies/Utils-Flask-SQLAlchemy
@@ -1 +1 @@
-Subproject commit 71fbdbefc80d1efc0287a4887efa03a1a2131f15
+Subproject commit 106a75cc608838f55288f42fdfe443da97be40a5

From f27ad945dc6bc54ef1a679d23355c0ce6f41bfd3 Mon Sep 17 00:00:00 2001
From: Cendrine HOARAU <c.hoarau@cbn-alpin.fr>
Date: Wed, 12 Jul 2023 09:35:43 +0200
Subject: [PATCH 170/209] fix synthese: resolve multipoint error

---
 .../synthese-carte.component.ts               | 57 +++++++------------
 1 file changed, 20 insertions(+), 37 deletions(-)

diff --git a/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts b/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
index 20662a1298..35d23f25ca 100644
--- a/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
+++ b/frontend/src/app/syntheseModule/synthese-results/synthese-carte/synthese-carte.component.ts
@@ -264,16 +264,6 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     }
   }
 
-  markerStyle(layer, countObs) {
-    layer.setIcon(this.defaultIcon);
-    layer.bindTooltip(`${countObs}`, {
-      permanent: true,
-      direction: 'center',
-      offset: L.point({ x: 0, y: -25 }),
-      className: 'number-obs',
-    });
-  }
-
   layerEvent(feature, layer, idSyntheseIds) {
     layer.on({
       click: (e) => {
@@ -287,17 +277,12 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
   }
 
   onEachFeature(feature, layer) {
-    let countObs = feature.properties.observations.id.length;
     // make a cache a layers in a dict with id key
     this.layerDictCache(feature.properties.observations.id, layer);
     // set style
     if (this.areasEnable) {
       this.setAreasStyle(layer, feature.properties.observations.id.length);
     }
-    if (feature.geometry.type == 'Point' || feature.geometry.type == 'MultiPoint') {
-      this.markerStyle(layer, countObs);
-    }
-    // set events
     this.layerEvent(feature, layer, feature.properties.observations.id);
   }
 
@@ -307,8 +292,8 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
   clusterCountOverrideFn(cluster) {
     const obsChildCount = cluster
       .getAllChildMarkers()
-      .map((marker) => {
-        return marker.feature.properties.observations.id.length;
+      .map((layer) => {
+        return layer.nb_obs;
       })
       .reduce((previous, next) => previous + next);
     const clusterSize = obsChildCount > 100 ? 'large' : obsChildCount > 10 ? 'medium' : 'small';
@@ -336,6 +321,19 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
           })
         : new L.FeatureGroup();
       const geojsonLayer = new L.GeoJSON(change.inputSyntheseData.currentValue, {
+        pointToLayer: (feature, latlng) => {
+          const circleMarker = L.circleMarker(latlng);
+          let countObs = feature.properties.observations.id.length;
+          (circleMarker as any).nb_obs = countObs;
+          circleMarker.bindTooltip(`${countObs}`, {
+            permanent: true,
+            direction: 'center',
+            offset: L.point({ x: 0, y: 0 }),
+            className: 'number-obs',
+          });
+
+          return circleMarker;
+        },
         onEachFeature: this.onEachFeature.bind(this),
       });
       this.cluserOrSimpleFeatureGroup.addLayer(geojsonLayer);
@@ -378,22 +376,15 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     // restore initial style
     let originStyle = this.areasEnable ? this.originAreasStyle : this.originDefaultStyle;
     let selectedStyle = this.areasEnable ? this.selectedAreasStyle : this.selectedDefaultStyle;
+
     if (this.selectedLayers.length > 0) {
       this.selectedLayers.forEach((layer) => {
-        if ('setStyle' in layer) {
-          (layer as L.GeoJSON).setStyle(originStyle);
-        } else {
-          (layer as L.Marker).setIcon(this.defaultIcon);
-        }
+        (layer as L.GeoJSON).setStyle(originStyle);
       });
     }
     // set selected style
-    if (this.areasEnable || !(feature.geometry.type == 'Point')) {
-      layer.setStyle(selectedStyle);
-    } else {
-      layer.setIcon(this.selectedIcon);
-    }
 
+    layer.setStyle(selectedStyle);
     this.selectedLayers = [layer];
   }
 
@@ -402,11 +393,7 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
     let originStyle = this.areasEnable ? this.originAreasStyle : this.originDefaultStyle;
     if (this.selectedLayers.length > 0) {
       this.selectedLayers.forEach((layer) => {
-        if ('setStyle' in layer) {
-          (layer as L.GeoJSON).setStyle(originStyle);
-        } else {
-          (layer as L.Marker).setIcon(this.defaultIcon);
-        }
+        (layer as L.GeoJSON).setStyle(originStyle);
       });
     }
     // Apply new selected layer
@@ -414,11 +401,7 @@ export class SyntheseCarteComponent implements OnInit, AfterViewInit, OnChanges,
 
     let selectedStyle = this.areasEnable ? this.selectedAreasStyle : this.selectedDefaultStyle;
     this.selectedLayers.forEach((layer) => {
-      if ('setStyle' in layer) {
-        (layer as any).setStyle(selectedStyle);
-      } else {
-        (layer as L.Marker).setIcon(this.selectedIcon);
-      }
+      (layer as L.GeoJSON).setStyle(selectedStyle);
     });
   }
 

From 42dde5a6080355b408f77211237d651c915c45df Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Tue, 18 Jul 2023 11:57:29 +0200
Subject: [PATCH 171/209] fix(synthese): fix default filters default
 nomenclature where not working

---
 frontend/src/app/syntheseModule/synthese.component.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/app/syntheseModule/synthese.component.ts b/frontend/src/app/syntheseModule/synthese.component.ts
index 1dd12b735c..a007e26db9 100644
--- a/frontend/src/app/syntheseModule/synthese.component.ts
+++ b/frontend/src/app/syntheseModule/synthese.component.ts
@@ -1,4 +1,4 @@
-import { Component, OnInit } from '@angular/core';
+import { Component, OnInit, ChangeDetectorRef } from '@angular/core';
 import { SyntheseDataService } from '@geonature_common/form/synthese-form/synthese-data.service';
 
 import { MapListService } from '@geonature_common/map-list/map-list.service';
@@ -35,6 +35,7 @@ export class SyntheseComponent implements OnInit {
     private _toasterService: ToastrService,
     private _route: ActivatedRoute,
     private _ngModal: NgbModal,
+    private _changeDetector: ChangeDetectorRef,
     public config: ConfigService
   ) {}
 
@@ -77,6 +78,7 @@ export class SyntheseComponent implements OnInit {
         .subscribe((processedDefaultFilters) => {
           this._fs.searchForm.patchValue(this._fs.processedDefaultFilters);
           this._fs.processedDefaultFilters = processedDefaultFilters;
+          this._changeDetector.detectChanges();
 
           this.loadAndStoreData(this._fs.formatParams());
         });

From f6411c9a0a1ec98c0d9cfd92559b317f13c00fdb Mon Sep 17 00:00:00 2001
From: Julien Corny <julien_corny@natural-soltuions.eu>
Date: Wed, 2 Aug 2023 17:17:43 +0200
Subject: [PATCH 172/209] fix(backend): multiple geo filters request

---
 .../core/gn_synthese/utils/query_select_sqla.py          | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
index 71ccbe121d..963bac7a89 100644
--- a/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
+++ b/backend/geonature/core/gn_synthese/utils/query_select_sqla.py
@@ -452,8 +452,13 @@ def filter_other_filters(self, user):
         # generic filters
         for colname, value in self.filters.items():
             if colname.startswith("area"):
-                self.add_join(CorAreaSynthese, CorAreaSynthese.id_synthese, self.model.id_synthese)
-                self.query = self.query.where(CorAreaSynthese.id_area.in_(value))
+                cor_area_synthese_alias = aliased(CorAreaSynthese)
+                self.add_join(
+                    cor_area_synthese_alias,
+                    cor_area_synthese_alias.id_synthese,
+                    self.model.id_synthese,
+                )
+                self.query = self.query.where(cor_area_synthese_alias.id_area.in_(value))
             elif colname.startswith("id_"):
                 col = getattr(self.model.__table__.columns, colname)
                 if isinstance(value, list):

From 679e5638e5deaa830c3eb97654f406ce14ee81b4 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 14:35:24 +0200
Subject: [PATCH 173/209] Better UI for permission admin

---
 backend/geonature/core/gn_permissions/admin.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index c209153468..85844622a8 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -116,7 +116,7 @@ def role_formatter(view, context, model, name):
 def permissions_formatter(view, context, model, name):
     available_permissions = PermissionAvailable.query.nice_order().all()
 
-    o = '<table class="table">'
+    o = "<table class='table'>"
     columns = ["Module", "Object", "Action", "Label"]
     if model.groupe:
         return_url = url_for("permissions/group.details_view", id=model.id_role)
@@ -146,7 +146,14 @@ def permissions_formatter(view, context, model, name):
                 )
             )
             permissions.append((effective_permissions, False))
-        o += "<tr>"
+            o += (
+                "<tr>"
+                if own_permissions or effective_permissions
+                else "<tr class='text-muted alert alert-danger'>"
+            )
+        else:
+            o += "<tr>" if own_permissions else "<tr class='text-muted alert alert-danger'>"
+
         o += "".join(
             [
                 f"<td>{col}</td>"

From 356587c7526255a67bff10fd5d2d524e4d670f8f Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 15:15:41 +0200
Subject: [PATCH 174/209] remove search on permission user and group detail

---
 backend/geonature/core/gn_permissions/admin.py         |  1 +
 backend/geonature/core/gn_permissions/routes.py        |  4 +++-
 .../gn_permissions/templates/role_or_group_detail.html | 10 ++++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 backend/geonature/core/gn_permissions/templates/role_or_group_detail.html

diff --git a/backend/geonature/core/gn_permissions/admin.py b/backend/geonature/core/gn_permissions/admin.py
index 85844622a8..4510d80c07 100644
--- a/backend/geonature/core/gn_permissions/admin.py
+++ b/backend/geonature/core/gn_permissions/admin.py
@@ -478,6 +478,7 @@ class RolePermAdmin(CruvedProtectedMixin, ModelView):
     can_export = False
     can_view_details = True
 
+    details_template = "role_or_group_detail.html"
     column_select_related_list = ("permissions",)
     column_labels = {
         "nom_role": "Nom",
diff --git a/backend/geonature/core/gn_permissions/routes.py b/backend/geonature/core/gn_permissions/routes.py
index 6c1c4485ea..cedc92c582 100644
--- a/backend/geonature/core/gn_permissions/routes.py
+++ b/backend/geonature/core/gn_permissions/routes.py
@@ -15,7 +15,9 @@
 from geonature.core.gn_permissions.commands import supergrant
 
 
-routes = Blueprint("gn_permissions", __name__, cli_group="permissions")
+routes = Blueprint(
+    "gn_permissions", __name__, cli_group="permissions", template_folder="./templates"
+)
 
 routes.cli.add_command(supergrant)
 
diff --git a/backend/geonature/core/gn_permissions/templates/role_or_group_detail.html b/backend/geonature/core/gn_permissions/templates/role_or_group_detail.html
new file mode 100644
index 0000000000..f29e813984
--- /dev/null
+++ b/backend/geonature/core/gn_permissions/templates/role_or_group_detail.html
@@ -0,0 +1,10 @@
+{% extends 'admin/model/details.html' %}
+
+{% block details_search %}
+
+{% endblock %}
+
+
+{% block details_table %}
+    {{super()}}
+{% endblock %}

From 8221dcde8cd8a9e1e797fb14174e73aea72f5960 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 15:25:27 +0200
Subject: [PATCH 175/209] bump usershub auth module

---
 backend/dependencies/UsersHub-authentification-module | 2 +-
 backend/requirements-dependencies.in                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/dependencies/UsersHub-authentification-module b/backend/dependencies/UsersHub-authentification-module
index d9765a0f20..74bc9ddefc 160000
--- a/backend/dependencies/UsersHub-authentification-module
+++ b/backend/dependencies/UsersHub-authentification-module
@@ -1 +1 @@
-Subproject commit d9765a0f20b273894ad4e78ea91880e923a3cc4a
+Subproject commit 74bc9ddefcaeb3dd9674c6ace4c4ca5c801f347f
diff --git a/backend/requirements-dependencies.in b/backend/requirements-dependencies.in
index a541b222d0..93f0753352 100644
--- a/backend/requirements-dependencies.in
+++ b/backend/requirements-dependencies.in
@@ -1,4 +1,4 @@
-pypnusershub>=1.6.8,<2
+pypnusershub>=1.6.9,<2
 pypnnomenclature>=1.5.4,<2
 pypn_habref_api>=0.3.2,<1
 utils-flask-sqlalchemy-geo>=0.2.8,<1

From d4b667b05ef805978528c651e6a4b7ca0b901c92 Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 16:45:13 +0200
Subject: [PATCH 176/209] requirements.txt

---
 backend/requirements.txt | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index a3643d3942..2bad910c0f 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -4,7 +4,7 @@
 #
 #    pip-compile --resolver=backtracking requirements.in
 #
-alembic==1.11.1
+alembic==1.11.2
     # via
     #   flask-migrate
     #   pypn-ref-geo
@@ -23,23 +23,23 @@ billiard==3.6.4.0
     # via celery
 blinker==1.6.2
     # via flask-mail
-boto3==1.28.2
+boto3==1.28.21
     # via taxhub
-botocore==1.31.2
+botocore==1.31.21
     # via
     #   boto3
     #   s3transfer
 cached-property==1.5.2
     # via kombu
-cairocffi==1.6.0
+cairocffi==1.6.1
     # via
     #   cairosvg
     #   weasyprint
-cairosvg==2.7.0
+cairosvg==2.7.1
     # via weasyprint
 celery[redis]==5.2.7
     # via -r requirements-common.in
-certifi==2023.5.7
+certifi==2023.7.22
     # via
     #   fiona
     #   requests
@@ -50,7 +50,7 @@ cffi==1.15.1
     #   weasyprint
 charset-normalizer==3.2.0
     # via requests
-click==8.1.4
+click==8.1.6
     # via
     #   -r requirements-common.in
     #   celery
@@ -71,7 +71,7 @@ click-repl==0.3.0
     # via celery
 cligj==0.7.2
     # via fiona
-cryptography==41.0.2
+cryptography==41.0.3
     # via authlib
 cssselect2==0.7.0
     # via
@@ -143,7 +143,7 @@ geojson==3.0.1
     # via
     #   -r requirements-common.in
     #   utils-flask-sqlalchemy-geo
-gunicorn==20.1.0
+gunicorn==21.2.0
     # via
     #   -r requirements-common.in
     #   taxhub
@@ -159,6 +159,7 @@ importlib-metadata==4.13.0 ; python_version < "3.10"
     #   celery
     #   click
     #   flask
+    #   gunicorn
     #   kombu
     #   mako
     #   munch
@@ -211,6 +212,7 @@ packaging==23.1
     # via
     #   -r requirements-common.in
     #   geoalchemy2
+    #   gunicorn
     #   marshmallow
     #   marshmallow-sqlalchemy
 pillow==9.5.0
@@ -221,7 +223,7 @@ pillow==9.5.0
     #   weasyprint
 prompt-toolkit==3.0.39
     # via click-repl
-psycopg2==2.9.6
+psycopg2==2.9.7
     # via
     #   -r requirements-common.in
     #   pypn-habref-api
@@ -241,7 +243,7 @@ pypn-ref-geo==1.3.0
     #   taxhub
 pypnnomenclature==1.5.4
     # via -r requirements-dependencies.in
-pypnusershub==1.6.8
+pypnusershub==1.6.9
     # via
     #   -r requirements-dependencies.in
     #   pypnnomenclature
@@ -315,7 +317,7 @@ urllib3==1.26.16
     #   botocore
     #   requests
     #   taxhub
-utils-flask-sqlalchemy==0.3.4
+utils-flask-sqlalchemy==0.3.5
     # via
     #   -r requirements-dependencies.in
     #   pypn-habref-api

From 1845481eb58a1f33bf28e160ccdabc301aeab5fb Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 11:24:10 +0200
Subject: [PATCH 177/209] bump utilsqla

---
 backend/requirements-dependencies.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/requirements-dependencies.in b/backend/requirements-dependencies.in
index 93f0753352..01ebe009f7 100644
--- a/backend/requirements-dependencies.in
+++ b/backend/requirements-dependencies.in
@@ -2,6 +2,6 @@ pypnusershub>=1.6.9,<2
 pypnnomenclature>=1.5.4,<2
 pypn_habref_api>=0.3.2,<1
 utils-flask-sqlalchemy-geo>=0.2.8,<1
-utils-flask-sqlalchemy>=0.3.4,<1
+utils-flask-sqlalchemy>=0.3.5,<1
 taxhub>=1.12.0,<2
 pypn-ref-geo>=1.3.0,<2

From a4f11a67c690b7147c4d15602b413231807cd8db Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 23:36:47 +0200
Subject: [PATCH 178/209] Doc admin - Remove duplicated section

---
 docs/admin-manual.rst | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index c7d0c8905a..0bc9ea6129 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -1174,11 +1174,6 @@ Customisation
 
 Tous les fichiers par défaut présents dans le dossier ``geonature/backend/static/`` peuvent être surcouchés, en placant un fichier du même nom dans ``geonature/custom/``.
 
-Customisation CSS
-"""""""""""""""""
-
-Pour customiser l'apparence de l'application, créer ou éditer le fichier `geonature/custom/css/frontend.css`
-
 Intégrer son logo
 """""""""""""""""
 

From b3260803f9f9b4a589efe380edc0c46227778ae5 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 23:43:54 +0200
Subject: [PATCH 179/209] Doc installation - precisions commande supergrant

---
 docs/installation.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/installation.rst b/docs/installation.rst
index dbc6404a91..a71da52d27 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -161,7 +161,7 @@ Exemple pour le module Import :
     source ~/GeoNature/backend/venv/bin/activate
     geonature install-gn-module ~/gn_module_import/ IMPORT
 
-Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, lancez la commande suivante pour vous ajoutez des droits. Vous pourrez ensuite definir des droits à vos utilisateurs
+Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, vous pouvez une commande ajoutant tous les droits sur tous les modules à un groupe ou utilisateur. Vous pourrez ensuite définir des droits à vos utilisateurs module par module, action par action.
 
 .. code-block:: bash
     # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé

From a6597c60f53925fe4f67e562708cf3287ffec45c Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 23:48:40 +0200
Subject: [PATCH 180/209] Doc install - Fix layout

---
 docs/installation.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/installation.rst b/docs/installation.rst
index a71da52d27..35ed5a1a7f 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -164,6 +164,7 @@ Exemple pour le module Import :
 Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, vous pouvez une commande ajoutant tous les droits sur tous les modules à un groupe ou utilisateur. Vous pourrez ensuite définir des droits à vos utilisateurs module par module, action par action.
 
 .. code-block:: bash
+
     # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé
     geonature permissions supergrant --group --nom "Grp_admin"
 

From 81fa1b613e238dafbf31c732c6c925b09289ddb9 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 23:53:08 +0200
Subject: [PATCH 181/209] Doc install - Review

---
 docs/installation.rst | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/docs/installation.rst b/docs/installation.rst
index 35ed5a1a7f..ab58280b17 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -161,20 +161,21 @@ Exemple pour le module Import :
     source ~/GeoNature/backend/venv/bin/activate
     geonature install-gn-module ~/gn_module_import/ IMPORT
 
-Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, vous pouvez une commande ajoutant tous les droits sur tous les modules à un groupe ou utilisateur. Vous pourrez ensuite définir des droits à vos utilisateurs module par module, action par action.
+Puis relancer GeoNatureet son worker :
 
 .. code-block:: bash
 
-    # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé
-    geonature permissions supergrant --group --nom "Grp_admin"
-
+    sudo systemctl restart geonature
+    sudo systemctl restart geonature-worker
 
-Puis relancer GeoNature :
+Aucune permission n'est définie par défaut lors de l'installation d'un module. En tant qu'administrateur, vous pouvez une commande ajoutant tous les droits sur tous les modules à un groupe ou utilisateur. Cette commande peut être relancée après l'installation d'un module pour automatiquement attribuer toutes les permissions à un groupe ou utilisateur administrateur :
 
 .. code-block:: bash
 
-    sudo systemctl restart geonature
+    # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé
+    geonature permissions supergrant --group --nom "Grp_admin"
 
+Vous devrez ensuite définir des droits à vos utilisateurs pour le nouveau module installé.
 
 Installation manuelle
 ---------------------

From e50183f11ed83c07a833aef9e304ebb88438e3bb Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 8 Aug 2023 23:55:20 +0200
Subject: [PATCH 182/209] Doc permissions - Mention supergrant

---
 docs/admin-manual.rst | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/docs/admin-manual.rst b/docs/admin-manual.rst
index 0bc9ea6129..32769424a7 100644
--- a/docs/admin-manual.rst
+++ b/docs/admin-manual.rst
@@ -398,7 +398,7 @@ La gestion des droits dans GeoNature, comme dans beaucoup d'applications, est li
 
 Chaque module peut utiliser toutes ou certaines de ces actions.
 
-Selon les modules, on peut appliquer des filtres sur ces actions. Notamment des filtres d'appartenance (portées / scope) 
+Selon les modules, on peut appliquer des filtres sur ces actions. Notamment des filtres d'appartenance (portées / scope) :
 
 - Portée 1 = Seulement mes données. Cela concerne les données sur lesquels je suis :
 
@@ -426,6 +426,13 @@ Cas particulier de l'action "C"
 | Comme il n'est pas "normal" de pouvoir saisir dans des JDD sur lesquels on n'a pas les droits de lecture, la portée de l'action "CREATE" vient simplement réduire la liste des JDD sur lesquels on a les droits de lecture ("READ").
 | Même si la portée de l'action "CREATE" sur le module est supérieure à celle de l'action "READ", l'utilisateur ne verra que les JDD sur lesquels il a des droits de lecture
 
+Une commande dédiée permet d'ajouter tous les droits sur tous les modules à un groupe ou utilisateur ayant le rôle d'administrateur. Cette commande peut être relancée après l'installation d'un nouveau module :
+
+.. code-block:: bash
+
+    # changer "Grp_Admin" par le nom de votre groupe d'administrateur si vous l'avez changé
+    geonature permissions supergrant --group --nom "Grp_admin"
+
 Récapitulatif
 `````````````
 

From b7c3ac5c82fd9fccf95687be54d91eadf7358fda Mon Sep 17 00:00:00 2001
From: TheoLechemia <theo.lechemia@ecrins-parcnational.fr>
Date: Mon, 14 Aug 2023 10:36:45 +0200
Subject: [PATCH 183/209] add submodule permission command for occtax

---
 contrib/occtax/backend/occtax/blueprint.py |  5 ++-
 contrib/occtax/backend/occtax/commands.py  | 42 ++++++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 contrib/occtax/backend/occtax/commands.py

diff --git a/contrib/occtax/backend/occtax/blueprint.py b/contrib/occtax/backend/occtax/blueprint.py
index dbe36d9166..3e97744f9b 100644
--- a/contrib/occtax/backend/occtax/blueprint.py
+++ b/contrib/occtax/backend/occtax/blueprint.py
@@ -51,8 +51,11 @@
 from utils_flask_sqla_geo.utilsgeometry import remove_third_dimension
 from utils_flask_sqla.response import to_csv_resp, to_json_resp, json_resp
 
+from occtax.commands import add_submodule_permissions
+
+blueprint = Blueprint("pr_occtax", __name__, cli_group="occtax")
+blueprint.cli.add_command(add_submodule_permissions)
 
-blueprint = Blueprint("pr_occtax", __name__)
 log = logging.getLogger(__name__)
 
 
diff --git a/contrib/occtax/backend/occtax/commands.py b/contrib/occtax/backend/occtax/commands.py
new file mode 100644
index 0000000000..6a3bc688c8
--- /dev/null
+++ b/contrib/occtax/backend/occtax/commands.py
@@ -0,0 +1,42 @@
+import click
+
+from geonature.utils.env import db
+
+
+@click.command()
+@click.argument("module_code", required=True)
+def add_submodule_permissions(module_code):
+    q = """
+        INSERT INTO
+            gn_permissions.t_permissions_available (
+                id_module,
+                id_object,
+                id_action,
+                label,
+                scope_filter
+            )
+        SELECT
+            m.id_module,
+            o.id_object,
+            a.id_action,
+            v.label,
+            v.scope_filter
+        FROM
+            (
+                VALUES
+                     (:module_code, 'ALL', 'C', True, 'Créer des relevés')
+                    ,(:module_code, 'ALL', 'R', True, 'Voir les relevés')
+                    ,(:module_code, 'ALL', 'U', True, 'Modifier les relevés')
+                    ,(:module_code, 'ALL', 'E', True, 'Exporter les relevés')
+                    ,(:module_code, 'ALL', 'D', True, 'Supprimer des relevés')
+            ) AS v (module_code, object_code, action_code, scope_filter, label)
+        JOIN
+            gn_commons.t_modules m ON m.module_code = v.module_code
+        JOIN
+            gn_permissions.t_objects o ON o.code_object = v.object_code
+        JOIN
+            gn_permissions.bib_actions a ON a.code_action = v.action_code
+        """
+    db.session.execute(q, {"module_code": module_code})
+    db.session.commit()
+    click.secho("DONE", fg="green")

From 262c70f1f79ffc8b411bec3251a13a5892a28747 Mon Sep 17 00:00:00 2001
From: DonovanMaillard <donovan.maillard@gmail.com>
Date: Sun, 30 Jul 2023 16:55:20 +0200
Subject: [PATCH 184/209] Update user-manual.rst

---
 docs/user-manual.rst | 89 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 87 insertions(+), 2 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index b7c98f24c9..cb327b75b0 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -407,6 +407,91 @@ Il permet notamment de gérer les permissions (CRUVED et autres filtres), les no
 Metadonnées
 -----------
 
-Ce module permet de gérer les métadonnées (Cadres d'acquisition et jeux de données), basées sur le standard Métadonnées du SINP
-(https://standards-sinp.mnhn.fr/category/standards/metadonnees/).
+Ce module permet de gérer les métadonnées (Cadres d'acquisition et jeux de données) de votre instance GeoNature, basées sur le standard Métadonnées du SINP (https://standards-sinp.mnhn.fr/category/standards/metadonnees/).
+
+Ces métadonnées permettent de décrire et d'organiser les données (occurrences de taxons, d'habitats, données protocolées...) au sein de lots de données cohérents et documentés. Les métadonnées ainsi créées sont propres à chaque instance de GeoNature. Pour autant, leur format standard permet aisément de les diffuser et les partager vers d'autres outils.
+
+
+Structure des métadonnées
+"""""""""""""""""""""""""
+
+Les métadonnées comprennent deux niveaux distincts, comportant chacun un ensemble d'informations descriptives : 
+
+- Le cadre d'acquisition, qui permet de décrire le contexte ou le projet dans lequel les données ont été produites
+- Le jeu de données, qui permet de regrouper un sous-ensemble ou lot de données similaires (groupées par protocole, localités, périodes...)
+
+Dans GeoNature, un Cadre d'Acquisition peut comporter un ou plusieurs jeux de données, comportant eux-mêmes les données de biodiversité. GeoNature permet également de regrouper des Cadres d'Acquisitions ensemble, au sein d'un Cadre d'Acquisition dit "parent". Dans le cas le plus complet, l'outil permet ainsi d'organiser les données selon le schéma suivant : 
+
+- Un cadre d'acquisition "parent" (ou méta-cadre selon le standard SINP) décrit un projet complexe
+- Ce cadre d'acquisition parent comporte un ou plusieurs cadres d'acquisitions, décrivant des "sous-projets" d'un niveau inférieur
+- Ces cadres d'acquisition comportent chacun un ou plusieurs jeux de données
+- Ces jeux de données comportent chacun un ensemble de données de biodiversité : données protocoles, occurrences de taxons, occurrences d'habitats etc
+
+--> Schéma
+
+
+Utilisation des métadonnées dans GeoNature
+""""""""""""""""""""""""""""""""""""""""""
+
+Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires dans les différents module de saisie ou de consultation des données. La gestion des métadonnées est donc la première étape à effectuer, avant de pouvoir produire ou exploiter les données de biodiversité en elles-mêmes. La notion de jeux de données intervient notamment pour les fonctionnalités suivantes :
+
+**Saisie ou import de données**
+
+	Lors de sa création dans GeoNature, chaque donnée est obligatoirement associée à un jeu de données. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées les données en cours de création. 
+	Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur. Pour autant, les données en cours de création sont automatiquement rattachées à un jeu de données défini dans la configuration, de manière transparente pour l'utilisateur. 
+
+	
+**Requêtage**
+	
+	Les métadonnées constituent des "boîtes" dans lesquelles sont rangées les données. Tous les modules de GeoNature permettant de requêter des données (Synthèse, Dashboard, Validation, Occtax...) offrent la possibilité de filtrer par cadre d'acquisition ou par jeu de données. 
+	De cette manière, l'outil permet aisément de rechercher ou exporter ses données par "campagnes", par "études", par "projet" etc, selon l'organisation des métadonnées mise en place au sein de l'instance et selon la manière de produire les données de chaque utilisateur.
+
+
+**Permissions**
+
+	Enfin, les métadonnées font également partie des critères d'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
+	Ainsi les acteurs associés aux métadonnées pourront définir les utilisateurs pouvant alimenter les jeux de données en question selon les paramètres définis : un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, tandis qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure.
+
+**Champs additionnels**
+
+	GeoNature permet de configurer des champs additionnels "personnalisés", qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire.
+
+
+Fonctionnement du module métadonnées
+""""""""""""""""""""""""""""""""""""
+
+	Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
+
+**Consulter, rechercher ou modifier ses métadonnées**
+TODO
+
+**Créer un cadre d'acquisition**
+Le module permet la création d'un nouveau cadre d'acquisition en appuyant sur "Ajouter un cadre d'acquisition". Il suffit ensuite d'alimenter le formulaire en décrivant le cadre d'acquisition (le projet ou programme) qui conduit à la production de données de biodiversité.
+
+Les champs obligatoires (Nom, description, objectifs, territoire...) sont marqués d'un trait rouge.
+
+Les cadres d'acquisition doivent comporter un ou des acteurs associés (organismes, utilisateurs, ou les deux). 
+
+L'outil permet également d'associer des références bibliographiques (publications etc) à un cadre d'acquisition. 
+
+En cliquant sur la case à cocher "est un cadre d'acquisition parent", l'utilisateur peut créer un cadre d'acquisition "supra", qui pourra ensuite regrouper plusieurs cadres d'acquisition "simples". A l'inverse, en sélectionnant un cadre d'acquisition parent, l'utilisateur pourra associer son cadre d'acquisition à un cadre "parent", de niveau supérieur. 
+
+-> Captures d'écran
+
+**Créer un jeu de données**
+De la même manière que pour les cadres d'acquisition, le module "métadonnées" permet de créer des jeux de données en cliquant sur "Ajouter un jeu de données". 
+
+L'utilisateur est alors invité à décrire son lot de données (nom, description, méthodes...) et à indiquer à quel cadre d'acquisition son jeu de données est rattaché. 
+La case à cocher "actif à la saisie" permet d'ouvrir ou fermer le jeu de données, qui sera ou non proposé aux utilisateurs dans les modules de saisie et/ou module d'import. De même, les données peuvent être - ou non - rendues validables.
+
+Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le ou les acteurs associés au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix pourront influer sur les permissions des utilisateurs à alimenter, ou non, le jeu de données considéré. 
+
+	*Associer un jeu de données à des modules*
+
+Afin de faciliter la saisie et limiter les erreurs, GeoNature nécessite d'associer chaque jeu de données à un ou des modules. De cette manière, l'utilisateur peut choisir depuis quel(s) module(s) (de saisie ou d'import) son jeu de données pourra être sélectionné et alimenté. Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
+
+	*Associer un jeu de données à une liste de taxons*
+
+De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreints (protocoles, suivis etc).
+Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
 

From e14dcc522f825f1e550649446c3292f7d754377e Mon Sep 17 00:00:00 2001
From: DonovanMaillard <donovan.maillard@gmail.com>
Date: Sun, 30 Jul 2023 16:57:51 +0200
Subject: [PATCH 185/209] Update user-manual.rst

---
 docs/user-manual.rst | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index cb327b75b0..0e696500d8 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -437,30 +437,30 @@ Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires d
 
 **Saisie ou import de données**
 
-	Lors de sa création dans GeoNature, chaque donnée est obligatoirement associée à un jeu de données. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées les données en cours de création. 
-	Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur. Pour autant, les données en cours de création sont automatiquement rattachées à un jeu de données défini dans la configuration, de manière transparente pour l'utilisateur. 
+Lors de sa création dans GeoNature, chaque donnée est obligatoirement associée à un jeu de données. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées les données en cours de création. 
+Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur. Pour autant, les données en cours de création sont automatiquement rattachées à un jeu de données défini dans la configuration, de manière transparente pour l'utilisateur. 
 
 	
 **Requêtage**
 	
-	Les métadonnées constituent des "boîtes" dans lesquelles sont rangées les données. Tous les modules de GeoNature permettant de requêter des données (Synthèse, Dashboard, Validation, Occtax...) offrent la possibilité de filtrer par cadre d'acquisition ou par jeu de données. 
-	De cette manière, l'outil permet aisément de rechercher ou exporter ses données par "campagnes", par "études", par "projet" etc, selon l'organisation des métadonnées mise en place au sein de l'instance et selon la manière de produire les données de chaque utilisateur.
+Les métadonnées constituent des "boîtes" dans lesquelles sont rangées les données. Tous les modules de GeoNature permettant de requêter des données (Synthèse, Dashboard, Validation, Occtax...) offrent la possibilité de filtrer par cadre d'acquisition ou par jeu de données. 
+De cette manière, l'outil permet aisément de rechercher ou exporter ses données par "campagnes", par "études", par "projet" etc, selon l'organisation des métadonnées mise en place au sein de l'instance et selon la manière de produire les données de chaque utilisateur.
 
 
 **Permissions**
 
-	Enfin, les métadonnées font également partie des critères d'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
-	Ainsi les acteurs associés aux métadonnées pourront définir les utilisateurs pouvant alimenter les jeux de données en question selon les paramètres définis : un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, tandis qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure.
+Enfin, les métadonnées font également partie des critères d'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
+Ainsi les acteurs associés aux métadonnées pourront définir les utilisateurs pouvant alimenter les jeux de données en question selon les paramètres définis : un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, tandis qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure.
 
 **Champs additionnels**
 
-	GeoNature permet de configurer des champs additionnels "personnalisés", qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire.
+GeoNature permet de configurer des champs additionnels "personnalisés", qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire.
 
 
 Fonctionnement du module métadonnées
 """"""""""""""""""""""""""""""""""""
 
-	Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
+Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
 
 **Consulter, rechercher ou modifier ses métadonnées**
 TODO
@@ -486,11 +486,11 @@ La case à cocher "actif à la saisie" permet d'ouvrir ou fermer le jeu de donn
 
 Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le ou les acteurs associés au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix pourront influer sur les permissions des utilisateurs à alimenter, ou non, le jeu de données considéré. 
 
-	*Associer un jeu de données à des modules*
+*Associer un jeu de données à des modules*
 
 Afin de faciliter la saisie et limiter les erreurs, GeoNature nécessite d'associer chaque jeu de données à un ou des modules. De cette manière, l'utilisateur peut choisir depuis quel(s) module(s) (de saisie ou d'import) son jeu de données pourra être sélectionné et alimenté. Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
 
-	*Associer un jeu de données à une liste de taxons*
+*Associer un jeu de données à une liste de taxons*
 
 De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreints (protocoles, suivis etc).
 Cette association se fait depuis le formulaire de création/d'édition du jeu de données.

From e48611718cb407892a1f0362634ecbe767a005cf Mon Sep 17 00:00:00 2001
From: DonovanMaillard <donovan.maillard@gmail.com>
Date: Sun, 20 Aug 2023 21:44:44 +0200
Subject: [PATCH 186/209] Update user-manual.rst

improve metadata doc and add pictures
---
 docs/user-manual.rst | 223 +++++++++++++++++++++++++------------------
 1 file changed, 130 insertions(+), 93 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index 0e696500d8..6b6a97f398 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -27,6 +27,136 @@ Un bouton en haut à droite permet de se déconnecter de l'application.
 
 .. image :: https://geonature.fr/docs/img/user-manual/01-home-logout.jpg
 
+
+Metadonnées
+-----------
+
+Ce module permet de gérer les métadonnées (Cadres d'acquisition et jeux de données) de votre instance GeoNature, basées sur le standard Métadonnées du SINP (https://standards-sinp.mnhn.fr/category/standards/metadonnees/).
+
+Ces métadonnées permettent de décrire et d'organiser les données (occurrences de taxons, d'habitats, données protocolées...) au sein de lots de données cohérents et documentés. Les métadonnées ainsi créées sont propres à chaque instance de GeoNature, mais leur format standard permet de les diffuser vers d'autres outils ou dans le cadre du SINP.
+
+Pour les utilisateurs disposant des droits suffisants, le module métadonnées est accessible depuis le menu gauche de GeoNature. 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_00_Acceder_au_module.png
+
+
+Structure des métadonnées
+"""""""""""""""""""""""""
+
+Les métadonnées comprennent deux niveaux distincts, comportant chacun un ensemble d'informations descriptives : 
+
+- Le cadre d'acquisition, qui permet de décrire le contexte ou le projet dans lequel les données ont été produites
+- Le jeu de données, qui permet de regrouper un sous-ensemble ou lot de données similaires (groupées par protocole, localités, périodes...)
+
+Un Cadre d'acquisition peut comporter un ou plusieurs Jeux de données, comportant eux-mêmes les données de biodiversité. GeoNature permet également de regrouper des Cadres d'acquisitions ensemble, au sein d'un Cadre d'acquisition dit "parent". Dans le cas le plus complet, l'outil permet ainsi d'organiser les données selon le schéma suivant : 
+
+- Un cadre d'acquisition "parent" (ou méta-cadre selon le standard SINP) décrit un projet complexe
+- Ce cadre d'acquisition parent comporte un ou plusieurs Cadres d'acquisitions, décrivant des "sous-projets" simples
+- Ces Cadres d'acquisition comportent chacun un ou plusieurs Jeux de données
+- Ces Jeux de données comportent chacun un ensemble de données de biodiversité : données protocolées, occurrences de taxons, occurrences d'habitats etc
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_01_Imbrication_notions.png
+
+
+Utilisation des métadonnées dans GeoNature
+""""""""""""""""""""""""""""""""""""""""""
+
+Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires dans les différents module de saisie ou de consultation des données. **La gestion des métadonnées est donc la première étape à effectuer, avant de pouvoir produire ou exploiter les données de biodiversité en elles-mêmes**. La notion de jeux de données intervient notamment pour les fonctionnalités suivantes :
+
+**- Saisie ou import de données**
+
+Lors de sa création dans GeoNature, chaque donnée doit être obligatoirement associée à un jeu de données préalablement créé. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées la ou les données en cours de création. 
+Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur car le jeu de données est sélectionné de manière "transparente" par la configuration du module.
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_exemple_selection_jdd.png
+	
+**- Requêtage**
+	
+Les métadonnées constituent des "boîtes" dans lesquelles sont rangées les données. Tous les modules de GeoNature permettant de requêter des données (Synthèse, Dashboard, Validation, Occtax...) offrent la possibilité de filtrer par cadre d'acquisition ou par jeu de données. 
+De cette manière, l'outil permet de rechercher ou exporter facilement ses données par "campagnes", par "études", par "projet" etc, selon l'organisation des métadonnées mise en place au sein de chaque instance.
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_exemple_requetage.png
+
+**- Permissions**
+
+Les métadonnées sont également utilisées pour l'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
+Ainsi les acteurs associés à chaque jeu de données permettront de définir les utilisateurs pouvant consulter ou alimenter les jeux de données en question selon les paramètres définis : 
+
+- un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, 
+- qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure,
+- enfin un utilisateur ayant les droits sur toutes les données pourra alimenter/consulter les données de tous les jeux de données, quelques soient les acteurs associés
+
+**- Champs additionnels**
+
+GeoNature permet de configurer des champs additionnels "personnalisés" (https://docs.geonature.fr/admin-manual.html#administration-des-champs-additionnels), qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire qui n'apparaitrait pas dans les champs "standards".
+
+
+Fonctionnement du module métadonnées
+""""""""""""""""""""""""""""""""""""
+
+Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
+
+**Consulter, rechercher ou modifier ses métadonnées**
+L'accueil du module métadonnées liste l'ensemble des Cadres d'acquisition disponibles dans l'instance GeoNature. Chaque cadre d'acquisition peut être "déplié" pour afficher les jeux de données qu'il contient. 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_02_Catalogue_mtd.png
+
+Cette page comporte également une barre de recherche pour effectuer une recherche rapide dans les métadonnées disponibles, et une fonctionnalité de "recherche avancée". Elle permet également de consulter les fiches détaillées, de modifier, ou de supprimer les métadonnées existantes. 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_03_Actions_catalogue
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_04_RechercheAvancee
+
+**Créer un cadre d'acquisition**
+
+Cette page permet également d'accéder au formulaire de création des Cadres d'acquisition via le bouton "Ajouter un Cadre d'acquisition". 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_05_AjouterCA.png
+
+Ce formulaire permet de renseigner les différentes informations descriptions du Cadre d'acquisition (projet/programme). Les champs obligatoires (Nom, description, objectifs, territoire...) sont marqués d'un trait rouge.
+
+Les cadres d'acquisition doivent également comporter un ou des acteurs associés (organismes, utilisateurs, ou les deux). 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_06_FormulaireCA.png
+
+Il est également possible d'associer des références bibliographiques (publications etc) au cadre d'acquisition. 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_07_BiblioCA.png
+
+En cliquant sur la case à cocher "est un cadre d'acquisition parent", l'utilisateur peut créer un "métacadre" d'acquisition, qui pourra ensuite regrouper plusieurs cadres d'acquisition "simples". A l'inverse, en sélectionnant un cadre d'acquisition parent, l'utilisateur pourra associer son cadre d'acquisition à un cadre "parent" créé préalablement. 
+
+
+**Créer un jeu de données**
+
+De la même manière que pour les Cadres d'acquisition, la page d'accueil du module métadonnées comporte un bouton "Ajouter un jeu de données" qui  permet d'accéder au formulaire de création d'un nouveau Jeu de Données. 
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_08_AjoutJDD.png
+
+Ce formulaire permet à l'utilisateur de décrire son lot de données (nom, description, méthodes...) et d'indiquer à quel cadre d'acquisition (projet) il est rattaché. 
+
+Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le ou les acteurs associés au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix permettront de définir les utilisateurs qui pourront - ou non - alimenter le jeu de données considéré en fonction des permissions configurées.
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_09_Formulaire_JDD.png
+
+La case à cocher "actif à la saisie" permet d'ouvrir ou fermer le jeu de données, qui sera ou non proposé aux utilisateurs dans les modules de saisie ou d'import. De même, les jeux de données peuvent être - ou non - rendus validables.
+
+Ce formulaire permet également d'associer les jeux de données à un ou des modules de GeoNature, et éventuellement à une liste de taxons.
+
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_10_SpecifiqueGeoNature.png
+
+
+*Association entre jeux de données et modules*
+
+Afin de faciliter la saisie et limiter les erreurs, GeoNature permet d'associer chaque jeu de données à un ou des modules. De cette manière, il est possible de définir depuis quel(s) module(s) le jeu de données considéré pourra être alimenté par les différents utilisateurs. 
+Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
+
+*Associer un jeu de données à une liste de taxons*
+
+De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). 
+Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreint (protocoles, suivis etc).
+Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
+
+
 OccTax
 ------
 
@@ -402,96 +532,3 @@ Admin
 C'est le module "backoffice" de GeoNature.
 Il permet notamment de gérer les permissions (CRUVED et autres filtres), les nomenclatures (typologies et vocabulaires) utilisées dans les différents modules de GeoNature ainsi que les champs additionnels.
 
-
-
-Metadonnées
------------
-
-Ce module permet de gérer les métadonnées (Cadres d'acquisition et jeux de données) de votre instance GeoNature, basées sur le standard Métadonnées du SINP (https://standards-sinp.mnhn.fr/category/standards/metadonnees/).
-
-Ces métadonnées permettent de décrire et d'organiser les données (occurrences de taxons, d'habitats, données protocolées...) au sein de lots de données cohérents et documentés. Les métadonnées ainsi créées sont propres à chaque instance de GeoNature. Pour autant, leur format standard permet aisément de les diffuser et les partager vers d'autres outils.
-
-
-Structure des métadonnées
-"""""""""""""""""""""""""
-
-Les métadonnées comprennent deux niveaux distincts, comportant chacun un ensemble d'informations descriptives : 
-
-- Le cadre d'acquisition, qui permet de décrire le contexte ou le projet dans lequel les données ont été produites
-- Le jeu de données, qui permet de regrouper un sous-ensemble ou lot de données similaires (groupées par protocole, localités, périodes...)
-
-Dans GeoNature, un Cadre d'Acquisition peut comporter un ou plusieurs jeux de données, comportant eux-mêmes les données de biodiversité. GeoNature permet également de regrouper des Cadres d'Acquisitions ensemble, au sein d'un Cadre d'Acquisition dit "parent". Dans le cas le plus complet, l'outil permet ainsi d'organiser les données selon le schéma suivant : 
-
-- Un cadre d'acquisition "parent" (ou méta-cadre selon le standard SINP) décrit un projet complexe
-- Ce cadre d'acquisition parent comporte un ou plusieurs cadres d'acquisitions, décrivant des "sous-projets" d'un niveau inférieur
-- Ces cadres d'acquisition comportent chacun un ou plusieurs jeux de données
-- Ces jeux de données comportent chacun un ensemble de données de biodiversité : données protocoles, occurrences de taxons, occurrences d'habitats etc
-
---> Schéma
-
-
-Utilisation des métadonnées dans GeoNature
-""""""""""""""""""""""""""""""""""""""""""
-
-Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires dans les différents module de saisie ou de consultation des données. La gestion des métadonnées est donc la première étape à effectuer, avant de pouvoir produire ou exploiter les données de biodiversité en elles-mêmes. La notion de jeux de données intervient notamment pour les fonctionnalités suivantes :
-
-**Saisie ou import de données**
-
-Lors de sa création dans GeoNature, chaque donnée est obligatoirement associée à un jeu de données. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées les données en cours de création. 
-Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur. Pour autant, les données en cours de création sont automatiquement rattachées à un jeu de données défini dans la configuration, de manière transparente pour l'utilisateur. 
-
-	
-**Requêtage**
-	
-Les métadonnées constituent des "boîtes" dans lesquelles sont rangées les données. Tous les modules de GeoNature permettant de requêter des données (Synthèse, Dashboard, Validation, Occtax...) offrent la possibilité de filtrer par cadre d'acquisition ou par jeu de données. 
-De cette manière, l'outil permet aisément de rechercher ou exporter ses données par "campagnes", par "études", par "projet" etc, selon l'organisation des métadonnées mise en place au sein de l'instance et selon la manière de produire les données de chaque utilisateur.
-
-
-**Permissions**
-
-Enfin, les métadonnées font également partie des critères d'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
-Ainsi les acteurs associés aux métadonnées pourront définir les utilisateurs pouvant alimenter les jeux de données en question selon les paramètres définis : un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, tandis qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure.
-
-**Champs additionnels**
-
-GeoNature permet de configurer des champs additionnels "personnalisés", qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire.
-
-
-Fonctionnement du module métadonnées
-""""""""""""""""""""""""""""""""""""
-
-Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
-
-**Consulter, rechercher ou modifier ses métadonnées**
-TODO
-
-**Créer un cadre d'acquisition**
-Le module permet la création d'un nouveau cadre d'acquisition en appuyant sur "Ajouter un cadre d'acquisition". Il suffit ensuite d'alimenter le formulaire en décrivant le cadre d'acquisition (le projet ou programme) qui conduit à la production de données de biodiversité.
-
-Les champs obligatoires (Nom, description, objectifs, territoire...) sont marqués d'un trait rouge.
-
-Les cadres d'acquisition doivent comporter un ou des acteurs associés (organismes, utilisateurs, ou les deux). 
-
-L'outil permet également d'associer des références bibliographiques (publications etc) à un cadre d'acquisition. 
-
-En cliquant sur la case à cocher "est un cadre d'acquisition parent", l'utilisateur peut créer un cadre d'acquisition "supra", qui pourra ensuite regrouper plusieurs cadres d'acquisition "simples". A l'inverse, en sélectionnant un cadre d'acquisition parent, l'utilisateur pourra associer son cadre d'acquisition à un cadre "parent", de niveau supérieur. 
-
--> Captures d'écran
-
-**Créer un jeu de données**
-De la même manière que pour les cadres d'acquisition, le module "métadonnées" permet de créer des jeux de données en cliquant sur "Ajouter un jeu de données". 
-
-L'utilisateur est alors invité à décrire son lot de données (nom, description, méthodes...) et à indiquer à quel cadre d'acquisition son jeu de données est rattaché. 
-La case à cocher "actif à la saisie" permet d'ouvrir ou fermer le jeu de données, qui sera ou non proposé aux utilisateurs dans les modules de saisie et/ou module d'import. De même, les données peuvent être - ou non - rendues validables.
-
-Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le ou les acteurs associés au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix pourront influer sur les permissions des utilisateurs à alimenter, ou non, le jeu de données considéré. 
-
-*Associer un jeu de données à des modules*
-
-Afin de faciliter la saisie et limiter les erreurs, GeoNature nécessite d'associer chaque jeu de données à un ou des modules. De cette manière, l'utilisateur peut choisir depuis quel(s) module(s) (de saisie ou d'import) son jeu de données pourra être sélectionné et alimenté. Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
-
-*Associer un jeu de données à une liste de taxons*
-
-De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreints (protocoles, suivis etc).
-Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
-

From c99b16230a3058bf539c85e2fa801e80b200f266 Mon Sep 17 00:00:00 2001
From: DonovanMaillard <donovan.maillard@gmail.com>
Date: Sun, 20 Aug 2023 21:46:49 +0200
Subject: [PATCH 187/209] Update user-manual.rst

fix typo
---
 docs/user-manual.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index 6b6a97f398..b6809e299e 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -145,12 +145,12 @@ Ce formulaire permet également d'associer les jeux de données à un ou des mod
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_10_SpecifiqueGeoNature.png
 
 
-*Association entre jeux de données et modules*
+**Association entre jeux de données et modules**
 
 Afin de faciliter la saisie et limiter les erreurs, GeoNature permet d'associer chaque jeu de données à un ou des modules. De cette manière, il est possible de définir depuis quel(s) module(s) le jeu de données considéré pourra être alimenté par les différents utilisateurs. 
 Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
 
-*Associer un jeu de données à une liste de taxons*
+**Association entre Jeu de données et liste de taxons**
 
 De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). 
 Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreint (protocoles, suivis etc).

From cfbf79b7921090abc01d5d6f0e6e483e61cda191 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Mon, 21 Aug 2023 11:40:29 +0200
Subject: [PATCH 188/209] User doc - Review metadata doc

---
 docs/user-manual.rst | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index b6809e299e..248781d1f0 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -35,7 +35,7 @@ Ce module permet de gérer les métadonnées (Cadres d'acquisition et jeux de do
 
 Ces métadonnées permettent de décrire et d'organiser les données (occurrences de taxons, d'habitats, données protocolées...) au sein de lots de données cohérents et documentés. Les métadonnées ainsi créées sont propres à chaque instance de GeoNature, mais leur format standard permet de les diffuser vers d'autres outils ou dans le cadre du SINP.
 
-Pour les utilisateurs disposant des droits suffisants, le module métadonnées est accessible depuis le menu gauche de GeoNature. 
+Pour les utilisateurs disposant des droits suffisants, le module Métadonnées est accessible depuis le menu gauche de GeoNature. 
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_00_Acceder_au_module.png
 
@@ -61,12 +61,12 @@ Un Cadre d'acquisition peut comporter un ou plusieurs Jeux de données, comporta
 Utilisation des métadonnées dans GeoNature
 """"""""""""""""""""""""""""""""""""""""""
 
-Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires dans les différents module de saisie ou de consultation des données. **La gestion des métadonnées est donc la première étape à effectuer, avant de pouvoir produire ou exploiter les données de biodiversité en elles-mêmes**. La notion de jeux de données intervient notamment pour les fonctionnalités suivantes :
+Les métadonnées jouent un rôle central dans GeoNature, et sont nécessaires dans les différents modules de saisie ou de consultation des données. **La gestion des métadonnées est donc la première étape à effectuer, avant de pouvoir produire ou exploiter les données de biodiversité en elles-mêmes**. La notion de jeux de données intervient notamment pour les fonctionnalités suivantes :
 
 **- Saisie ou import de données**
 
 Lors de sa création dans GeoNature, chaque donnée doit être obligatoirement associée à un jeu de données préalablement créé. Ainsi le module d'import et la majorité des modules de saisie (Occtax, OccHab...) nécessitent de sélectionner le jeu de données auquel seront rattachées la ou les données en cours de création. 
-Dans certains cas plus spécifiques (monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur car le jeu de données est sélectionné de manière "transparente" par la configuration du module.
+Dans certains cas plus spécifiques (Monitorings par exemple), le module peut ne pas demander cette information à l'utilisateur car le jeu de données est sélectionné de manière "transparente" par la configuration du module.
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_exemple_selection_jdd.png
 	
@@ -82,8 +82,8 @@ De cette manière, l'outil permet de rechercher ou exporter facilement ses donn
 Les métadonnées sont également utilisées pour l'application des permissions ou restrictions imposées à chaque utilisateur au sein de l'instance (cf https://docs.geonature.fr/admin-manual.html#gestion-des-droits). 
 Ainsi les acteurs associés à chaque jeu de données permettront de définir les utilisateurs pouvant consulter ou alimenter les jeux de données en question selon les paramètres définis : 
 
-- un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter un jeu de données sont il est personnellement acteur, 
-- qu'un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter tous jeux de données associés à sa structure,
+- un utilisateur disposant uniquement des droits sur ses propres données pourra alimenter/consuter les données des jeux de données dont il est personnellement acteur, 
+- un utilisateur ayant des droits sur les données de son organisme pourra potentiellement alimenter/consulter les données des jeux de données dont sa structure est actrice,
 - enfin un utilisateur ayant les droits sur toutes les données pourra alimenter/consulter les données de tous les jeux de données, quelques soient les acteurs associés
 
 **- Champs additionnels**
@@ -91,13 +91,14 @@ Ainsi les acteurs associés à chaque jeu de données permettront de définir le
 GeoNature permet de configurer des champs additionnels "personnalisés" (https://docs.geonature.fr/admin-manual.html#administration-des-champs-additionnels), qui viennent compléter les champs du standard du sinp (sexe, stade de vie etc). Ces champs additionnels sont implémentés dans le module de saisie Occtax notamment, et peuvent être rendus disponibles uniquement pour certains jeux de données. Il devient ainsi possible, pour un jeu de données en particulier, de recueillir une variable ou une information supplémentaire qui n'apparaitrait pas dans les champs "standards".
 
 
-Fonctionnement du module métadonnées
+Fonctionnement du module Métadonnées
 """"""""""""""""""""""""""""""""""""
 
-Le module métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
+Le module Métadonnées de GeoNature permet de consulter, rechercher et gérer ses cadres d'acquisitions et jeux de données, nécessaires à la gestion des données.
 
 **Consulter, rechercher ou modifier ses métadonnées**
-L'accueil du module métadonnées liste l'ensemble des Cadres d'acquisition disponibles dans l'instance GeoNature. Chaque cadre d'acquisition peut être "déplié" pour afficher les jeux de données qu'il contient. 
+
+L'accueil du module Métadonnées liste l'ensemble des Cadres d'acquisition disponibles dans l'instance GeoNature. Chaque cadre d'acquisition peut être "déplié" pour afficher les jeux de données qu'il contient. 
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_02_Catalogue_mtd.png
 
@@ -128,32 +129,35 @@ En cliquant sur la case à cocher "est un cadre d'acquisition parent", l'utilisa
 
 **Créer un jeu de données**
 
-De la même manière que pour les Cadres d'acquisition, la page d'accueil du module métadonnées comporte un bouton "Ajouter un jeu de données" qui  permet d'accéder au formulaire de création d'un nouveau Jeu de Données. 
+De la même manière que pour les Cadres d'acquisition, la page d'accueil du module Métadonnées comporte un bouton "Ajouter un jeu de données" qui  permet d'accéder au formulaire de création d'un nouveau Jeu de Données. 
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_08_AjoutJDD.png
 
 Ce formulaire permet à l'utilisateur de décrire son lot de données (nom, description, méthodes...) et d'indiquer à quel cadre d'acquisition (projet) il est rattaché. 
 
-Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le ou les acteurs associés au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix permettront de définir les utilisateurs qui pourront - ou non - alimenter le jeu de données considéré en fonction des permissions configurées.
+Enfin comme pour les cadres d'acquisition, l'utilisateur devra définir le (ou les) acteur(s) associé(s) au jeu de données en question (producteur, financeur etc) : organismes, personnes, ou les deux. Ces choix permettront de définir les utilisateurs qui pourront - ou non - alimenter et consulter les données du jeu de données considéré en fonction des permissions configurées.
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_09_Formulaire_JDD.png
 
 La case à cocher "actif à la saisie" permet d'ouvrir ou fermer le jeu de données, qui sera ou non proposé aux utilisateurs dans les modules de saisie ou d'import. De même, les jeux de données peuvent être - ou non - rendus validables.
 
-Ce formulaire permet également d'associer les jeux de données à un ou des modules de GeoNature, et éventuellement à une liste de taxons.
+Ce formulaire permet également d'associer les jeux de données à un (ou des) module(s) de GeoNature, et éventuellement à une liste de taxons.
 
 .. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_10_SpecifiqueGeoNature.png
 
 
 **Association entre jeux de données et modules**
 
-Afin de faciliter la saisie et limiter les erreurs, GeoNature permet d'associer chaque jeu de données à un ou des modules. De cette manière, il est possible de définir depuis quel(s) module(s) le jeu de données considéré pourra être alimenté par les différents utilisateurs. 
+Afin de faciliter la saisie et limiter les erreurs, GeoNature permet d'associer chaque jeu de données à un (ou des) module(s). De cette manière, il est possible de définir depuis quel(s) module(s) le jeu de données considéré pourra être alimenté par les différents utilisateurs.
+
 Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
 
 **Association entre Jeu de données et liste de taxons**
 
-De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout taxref qui seront disponibles). 
+De la même manière, GeoNature permet d'associer un jeu de données à une liste de taxons. Cette association n'est pas obligatoire (par défaut, c'est la liste du module de saisie ou tout Taxref qui seront disponibles).
+
 Cela permet notamment de réduire le nombre de taxons proposés à la saisie dans des jeux de données dédiés à un groupe d'espèces restreint (protocoles, suivis etc).
+
 Cette association se fait depuis le formulaire de création/d'édition du jeu de données.
 
 

From eac6b53c034f1576f9e18046b86ad2245ada8ca4 Mon Sep 17 00:00:00 2001
From: DonovanMaillard <donovan.maillard@gmail.com>
Date: Mon, 21 Aug 2023 11:48:36 +0200
Subject: [PATCH 189/209] Update user-manual.rst

fix links
---
 docs/user-manual.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/user-manual.rst b/docs/user-manual.rst
index 248781d1f0..373c638587 100644
--- a/docs/user-manual.rst
+++ b/docs/user-manual.rst
@@ -104,9 +104,9 @@ L'accueil du module Métadonnées liste l'ensemble des Cadres d'acquisition disp
 
 Cette page comporte également une barre de recherche pour effectuer une recherche rapide dans les métadonnées disponibles, et une fonctionnalité de "recherche avancée". Elle permet également de consulter les fiches détaillées, de modifier, ou de supprimer les métadonnées existantes. 
 
-.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_03_Actions_catalogue
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_03_Actions_catalogue.png
 
-.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_04_RechercheAvancee
+.. image :: https://geonature.fr/docs/img/user-manual/mtd/mtd_04_RechercheAvancee.png
 
 **Créer un cadre d'acquisition**
 

From e7ad82d7d28f1d1983bf5e63736f62e2d8e24b1a Mon Sep 17 00:00:00 2001
From: Andria Capai <andria_capai@natural-solutions.eu>
Date: Thu, 17 Aug 2023 16:48:29 +0200
Subject: [PATCH 190/209] fix(front): OCCTAX disaplaying last geometry point
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix --> Erreur d'affichage lors de l'enchainement de saisie de données pour le
module occtax . Si la géométrie saisie pour le premier  relevé est un polygon/polyline et que le second relevé est un point ce dernier n'est pas affiché au retour sur le composant map pour le relevé suivant.

Closes #2657
[Refs_ticket]: #2657
Reviewed-by: andriacap
---
 .../occtax/frontend/app/occtax-form/map/occtax-map.service.ts    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
index 13c2957c7a..9298749ef2 100644
--- a/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
+++ b/contrib/occtax/frontend/app/occtax-form/map/occtax-map.service.ts
@@ -37,6 +37,7 @@ export class OcctaxFormMapService {
     this.manageGeometryChange(geojson);
     if (geojson.type == 'Point') {
       this.markerCoordinates = geojson.coordinates;
+      this.leafletDrawGeoJson = geojson;
     } else {
       this.leafletDrawGeoJson = geojson;
     }

From 56514cfd2cc63d8e204442c9755f3020fdad6c98 Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Thu, 3 Aug 2023 11:30:02 +0200
Subject: [PATCH 191/209] fix(metadata): changing fields to ng-select

---
 .../metadataModule/metadata.component.html    | 86 ++++++++++++-------
 .../app/metadataModule/metadata.component.ts  |  4 +
 2 files changed, 58 insertions(+), 32 deletions(-)

diff --git a/frontend/src/app/metadataModule/metadata.component.html b/frontend/src/app/metadataModule/metadata.component.html
index 1cae313aa6..b0c960ea0e 100644
--- a/frontend/src/app/metadataModule/metadata.component.html
+++ b/frontend/src/app/metadataModule/metadata.component.html
@@ -225,15 +225,26 @@ <h3 class="main-color">Catalogue des jeux de données</h3>
     style="align-items: flex-end"
   >
     <label> Rechercher sur:</label>
-    <select
+    <ng-select
+      [items]="meta_type"
       [formControl]="metadataService.form.get('selector')"
+      bindLabel="label"
+      bindValue="value"
       name="selecteur"
       id="selector"
-      class="form-control"
+      clearable=""false
     >
-      <option value="ds">Jeu de données</option>
-      <option value="af">Cadre d'acquisition</option>
-    </select>
+      <ng-template
+        ng-option-tmp
+        let-item="item"
+        let-index="index"
+        let-search="searchTerm"
+      >
+        <div [attr.data-qa]="item.value">
+          <span class="pre-wrap">{{item.label}}</span>
+        </div>
+      </ng-template>
+    </ng-select>
     <label>UUID</label>
     <input
       [formControl]="metadataService.form.get('uuid')"
@@ -251,40 +262,51 @@ <h3 class="main-color">Catalogue des jeux de données</h3>
       [parentFormControl]="metadataService.form.get('date')"
       label="Date de création"
     ></pnx-date>
-    <label>Acteur (organisme)</label>
 
-    <select
+    <label>Acteur (organisme)</label>
+    
+    <ng-select
+      [items]="organisms"
       [formControl]="metadataService.form.get('organism')"
-      class="form-control form-control"
-    >
-      <option
-        value=""
-        selected
-      >--</option>
-      <option
-        *ngFor="let org of organisms"
-        value="{{ org.id_organisme }}"
+      bindLabel="nom_organisme"
+      bindValue="id_organisme"
+      [multiple]="false"
+      [searchable]="true"
+      [clearable]="true"
+      >
+      <ng-template
+        ng-option-tmp
+        let-item="item"
+        let-index="index"
+        let-search="searchTerm"
       >
-        {{ org.nom_organisme }}
-      </option>
-    </select>
+        <div [matTooltip]="item.nom_organisme" [attr.data-qa]="item.id_organism">
+          <span class="pre-wrap">{{item.nom_organisme}}</span>
+        </div>
+      </ng-template>
+    </ng-select>
+
     <label> Acteur (personne)</label>
 
-    <select
-      class="form-control form-control"
+    <ng-select
+      [items]="roles"
       [formControl]="metadataService.form.get('person')"
-    >
-      <option
-        value=""
-        selected
-      >--</option>
-      <option
-        *ngFor="let role of roles"
-        value="{{ role.id_role }}"
+      bindLabel="nom_complet"
+      bindValue="id_role"
+      [multiple]="false"
+      [virtualScroll]="true"
       >
-        {{ role?.nom_complet }}
-      </option>
-    </select>
+      <ng-template
+        ng-option-tmp
+        let-item="item"
+        let-index="index"
+        let-search="searchTerm"
+      >
+        <div [matTooltip]="item.nom_complet" [attr.data-qa]="item.id_role">
+          <span class="pre-wrap">{{item.nom_complet}}</span>
+        </div>
+      </ng-template>
+    </ng-select>
 
     <div *ngIf="displayMetaAreaFilters() && metadataService.formBuilded">
       <div *ngFor="let area of areaFilters; let i = index">
diff --git a/frontend/src/app/metadataModule/metadata.component.ts b/frontend/src/app/metadataModule/metadata.component.ts
index 3df6ad8f55..12dd6f1860 100644
--- a/frontend/src/app/metadataModule/metadata.component.ts
+++ b/frontend/src/app/metadataModule/metadata.component.ts
@@ -32,6 +32,10 @@ export class MetadataComponent implements OnInit {
   public organisms: any[] = [];
   /* liste des roles issues de l'API pour le select. */
   public roles: any[] = [];
+  public meta_type: any[] = [
+    { label: 'Jeu de données', value: 'ds' },
+    { label: "Cadre d'acquisition", value: 'af' },
+  ];
 
   public areaFilters: Array<any>;
 

From 1152514f725bb70e58c974dca57b5323bd303893 Mon Sep 17 00:00:00 2001
From: Maxime Vergez <maxime_vergez@natural-solutions.eu>
Date: Mon, 21 Aug 2023 11:18:25 +0200
Subject: [PATCH 192/209] feat(occtax): add config to expand advanced btn

On occurence tab when adding a taxon
---
 contrib/occtax/backend/occtax/conf_schema_toml.py             | 1 +
 .../app/occtax-form/occurrence/occurrence.component.ts        | 4 +++-
 contrib/occtax/occtax_config.toml.example                     | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/contrib/occtax/backend/occtax/conf_schema_toml.py b/contrib/occtax/backend/occtax/conf_schema_toml.py
index f3e6b8783c..edf6147c0e 100644
--- a/contrib/occtax/backend/occtax/conf_schema_toml.py
+++ b/contrib/occtax/backend/occtax/conf_schema_toml.py
@@ -191,3 +191,4 @@ class GnModuleSchemaConf(Schema):
     ADD_MEDIA_IN_EXPORT = fields.Boolean(load_default=False)
     ID_LIST_HABITAT = fields.Integer(load_default=None)
     CD_TYPO_HABITAT = fields.Integer(load_default=None)
+    ADVANCED_DETAILS_OCCURRENCE_EXPANDED = fields.Boolean(load_default=False)
diff --git a/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts b/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
index 047506c63f..cda1ab9bf1 100644
--- a/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
+++ b/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
@@ -77,7 +77,9 @@ export class OcctaxFormOccurrenceComponent implements OnInit, OnDestroy {
         )
         .subscribe((display: boolean) => (this.displayProofFromElements = display))
     );
-
+    this.advanced = this.config.OCCTAX.ADVANCED_DETAILS_OCCURRENCE_EXPANDED
+      ? 'expanded'
+      : 'collapsed';
     this.initTaxrefSearch();
   }
 
diff --git a/contrib/occtax/occtax_config.toml.example b/contrib/occtax/occtax_config.toml.example
index 6f05007c01..6acedbcd02 100644
--- a/contrib/occtax/occtax_config.toml.example
+++ b/contrib/occtax/occtax_config.toml.example
@@ -24,6 +24,9 @@ DATE_FORM_WITH_TODAY = true
 # Displays the possibility for the user to indicate a default value for the different fields of the form
 ENABLE_SETTINGS_TOOLS = false
 
+# Automatically expand the advanced button when adding a taxon
+ADVANCED_DETAILS_OCCURRENCE_EXPANDED = false
+
 # -------- MAPLIST PARAMETER ------------
 
 # Zoom level on the map from which you can add point/line/polygon

From ef501d7c5d9848a66c1dbf44906df564194e584d Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 14:06:44 +0200
Subject: [PATCH 193/209] Install - Bump GN to 2.13.0

---
 install/install_all/install_all.ini | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/install/install_all/install_all.ini b/install/install_all/install_all.ini
index ad8c1a2568..99e02b2002 100644
--- a/install/install_all/install_all.ini
+++ b/install/install_all/install_all.ini
@@ -32,7 +32,7 @@ usershub_release=2.3.4
 ### CONFIGURATION GEONATURE ###
 
 # Version de GeoNature
-geonature_release=2.12.3
+geonature_release=2.13.0
 # Effacer la base de données GeoNature existante lors de la réinstallation
 drop_geonaturedb=false
 # Nom de la base de données GeoNature

From e4c09357ca0cce69197d6e7b880b02a5d17b5d34 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Mon, 22 May 2023 22:50:08 +0200
Subject: [PATCH 194/209] Changelog 2.13.0

---
 docs/CHANGELOG.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 2b5a74b5f6..8c115ae50c 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,6 +1,55 @@
 CHANGELOG
 =========
 
+2.13.0 (unreleased)
+-------------------
+
+Révision globale des permissions
+
+**TODO**
+
+- MAJ des modules définissant leurs permissions disponibles
+- Release TH et UH + Flask-utils ?
+
+**🚀 Nouveautés**
+
+- Refonte complète des permissions (#2487)
+- Suppression de l'héritage des permissions du module "GeoNature" vers les autres modules, et de l'objet "All" vers les éventuels autres objets des modules. Chaque permission dans un module doit désormais être définie explicitement. Cela entraine de devoir définir plus de permissions (à l'installation d'un nouveau module notamment) mais aussi de les rendre plus lisibles, additives et explicites (#2474)
+- Evolution du modèle de données des permissions pour élargir les possibilités de filtrage des permissions au-delà de la portée (AKA appartenance AKA scope) (#2472)
+- Suppression Scope 0 et 3
+- Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
+- Admin des permissions (Flask-admin) ne proposant que les permissions disponibles, calculant les permissions explicites d'un utilisateur et celles provenant d'un groupe auquel il appartient
+- Optimisation et agrégation des permissions
+- [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
+- Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
+- Ajout de la vérification des permissions manquantes sur différentes routes (#2542 / #1863)
+- Ajout de notifications quand un commentaire est ajouté sur une observation (#2460)
+- [Admin] Fixer la barre de navigation du menu latéral et possibilité de la rabbatre (#2556)
+- [Synthèse] Ajout d'un filtre par source (#2513)
+- [Synthèse] Ajout d'un filtre par `id_synthese` (#2516)
+- Suppression des médias orphelins basculée dans une tache Celery Beat lancée automatiquement toutes les nuits (`clean_attachments`), et non plus à l'ajout ou suppression d'un autre média (#2436)
+
+**🐛 Corrections**
+
+- [Occtax] Correction du déplacement du marqueur de localisation poncutelle d'un relevé (#2554 et #2552)
+- Correction de la sélection automatique des valeurs par défaut numériques dans les champs de type "Liste déroulante (Select)" des formulaires dynamiques (#2540)
+
+**💻 Développement**
+
+- Découpage du script `install/03_create_db.sh` en 2 (avec la création du fichier `install/03b_populate_db.sh`) notamment pour améliorer la dockerisation de GeoNature (#2544)
+- Ajout d'un script `install/03b_populate_db_for_test.sh` pouvant être utilisé par la CI de test des modules GeoNature (#2544)
+- Ajout d'un script `install/assets/docker_startup.sh` pour lancer les migrations Alembic depuis le docker de GeoNature (#2544)
+- Création d'un fichier `install/assets/db/add_pg_extensions.sql` regroupant la création des extensions PostgreSQL (#2544)
+- Amélioration de `APPLICATION_ROOT` pour qu'il fonctionne en mode développement (#2546)
+- Amélioration des modèles de la Synthèse pour prendre en compte les valeurs par défaut des nomenclatures (#2524)
+- Meilleure portabilité des scripts dans les différents systèmes Unix (#2435)
+
+**⚠️ Notes de version**
+
+- Les permissions existantes sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
+- Restart worker à cause de la nouvelle tache Celery beat ?
+
+
 2.12.3 (2023-05-09)
 -------------------
 

From 0dfc23929761c365b4904bb010ad15e9c3406fbd Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 23 May 2023 08:38:11 +0200
Subject: [PATCH 195/209] Review changelog 2.13.0

---
 docs/CHANGELOG.md | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 8c115ae50c..9e5c58d069 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -4,7 +4,8 @@ CHANGELOG
 2.13.0 (unreleased)
 -------------------
 
-Révision globale des permissions
+- Révision globale des permissions pour pouvoir leur associer d'autres types de filtres (sensibilité notamment), les simplifier et clarifier en supprimant l'héritage et en définissant les permissions disponibles pour chaque module
+- Vérifiez que vos modules sont compatibles avec le nouveau mécanisme de permissions disponibles
 
 **TODO**
 
@@ -15,10 +16,11 @@ Révision globale des permissions
 
 - Refonte complète des permissions (#2487)
 - Suppression de l'héritage des permissions du module "GeoNature" vers les autres modules, et de l'objet "All" vers les éventuels autres objets des modules. Chaque permission dans un module doit désormais être définie explicitement. Cela entraine de devoir définir plus de permissions (à l'installation d'un nouveau module notamment) mais aussi de les rendre plus lisibles, additives et explicites (#2474)
-- Evolution du modèle de données des permissions pour élargir les possibilités de filtrage des permissions au-delà de la portée (AKA appartenance AKA scope) (#2472)
-- Suppression Scope 0 et 3
+- Evolution du modèle de données des permissions pour élargir les possibilités de filtrage des permissions au-delà de l'appartenance (anciennement nommée portée ou scope) (#2472)
+- Suppression des permissions ayant une appartenance de niveau 0 (Aucune donnée). En effet, en supprimant l'héritage des permissions et en les définissant par module de manière explicite, si un groupe ou utilisateur n'a aucune permission sur un module, alors il n'y accède pas et ne le voit pas dans le menu latéral. Si il a n'importe quelle permission sur un module, alors il y accède.
+- Suppression du filtre d'appartenance de niveau 3 (Toutes les données). En effet, celui-ci est désormais redondant avec l'ajout d'une permission sans filtre.
 - Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
-- Admin des permissions (Flask-admin) ne proposant que les permissions disponibles, calculant les permissions explicites d'un utilisateur et celles provenant d'un groupe auquel il appartient
+- Admin des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient
 - Optimisation et agrégation des permissions
 - [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
 - Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
@@ -47,8 +49,7 @@ Révision globale des permissions
 **⚠️ Notes de version**
 
 - Les permissions existantes sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
-- Restart worker à cause de la nouvelle tache Celery beat ?
-
+- Si vous avez des modules externes, vous devez déclarer ses permissions disponibles (exemple : #2543)
 
 2.12.3 (2023-05-09)
 -------------------

From 978cf913c1609caaebd8cb8cffc1fb68d026eb84 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Tue, 6 Jun 2023 09:30:22 +0200
Subject: [PATCH 196/209] Update CHANGELOG.md

---
 docs/CHANGELOG.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 9e5c58d069..7b51cf7886 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -10,7 +10,7 @@ CHANGELOG
 **TODO**
 
 - MAJ des modules définissant leurs permissions disponibles
-- Release TH et UH + Flask-utils ?
+- Release TH et UH + Flask-utils = bump dépendances ?
 
 **🚀 Nouveautés**
 
@@ -49,7 +49,8 @@ CHANGELOG
 **⚠️ Notes de version**
 
 - Les permissions existantes sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
-- Si vous avez des modules externes, vous devez déclarer ses permissions disponibles (exemple : #2543)
+- Désormais, quand vous installerez un nouveau module (ou sous-module), il faudra lui appliquer des permissions aux groupes ou utilisateurs qui doivent y accéder.
+- Si vous avez des modules externes, vous devez déclarer ses permissions disponibles (exemple : #2543).
 
 2.12.3 (2023-05-09)
 -------------------

From f6dbb2016cb8babb08f47eafa8bb1c55cd8ac55a Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Thu, 22 Jun 2023 18:11:27 +0200
Subject: [PATCH 197/209] =?UTF-8?q?Changelog=202.13.0=20-=20Compl=C3=A9men?=
 =?UTF-8?q?ts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 7b51cf7886..8bec612165 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -11,6 +11,7 @@ CHANGELOG
 
 - MAJ des modules définissant leurs permissions disponibles
 - Release TH et UH + Flask-utils = bump dépendances ?
+- Support Debian 12 (#2594)
 
 **🚀 Nouveautés**
 
@@ -35,6 +36,9 @@ CHANGELOG
 
 - [Occtax] Correction du déplacement du marqueur de localisation poncutelle d'un relevé (#2554 et #2552)
 - Correction de la sélection automatique des valeurs par défaut numériques dans les champs de type "Liste déroulante (Select)" des formulaires dynamiques (#2540)
+- Correction de la gestion des entiers pour les champs additionnels de type "checkbox" (#2518)
+- Récupération du contenu du champs "Organisme" dans le formulaire de demande de création de compte (#1760)
+- Amélioration des messages lors de la demande de création de compte (#2575)
 
 **💻 Développement**
 
@@ -45,6 +49,9 @@ CHANGELOG
 - Amélioration de `APPLICATION_ROOT` pour qu'il fonctionne en mode développement (#2546)
 - Amélioration des modèles de la Synthèse pour prendre en compte les valeurs par défaut des nomenclatures (#2524)
 - Meilleure portabilité des scripts dans les différents systèmes Unix (#2435)
+- Mise à jour des dépendances Python (#2596)
+- Documentation de développement des permissions (#2585)
+- Les médias orphelins sont désormais supprimés par une tache Celery Beat, et non plus à chaque ajout ou modification d'un média (#2436)
 
 **⚠️ Notes de version**
 

From 1b99a67052e720d46e3141392cb9ad07482e975d Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Fri, 23 Jun 2023 00:02:09 +0200
Subject: [PATCH 198/209] Changelog 2.13.0

Mention Permissions Admin issue (documentation)
---
 docs/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 8bec612165..0ece71d7c1 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -21,7 +21,7 @@ CHANGELOG
 - Suppression des permissions ayant une appartenance de niveau 0 (Aucune donnée). En effet, en supprimant l'héritage des permissions et en les définissant par module de manière explicite, si un groupe ou utilisateur n'a aucune permission sur un module, alors il n'y accède pas et ne le voit pas dans le menu latéral. Si il a n'importe quelle permission sur un module, alors il y accède.
 - Suppression du filtre d'appartenance de niveau 3 (Toutes les données). En effet, celui-ci est désormais redondant avec l'ajout d'une permission sans filtre.
 - Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
-- Admin des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient
+- Refonte de l'interface d'administration des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient (#2605)
 - Optimisation et agrégation des permissions
 - [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
 - Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)

From 57e1cecd5f796f04281bc92c3002211b9486536a Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Fri, 23 Jun 2023 00:15:01 +0200
Subject: [PATCH 199/209] Changelog 2.13.0 - Missing fix

---
 docs/CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 0ece71d7c1..0ed24c6d09 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -37,6 +37,7 @@ CHANGELOG
 - [Occtax] Correction du déplacement du marqueur de localisation poncutelle d'un relevé (#2554 et #2552)
 - Correction de la sélection automatique des valeurs par défaut numériques dans les champs de type "Liste déroulante (Select)" des formulaires dynamiques (#2540)
 - Correction de la gestion des entiers pour les champs additionnels de type "checkbox" (#2518)
+- Correction de l'envoi à plusieurs destinataires des emails de demande de création de compte (#2389)
 - Récupération du contenu du champs "Organisme" dans le formulaire de demande de création de compte (#1760)
 - Amélioration des messages lors de la demande de création de compte (#2575)
 

From 8169b6da145dc838189f778a1913a5ec029324ed Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 12 Jul 2023 01:37:34 +0200
Subject: [PATCH 200/209] Changelog 2.13.0

---
 docs/CHANGELOG.md | 45 +++++++++++++++++++++++++--------------------
 1 file changed, 25 insertions(+), 20 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 0ed24c6d09..1e8c729654 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -5,41 +5,41 @@ CHANGELOG
 -------------------
 
 - Révision globale des permissions pour pouvoir leur associer d'autres types de filtres (sensibilité notamment), les simplifier et clarifier en supprimant l'héritage et en définissant les permissions disponibles pour chaque module
-- Vérifiez que vos modules sont compatibles avec le nouveau mécanisme de permissions disponibles
-
-**TODO**
-
-- MAJ des modules définissant leurs permissions disponibles
-- Release TH et UH + Flask-utils = bump dépendances ?
-- Support Debian 12 (#2594)
+- Possibilité de filtrer les données dans la Synthèse selon leur sensibilité, mais sans floutage pour le moment, en affichant ou non les données sensibles selon les permissions de l'utilisateur
+- Vérifiez que vos modules soient compatibles avec le nouveau mécanisme de déclaration des permissions disponibles
 
 **🚀 Nouveautés**
 
 - Refonte complète des permissions (#2487)
-- Suppression de l'héritage des permissions du module "GeoNature" vers les autres modules, et de l'objet "All" vers les éventuels autres objets des modules. Chaque permission dans un module doit désormais être définie explicitement. Cela entraine de devoir définir plus de permissions (à l'installation d'un nouveau module notamment) mais aussi de les rendre plus lisibles, additives et explicites (#2474)
-- Evolution du modèle de données des permissions pour élargir les possibilités de filtrage des permissions au-delà de l'appartenance (anciennement nommée portée ou scope) (#2472)
-- Suppression des permissions ayant une appartenance de niveau 0 (Aucune donnée). En effet, en supprimant l'héritage des permissions et en les définissant par module de manière explicite, si un groupe ou utilisateur n'a aucune permission sur un module, alors il n'y accède pas et ne le voit pas dans le menu latéral. Si il a n'importe quelle permission sur un module, alors il y accède.
-- Suppression du filtre d'appartenance de niveau 3 (Toutes les données). En effet, celui-ci est désormais redondant avec l'ajout d'une permission sans filtre.
-- Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
-- Refonte de l'interface d'administration des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient (#2605)
-- Optimisation et agrégation des permissions
-- [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
-- Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
-- Ajout de la vérification des permissions manquantes sur différentes routes (#2542 / #1863)
+  - Suppression de l'héritage des permissions du module "GeoNature" vers les autres modules, et de l'objet "All" vers les éventuels autres objets des modules. Chaque permission dans un module doit désormais être définie explicitement. Cela entraine de devoir définir plus de permissions (à l'installation d'un nouveau module notamment) mais aussi de les rendre plus lisibles, additives et explicites (#2474)
+  - Evolution du modèle de données des permissions pour élargir les possibilités de filtrage des permissions au-delà de l'appartenance (anciennement nommée portée ou scope) (#2472)
+  - Suppression des permissions ayant une appartenance de niveau 0 (Aucune donnée). En effet, en supprimant l'héritage des permissions et en les définissant par module de manière explicite, si un groupe ou utilisateur n'a aucune permission sur un module, alors il n'y accède pas et ne le voit pas dans le menu latéral. Si il a n'importe quelle permission sur un module, alors il y accède.
+  - Suppression du filtre d'appartenance de niveau 3 (Toutes les données). En effet, celui-ci est désormais redondant avec l'ajout d'une permission sans filtre.
+  - Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
+  - Refonte de l'interface d'administration des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient (#2605)
+  - Optimisation et agrégation des permissions
+  - [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher et de les exporter ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
+  - Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
+  - Ajout de la vérification des permissions manquantes sur différentes routes (#2542 / #1863)
 - Ajout de notifications quand un commentaire est ajouté sur une observation (#2460)
+- Support de Debian 12 (avec Python 3.11, PostgreSQL 15 et PostGIS 3.3) (#1787)
 - [Admin] Fixer la barre de navigation du menu latéral et possibilité de la rabbatre (#2556)
 - [Synthèse] Ajout d'un filtre par source (#2513)
 - [Synthèse] Ajout d'un filtre par `id_synthese` (#2516)
+- [Synthèse] Recherche des observateurs multiples et insensible aux accents (#2568)
+- Conservation du fond de carte utilisé quand on navigue dans les modules (#2619)
 - Suppression des médias orphelins basculée dans une tache Celery Beat lancée automatiquement toutes les nuits (`clean_attachments`), et non plus à l'ajout ou suppression d'un autre média (#2436)
 
 **🐛 Corrections**
 
 - [Occtax] Correction du déplacement du marqueur de localisation poncutelle d'un relevé (#2554 et #2552)
+- [Occtax] Correction du centrage sur la carte quand on modifie un relevé
 - Correction de la sélection automatique des valeurs par défaut numériques dans les champs de type "Liste déroulante (Select)" des formulaires dynamiques (#2540)
 - Correction de la gestion des entiers pour les champs additionnels de type "checkbox" (#2518)
 - Correction de l'envoi à plusieurs destinataires des emails de demande de création de compte (#2389)
 - Récupération du contenu du champs "Organisme" dans le formulaire de demande de création de compte (#1760)
 - Amélioration des messages lors de la demande de création de compte (#2575)
+- Correction du graphique dans l'export PDF des cadres d'acquisition (#2618)
 
 **💻 Développement**
 
@@ -52,13 +52,18 @@ CHANGELOG
 - Meilleure portabilité des scripts dans les différents systèmes Unix (#2435)
 - Mise à jour des dépendances Python (#2596)
 - Documentation de développement des permissions (#2585)
-- Les médias orphelins sont désormais supprimés par une tache Celery Beat, et non plus à chaque ajout ou modification d'un média (#2436)
 
 **⚠️ Notes de version**
 
-- Les permissions existantes sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
+Si vous mettez à jour GeoNature :
+
+- Mettre à jour TaxHub en version 1.12.0 (ou plus) et optionnellement UsersHub
+- Si vous les utilisez, mettez à jour les modules Import, Export, Monitoring et Dashboard dans leurs versions compatibles avec GeoNature 2.13, avec la nouvelle procédure consistant uniquement à télécharger, dézipper et renommer les dossiers des modules et de leur configuration
+- Si vous utilisez d'autres modules externes, vérifiez qu'ils disposent d'une version compatible avec GeoNature 2.13, ou faites-les évoluer pour qu'ils déclarent leurs permissions disponibles (exemple : #2543)
+- Suivez la procédure de mise à jour classique de GeoNature (<https://docs.geonature.fr/installation.html#mise-a-jour-de-l-application>)
+- Les permissions existantes sur vos différents groupes et utilisateurs sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
 - Désormais, quand vous installerez un nouveau module (ou sous-module), il faudra lui appliquer des permissions aux groupes ou utilisateurs qui doivent y accéder.
-- Si vous avez des modules externes, vous devez déclarer ses permissions disponibles (exemple : #2543).
+
 
 2.12.3 (2023-05-09)
 -------------------

From 53afafedffb2e06fcdbd0e81649d78e6c7268375 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 12 Jul 2023 01:51:23 +0200
Subject: [PATCH 201/209] Changelog 2.13.0 - Add contributors

---
 docs/CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 1e8c729654..3f5b67ada1 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -64,6 +64,10 @@ Si vous mettez à jour GeoNature :
 - Les permissions existantes sur vos différents groupes et utilisateurs sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
 - Désormais, quand vous installerez un nouveau module (ou sous-module), il faudra lui appliquer des permissions aux groupes ou utilisateurs qui doivent y accéder.
 
+**📝 Merci aux contributeurs**
+
+@bouttier / @TheoLechemia / @VincentCauchois / @Pierre-Narcisi / @joelclems / @andriacap / @mvergez / @MathRdt / @camillemonchicourt
+
 
 2.12.3 (2023-05-09)
 -------------------

From 7bb612d8c54603f7bbcfb2fb5f9dd97b760bf9f6 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 9 Aug 2023 17:32:46 +0200
Subject: [PATCH 202/209] =?UTF-8?q?Changelog=202.13.0=20-=20Compl=C3=A9men?=
 =?UTF-8?q?ts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/CHANGELOG.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 3f5b67ada1..f4f6d24ecc 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -7,6 +7,9 @@ CHANGELOG
 - Révision globale des permissions pour pouvoir leur associer d'autres types de filtres (sensibilité notamment), les simplifier et clarifier en supprimant l'héritage et en définissant les permissions disponibles pour chaque module
 - Possibilité de filtrer les données dans la Synthèse selon leur sensibilité, mais sans floutage pour le moment, en affichant ou non les données sensibles selon les permissions de l'utilisateur
 - Vérifiez que vos modules soient compatibles avec le nouveau mécanisme de déclaration des permissions disponibles
+- Cette nouvelle version est compatible avec Debian 12. Le support de Debian 10 sera arrêté prochainement.
+
+++++++ Améliorations performances recherche taxons (#2592) et TaxHub (https://github.com/PnX-SI/TaxHub/pull/385)
 
 **🚀 Nouveautés**
 
@@ -62,7 +65,7 @@ Si vous mettez à jour GeoNature :
 - Si vous utilisez d'autres modules externes, vérifiez qu'ils disposent d'une version compatible avec GeoNature 2.13, ou faites-les évoluer pour qu'ils déclarent leurs permissions disponibles (exemple : #2543)
 - Suivez la procédure de mise à jour classique de GeoNature (<https://docs.geonature.fr/installation.html#mise-a-jour-de-l-application>)
 - Les permissions existantes sur vos différents groupes et utilisateurs sont récupérées et remises à plat automatiquement sans système d'héritage. Vérifiez cependant les permissions après la mise à jour de vos groupes et utilisateurs.
-- Désormais, quand vous installerez un nouveau module (ou sous-module), il faudra lui appliquer des permissions aux groupes ou utilisateurs qui doivent y accéder.
+- Désormais, quand vous installerez un nouveau module (ou sous-module), pour le voir affiché dans le menu et y avoir accès, il faudra lui appliquer des permissions aux groupes ou utilisateurs qui doivent y accéder.
 
 **📝 Merci aux contributeurs**
 

From 5047f0ddf0db57a042ea3f59ec273d54234050fe Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 12:16:56 +0200
Subject: [PATCH 203/209] Changelog 2.13.0

---
 docs/CHANGELOG.md | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index f4f6d24ecc..2292d83bf9 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,16 +1,14 @@
 CHANGELOG
 =========
 
-2.13.0 (unreleased)
--------------------
+2.13.0 - [Carpodacus erythrinus](https://www.ecrins-parcnational.fr/breve/roselin-gondouins) 🐤 (2023-08-23)
+------------------------------------------------------------------------------------------------------------
 
-- Révision globale des permissions pour pouvoir leur associer d'autres types de filtres (sensibilité notamment), les simplifier et clarifier en supprimant l'héritage et en définissant les permissions disponibles pour chaque module
-- Possibilité de filtrer les données dans la Synthèse selon leur sensibilité, mais sans floutage pour le moment, en affichant ou non les données sensibles selon les permissions de l'utilisateur
-- Vérifiez que vos modules soient compatibles avec le nouveau mécanisme de déclaration des permissions disponibles
+- Révision globale des permissions pour pouvoir leur associer d'autres types de filtres (sensibilité notamment), les simplifier et clarifier en supprimant l'héritage et en définissant les permissions disponibles pour chaque module.
+- Possibilité de filtrer les données dans la Synthèse selon leur sensibilité, mais sans floutage pour le moment (à venir), en affichant ou non les données sensibles selon les permissions de l'utilisateur.
+- Vérifiez que vos modules soient compatibles avec le nouveau mécanisme de déclaration des permissions disponibles. C'est le cas pour les modules Import, Export, Dashboard, Monitorings et Zones humides.
 - Cette nouvelle version est compatible avec Debian 12. Le support de Debian 10 sera arrêté prochainement.
 
-++++++ Améliorations performances recherche taxons (#2592) et TaxHub (https://github.com/PnX-SI/TaxHub/pull/385)
-
 **🚀 Nouveautés**
 
 - Refonte complète des permissions (#2487)
@@ -25,24 +23,32 @@ CHANGELOG
   - Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
   - Ajout de la vérification des permissions manquantes sur différentes routes (#2542 / #1863)
 - Ajout de notifications quand un commentaire est ajouté sur une observation (#2460)
+- Amélioration des performances de la recherche de taxons dans Occtax et dans la Synthèse (#2592 / https://github.com/PnX-SI/TaxHub/issues/384)
 - Support de Debian 12 (avec Python 3.11, PostgreSQL 15 et PostGIS 3.3) (#1787)
 - [Admin] Fixer la barre de navigation du menu latéral et possibilité de la rabbatre (#2556)
 - [Synthèse] Ajout d'un filtre par source (#2513)
 - [Synthèse] Ajout d'un filtre par `id_synthese` (#2516)
 - [Synthèse] Recherche des observateurs multiples et insensible aux accents (#2568)
+- [Occtax] Ajout du paramètre `EXPANDED_TAXON_ADVANCED_DETAILS` permettant d'ouvrir par défaut les champs avancés du formulaire de renseignement du taxon (#2446)
 - Conservation du fond de carte utilisé quand on navigue dans les modules (#2619)
 - Suppression des médias orphelins basculée dans une tache Celery Beat lancée automatiquement toutes les nuits (`clean_attachments`), et non plus à l'ajout ou suppression d'un autre média (#2436)
+- Ajout d'une documentation utilisateur sur le module Métadonnées (#2662)
 
 **🐛 Corrections**
 
 - [Occtax] Correction du déplacement du marqueur de localisation poncutelle d'un relevé (#2554 et #2552)
 - [Occtax] Correction du centrage sur la carte quand on modifie un relevé
+- [Occtax] Correction de l'affichage de la géométrie du précédent relevé quand on enchaine des relevés de type polygone puis point (#2657)
 - Correction de la sélection automatique des valeurs par défaut numériques dans les champs de type "Liste déroulante (Select)" des formulaires dynamiques (#2540)
 - Correction de la gestion des entiers pour les champs additionnels de type "checkbox" (#2518)
 - Correction de l'envoi à plusieurs destinataires des emails de demande de création de compte (#2389)
 - Récupération du contenu du champs "Organisme" dans le formulaire de demande de création de compte (#1760)
 - Amélioration des messages lors de la demande de création de compte (#2575)
 - Correction du graphique dans l'export PDF des cadres d'acquisition (#2618)
+- [Synthèse] Correction de l'affichage des géométries de type multipoint (#2536)
+- [Synthèse] Correction des filtres par défaut (#2634)
+- [Synthèse] Correction des filtres géographiques multiples (#2639)
+- [Métadonnées] Correction de l'affichage du formulaire de filtres avancés (#2649)
 
 **💻 Développement**
 
@@ -69,7 +75,7 @@ Si vous mettez à jour GeoNature :
 
 **📝 Merci aux contributeurs**
 
-@bouttier / @TheoLechemia / @VincentCauchois / @Pierre-Narcisi / @joelclems / @andriacap / @mvergez / @MathRdt / @camillemonchicourt
+@bouttier / @TheoLechemia / @VincentCauchois / @Pierre-Narcisi / @joelclems / @andriacap / @mvergez / @JulienCorny / @MathRdt / @DonovanMaillard / @camillemonchicourt
 
 
 2.12.3 (2023-05-09)
@@ -1683,8 +1689,8 @@ Si vous mettez à jour GeoNature :
 -   Suivez la procédure classique de mise à jour de GeoNature
     (<http://docs.geonature.fr/installation-standalone.html#mise-a-jour-de-l-application>)
 
-2.6.0 - Saxifraga (2021-02-04) 🌸 
---------------------------------
+2.6.0 - Saxifraga 🌸 (2021-02-04)
+---------------------------------
 
 Nécessite Debian 10, car cette nouvelle version nécessite PostgreSQL 10
 minimum (qui n’est pas fourni par défaut avec Debian 9) pour les

From 1bea0b56e5c57fe65f732436e88bcb9751163ad4 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 13:45:17 +0200
Subject: [PATCH 204/209] Changelog - Fix layout

---
 docs/CHANGELOG.md | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 2292d83bf9..e1400a1c7e 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1668,10 +1668,10 @@ Si vous mettez à jour GeoNature :
 -   Synthèse : correction de l’affichage du filtre "statut de
     validation" (#1267)
 -   Permissions : correction de l’URL de redirection après
-    l’éditiondes permissions (#1253)
+    l’édition des permissions (#1253)
 -   Précision de la documentation de mise à jour de GeoNature (#1251)
 -   Ajout du paramètre `DISPLAY_EMAIL_INFO_OBS` dans le fichier
-    d’exemple de configuration (#1066 par \@jbdesbas)
+    d’exemple de configuration (#1066 par @jbdesbas)
 -   Sécurité : suppression d’une route inutile
 -   Correction de l’URL de la doc sur la page d’accueil
 
@@ -1683,11 +1683,12 @@ Si vous mettez à jour GeoNature :
     notes des versions intermédiaires
 -   Exécuter le script de mise à jour de la BDD du sous-module de
     nomenclature :
-    <https://github.com/PnX-SI/Nomenclature-api-module/blob/master/data/update1.3.5to1.3.6.sql>
+    https://github.com/PnX-SI/Nomenclature-api-module/blob/master/data/update1.3.5to1.3.6.sql
 -   Exécuter ensuite le script SQL de mise à jour de la BDD de GeoNature
-    (<https://github.com/PnX-SI/GeoNature/blob/master/data/migrations/2.6.0to2.6.1.sql>)
+    (https://github.com/PnX-SI/GeoNature/blob/master/data/migrations/2.6.0to2.6.1.sql)
 -   Suivez la procédure classique de mise à jour de GeoNature
-    (<http://docs.geonature.fr/installation-standalone.html#mise-a-jour-de-l-application>)
+    (http://docs.geonature.fr/installation-standalone.html#mise-a-jour-de-l-application)
+
 
 2.6.0 - Saxifraga 🌸 (2021-02-04)
 ---------------------------------

From 35094434ecc0b20d087dfef0e8e8a9c4ca1fe7ae Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 13:50:05 +0200
Subject: [PATCH 205/209] Cgangelog - Fix layout

---
 docs/CHANGELOG.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index e1400a1c7e..38a69f263f 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -201,15 +201,15 @@ Si vous mettez à jour GeoNature :
 - Configuration dynamique du frontend : le frontend récupère dynamiquement sa configuration depuis le backend. Pour cela, il nécessite uniquement l’adresse de l’`API_ENDPOINT` qui doit être renseignée dans le fichier `frontend/src/assets/config.json`. En conséquence, il n’est plus nécessaire de rebuilder le frontend lors d’une modification de la configuration de GeoNature ou de ses modules (#2205)
 - Personnalisation de la page d’accueil : ajout d’une section `[HOME]` contenant les paramètres `TITLE`, `INTRODUCTION` et `FOOTER`. Ceux-ci peuvent contenir du code HTML qui est chargé dynamiquement avec la configuration, évitant ainsi la nécessité d’un rebuild du frontend (#2300)
 - Synthèse : Agrégation des observations ayant la même géométrie pour ne les charger qu'une seule fois, et ainsi améliorer les performances et la lisibilité (#1847)
-- Synthèse : Possibilité d'afficher les données agrégées par maille (#1878). La fonctionnalité est configurable avec les paramètres suivant :
-  ```toml
+- Synthèse : Possibilité d'afficher les données agrégées par maille (#1878). La fonctionnalité est configurable avec les paramètres suivants :
+  ```
   [SYNTHESE]
       AREA_AGGREGATION_ENABLED = true
       AREA_AGGREGATION_TYPE = "M10"
       AREA_AGGREGATION_BY_DEFAULT = false    # affichage groupé par défaut
       AREA_AGGREGATION_LEGEND_CLASSES = .   # voir fichier de configuration d’exemple
   ```
-- Synthèse : Possibilité de définir des filtres par défaut à travers le paramètre `SYNTHESE.DEFAULT_FILTERS` (#2261)
+- Synthèse : Possibilité de définir des filtres par défaut avec le paramètre `SYNTHESE.DEFAULT_FILTERS` (#2261)
 - Métadonnées : Chargement des jeux de données seulement quand on clique sur un cadre d'acquisition dans la liste des métadonnées, pour améliorer les performances du module, en ne chargeant pas tous les jeux de données par défaut (#2004)
 - Champs additionnels : Les champs de formulaire de type `radio`, `select`, `multiselect` et `checkbox`, attendent désormais une liste de dictionnaire `{value, label}` (voir doc des champs additionnels) (#2214)
 - Admin : Possibilité de gérer la table des applications mobiles (`t_mobile_apps`) dans le module "Admin" de GeoNature, notamment pour faciliter la gestion des mises à jour de Occtax-mobile (#2352)

From 0208cf4c21b61fb7e7434758711a9f80cb7ec765 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 14:02:57 +0200
Subject: [PATCH 206/209] Changelog - Layout again...

---
 docs/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 38a69f263f..3bb1af3280 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -202,7 +202,7 @@ Si vous mettez à jour GeoNature :
 - Personnalisation de la page d’accueil : ajout d’une section `[HOME]` contenant les paramètres `TITLE`, `INTRODUCTION` et `FOOTER`. Ceux-ci peuvent contenir du code HTML qui est chargé dynamiquement avec la configuration, évitant ainsi la nécessité d’un rebuild du frontend (#2300)
 - Synthèse : Agrégation des observations ayant la même géométrie pour ne les charger qu'une seule fois, et ainsi améliorer les performances et la lisibilité (#1847)
 - Synthèse : Possibilité d'afficher les données agrégées par maille (#1878). La fonctionnalité est configurable avec les paramètres suivants :
-  ```
+  ```toml
   [SYNTHESE]
       AREA_AGGREGATION_ENABLED = true
       AREA_AGGREGATION_TYPE = "M10"

From e9b086b6e27bdbbc793e6af6fb55692e3af005dc Mon Sep 17 00:00:00 2001
From: Pierre Narcisi <pierre.narcisi@mnhn.fr>
Date: Wed, 23 Aug 2023 14:09:35 +0200
Subject: [PATCH 207/209] fix(config): ADVANCED_DETAILS_OCCURRENCE_EXPANDED ->
 EXPANDED_TAXON_ADVANCED_DETAILS

---
 contrib/occtax/backend/occtax/conf_schema_toml.py             | 2 +-
 .../app/occtax-form/occurrence/occurrence.component.ts        | 4 +---
 contrib/occtax/occtax_config.toml.example                     | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/contrib/occtax/backend/occtax/conf_schema_toml.py b/contrib/occtax/backend/occtax/conf_schema_toml.py
index edf6147c0e..fa99d7c883 100644
--- a/contrib/occtax/backend/occtax/conf_schema_toml.py
+++ b/contrib/occtax/backend/occtax/conf_schema_toml.py
@@ -191,4 +191,4 @@ class GnModuleSchemaConf(Schema):
     ADD_MEDIA_IN_EXPORT = fields.Boolean(load_default=False)
     ID_LIST_HABITAT = fields.Integer(load_default=None)
     CD_TYPO_HABITAT = fields.Integer(load_default=None)
-    ADVANCED_DETAILS_OCCURRENCE_EXPANDED = fields.Boolean(load_default=False)
+    EXPANDED_TAXON_ADVANCED_DETAILS = fields.Boolean(load_default=False)
diff --git a/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts b/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
index cda1ab9bf1..5b50d0e71b 100644
--- a/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
+++ b/contrib/occtax/frontend/app/occtax-form/occurrence/occurrence.component.ts
@@ -77,9 +77,7 @@ export class OcctaxFormOccurrenceComponent implements OnInit, OnDestroy {
         )
         .subscribe((display: boolean) => (this.displayProofFromElements = display))
     );
-    this.advanced = this.config.OCCTAX.ADVANCED_DETAILS_OCCURRENCE_EXPANDED
-      ? 'expanded'
-      : 'collapsed';
+    this.advanced = this.config.OCCTAX.EXPANDED_TAXON_ADVANCED_DETAILS ? 'expanded' : 'collapsed';
     this.initTaxrefSearch();
   }
 
diff --git a/contrib/occtax/occtax_config.toml.example b/contrib/occtax/occtax_config.toml.example
index 6acedbcd02..7d0df9642c 100644
--- a/contrib/occtax/occtax_config.toml.example
+++ b/contrib/occtax/occtax_config.toml.example
@@ -25,7 +25,7 @@ DATE_FORM_WITH_TODAY = true
 ENABLE_SETTINGS_TOOLS = false
 
 # Automatically expand the advanced button when adding a taxon
-ADVANCED_DETAILS_OCCURRENCE_EXPANDED = false
+EXPANDED_TAXON_ADVANCED_DETAILS = false
 
 # -------- MAPLIST PARAMETER ------------
 

From 34223aad0c1cba8e145da2a90ffe24fbdf6918dc Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 15:36:39 +0200
Subject: [PATCH 208/209] Bump VERSION - 2.13.0

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index fb609bc25c..fb2c0766b7 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.13.0-beta1
+2.13.0

From 4112da7c67eb349d5dc0c5732ad2c9206fff32a5 Mon Sep 17 00:00:00 2001
From: Camille Monchicourt <camille.monchicourt@ecrins-parcnational.fr>
Date: Wed, 23 Aug 2023 22:45:03 +0200
Subject: [PATCH 209/209] =?UTF-8?q?Changelog=202.13.0=20-=20Compl=C3=A9men?=
 =?UTF-8?q?ts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/CHANGELOG.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 3bb1af3280..c209f14a6e 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -19,7 +19,7 @@ CHANGELOG
   - Définition des permissions disponibles dans chaque module dans la nouvelle table `gn_permissions.t_permissions_available`, pour ne proposer que des permissions qui ont un usage quand on ajoute ou modifie les permissions d'un utilisateur (#2489)
   - Refonte de l'interface d'administration des permissions (Flask-admin) ne proposant que les permissions disponibles, affichant les permissions explicites d'un utilisateur et calculant celles effectives provenant d'un groupe auquel il appartient (#2605)
   - Optimisation et agrégation des permissions
-  - [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher et de les exporter ou non à un groupe ou utilisateurs (pas de floutage pour le moment) (#2504)
+  - [Synthèse] Ajout d'un filtre sur la sensibilité des données, permettant de les afficher et de les exporter ou non à un groupe ou utilisateurs (pas de floutage pour le moment)  (#2504 / #2584)
   - Ajout de la commande `geonature permissions supergrant` permettant d'ajouter toutes les permissions disponibles à un utilisateur ou groupe super-administrateur (#2557)
   - Ajout de la vérification des permissions manquantes sur différentes routes (#2542 / #1863)
 - Ajout de notifications quand un commentaire est ajouté sur une observation (#2460)
@@ -32,7 +32,7 @@ CHANGELOG
 - [Occtax] Ajout du paramètre `EXPANDED_TAXON_ADVANCED_DETAILS` permettant d'ouvrir par défaut les champs avancés du formulaire de renseignement du taxon (#2446)
 - Conservation du fond de carte utilisé quand on navigue dans les modules (#2619)
 - Suppression des médias orphelins basculée dans une tache Celery Beat lancée automatiquement toutes les nuits (`clean_attachments`), et non plus à l'ajout ou suppression d'un autre média (#2436)
-- Ajout d'une documentation utilisateur sur le module Métadonnées (#2662)
+- Ajout d'une documentation utilisateur sur le module Métadonnées - https://docs.geonature.fr/user-manual.html#metadonnees (#2662)
 
 **🐛 Corrections**