Dependency Updates (#3124)

Co-authored-by: Astra <noreply@openai.com>
Co-authored-by: Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Mythos 5.1 <noreply@anthropic.com>

Author: 3 people

.github/dependabot.yml

@@ -2,6 +2,14 @@ version: 2
 updates:
 - package-ecosystem: pip
   directory: "/"
+  groups:
+    pip:
+      patterns:
+        - "*"
+      # Review major upgrades separately.
+      update-types:
+        - minor
+        - patch
   schedule:
     interval: quarterly
   cooldown:
@@ -19,6 +27,14 @@ updates:
     default-days: 7
 - package-ecosystem: docker
   directory: "/"
+  groups:
+    docker:
+      patterns:
+        - "*"
+      # Review major upgrades separately.
+      update-types:
+        - minor
+        - patch
   schedule:
     interval: quarterly
   cooldown:

apps/events/tests/test_importer.py

@@ -5,13 +5,14 @@
 from django.utils.timezone import datetime, make_aware
 
 from apps.events.importer import ICSImporter
-from apps.events.models import Calendar, Event
+from apps.events.models import Calendar, Event, OccurringRule
 
 CUR_DIR = Path(__file__).parent
 EVENTS_CALENDAR = str(CUR_DIR / "events.ics")
 EVENTS_CALENDAR_URL = (
     "https://www.google.com/calendar/ical/j7gov1cmnqr9tvg14k621j7t5c@group.calendar.google.com/public/basic.ics"
 )
+FIXTURE_EVENT_COUNT = 78
 
 
 class EventsImporterTestCase(TestCase):
@@ -23,10 +24,20 @@ def setUpClass(cls):
 
     def test_injest(self):
         importer = ICSImporter(self.calendar)
-        with Path(EVENTS_CALENDAR).open() as fh:
-            ical = fh.read()
+        ical = Path(EVENTS_CALENDAR).read_bytes()
         importer.import_events_from_text(ical)
 
+        self.assertEqual(Event.objects.filter(calendar=self.calendar).count(), FIXTURE_EVENT_COUNT)
+
+        first_event = Event.objects.get(uid="0dpji3hft657pi6cgradu20rro@google.com")
+        self.assertEqual(first_event.title, "PyCon APAC 2014")
+        self.assertEqual(first_event.venue.name, "Academia Sinica, Taipei, Taiwan")
+        self.assertIn('href="http://tw.pycon.org/2014apac/en/"', first_event.description.rendered)
+        occurrence = first_event.next_or_previous_time
+        self.assertTrue(occurrence.all_day)
+        self.assertEqual(make_aware(datetime(year=2014, month=5, day=16)), occurrence.dt_start)
+        self.assertEqual(make_aware(datetime(year=2014, month=5, day=18)), occurrence.dt_end)
+
     def test_modified_event(self):
         importer = ICSImporter(self.calendar)
         ical = """BEGIN:VCALENDAR
@@ -175,3 +186,88 @@ def test_import_event_escaped(self):
         event_page = response.content.decode()
         self.assertIn("<javascript:alert(1)>", event_page)
         self.assertNotIn("<javascript:alert(1)>", event_page)
+
+    def test_import_event_with_named_tzid_converts_to_utc_instant(self):
+        """Named timezones retain winter and summer offsets."""
+        ical = """BEGIN:VCALENDAR
+BEGIN:VTIMEZONE
+TZID:America/New_York
+BEGIN:STANDARD
+DTSTART:19701101T020000
+TZOFFSETFROM:-0400
+TZOFFSETTO:-0500
+TZNAME:EST
+END:STANDARD
+BEGIN:DAYLIGHT
+DTSTART:19700308T020000
+TZOFFSETFROM:-0500
+TZOFFSETTO:-0400
+TZNAME:EDT
+END:DAYLIGHT
+END:VTIMEZONE
+BEGIN:VEVENT
+DTSTART;TZID=America/New_York:20260115T090000
+DTEND;TZID=America/New_York:20260115T100000
+UID:tzid-winter@python.org
+SUMMARY:Winter TZID event
+LOCATION:New York, USA
+END:VEVENT
+BEGIN:VEVENT
+DTSTART;TZID=America/New_York:20260715T090000
+DTEND;TZID=America/New_York:20260715T100000
+UID:tzid-summer@python.org
+SUMMARY:Summer TZID event
+LOCATION:New York, USA
+END:VEVENT
+END:VCALENDAR
+"""
+        importer = ICSImporter(self.calendar)
+        importer.import_events_from_text(ical)
+
+        winter = Event.objects.get(uid="tzid-winter@python.org")
+        summer = Event.objects.get(uid="tzid-summer@python.org")
+        # January = EST (UTC-5).
+        self.assertEqual(
+            make_aware(datetime(year=2026, month=1, day=15, hour=14)), winter.next_or_previous_time.dt_start
+        )
+        # July = EDT (UTC-4).
+        self.assertEqual(
+            make_aware(datetime(year=2026, month=7, day=15, hour=13)), summer.next_or_previous_time.dt_start
+        )
+
+        # Re-import must update in place, not duplicate.
+        winter_pk, winter_occurrence_pk = winter.pk, winter.next_or_previous_time.pk
+        importer.import_events_from_text(ical)
+        winter_again = Event.objects.get(uid="tzid-winter@python.org")
+        self.assertEqual(winter_again.pk, winter_pk)
+        self.assertEqual(winter_again.next_or_previous_time.pk, winter_occurrence_pk)
+        self.assertEqual(Event.objects.filter(uid="tzid-winter@python.org").count(), 1)
+        self.assertEqual(OccurringRule.objects.filter(event=winter_again).count(), 1)
+
+    def test_import_events_from_text_isolates_malformed_event(self):
+        """A bad event must not prevent importing the next one."""
+        ical = """BEGIN:VCALENDAR
+BEGIN:VEVENT
+DTSTART:not-a-date
+DTEND:20130802T203000Z
+UID:bad@python.org
+SUMMARY:Bad event
+LOCATION:Nowhere
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20130802T200000Z
+DTEND:20130802T203000Z
+UID:good@python.org
+SUMMARY:Good event
+LOCATION:Nowhere
+END:VEVENT
+END:VCALENDAR
+"""
+        importer = ICSImporter(self.calendar)
+        importer.import_events_from_text(ical)
+
+        good_event = Event.objects.get(uid="good@python.org")
+        self.assertEqual(
+            make_aware(datetime(year=2013, month=8, day=2, hour=20)),
+            good_event.next_or_previous_time.dt_start,
+        )

apps/jobs/tests/test_thumbnails.py

@@ -0,0 +1,39 @@
+import re
+from io import BytesIO
+from tempfile import TemporaryDirectory
+
+from django.conf import settings
+from django.core.files.base import ContentFile
+from django.core.files.storage import default_storage
+from django.template.loader import render_to_string
+from django.test import TestCase, override_settings
+from PIL import Image
+
+from apps.companies.factories import CompanyFactory
+
+
+@override_settings(CACHES={"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}})
+class ThumbnailGenerationTests(TestCase):
+    def test_featured_company_thumbnail_and_cache(self):
+        with TemporaryDirectory() as media_root, self.settings(MEDIA_ROOT=media_root):
+            source = BytesIO()
+            Image.new("RGB", (480, 320), (30, 90, 200)).save(source, format="PNG")
+            company = CompanyFactory()
+            company.logo.save("logo.png", ContentFile(source.getvalue()))
+            context = {"featured_companies": [company]}
+
+            html = render_to_string("jobs/featured_companies-widget.html", context)
+            match = re.search(r'<img src="([^"]+)"[^>]*width="(\d+)"[^>]*height="(\d+)"', html)
+            self.assertIsNotNone(match, html)
+            src, width, height = match.groups()
+            self.assertEqual((int(width), int(height)), (240, 80))
+            self.assertTrue(src.startswith(settings.MEDIA_URL))
+            name = src.removeprefix(settings.MEDIA_URL)
+            with default_storage.open(name) as generated_file, Image.open(generated_file) as generated:
+                generated.load()
+                self.assertEqual(generated.size, (240, 80))
+                self.assertEqual(generated.format, "PNG")
+
+            modified = default_storage.get_modified_time(name)
+            self.assertEqual(render_to_string("jobs/featured_companies-widget.html", context), html)
+            self.assertEqual(default_storage.get_modified_time(name), modified)

apps/membership/tests/test_views.py

@@ -1,15 +1,91 @@
+from django.contrib.auth.models import Group
 from django.test import TestCase
+from waffle.models import Flag
 from waffle.testutils import override_flag
 
+from apps.users.factories import UserFactory
+
+FLAG_NAME = "psf_membership"
+MEMBERSHIP_URL = "/membership/"
+
 
 class MembershipViewTests(TestCase):
-    @override_flag("psf_membership", active=False)
+    def _set_flag(self, **fields):
+        # TestCase does not run on_commit callbacks.
+        groups = fields.pop("groups", None)
+        users = fields.pop("users", None)
+        flag, _created = Flag.objects.get_or_create(name=FLAG_NAME)
+        for key, value in fields.items():
+            setattr(flag, key, value)
+        flag.save()
+        if groups is not None:
+            flag.groups.set(groups)
+        if users is not None:
+            flag.users.set(users)
+        flag.flush()
+        return flag
+
+    @override_flag(FLAG_NAME, active=False)
     def test_membership_landing_ensure_404(self):
-        response = self.client.get("/membership/")
+        response = self.client.get(MEMBERSHIP_URL)
         self.assertEqual(response.status_code, 404)
 
-    @override_flag("psf_membership", active=True)
+    @override_flag(FLAG_NAME, active=True)
     def test_membership_landing(self):
         # Ensure FlagMixin is working
-        response = self.client.get("/membership/")
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 200)
+
+    def test_everyone_false_overrides_superuser_targeting(self):
+        self._set_flag(everyone=False, superusers=True, staff=True, authenticated=True)
+        user = UserFactory(is_superuser=True, is_staff=True, membership=None)
+        self.client.force_login(user)
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 404)
+
+    def test_authenticated_targeting_grants_access_to_any_logged_in_user(self):
+        self._set_flag(everyone=None, authenticated=True)
+        user = UserFactory(is_superuser=False, is_staff=False, membership=None)
+        self.client.force_login(user)
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 200)
+
+        self.client.logout()
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 404)
+
+    def test_explicit_user_targeting_grants_access_only_to_that_user(self):
+        targeted_user = UserFactory(membership=None)
+        other_user = UserFactory(membership=None)
+        self._set_flag(everyone=None, users=[targeted_user])
+
+        self.client.force_login(targeted_user)
+        response = self.client.get(MEMBERSHIP_URL)
         self.assertEqual(response.status_code, 200)
+
+        self.client.force_login(other_user)
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 404)
+
+    def test_explicit_group_targeting_grants_access_only_to_members(self):
+        targeted_group = Group.objects.create(name="psf-membership-testers")
+        member = UserFactory(groups=[targeted_group], membership=None)
+        non_member = UserFactory(membership=None)
+        self._set_flag(everyone=None, groups=[targeted_group])
+
+        self.client.force_login(member)
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 200)
+
+        self.client.force_login(non_member)
+        response = self.client.get(MEMBERSHIP_URL)
+        self.assertEqual(response.status_code, 404)
+
+    def test_testing_query_param_overrides_targeting_when_everyone_unset(self):
+        self._set_flag(everyone=None, testing=True, superusers=True, staff=True, authenticated=True)
+
+        response = self.client.get(MEMBERSHIP_URL, {"dwft_psf_membership": "1"})
+        self.assertEqual(response.status_code, 200)
+
+        response = self.client.get(MEMBERSHIP_URL, {"dwft_psf_membership": "0"})
+        self.assertEqual(response.status_code, 404)

apps/sponsors/tests/test_thumbnails.py

@@ -0,0 +1,84 @@
+import json
+import re
+from io import BytesIO
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from django.conf import settings
+from django.contrib import admin
+from django.core.cache import cache
+from django.core.files.base import ContentFile
+from django.test import TestCase
+from model_bakery import baker
+from PIL import Image
+from sorl.thumbnail import default
+from sorl.thumbnail.helpers import tokey
+from sorl.thumbnail.images import ImageFile, get_or_create_storage
+from sorl.thumbnail.kvstores.base import add_prefix
+from sorl.thumbnail.models import KVStore
+
+from apps.sponsors.admin import SponsorshipAdmin
+from apps.sponsors.models import Sponsor, Sponsorship
+
+
+class SponsorThumbnailTests(TestCase):
+    def setUp(self):
+        media = TemporaryDirectory()
+        self.addCleanup(media.cleanup)
+        self.addCleanup(self.reset_storage)
+        self.enterContext(
+            self.settings(
+                MEDIA_ROOT=media.name,
+                CACHES={"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}},
+            )
+        )
+        self.reset_storage()
+        source = BytesIO()
+        image = Image.new("RGBA", (300, 300), (30, 144, 255, 255))
+        image.paste((0, 0, 0, 0), (0, 0, 150, 150))
+        image.save(source, format="PNG")
+        sponsor = baker.make(Sponsor)
+        sponsor.web_logo.save("logo.png", ContentFile(source.getvalue()))
+        self.sponsorship = Sponsorship(sponsor=sponsor)
+        self.admin = SponsorshipAdmin(Sponsorship, admin.site)
+
+    @staticmethod
+    def reset_storage():
+        # sorl caches storage instances beyond override_settings.
+        default.storage = default.Storage()
+        default.kvstore = default.KVStore()
+        get_or_create_storage.cache_clear()
+        cache.clear()
+
+    def thumbnail(self):
+        html = str(self.admin.get_sponsor_web_logo(self.sponsorship))
+        match = re.search(r"src='([^']+)'", html)
+        self.assertIsNotNone(match, html)
+        url = match.group(1)
+        self.assertTrue(url.startswith(settings.MEDIA_URL))
+        name = url.removeprefix(settings.MEDIA_URL)
+        return html, name, Path(settings.MEDIA_ROOT) / name
+
+    def test_admin_thumbnail_preserves_transparency_and_reuses_cache(self):
+        html, _, path = self.thumbnail()
+        with Image.open(path) as image:
+            self.assertEqual(image.format, "PNG")
+            self.assertEqual(image.size, (150, 150))
+            self.assertEqual(image.getpixel((10, 10))[3], 0)
+            self.assertEqual(image.getpixel((140, 140))[3], 255)
+        modified = path.stat().st_mtime_ns
+        self.assertEqual(self.thumbnail()[0], html)
+        self.assertEqual(path.stat().st_mtime_ns, modified)
+
+    def test_cached_images_from_before_storage_aliases_remain_readable(self):
+        _, name, path = self.thumbnail()
+        original = path.read_bytes()
+        backend = "django.core.files.storage.FileSystemStorage"
+        key = add_prefix(tokey(name, backend), "image")
+        value = json.dumps({"name": name, "storage": backend, "size": [150, 150]})
+        KVStore.objects.update_or_create(key=key, defaults={"value": value})
+        cache.clear()
+
+        resolved = default.kvstore.get(ImageFile(name, default.storage))
+        self.assertIsNotNone(resolved)
+        self.assertEqual(resolved.read(), original)