Make the glyphicons images non-executable

Django 6.1 requires MySQL 8.4 or MariaDB 10.11 or newer.

.dockerignore

@@ -0,0 +1,14 @@
+.git
+.venv
+**/__pycache__
+**/node_modules
+static/assets
+static/index.html
+staticfiles
+media
+db.sqlite3
+.env
+bbs/local_settings.py
+bbs/management/commands/generate_testdata.py
+.coverage
+coverage.xml

.env-default

@@ -0,0 +1 @@
+VITE_API_URL=http://localhost:3000

.gitea/workflows/deploy.yml

@@ -0,0 +1,60 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  # The runner gives jobs no docker socket, so kaniko builds the image unprivileged.
+  # Its debug image has busybox but no node, so it clones the tested commit itself
+  # instead of using actions/checkout.
+  image:
+    if: vars.DEPLOY_AMIGA == 'true'
+    runs-on: ubuntu-latest
+    needs:
+      - tests
+      - prek
+    container: ghcr.io/osscontainertools/kaniko:v1.28.6-debug
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - name: Build and push
+        env:
+          GIT_USERNAME: ${{ github.actor }}
+          GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          auth=$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_TOKEN" | base64 | tr -d '\n')
+          printf '{"auths":{"git.neuf.no":{"auth":"%s"}}}' "$auth" > /kaniko/.docker/config.json
+          /kaniko/executor \
+            --context "git://git.neuf.no/${{ github.repository }}.git#${{ github.ref }}#${{ github.sha }}" \
+            --destination "git.neuf.no/edb/bbs:${{ github.sha }}" \
+            --build-arg "SENTRY_RELEASE=${{ github.sha }}" \
+            --cache=true --cache-repo git.neuf.no/edb/bbs-cache \
+            --snapshot-mode=redo --use-new-run \
+            --reproducible
+
+  # amiga's authorized_keys sends this key to bbs-deploy, which reads the sha from the
+  # ssh command line and deploys it to every bbs tenant on the host.
+  deploy-amiga:
+    if: vars.DEPLOY_AMIGA == 'true'
+    runs-on: ubuntu-latest
+    needs:
+      - image
+    steps:
+      - name: Deploy
+        run: |
+          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
+          eval $(ssh-agent -s)
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          ssh bbs-deploy@amiga.neuf.no "${{ github.sha }}"
+
+  prek:
+    uses: ./.gitea/workflows/prek.yml
+  tests:
+    uses: ./.gitea/workflows/tests.yml

.gitea/workflows/prek.yml

@@ -0,0 +1,12 @@
+name: "Lint: prek"
+
+on:
+  pull_request:
+  workflow_call:
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: j178/prek-action@v1

.gitea/workflows/tests.yml

@@ -0,0 +1,42 @@
+name: Tests
+
+on:
+  pull_request:
+  workflow_call:
+
+jobs:
+  build_frontend:
+    runs-on: ubuntu-latest
+    container: node:26-alpine
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+  tests:
+    runs-on: ubuntu-latest
+    container: nikolaik/python-nodejs:python3.14-nodejs26
+    steps:
+      - uses: actions/checkout@v4
+
+      # The SPA tests serve the built static/index.html
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+      - name: Run migrations
+        run: uv run --locked manage.py migrate
+      - name: Run Django checks
+        run: uv run manage.py check
+      - name: Run tests with coverage
+        run: uv run pytest -v --cov bbs --cov-report term --cov-report xml:coverage.xml
+
+      - name: Upload coverage reports
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-report
+          path: coverage.xml

.gitignore

@@ -11,4 +11,8 @@ CACHE/
 media/
 tmp/
 frontend/dist
-static/modern
+static/assets
+static/index.html
+.python-version
+.env
+.coverage

.gitlab-ci.yml

@@ -1,35 +0,0 @@
-variables:
-  PIP_CACHE_DIR: "${CI_PROJECT_DIR}/.cache/pip"
-
-default:
-  image: nikolaik/python-nodejs:python3.9-nodejs16
-  cache:
-    paths:
-      - .cache/pip
-      - .venv
-  before_script:
-    - poetry config virtualenvs.in-project true
-    - poetry install
-
-django-checks:
-  stage: build
-  script:
-    - poetry run python manage.py migrate
-    - poetry run python manage.py check
-
-tests:
-  stage: test
-  script:
-    - poetry run bin/test
-
-lint:
-  stage: test
-  script:
-    - poetry run bin/lint
-
-deploy:
-  stage: deploy
-  script:
-    - ssh gitdeploy@dreamcast.neuf.no "$(< bin/deploy)"
-  only:
-    - main

.pre-commit-config.yaml

@@ -1,18 +0,0 @@
-# See https://pre-commit.com for more information
-# See https://pre-commit.com/hooks.html for more hooks
-repos:
-- repo: local
-  hooks:
-  - id: black
-    name: black
-    entry: black
-    args: [--check]
-    language: system
-    require_serial: true
-    types: [python]
-  - id: isort
-    name: isort
-    entry: isort
-    args: [--check]
-    language: system
-    types: [python]

.yamllint.yml

@@ -0,0 +1,8 @@
+extends: default
+
+rules:
+  document-start: disable
+  line-length:
+    max: 120
+  truthy:
+    allowed-values: ["true", "false", "on", "off"]

Dockerfile

@@ -0,0 +1,44 @@
+FROM node:26-trixie-slim AS frontend
+WORKDIR /src/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+# Django serves its routes under /api/ in the image (BBS_API_PREFIX in settings_prod.py)
+ENV VITE_API_URL=/api
+RUN npm run build
+
+FROM python:3.14-slim-trixie AS build
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /bin/uv
+# mysqlclient ships no wheels; it stays until no database is copied from MySQL
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential pkg-config default-libmysqlclient-dev \
+    && rm -rf /var/lib/apt/lists/*
+# The venv lives outside /app so the final stage copies it as a layer of its own, which
+# only a dependency change replaces.
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never UV_PROJECT_ENVIRONMENT=/venv
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+RUN uv sync --locked --no-dev --no-install-project
+COPY . .
+# Vite writes into static/, beside the files already tracked there
+COPY --from=frontend /src/static/ static/
+RUN DJANGO_SETTINGS_MODULE=bbs.settings_prod SECRET_KEY=collectstatic /venv/bin/python manage.py collectstatic --noinput
+
+FROM python:3.14-slim-trixie
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libmariadb3 \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --uid 932 --home-dir /app --no-create-home bbs \
+    && mkdir /data && chown bbs:bbs /data
+COPY --from=build /venv /venv
+COPY --from=build /app /app
+WORKDIR /app
+ARG SENTRY_RELEASE=N/A
+ENV PATH=/venv/bin:$PATH \
+    DJANGO_SETTINGS_MODULE=bbs.settings_prod \
+    PYTHONUNBUFFERED=1 \
+    SENTRY_RELEASE=$SENTRY_RELEASE
+USER bbs
+VOLUME /data
+EXPOSE 8000
+CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "2", "--no-control-socket", "--access-logfile", "-", "bbs.wsgi"]

README.md

@@ -1,36 +1,52 @@
 # Getting started
 
-Before starting, make sure you have a working python and nodejs setup with pyenv and nvm.
+Before starting, make sure you have [mise](https://mise.jdx.dev) installed. It manages Python, Node, uv and prek.
 
 ```bash
-apt-get install libmysqlclient-dev
-poetry install
-poetry shell
-pre-commit install
-python manage.py migrate
-bin/run
+mise install
+prek install
+uv run manage.py migrate
+cp .env-default .env
+uv run manage.py seed_demo_data
 
-# in another terminal
-cd frontend
-npm install
-npm start
+# Optional: create an admin login
+uv run manage.py createsuperuser
 ```
 
+Start the backend and frontend in separate terminals from the project root:
+
+```bash
+mise run server
+```
+
+```bash
+mise run frontend-run
+```
+
+Vite prints the frontend URL when it starts (normally <http://localhost:5173/>; if that port is busy, it selects another). Django runs at <http://localhost:3000/>; open the admin directly at <http://localhost:3000/admin/> or through the frontend dev proxy at the printed Vite URL followed by `/admin/`. The GraphQL API is at <http://localhost:3000/graphql/>; the frontend uses Vite's proxy for development API requests.
+
+To test the frontend against a different backend, set `VITE_DEV_API_PROXY` when starting Vite, for example `VITE_DEV_API_PROXY=https://bbs.neuf.no mise run frontend-run`. This affects the development proxy only; use caution with a live backend, since app changes and submissions may modify production data.
+
+For more realistic statistics, `uv run manage.py seed_demo_data --size medium` also generates random users, orders and deposits spread over time (`small`, `medium` or `large`; add `--seed N` for reproducible output). It adds more data on every run.
+
+To create the admin during data seeding instead, set `BBS_SEED_ADMIN_PASSWORD` for that command; the command only creates a local `admin` superuser if one does not already exist.
+
+## Testing
+
+```bash
+mise run test
+```
+
+## Deployment
+
+Every push to main that passes the tests is built into `git.neuf.no/edb/bbs:<sha>` and deployed to amiga by `.gitea/workflows/deploy.yml`, while the repository variable `DEPLOY_AMIGA` is `true`. The image runs with `bbs.settings_prod`: SQLite and uploads in `/data`, Django under `/api/` and the frontend at the root. The stacks on amiga, one per tenant, are the `bbs` role in [edb-infra](https://git.neuf.no/edb/edb-infra).
+
 ## References
 
-- We use JS code generation to work with queries/mutations in our graphql API: https://github.com/dotansimha/graphql-typed-document-node
-
-## TODO
-
-- update emails
-- Stats: products over time
-- Light on dark colors
-- inventory views
-
+- We use JS code generation to work with queries/mutations in our graphql API: <https://github.com/dotansimha/graphql-typed-document-node>
 
 ## TODO-old
 
 - Larger pictures
 - Compact GUI for max 768 vertical pixels
   - Search right of in title
-

bbs/admin.py

@@ -1,13 +1,20 @@
 from django.contrib import admin
 
-from main.models import *
+from bbs.models import (
+    InventoryTransaction,
+    Order,
+    OrderLine,
+    Product,
+    Transaction,
+    UserProfile,
+)
 
 
+@admin.register(Product)
 class ProductAdmin(admin.ModelAdmin):
     pass
 
 
-admin.site.register(Product, ProductAdmin)
 admin.site.register(InventoryTransaction)
 admin.site.register(Order)
 admin.site.register(OrderLine)

bbs/api/mutations/inventory.py

@@ -0,0 +1,63 @@
+from decimal import Decimal
+from typing import Annotated
+
+import strawberry
+from django.db import transaction
+from strawberry import ID, Info
+
+from bbs import models
+from bbs.api.errors import FieldError, FormErrors
+from bbs.api.types.inventory import InventoryTransaction
+
+
+@strawberry.input
+class InventoryTransactionInput:
+    product_id: ID
+    amount: int
+    unit_price: Decimal
+    comment: str = ""
+
+
+@strawberry.type
+class CreateInventoryTransactionSuccess:
+    inventory_transaction: InventoryTransaction
+
+
+CreateInventoryTransactionResponse = Annotated[
+    CreateInventoryTransactionSuccess | FormErrors,
+    strawberry.union("CreateInventoryTransactionResponse"),
+]
+
+
+@strawberry.mutation
+@transaction.atomic
+def create_inventory_transaction(
+    info: Info,
+    data: InventoryTransactionInput,
+) -> CreateInventoryTransactionResponse:
+    user = info.context.request.user
+    if not user.is_authenticated:
+        message = "Logg inn for å registrere varetransaksjoner."
+        return FormErrors(message=message, fields=[FieldError(field="user", message=message)])
+
+    try:
+        product = models.Product.objects.get(pk=data.product_id, active=True)
+    except models.Product.DoesNotExist, ValueError:
+        message = "Velg et aktivt produkt."
+        return FormErrors(message=message, fields=[FieldError(field="product_id", message=message)])
+
+    product.inventory_amount += data.amount
+    product.save()
+    inventory_transaction = models.InventoryTransaction.objects.create(
+        user=user,
+        product=product,
+        amount=data.amount,
+        unit_price=data.unit_price,
+        comment=data.comment,
+    )
+    return CreateInventoryTransactionSuccess(inventory_transaction=inventory_transaction)
+
+
+@strawberry.type
+class InventoryMutations:
+    create_inventory_transaction = create_inventory_transaction

bbs/api/mutations/shop.py

@@ -1,3 +1,5 @@
+from typing import Annotated, Union
+
 import strawberry
 from django.conf import settings
 from django.contrib.auth import get_user_model
@@ -5,10 +7,10 @@ from django.db import transaction
 from django.shortcuts import get_object_or_404
 from strawberry import ID
 
-from main import models
-from main.api.errors import Error, FieldError, FormErrors
-from main.api.types.inventory import Transaction
-from main.api.types.shop import Order
+from bbs import models
+from bbs.api.errors import Error, FieldError, FormErrors
+from bbs.api.types.inventory import Transaction
+from bbs.api.types.shop import Order
 
 UserModel = get_user_model()
 
@@ -25,20 +27,22 @@ class CreateOrderSuccess:
 
 
 @strawberry.type
-class InsufficientFunds(Error):
+class InsufficientFunds(Error):  # noqa: N818
     amount_lacking: float
 
 
-CreateOrderResponse = strawberry.union("CreateOrderResponse", [CreateOrderSuccess, InsufficientFunds, FormErrors])
+CreateOrderResponse = Annotated[
+    Union[CreateOrderSuccess, InsufficientFunds, FormErrors], strawberry.union("CreateOrderResponse")  # noqa: UP007
+]
 
 
 @strawberry.mutation
 @transaction.atomic
-def create_order(customer_id: ID, order_lines: list[OrderLineInput], is_external: bool = False) -> CreateOrderResponse:
+def create_order(customer_id: ID, order_lines: list[OrderLineInput], is_external: bool = False) -> CreateOrderResponse:  # noqa: FBT001
     # clean and validate
     try:
         user = UserModel.objects.get(pk=customer_id)
-    except (UserModel.DoesNotExist, ValueError):
+    except UserModel.DoesNotExist, ValueError:
         user = None
 
     if user is None and not is_external:
@@ -61,15 +65,17 @@ def create_order(customer_id: ID, order_lines: list[OrderLineInput], is_external
         price = product.sale_price_ext if is_external else product.sale_price_int
         ols.append(models.OrderLine(product=product, amount=ol.amount, unit_price=price))
         order_sum += ol.amount * price
-        product.inventory_amount -= ol.amount
-        product.save()
 
-    if not is_external and user.profile.balance <= order_sum:
+    if not is_external and user.profile.balance < order_sum:
         return InsufficientFunds(
-            message="Du har ikke nok penger på bok.", amount_lacking=abs(order_sum - user.profile.balance)
+            message="Du har ikke nok penger på bok.",
+            amount_lacking=float(abs(order_sum - user.profile.balance)),
         )
 
     # create
+    for ol in ols:
+        ol.product.inventory_amount -= ol.amount
+        ol.product.save()
     order = models.Order.objects.create(customer=user, order_sum=order_sum)
     for ol in ols:
         ol.order = order
@@ -89,12 +95,14 @@ class CreateDepositSuccess:
 
 
 @strawberry.type
-class AboveMaxSaldo(Error):
+class AboveMaxSaldo(Error):  # noqa: N818
     max_saldo: float
     above: float
 
 
-CreateDepositResponse = strawberry.union("CreateDepositResponse", [CreateDepositSuccess, AboveMaxSaldo, FormErrors])
+CreateDepositResponse = Annotated[
+    Union[CreateDepositSuccess, AboveMaxSaldo, FormErrors], strawberry.union("CreateDepositResponse")  # noqa: UP007
+]
 
 
 @strawberry.mutation
@@ -103,7 +111,7 @@ def create_deposit(user_id: ID, amount: int) -> CreateDepositResponse:
     # clean and validate
     try:
         user = UserModel.objects.get(pk=user_id)
-    except (UserModel.DoesNotExist, ValueError):
+    except UserModel.DoesNotExist, ValueError:
         message = "Du har ikke valgt hvem som sette inn penger."
         return FormErrors(
             message=message,
@@ -116,11 +124,11 @@ def create_deposit(user_id: ID, amount: int) -> CreateDepositResponse:
             fields=[FieldError(field="amount", message=message)],
         )
     # 1337 is special <3
-    if amount + user.profile.balance > settings.BBS_SALDO_MAX and amount + user.profile.balance != 1337:
+    if amount + user.profile.balance > settings.BBS_SALDO_MAX and amount + user.profile.balance != 1337:  # noqa: PLR2004
         return AboveMaxSaldo(
             message="Du prøver å sette inn for mye penger",
             max_saldo=settings.BBS_SALDO_MAX,
-            above=amount + user.profile.balance - settings.BBS_SALDO_MAX,
+            above=float(amount + user.profile.balance - settings.BBS_SALDO_MAX),
         )
 
     trans = models.Transaction.objects.create(user=user, amount=amount)

bbs/api/mutations/users.py

@@ -1,13 +1,11 @@
 import strawberry
 import strawberry_django
-from django.contrib.auth import get_user_model
+from django.contrib.auth.models import User as DjangoUser
 from django.db import transaction
-from strawberry_django import auto
+from strawberry import auto
 
-from main import models
-from main.api.types.users import User
-
-DjangoUser = get_user_model()
+from bbs import models
+from bbs.api.types.users import User
 
 
 @strawberry_django.input(DjangoUser)
@@ -19,9 +17,12 @@ class UserInput:
 
 @strawberry.mutation
 @transaction.atomic
-def register_mutation(input: UserInput) -> User:
+def register_mutation(input: UserInput) -> User:  # noqa: A002
     user = DjangoUser.objects.create_user(
-        first_name=input.first_name, last_name=input.last_name, email=input.email, username=input.email
+        first_name=input.first_name,
+        last_name=input.last_name,
+        email=input.email,
+        username=input.email,
     )
     models.UserProfile.objects.create(user=user)
     return user

bbs/api/queries/inventory.py

@@ -0,0 +1,105 @@
+from datetime import datetime
+from decimal import Decimal
+
+import strawberry
+import strawberry_django
+from django.db.models import F, Sum
+from django.utils import timezone
+
+from bbs import models
+from bbs.api.types.inventory import (
+    InventoryReport,
+    InventoryReportProduct,
+    InventoryTransaction,
+    InventoryTransactionOrdering,
+    Transaction,
+    TransactionOrdering,
+)
+
+
+@strawberry.type
+class InventoryQueries:
+    transaction_list: list[Transaction] = strawberry_django.field(pagination=True, ordering=TransactionOrdering)
+    inventory_transaction_list: list[InventoryTransaction] = strawberry_django.field(
+        pagination=True,
+        ordering=InventoryTransactionOrdering,
+    )
+
+    @strawberry.field
+    def inventory_report(self, start_time: datetime, end_time: datetime) -> InventoryReport:
+        if timezone.is_naive(start_time):
+            start_time = timezone.make_aware(start_time)
+        if timezone.is_naive(end_time):
+            end_time = timezone.make_aware(end_time)
+        if start_time > end_time:
+            raise ValueError("The report start date must not be after the end date.")
+
+        purchases = (
+            models.InventoryTransaction.objects.filter(created__range=(start_time, end_time))
+            .values("product_id", "product__name")
+            .annotate(units=Sum("amount"), value=Sum(F("amount") * F("unit_price")))
+        )
+        sales = (
+            models.OrderLine.objects.filter(order__created__range=(start_time, end_time))
+            .values("product_id", "product__name")
+            .annotate(units=Sum("amount"), value=Sum(F("amount") * F("unit_price")))
+        )
+
+        product_totals = {}
+        for product in purchases:
+            product_totals[product["product_id"]] = {
+                "product_id": product["product_id"],
+                "product_name": product["product__name"],
+                "purchase_units": product["units"] or 0,
+                "purchase_value": product["value"] or Decimal(0),
+                "sales_units": 0,
+                "sales_value": Decimal(0),
+            }
+
+        for product in sales:
+            product_data = product_totals.setdefault(
+                product["product_id"],
+                {
+                    "product_id": product["product_id"],
+                    "product_name": product["product__name"],
+                    "purchase_units": 0,
+                    "purchase_value": Decimal(0),
+                    "sales_units": 0,
+                    "sales_value": Decimal(0),
+                },
+            )
+            product_data["sales_units"] = product["units"] or 0
+            product_data["sales_value"] = product["value"] or Decimal(0)
+
+        product_data = sorted(product_totals.values(), key=lambda product: product["product_name"])
+        inventory_purchases = sum((product["purchase_value"] for product in product_data), Decimal(0))
+        product_sales = sum((product["sales_value"] for product in product_data), Decimal(0))
+
+        deposits = models.Transaction.objects.filter(created__range=(start_time, end_time)).aggregate(
+            total=Sum("amount")
+        )["total"] or Decimal(0)
+        order_purchases = models.Order.objects.filter(created__range=(start_time, end_time)).aggregate(
+            total=Sum("order_sum")
+        )["total"] or Decimal(0)
+        deposits_start = models.Transaction.objects.filter(created__lt=start_time).aggregate(total=Sum("amount"))[
+            "total"
+        ] or Decimal(0)
+        orders_start = models.Order.objects.filter(created__lt=start_time).aggregate(total=Sum("order_sum"))[
+            "total"
+        ] or Decimal(0)
+        deposits_end = models.Transaction.objects.filter(created__lte=end_time).aggregate(total=Sum("amount"))[
+            "total"
+        ] or Decimal(0)
+        orders_end = models.Order.objects.filter(created__lte=end_time).aggregate(total=Sum("order_sum"))[
+            "total"
+        ] or Decimal(0)
+
+        return InventoryReport(
+            products=[InventoryReportProduct(**product) for product in product_data],
+            inventory_purchases=inventory_purchases,
+            product_sales=product_sales,
+            deposits=deposits,
+            order_purchases=order_purchases,
+            balance_at_start=deposits_start - orders_start,
+            balance_at_end=deposits_end - orders_end,
+        )

bbs/api/queries/shop.py

@@ -1,15 +1,23 @@
 import strawberry
 import strawberry_django
 
-from main import models
-from main.api.types.shop import Order, OrderOrdering, OrderStats, OrderStatsByTime, Point, Product, ProductOrderStat
+from bbs import models
+from bbs.api.types.shop import (
+    Order,
+    OrderOrdering,
+    OrderStats,
+    OrderStatsByTime,
+    Point,
+    Product,
+    ProductOrderStat,
+)
 
 
 @strawberry.type
 class ShopQueries:
     all_products: list[Product] = strawberry_django.field()
     all_orders: list[Order] = strawberry_django.field()
-    order_list: list[Order] = strawberry_django.field(pagination=True, order=OrderOrdering)
+    order_list: list[Order] = strawberry_django.field(pagination=True, ordering=OrderOrdering)
 
     @strawberry.field
     def order_stats(self) -> OrderStats:
@@ -26,6 +34,9 @@ class ShopQueries:
     @strawberry.field
     def product_stats(self) -> list[ProductOrderStat]:
         return [
-            ProductOrderStat(product_name=stat["product_name"], data=[Point(**p) for p in stat["data"]])
+            ProductOrderStat(
+                product_name=stat["product_name"],
+                data=[Point(**p) for p in stat["data"]],
+            )
             for stat in models.OrderLine.objects.product_order_stats().as_series()
         ]

bbs/api/queries/users.py

@@ -1,14 +1,15 @@
 import strawberry
-import strawberry_django
 from django.contrib.auth.models import User as DjangoUser
 from strawberry import ID
 
-from main.api.types.users import User
+from bbs.api.types.users import User
 
 
 @strawberry.type
 class UsersQueries:
-    all_users: list[User] = strawberry_django.field()
+    @strawberry.field
+    def all_users(self) -> list[User]:
+        return DjangoUser.objects.filter(profile__isnull=False)
 
     @strawberry.field
     def user(self, user_id: ID) -> User:

bbs/api/schema.py

@@ -0,0 +1,36 @@
+import strawberry
+from django.core.exceptions import ObjectDoesNotExist
+from strawberry.extensions import SchemaExtension
+
+from bbs.api.mutations.inventory import InventoryMutations
+from bbs.api.mutations.shop import ShopMutations
+from bbs.api.mutations.users import UsersMutations
+from bbs.api.queries.inventory import InventoryQueries
+from bbs.api.queries.shop import ShopQueries
+from bbs.api.queries.users import UsersQueries
+
+
+@strawberry.type
+class Query(InventoryQueries, ShopQueries, UsersQueries):
+    pass
+
+
+@strawberry.type
+class Mutation(InventoryMutations, ShopMutations, UsersMutations):
+    pass
+
+
+class HandleNotFound(SchemaExtension):
+    def on_operation(self):
+        yield
+        result = self.execution_context.result
+        if result.errors:
+            for error in result.errors:
+                if isinstance(error.original_error, ObjectDoesNotExist):
+                    error.extensions = {
+                        "code": "NOT_FOUND",
+                        "model": type(error.original_error).__qualname__.replace(".DoesNotExist", ""),
+                    }
+
+
+schema = strawberry.Schema(query=Query, mutation=Mutation, extensions=[HandleNotFound])

bbs/api/types/inventory.py

@@ -0,0 +1,62 @@
+from decimal import Decimal
+from typing import TYPE_CHECKING, Annotated
+
+import strawberry
+import strawberry_django
+from strawberry import ID, auto
+
+from bbs import models
+
+if TYPE_CHECKING:
+    from .shop import Product
+    from .users import User
+
+
+@strawberry_django.order_type(models.Transaction)
+class TransactionOrdering:
+    created: auto
+
+
+@strawberry_django.type(models.Transaction)
+class Transaction:
+    id: auto
+    user: Annotated["User", strawberry.lazy(".users")]
+    amount: auto
+    created: auto
+
+
+@strawberry_django.type(models.InventoryTransaction)
+class InventoryTransaction:
+    id: auto
+    user: Annotated["User", strawberry.lazy(".users")]
+    product: Annotated["Product", strawberry.lazy(".shop")]
+    amount: auto
+    unit_price: auto
+    comment: auto
+    created: auto
+
+
+@strawberry_django.order_type(models.InventoryTransaction)
+class InventoryTransactionOrdering:
+    created: auto
+
+
+@strawberry.type
+class InventoryReportProduct:
+    product_id: ID
+    product_name: str
+    purchase_units: int
+    purchase_value: Decimal
+    sales_units: int
+    sales_value: Decimal
+
+
+@strawberry.type
+class InventoryReport:
+    products: list[InventoryReportProduct]
+    inventory_purchases: Decimal
+    product_sales: Decimal
+    deposits: Decimal
+    order_purchases: Decimal
+    balance_at_start: Decimal
+    balance_at_end: Decimal

bbs/api/types/shop.py

@@ -1,12 +1,18 @@
+from decimal import Decimal
+from typing import TYPE_CHECKING, Annotated
+
 import strawberry
 import strawberry_django
-from strawberry_django import auto
+from strawberry import auto
+from strawberry.scalars import JSON
 
-from main import models
-from main.api.types.utils import JSONScalar
+from bbs import models
+
+if TYPE_CHECKING:
+    from .users import User
 
 
-@strawberry_django.filters.filter(models.Product)
+@strawberry_django.filter_type(models.Product)
 class ProductFilter:
     id: auto
     active: auto
@@ -19,11 +25,16 @@ class Product:
     image_url: str
     sale_price_int: auto
     sale_price_ext: auto
+    active: auto
+    inventory_amount: auto
+    updated: auto
+    wholesale_unit_price: Decimal
+    wholesale_value: Decimal
     # FIXME: stricter types
-    user_counts: JSONScalar
+    user_counts: JSON
 
 
-@strawberry_django.ordering.order(models.Order)
+@strawberry_django.order_type(models.Order)
 class OrderOrdering:
     created: auto
 
@@ -31,7 +42,7 @@ class OrderOrdering:
 @strawberry_django.type(models.Order)
 class Order:
     id: auto
-    customer: strawberry.LazyType["User", "main.api.types.users"]
+    customer: Annotated["User", strawberry.lazy(".users")] | None
     order_sum: auto
     created: auto
     orderlines: list["OrderLine"]

bbs/api/types/users.py

@@ -0,0 +1,51 @@
+from datetime import datetime
+from decimal import Decimal
+
+import strawberry
+import strawberry_django
+from django.contrib.auth.models import User as DjangoUser
+from strawberry import auto
+
+from bbs import models
+from bbs.api.types.shop import Point, ProductOrderStat
+
+
+@strawberry.type
+class TopMonth:
+    period: str
+    count: int
+    sum: float
+
+
+@strawberry_django.type(models.UserProfile)
+class UserProfile:
+    id: auto
+    balance: auto
+    image: auto
+    last_purchase_date: datetime
+    order_sum_total: Decimal
+
+    @strawberry.field()
+    def top_months(self) -> list[TopMonth]:
+        return [
+            TopMonth(period=month["period"], count=month["count"], sum=float(month["sum"]))
+            for month in self.top_months()
+        ]
+
+    @strawberry.field()
+    def product_order_stats(self) -> list[ProductOrderStat]:
+        return [
+            ProductOrderStat(
+                product_name=stat["product_name"],
+                data=[Point(**p) for p in stat["data"]],
+            )
+            for stat in self.product_order_stats().as_series()
+        ]
+
+
+@strawberry_django.type(DjangoUser)
+class User:
+    id: auto
+    first_name: auto
+    last_name: auto
+    profile: UserProfile | None

bbs/apps.py

@@ -2,7 +2,7 @@ from django.apps import AppConfig
 
 
 class BBSAppConfig(AppConfig):
-    name = "main"
+    name = "bbs"
     verbose_name = "Biceps Bar System"
 
     def ready(self):

bbs/forms.py

@@ -1,14 +1,22 @@
 from django import forms
 
-from main.models import InventoryTransaction, Product
+from bbs.models import InventoryTransaction, Product
+
+MAX_DIGITS = 9
+DECIMAL_PLACES = 1
 
 
 class InventoryTransactionForm(forms.ModelForm):
-    unit_price = forms.FloatField(required=True, localize=True)
+    unit_price = forms.DecimalField(
+        max_digits=MAX_DIGITS,
+        decimal_places=DECIMAL_PLACES,
+        required=True,
+        localize=True,
+    )
 
     def __init__(self, *args, **kwargs):
         # Only show active products
-        super(InventoryTransactionForm, self).__init__(*args, **kwargs)
+        super().__init__(*args, **kwargs)
         self.fields["product"].queryset = Product.objects.filter(active=True)
 
     class Meta:

bbs/management/commands/export_schema.py

@@ -1,23 +1,23 @@
 from pathlib import Path
 
+from django.conf import settings
 from django.core.management import BaseCommand, CommandParser
 from strawberry.printer import print_schema
 
-from bbssite.settings import BASE_DIR
-from main.api.schema import schema as schema_symbol
+from bbs.api.schema import schema as schema_symbol
 
 
 class Command(BaseCommand):
-    help = " Write graphql schema to file or stdout"
+    help = "Write graphql schema to file or stdout"
 
     def add_arguments(self, parser: CommandParser):
         parser.add_argument("--filename", default="schema.graphql", help="`-` prints to stdout")
 
-    def handle(self, *args, filename=None, **options):
+    def handle(self, *args, filename=None, **options):  # noqa: ARG002
         schema_output = print_schema(schema_symbol)
         if filename != "-":
-            with Path(BASE_DIR, filename).open("w+") as fp:
+            with Path(settings.BASE_DIR, filename).open("w+") as fp:
                 fp.write(schema_output)
             self.stdout.write(self.style.SUCCESS("OK"))
         else:
-            print(schema_output)
+            pass

bbs/management/commands/profile_images.py

@@ -1,6 +1,6 @@
 from django.core.management.base import BaseCommand, CommandParser
 
-from main.models import UserProfile
+from bbs.models import UserProfile
 
 
 class Command(BaseCommand):
@@ -10,11 +10,10 @@ class Command(BaseCommand):
         parser.add_argument("--dry-run", action="store_true")
         parser.add_argument("--force", action="store_true")
 
-    def handle(self, *args, dry_run=False, force=False, **options):
+    def handle(self, *args, dry_run=False, force=False, **options):  # noqa: ARG002
         for profile in UserProfile.objects.all().order_by("id"):
             if dry_run:
-                print(profile.user.email, profile.image_url())
-            else:
-                if force or not profile.image:
+                pass
+            elif force or not profile.image:
                 profile.image = profile.image_url()
                 profile.save()

bbs/management/commands/seed_demo_data.py

@@ -0,0 +1,388 @@
+import os
+import random
+from datetime import datetime, time, timedelta
+from decimal import Decimal
+from urllib.parse import quote
+
+from django.contrib.auth import get_user_model
+from django.core.management import BaseCommand, CommandParser
+from django.db import transaction as db_transaction
+from django.db.models import Sum
+from django.utils import timezone
+
+from bbs.models import InventoryTransaction, Order, OrderLine, Product, Transaction, UserProfile
+
+# Some users go by first name only, which the frontend handles differently.
+DEMO_USERS = (
+    ("demo-ada", "Ada", "Nord", "ada@example.test", Decimal("300.0")),
+    ("demo-bjørn", "Bjørn", "Berg", "bjorn@example.test", Decimal("250.0")),
+    ("demo-casey", "Casey", "Sol", "casey@example.test", Decimal("200.0")),
+    ("demo-kari", "Kari", "Nordmann", "kari@example.test", Decimal("400.0")),
+    ("demo-ole-martin", "Ole-Martin", "Ødegård", "ole-martin@example.test", Decimal("300.0")),
+    ("demo-solveig", "Solveig", "", "solveig@example.test", Decimal("250.0")),
+    ("demo-trygve", "Trygve", "Halvorsen", "trygve@example.test", Decimal("200.0")),
+    ("demo-ingrid", "Ingrid", "Bakken", "ingrid@example.test", Decimal("350.0")),
+    ("demo-håkon", "Håkon", "", "hakon@example.test", Decimal("150.0")),
+)
+
+# name, volume_liter, alcohol_percent, sale_price_int, sale_price_ext
+BEERS = (
+    ("Frydenlund Fatøl", "0.5", "4.5", "25", "35"),
+    ("Ringnes Pilsner", "0.5", "4.7", "25", "35"),
+    ("Nøgne Ø India Pale Ale", "0.5", "7.5", "45", "60"),
+    ("Lervig Lucky Jack", "0.33", "4.7", "40", "55"),
+    ("Munkholm Alkoholfri", "0.5", "0.5", "20", "28"),
+    ("Haandbryggeriet Mjød", "0.5", "8.0", "55", "70"),
+    ("Hansa Bayer", "0.5", "4.6", "27", "37"),
+    ("Aass Bayer", "0.5", "4.5", "28", "38"),
+    ("Mack Pilsner", "0.5", "4.7", "28", "38"),
+    ("Dahls Pils", "0.5", "4.5", "25", "35"),
+    ("Borg Bryggeri Pils", "0.5", "4.7", "30", "40"),
+    ("Grans Bare Pils", "0.5", "4.7", "24", "34"),
+    ("CB Pilsner", "0.5", "4.7", "25", "35"),
+    ("7 Fjell Hopyards IPA", "0.33", "6.5", "48", "63"),
+    ("Tuborg Grønn", "0.5", "4.6", "28", "38"),
+    ("Carlsberg Pilsner", "0.5", "4.6", "28", "38"),
+    ("Frydenlund Bayer", "0.5", "4.5", "26", "36"),
+    ("Berentsens Julebrygg", "0.5", "4.7", "32", "42"),
+    ("Ægir Sumble", "0.5", "4.7", "42", "57"),
+    ("Kinn Vestkyst", "0.5", "5.2", "46", "61"),
+    ("Trondhjem Pilsner", "0.5", "4.7", "30", "40"),
+    ("Nøgne Ø Pale Ale", "0.5", "4.5", "44", "59"),
+    ("Voss Bryggeri Pils", "0.5", "4.7", "38", "50"),
+    ("Lervig Pils", "0.33", "4.7", "30", "40"),
+)
+DEMO_PRODUCTS = BEERS[:6]
+DEMO_STOCK = 30
+
+DESCRIPTIONS = (
+    "Klassisk norsk pils med frisk og rund smak.",
+    "Fyldig og maltrik, perfekt på en kald kveld.",
+    "Lett og forfriskende, godt selskap til maten.",
+    "Humlerik og bitter, for den som vil ha litt mer.",
+    "Tradisjonsrik bryggekunst fra ærverdig bryggeri.",
+)
+
+# user index, days ago, (product name, amount) lines
+DEMO_ORDERS = (
+    (0, 26, (("Ringnes Pilsner", 2), ("Munkholm Alkoholfri", 1))),
+    (1, 21, (("Frydenlund Fatøl", 2), ("Lervig Lucky Jack", 1))),
+    (2, 13, (("Nøgne Ø India Pale Ale", 1),)),
+    (3, 24, (("Frydenlund Fatøl", 2), ("Munkholm Alkoholfri", 1))),
+    (4, 19, (("Nøgne Ø India Pale Ale", 2),)),
+    (5, 15, (("Ringnes Pilsner", 1), ("Lervig Lucky Jack", 1))),
+    (6, 11, (("Haandbryggeriet Mjød", 1),)),
+    (7, 8, (("Lervig Lucky Jack", 2), ("Frydenlund Fatøl", 1))),
+    (3, 4, (("Ringnes Pilsner", 1), ("Frydenlund Fatøl", 1))),
+    (8, 2, (("Munkholm Alkoholfri", 3),)),
+    (4, 1, (("Frydenlund Fatøl", 2),)),
+)
+
+# Extra random users for --size
+FIRST_NAMES = (
+    "Ola", "Kari", "Per", "Anne", "Lars", "Ingrid", "Bjørn", "Marit", "Geir", "Hanne", "Knut", "Liv",
+    "Nils", "Solveig", "Erik", "Astrid", "Håkon", "Sigrid", "Trygve", "Randi", "Espen", "Tone", "Magnus",
+    "Silje", "Henrik", "Maren", "Sander", "Ida", "Jonas", "Emma", "Mathias", "Nora", "Tobias", "Thea",
+    "Vegard", "Kristin", "Ole-Martin", "Anne-Lise", "Frode", "Gunnhild",
+)  # fmt: skip
+LAST_NAMES = (
+    "Hansen", "Johansen", "Olsen", "Larsen", "Andersen", "Pedersen", "Nilsen", "Kristiansen", "Jensen",
+    "Karlsen", "Berg", "Haugen", "Hagen", "Johnsen", "Andreassen", "Jakobsen", "Dahl", "Lund", "Halvorsen",
+    "Eriksen", "Bakken", "Moen", "Strand", "Ødegård",
+)  # fmt: skip
+
+SIZE_PRESETS = {
+    "small": {"users": 6, "orders": 40, "days": 30},
+    "medium": {"users": 15, "orders": 300, "days": 180},
+    "large": {"users": 40, "orders": 1500, "days": 365},
+}
+FIRST_NAME_ONLY_PROB = 0.35  # users registered with just a first name
+EXTERNAL_ORDER_PROB = 0.10  # orders with no customer (paid in cash)
+WITHDRAWAL_PROB = 0.10  # users who have had money paid back out
+
+
+def avatar_url(email: str) -> str:
+    return f"https://i.pravatar.cc/150?u={quote(email)}"
+
+
+def ascii_name(name: str) -> str:
+    return name.lower().replace("ø", "o").replace("å", "a").replace("æ", "ae")
+
+
+class Command(BaseCommand):
+    help = "Create repeatable demo users, products, deposits, and orders for local testing."
+
+    def add_arguments(self, parser: CommandParser):
+        parser.add_argument(
+            "--size",
+            choices=sorted(SIZE_PRESETS),
+            help="Also generate random users, orders and deposits on top of the demo data. Adds more on every run.",
+        )
+        parser.add_argument("--users", type=int, help="Number of random users (overrides --size).")
+        parser.add_argument("--orders", type=int, help="Number of random orders (overrides --size).")
+        parser.add_argument("--days", type=int, help="Spread random activity over this many past days.")
+        parser.add_argument("--seed", type=int, help="Seed for the random data, for reproducible output.")
+
+    def handle(self, *args, **options):  # noqa: ARG002
+        users = self.seed_users()
+        products = self.seed_products(users[0][0])
+        self.seed_deposits(users)
+        self.seed_orders(users, products)
+        self.update_balances(users)
+        self.create_admin()
+
+        if options["size"]:
+            preset = SIZE_PRESETS[options["size"]]
+            generator = RandomData(
+                random.Random(options["seed"]),  # noqa: S311
+                days=options["days"] or preset["days"],
+            )
+            with db_transaction.atomic():
+                generator.run(
+                    n_users=options["users"] or preset["users"],
+                    n_orders=options["orders"] or preset["orders"],
+                )
+            self.stdout.write(
+                f"Generated {generator.n_users} random users and {generator.n_orders} random orders "
+                f"over {generator.days} days.",
+            )
+
+        self.stdout.write(self.style.SUCCESS("Demo data is ready."))
+        if not os.environ.get("BBS_SEED_ADMIN_PASSWORD"):
+            self.stdout.write("Create an admin login with: uv run manage.py createsuperuser")
+
+    @staticmethod
+    def seed_users():
+        user_model = get_user_model()
+        users = []
+        for username, first_name, last_name, email, deposit_amount in DEMO_USERS:
+            user, _ = user_model.objects.get_or_create(
+                username=username,
+                defaults={"first_name": first_name, "last_name": last_name, "email": email},
+            )
+            UserProfile.objects.get_or_create(user=user, defaults={"image": avatar_url(email)})
+            users.append((user, deposit_amount))
+        return users
+
+    @staticmethod
+    def seed_products(stock_user):
+        products = {}
+        for index, (name, volume, alcohol, sale_price_int, sale_price_ext) in enumerate(DEMO_PRODUCTS):
+            product, created = Product.objects.get_or_create(
+                name=name,
+                defaults={
+                    "sale_price_int": Decimal(sale_price_int),
+                    "sale_price_ext": Decimal(sale_price_ext),
+                    "volume_liter": Decimal(volume),
+                    "alcohol_percent": Decimal(alcohol),
+                    "inventory_amount": DEMO_STOCK,
+                    "description": DESCRIPTIONS[index % len(DESCRIPTIONS)],
+                },
+            )
+            products[name] = product
+            if created:
+                InventoryTransaction.objects.get_or_create(
+                    user=stock_user,
+                    product=product,
+                    comment="Demo opening stock",
+                    defaults={"amount": DEMO_STOCK, "unit_price": Decimal(sale_price_int) * Decimal("0.6")},
+                )
+        return products
+
+    def seed_deposits(self, users):
+        for index, (user, deposit_amount) in enumerate(users):
+            created_at = self.timestamp(days_ago=32 + index)
+            deposit, created = Transaction.objects.get_or_create(
+                user=user,
+                created=created_at,
+                defaults={"amount": deposit_amount},
+            )
+            if created:
+                deposit.created = created_at
+                deposit.save(update_fields=["created"])
+
+    def seed_orders(self, users, products):
+        for user_index, days_ago, lines in DEMO_ORDERS:
+            user = users[user_index][0]
+            created_at = self.timestamp(days_ago=days_ago)
+            total = sum(
+                (products[name].sale_price_int * amount for name, amount in lines),
+                start=Decimal(0),
+            )
+            order, created = Order.objects.get_or_create(
+                customer=user,
+                created=created_at,
+                defaults={"order_sum": total},
+            )
+            if created:
+                order.created = created_at
+                order.save(update_fields=["created"])
+                for name, amount in lines:
+                    product = products[name]
+                    OrderLine.objects.create(
+                        order=order,
+                        product=product,
+                        amount=amount,
+                        unit_price=product.sale_price_int,
+                    )
+                    product.inventory_amount -= amount
+                    product.save(update_fields=["inventory_amount"])
+
+    @staticmethod
+    def update_balances(users):
+        for user, _ in users:
+            deposits = Transaction.objects.filter(user=user).aggregate(total=Sum("amount"))["total"] or Decimal(0)
+            purchases = Order.objects.filter(customer=user).aggregate(total=Sum("order_sum"))["total"] or Decimal(0)
+            profile = user.profile
+            profile.balance = deposits - purchases
+            profile.save(update_fields=["balance"])
+
+    def create_admin(self):
+        admin_password = os.environ.get("BBS_SEED_ADMIN_PASSWORD")
+        if not admin_password:
+            return
+
+        user_model = get_user_model()
+        if user_model.objects.filter(username="admin").exists():
+            self.stdout.write("Existing 'admin' account left unchanged.")
+        else:
+            user_model.objects.create_superuser(
+                username="admin",
+                email="admin@example.test",
+                password=admin_password,
+            )
+            self.stdout.write("Created superuser 'admin'.")
+
+    @staticmethod
+    def timestamp(days_ago: int) -> datetime:
+        date = timezone.localdate() - timedelta(days=days_ago)
+        return timezone.make_aware(datetime.combine(date, time(hour=12)))
+
+
+class RandomData:
+    """Random users, restocks, orders and deposits spread over time, for realistic stats."""
+
+    def __init__(self, rng: random.Random, days: int):
+        self.rng = rng
+        self.days = days
+        self.end = timezone.now()
+        self.start = self.end - timedelta(days=days)
+        self.n_users = 0
+        self.n_orders = 0
+
+    def run(self, n_users: int, n_orders: int):
+        users = self.create_users(n_users)
+        products = self.create_products()
+        self.restock(products, users)
+        spent = self.create_orders(users, products, n_orders)
+        self.create_money(users, spent)
+
+    def random_time(self):
+        span = int((self.end - self.start).total_seconds())
+        return self.start + timedelta(seconds=self.rng.randint(0, max(span, 1)))
+
+    @staticmethod
+    def set_created(obj, created):
+        # created is auto_now_add, so backdate with an update
+        type(obj).objects.filter(pk=obj.pk).update(created=created)
+
+    def create_users(self, n: int) -> list:
+        user_model = get_user_model()
+        users = []
+        for _ in range(n):
+            first = self.rng.choice(FIRST_NAMES)
+            last = "" if self.rng.random() < FIRST_NAME_ONLY_PROB else self.rng.choice(LAST_NAMES)
+            base = ".".join(ascii_name(part) for part in (first, last) if part)
+            email = f"{base}@example.test"
+            suffix = 1
+            while user_model.objects.filter(username=email).exists():
+                suffix += 1
+                email = f"{base}{suffix}@example.test"
+
+            user = user_model.objects.create_user(username=email, email=email, first_name=first, last_name=last)
+            UserProfile.objects.create(user=user, image=avatar_url(email))
+            users.append(user)
+        self.n_users = len(users)
+        return users
+
+    def create_products(self) -> list:
+        products = []
+        for name, volume, alcohol, sale_price_int, sale_price_ext in BEERS:
+            product, _ = Product.objects.get_or_create(
+                name=name,
+                defaults={
+                    "sale_price_int": Decimal(sale_price_int),
+                    "sale_price_ext": Decimal(sale_price_ext),
+                    "volume_liter": Decimal(volume),
+                    "alcohol_percent": Decimal(alcohol),
+                    "description": self.rng.choice(DESCRIPTIONS),
+                },
+            )
+            products.append(product)
+        return products
+
+    def restock(self, products: list, users: list):
+        for product in products:
+            wholesale = (product.sale_price_int * Decimal("0.6")).quantize(Decimal("0.1"))
+            for _ in range(self.rng.randint(1, 3)):
+                amount = self.rng.choice([24, 48, 60, 120])
+                restock = InventoryTransaction.objects.create(
+                    user=self.rng.choice(users),
+                    product=product,
+                    amount=amount,
+                    unit_price=wholesale,
+                    comment="Innkjøp",
+                )
+                self.set_created(restock, self.random_time())
+                product.inventory_amount += amount
+            product.save(update_fields=["inventory_amount"])
+
+    def create_orders(self, users: list, products: list, n_orders: int) -> dict:
+        spent = {user.pk: Decimal(0) for user in users}
+        for _ in range(n_orders):
+            customer = None if self.rng.random() < EXTERNAL_ORDER_PROB else self.rng.choice(users)
+            # Mostly a single product, occasionally two or three
+            n_lines = self.rng.choices([1, 2, 3], weights=[60, 30, 10])[0]
+            lines = []
+            order_sum = Decimal(0)
+            for product in self.rng.sample(products, n_lines):
+                amount = self.rng.choices([1, 2, 3, 6], weights=[55, 30, 10, 5])[0]
+                unit_price = product.sale_price_int if customer else product.sale_price_ext
+                lines.append(OrderLine(product=product, amount=amount, unit_price=unit_price))
+                order_sum += unit_price * amount
+                product.inventory_amount = max(0, product.inventory_amount - amount)
+
+            order = Order.objects.create(customer=customer, order_sum=order_sum)
+            for line in lines:
+                line.order = order
+            OrderLine.objects.bulk_create(lines)
+            self.set_created(order, self.random_time())
+            if customer:
+                spent[customer.pk] += order_sum
+
+        for product in products:
+            product.save(update_fields=["inventory_amount"])
+        self.n_orders = n_orders
+        return spent
+
+    def create_money(self, users: list, spent: dict):
+        """Round deposits covering what each user spent, plus rare withdrawals within the leftover buffer."""
+        for user in users:
+            buffer = Decimal(self.rng.choice([0, 50, 100, 200, 300, 400]))
+            remaining = spent[user.pk] + buffer
+            net = Decimal(0)
+            while remaining > 0:
+                amount = min(Decimal(self.rng.choice([100, 200, 200, 300, 500])), remaining)
+                deposit = Transaction.objects.create(user=user, amount=amount)
+                self.set_created(deposit, self.random_time())
+                net += amount
+                remaining -= amount
+
+            if buffer > 0 and self.rng.random() < WITHDRAWAL_PROB:
+                withdrawal = Decimal(self.rng.randint(1, int(buffer)))
+                payout = Transaction.objects.create(user=user, amount=-withdrawal)
+                self.set_created(payout, self.random_time())
+                net -= withdrawal
+
+            user.profile.balance = net - spent[user.pk]
+            user.profile.save(update_fields=["balance"])

bbs/migrations/0001_initial.py

@@ -3,7 +3,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         migrations.swappable_dependency(settings.AUTH_USER_MODEL),
     ]
@@ -72,7 +71,7 @@ class Migration(migrations.Migration):
                     models.ForeignKey(
                         on_delete=models.CASCADE,
                         related_name="orderlines",
-                        to="main.Order",
+                        to="bbs.Order",
                     ),
                 ),
             ],
@@ -157,7 +156,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name="orderline",
             name="product",
-            field=models.ForeignKey(on_delete=models.CASCADE, related_name="orderlines", to="main.Product"),
+            field=models.ForeignKey(on_delete=models.CASCADE, related_name="orderlines", to="bbs.Product"),
         ),
         migrations.AddField(
             model_name="inventorytransaction",
@@ -166,7 +165,7 @@ class Migration(migrations.Migration):
                 on_delete=models.CASCADE,
                 related_name="transactions",
                 verbose_name="Produkt",
-                to="main.Product",
+                to="bbs.Product",
             ),
         ),
         migrations.AddField(
@@ -180,6 +179,6 @@ class Migration(migrations.Migration):
         ),
         migrations.AlterUniqueTogether(
             name="orderline",
-            unique_together=set([("order", "product")]),
+            unique_together={("order", "product")},
         ),
     ]

bbs/migrations/0002_alter_inventorytransaction_amount_and_more.py

@@ -0,0 +1,62 @@
+# Generated by Django 4.0.2 on 2022-03-05 19:26
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("bbs", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="inventorytransaction",
+            name="amount",
+            field=models.IntegerField(verbose_name="Antall"),
+        ),
+        migrations.AlterField(
+            model_name="inventorytransaction",
+            name="unit_price",
+            field=models.DecimalField(decimal_places=1, max_digits=9, verbose_name="Enhetspris"),
+        ),
+        migrations.AlterField(
+            model_name="orderline",
+            name="unit_price",
+            field=models.DecimalField(decimal_places=1, max_digits=9, verbose_name="Enhetspris"),
+        ),
+        migrations.AlterField(
+            model_name="product",
+            name="alcohol_percent",
+            field=models.DecimalField(decimal_places=1, max_digits=9, null=True),
+        ),
+        migrations.AlterField(
+            model_name="product",
+            name="inventory_amount",
+            field=models.IntegerField(default=0),
+        ),
+        migrations.AlterField(
+            model_name="product",
+            name="sale_price_ext",
+            field=models.DecimalField(decimal_places=1, max_digits=9),
+        ),
+        migrations.AlterField(
+            model_name="product",
+            name="sale_price_int",
+            field=models.DecimalField(decimal_places=1, max_digits=9),
+        ),
+        migrations.AlterField(
+            model_name="product",
+            name="volume_liter",
+            field=models.DecimalField(decimal_places=1, max_digits=9, null=True),
+        ),
+        migrations.AlterField(
+            model_name="transaction",
+            name="amount",
+            field=models.DecimalField(decimal_places=1, max_digits=9),
+        ),
+        migrations.AlterField(
+            model_name="userprofile",
+            name="balance",
+            field=models.DecimalField(decimal_places=1, default=0, max_digits=9),
+        ),
+    ]

bbs/migrations/0003_alter_order_order_sum.py

@@ -0,0 +1,17 @@
+# Generated by Django 4.0.2 on 2023-06-28 19:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("bbs", "0002_alter_inventorytransaction_amount_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="order",
+            name="order_sum",
+            field=models.DecimalField(db_column="sum", decimal_places=1, max_digits=9),
+        ),
+    ]

bbs/migrations/0004_orderline_unique_constraint.py

@@ -0,0 +1,20 @@
+# Generated by Django 5.2.18 on 2026-10-22 23:51
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("bbs", "0003_alter_order_order_sum"),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="orderline",
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name="orderline",
+            constraint=models.UniqueConstraint(fields=("order", "product"), name="unique_order_product"),
+        ),
+    ]

bbs/models.py

@@ -1,7 +1,7 @@
-import hashlib
-from datetime import datetime
+import hashlib  # noqa: EXE002
+from datetime import UTC, datetime
+from decimal import Decimal
 from itertools import groupby
-from typing import Type
 
 from django.conf import settings
 from django.db import models
@@ -17,6 +17,8 @@ from django.db.models.functions import (
 )
 
 EXTERNAL_USER = "Ekstern"
+MAX_DIGITS = 9
+DECIMAL_PLACES = 1
 
 
 def _format_counts(per_user):
@@ -36,14 +38,15 @@ def _format_counts(per_user):
 
 class Product(models.Model):
     name = models.CharField(max_length=64)
-    sale_price_int = models.FloatField()
-    sale_price_ext = models.FloatField()
+    sale_price_int = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES)
+    sale_price_ext = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES)
     description = models.CharField(max_length=256, blank=True)
-    volume_liter = models.FloatField(null=True)
-    alcohol_percent = models.FloatField(null=True)
+    volume_liter = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES, null=True)
+    alcohol_percent = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES, null=True)
     image = models.ImageField(upload_to="products", blank=True)
     customer_support = models.CharField(max_length=32, blank=True)
-    inventory_amount = models.FloatField(default=0)
+    # FIXME: rename to inventory_quantity
+    inventory_amount = models.IntegerField(default=0)
     active = models.BooleanField(default=True)
     created = models.DateTimeField(auto_now_add=True)
     updated = models.DateTimeField(auto_now=True)
@@ -83,21 +86,26 @@ class Product(models.Model):
 
         return _format_counts(per_user)
 
-    def __str__(self):
+    def __str__(self):  # noqa: DJ012
         return self.name
 
-    class Meta:
+    class Meta:  # noqa: DJ012
         ordering = ["name"]
 
 
 class OrderManager(models.Manager):
-    def count_by_created(self, extract_class: Type[Extract]):
+    def count_by_created(self, extract_class: type[Extract]):
         period = extract_class("created")
         return self.get_queryset().annotate(period=period).values("period").annotate(count=Count("id"))
 
     def count_by_created_period(self, period: str):
-        periods = {"yearly": ExtractYear, "monthly": ExtractMonth, "daily": ExtractIsoWeekDay, "hourly": ExtractHour}
-        assert period in periods
+        periods = {
+            "yearly": ExtractYear,
+            "monthly": ExtractMonth,
+            "daily": ExtractIsoWeekDay,
+            "hourly": ExtractHour,
+        }
+        assert period in periods  # noqa: S101
         return self.count_by_created(periods[period])
 
 
@@ -109,7 +117,7 @@ class Order(models.Model):
         blank=True,
         related_name="orders",
     )
-    order_sum = models.FloatField(db_column="sum")
+    order_sum = models.DecimalField(db_column="sum", max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES)
     created = models.DateTimeField(auto_now_add=True)
 
     objects = OrderManager()
@@ -120,7 +128,7 @@ class Order(models.Model):
     def reciept(self):
         return ", ".join([str(ol) for ol in self.orderlines.all()])
 
-    def __str__(self):
+    def __str__(self):  # noqa: DJ012
         return f"{self.customer or EXTERNAL_USER}: {self.order_sum} kr"
 
 
@@ -146,10 +154,12 @@ class OrderLineManager(models.QuerySet):
 
 
 class OrderLine(models.Model):
-    order = models.ForeignKey("main.Order", on_delete=models.CASCADE, related_name="orderlines")
-    product = models.ForeignKey("main.Product", on_delete=models.CASCADE, related_name="orderlines")
+    order = models.ForeignKey("bbs.Order", on_delete=models.CASCADE, related_name="orderlines")
+    product = models.ForeignKey("bbs.Product", on_delete=models.CASCADE, related_name="orderlines")
+    # FIXME: rename to quantity
     amount = models.IntegerField()
-    unit_price = models.FloatField(verbose_name="Enhetspris")
+    # FIXME: rename to price
+    unit_price = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES, verbose_name="Enhetspris")
 
     objects = OrderLineManager.as_manager()
 
@@ -157,22 +167,24 @@ class OrderLine(models.Model):
     def price(self):
         return self.amount * self.unit_price
 
-    def __str__(self):
+    def __str__(self):  # noqa: DJ012
         return f"{self.amount} {self.product} ({self.unit_price} kr per)"
 
-    class Meta:
-        unique_together = ("order", "product")
+    class Meta:  # noqa: DJ012
+        constraints = [
+            models.UniqueConstraint(fields=["order", "product"], name="unique_order_product"),
+        ]
 
 
 class Transaction(models.Model):
     """Money"""
 
     user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="transactions")
-    amount = models.FloatField()
+    amount = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES)
     created = models.DateTimeField(auto_now_add=True)
 
     def __str__(self):
-        return f"{self.id}: { self.user}: {self.amount}"
+        return f"{self.id}: {self.user}: {self.amount}"
 
 
 class InventoryTransaction(models.Model):
@@ -184,13 +196,15 @@ class InventoryTransaction(models.Model):
         related_name="inventory_transactions",
     )
     product = models.ForeignKey(
-        "main.Product",
+        "bbs.Product",
         on_delete=models.CASCADE,
         related_name="transactions",
         verbose_name="Produkt",
     )
-    amount = models.FloatField(verbose_name="Antall")
-    unit_price = models.FloatField(verbose_name="Enhetspris")
+    # FIXME: rename to quantity
+    amount = models.IntegerField(verbose_name="Antall")
+    # FIXME: rename to price
+    unit_price = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES, verbose_name="Enhetspris")
     comment = models.TextField(verbose_name="Kommentar", blank=True)
     created = models.DateTimeField(auto_now_add=True)
 
@@ -198,13 +212,13 @@ class InventoryTransaction(models.Model):
     def price(self):
         return self.amount * self.unit_price
 
-    def __str__(self):
+    def __str__(self):  # noqa: DJ012
         return f"{self.id}: {self.user}: {self.product}. {self.amount:.0f} stykker ({self.unit_price} kr per)"
 
 
 class UserProfile(models.Model):
     user = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="profile")
-    balance = models.FloatField(default=0.0)
+    balance = models.DecimalField(max_digits=MAX_DIGITS, decimal_places=DECIMAL_PLACES, default=0)
     image = models.URLField(blank=True)
 
     def last_purchase(self):
@@ -212,8 +226,7 @@ class UserProfile(models.Model):
 
     def last_purchase_date(self) -> datetime:
         last = self.last_purchase()
-        last_p = last.created if last else datetime.min
-        return last_p
+        return last.created if last else datetime.min.replace(tzinfo=UTC)
 
     def top_months(self, limit=5):
         return (
@@ -227,21 +240,21 @@ class UserProfile(models.Model):
     def product_order_stats(self):
         return OrderLine.objects.filter(order__customer__pk=self.pk).product_order_stats()
 
-    def order_sum_total(self) -> float:
+    def order_sum_total(self) -> Decimal:
         return Order.objects.filter(customer_id=self.user_id).aggregate(sum=Sum("order_sum"))["sum"] or 0
 
     def image_url(self) -> str:
         if self.user.email:
-            md5_hash = hashlib.md5(self.user.email.lower().strip().encode()).hexdigest()
-            return f"https://www.gravatar.com/avatar/{md5_hash}?d=identicon"
+            sha256_hash = hashlib.sha256(self.user.email.lower().strip().encode()).hexdigest()
+            return f"https://www.gravatar.com/avatar/{sha256_hash}?d=identicon"
 
         return ""
 
-    def save(self, **kwargs):
+    def save(self, **kwargs):  # noqa: DJ012
         if not self.image:
             self.image = self.image_url()
 
         super().save(**kwargs)
 
-    def __str__(self):
+    def __str__(self):  # noqa: DJ012
         return f"{self.user}"

bbs/settings.py

@@ -1,12 +1,13 @@
-# Django settings for bbs project.
+# Django settings for bbs project.  # noqa: EXE002
+import contextlib
 import os
 
-BASE_DIR = os.path.dirname(os.path.dirname(__file__))
+BASE_DIR = os.path.dirname(os.path.dirname(__file__))  # noqa: PTH120
 
 DEBUG = True
 
 ADMINS = (
-    # ('Your Name', 'your_email@example.com'),
+    # ('Your Name', 'your_email@example.com'),  # noqa: ERA001
 )
 MANAGERS = ADMINS
 
@@ -20,18 +21,18 @@ DATABASES = {
 TIME_ZONE = "Europe/Oslo"
 LANGUAGE_CODE = "nb"
 USE_I18N = True
-USE_L10N = True
+USE_TZ = True
 
 SITE_ID = 1
 
 # Media and uploads
-MEDIA_ROOT = os.path.join(BASE_DIR, "media")
+MEDIA_ROOT = os.path.join(BASE_DIR, "media")  # noqa: PTH118
 MEDIA_URL = "/media/"
 
 # Static files
-STATIC_ROOT = os.path.join(BASE_DIR, "staticfiles")
+STATIC_ROOT = os.path.join(BASE_DIR, "staticfiles")  # noqa: PTH118
 STATIC_URL = "/static/"
-STATICFILES_DIRS = (os.path.join(BASE_DIR, "static"),)
+STATICFILES_DIRS = (os.path.join(BASE_DIR, "static"),)  # noqa: PTH118
 
 STATICFILES_FINDERS = (
     "django.contrib.staticfiles.finders.FileSystemFinder",
@@ -39,13 +40,13 @@ STATICFILES_FINDERS = (
 )
 
 # Make this unique, and don't share it with anybody.
-SECRET_KEY = "osv$uy-ea$*%lc)+xiwt5@2b7au%u*c!pa6hmh#vl)*+tp%fss"
+SECRET_KEY = "osv$uy-ea$*%lc)+xiwt5@2b7au%u*c!pa6hmh#vl)*+tp%fss"  # noqa: S105
 
 TEMPLATES = [
     {
         "BACKEND": "django.template.backends.django.DjangoTemplates",
         "DIRS": [
-            os.path.join(BASE_DIR, "templates"),
+            os.path.join(BASE_DIR, "templates"),  # noqa: PTH118
         ],
         "APP_DIRS": True,
         "OPTIONS": {
@@ -72,7 +73,7 @@ MIDDLEWARE = [
     "django.contrib.messages.middleware.MessageMiddleware",
 ]
 
-ROOT_URLCONF = "bbssite.urls"
+ROOT_URLCONF = "bbs.urls"
 
 INSTALLED_APPS = [
     "django.contrib.auth",
@@ -87,16 +88,20 @@ INSTALLED_APPS = [
     "corsheaders",
 ]
 LOCAL_APPS = [
-    "main",
+    "bbs",
 ]
 INSTALLED_APPS += LOCAL_APPS
 
 LOGIN_REDIRECT_URL = "/"
 
+# Where Django's own routes (graphql, admin, accounts) are mounted. Production serves
+# them under api/ beside the frontend; in development Vite proxies them at the root.
+BBS_API_PREFIX = ""
+
 SESSION_COOKIE_AGE = 1209600  # 15 minutes
 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
 
-BBS_SALDO_MAX = 600
+BBS_SALDO_MAX = 1000
 BBS_LIMIT_DEPOSITS = False
 
 # Thumbnails
@@ -140,7 +145,5 @@ CORS_ALLOWED_ORIGINS = [
     "http://localhost:3000",
 ]
 
-try:
-    from .local_settings import *
-except ImportError:
-    pass
+with contextlib.suppress(ImportError):
+    from .local_settings import *  # noqa: F403

bbs/settings_prod.py

@@ -0,0 +1,68 @@
+"""Settings for the container image, from environment variables."""
+
+import os
+
+from bbs.settings import *  # noqa: F403
+from bbs.settings import BASE_DIR, MIDDLEWARE
+
+DEBUG = False
+SECRET_KEY = os.environ["SECRET_KEY"]
+ALLOWED_HOSTS = os.getenv("ALLOWED_HOSTS", "").split(",")
+CSRF_TRUSTED_ORIGINS = [f"https://{host}" for host in ALLOWED_HOSTS if host]
+
+# Django's routes live under /api/, the frontend at the root
+BBS_API_PREFIX = "api/"
+LOGIN_URL = "django.contrib.auth.views.login"
+
+DATA_DIR = os.getenv("DATA_DIR", "/data")
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": os.path.join(DATA_DIR, "db.sqlite3"),  # noqa: PTH118
+        # WAL lets gunicorn's workers read while one writes; IMMEDIATE makes a writer
+        # wait for the lock up to `timeout` instead of failing mid-transaction.
+        "OPTIONS": {
+            "init_command": "PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL;",
+            "transaction_mode": "IMMEDIATE",
+            "timeout": 20,
+        },
+    },
+}
+MEDIA_ROOT = os.path.join(DATA_DIR, "media")  # noqa: PTH118
+STATIC_ROOT = os.path.join(BASE_DIR, "staticfiles")  # noqa: PTH118
+
+# whitenoise serves Django's static files at STATIC_URL, and the built frontend
+# (index.html, assets/) at the root
+# SecurityMiddleware applies the TLS settings below
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "whitenoise.middleware.WhiteNoiseMiddleware",
+    *MIDDLEWARE,
+]
+WHITENOISE_ROOT = os.path.join(BASE_DIR, "static")  # noqa: PTH118
+WHITENOISE_INDEX_FILE = True
+STORAGES = {
+    "default": {"BACKEND": "django.core.files.storage.FileSystemStorage"},
+    "staticfiles": {"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage"},
+}
+
+# TLS ends at the host's nginx
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+SECURE_SSL_REDIRECT = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+
+if dsn := os.getenv("SENTRY_DSN"):
+    import sentry_sdk
+    from sentry_sdk.integrations.django import DjangoIntegration
+
+    sentry_sdk.init(
+        dsn=dsn,
+        environment=os.getenv("SENTRY_ENVIRONMENT", "production"),
+        release=os.getenv("SENTRY_RELEASE", "N/A"),
+        integrations=[DjangoIntegration()],
+        send_default_pii=True,
+        traces_sample_rate=0,
+        send_client_reports=False,
+        auto_session_tracking=False,
+    )

bbs/tests/conftest.py

@@ -0,0 +1,40 @@
+import pytest
+from django.contrib.auth.models import User as DjangoUser
+from django.test import Client
+from strawberry.django.test import GraphQLTestClient
+
+from bbs.models import Order, OrderLine, Product, Transaction, UserProfile
+
+
+@pytest.fixture
+def product(db):  # noqa: ARG001
+    return Product.objects.create(name="borg", sale_price_ext=35, sale_price_int=30)
+
+
+@pytest.fixture
+def user(db):  # noqa: ARG001
+    u = DjangoUser.objects.create_user(
+        username="test@example.com",
+        email="test@example.com",
+        first_name="Test",
+        last_name="User",
+    )
+    UserProfile.objects.create(user=u, balance=10)
+    return u
+
+
+@pytest.fixture
+def order(product):
+    o = Order.objects.create(order_sum=35)
+    OrderLine.objects.create(order=o, product=product, amount=1, unit_price=35)
+    return o
+
+
+@pytest.fixture
+def transaction(user):
+    return Transaction.objects.create(user=user, amount=100)
+
+
+@pytest.fixture
+def gql_client(client: Client):
+    return GraphQLTestClient(client)

bbs/tests/test_forms.py

@@ -0,0 +1,38 @@
+from bbs.forms import DateRangeForm, InventoryTransactionForm
+from bbs.models import Product
+
+
+def test_inventory_form_filters_active_products(db):  # noqa: ARG001
+    active = Product.objects.create(name="active", sale_price_int=10, sale_price_ext=12, active=True)
+    inactive = Product.objects.create(name="inactive", sale_price_int=10, sale_price_ext=12, active=False)
+    product_queryset = InventoryTransactionForm().fields["product"].queryset
+
+    assert active in product_queryset
+    assert inactive not in product_queryset
+
+
+def test_inventory_form_valid(db):  # noqa: ARG001
+    product = Product.objects.create(name="borg", sale_price_ext=35, sale_price_int=30)
+    form = InventoryTransactionForm(
+        data={"product": product.pk, "amount": 5, "unit_price": "12.5", "comment": ""},
+    )
+
+    assert form.is_valid()
+
+
+def test_inventory_form_invalid_missing_required_fields(db):  # noqa: ARG001
+    form = InventoryTransactionForm(data={})
+
+    assert not form.is_valid()
+    assert "product" in form.errors
+
+
+def test_date_range_form_allows_missing_dates():
+    assert DateRangeForm(data={}).is_valid()
+
+
+def test_date_range_form_accepts_dates():
+    form = DateRangeForm(data={"start_time": "2026-01-01 00:00:00", "end_time": "2026-01-31 23:59:59"})
+
+    assert form.is_valid()
+    assert form.cleaned_data["start_time"] is not None

bbs/tests/test_management.py

@@ -0,0 +1,52 @@
+import pytest
+from django.core.management import call_command
+
+from bbs.models import UserProfile
+
+
+def test_profile_images_updates_missing_image(user):
+    UserProfile.objects.filter(pk=user.profile.pk).update(image="")
+
+    call_command("profile_images")
+
+    user.profile.refresh_from_db()
+    assert user.profile.image != ""
+
+
+def test_profile_images_dry_run_skips_update(user):
+    UserProfile.objects.filter(pk=user.profile.pk).update(image="")
+
+    call_command("profile_images", dry_run=True)
+
+    user.profile.refresh_from_db()
+    assert user.profile.image == ""
+
+
+def test_profile_images_force_overwrites_existing_image(user):
+    UserProfile.objects.filter(pk=user.profile.pk).update(image="https://example.com/old.jpg")
+
+    call_command("profile_images", force=True)
+
+    user.profile.refresh_from_db()
+    assert user.profile.image not in ("", "https://example.com/old.jpg")
+
+
+@pytest.mark.django_db
+def test_export_schema_writes_file(tmp_path, settings):
+    settings.BASE_DIR = str(tmp_path)
+
+    call_command("export_schema")
+
+    schema_file = tmp_path / "schema.graphql"
+    assert schema_file.exists()
+    assert "type Query" in schema_file.read_text()
+
+
+@pytest.mark.django_db
+def test_export_schema_stdout_does_not_write_file(tmp_path, settings, capsys):
+    settings.BASE_DIR = str(tmp_path)
+
+    call_command("export_schema", filename="-")
+
+    assert not (tmp_path / "schema.graphql").exists()
+    assert capsys.readouterr().out == ""

bbs/tests/test_models.py

@@ -0,0 +1,313 @@
+import hashlib
+from datetime import UTC, datetime
+from decimal import Decimal
+
+import pytest
+from django.contrib.auth.models import User as DjangoUser
+
+from bbs.models import (
+    EXTERNAL_USER,
+    InventoryTransaction,
+    Order,
+    OrderLine,
+    Product,
+    UserProfile,
+    _format_counts,
+)
+
+# _format_counts
+# ==============
+
+
+def test_format_counts_with_last_name():
+    rows = [{"order__customer__first_name": "Alice", "order__customer__last_name": "Smith", "count": 3}]
+    result = _format_counts(rows)
+    assert result[0]["name"] == "Alice S"
+
+
+def test_format_counts_no_last_name():
+    rows = [{"order__customer__first_name": "Bob", "order__customer__last_name": "", "count": 1}]
+    result = _format_counts(rows)
+    assert result[0]["name"] == "Bob"
+
+
+def test_format_counts_external():
+    rows = [{"order__customer__first_name": None, "order__customer__last_name": None, "count": 2}]
+    result = _format_counts(rows)
+    assert result[0]["name"] == EXTERNAL_USER
+
+
+# Product
+# =======
+
+
+def test_product_str(product):
+    assert str(product) == "borg"
+
+
+def test_image_url_without_image(product):
+    assert product.image_url == ""
+
+
+def test_image_url_with_image(product):
+    product.image = "products/test.jpg"
+    assert product.image_url == product.image.url
+
+
+def test_wholesale_unit_price_no_inventory(product):
+    product.inventory_amount = 0
+    assert product.wholesale_unit_price == 0
+
+
+def test_wholesale_unit_price_no_transactions(product):
+    product.inventory_amount = 5
+    assert product.wholesale_unit_price == 0
+
+
+def test_wholesale_unit_price_within_batch(user, product):
+    product.inventory_amount = 5
+    product.save()
+    InventoryTransaction.objects.create(user=user, product=product, amount=10, unit_price=Decimal("8.0"))
+    assert product.wholesale_unit_price == Decimal("8.0")
+
+
+def test_wholesale_unit_price_exceeds_all_batches(user, product):
+    product.inventory_amount = 20
+    product.save()
+    InventoryTransaction.objects.create(user=user, product=product, amount=5, unit_price=Decimal("8.0"))
+    InventoryTransaction.objects.create(user=user, product=product, amount=5, unit_price=Decimal("6.0"))
+    # inventory(20) > total transactions(10), falls back to first transaction's unit_price
+    assert product.wholesale_unit_price == Decimal("8.0")
+
+
+def test_wholesale_value(user, product):
+    product.inventory_amount = 5
+    product.save()
+    InventoryTransaction.objects.create(user=user, product=product, amount=10, unit_price=Decimal("8.0"))
+    assert product.wholesale_value == product.wholesale_unit_price * 5
+
+
+def test_user_counts(user, product):
+    o = Order.objects.create(customer=user, order_sum=60)
+    OrderLine.objects.create(order=o, product=product, amount=2, unit_price=30)
+    counts = product.user_counts()
+    assert len(counts) == 1
+    assert counts[0]["name"] == "Test U"
+    assert counts[0]["count"] == 2
+
+
+# OrderManager
+# ============
+
+
+def test_count_by_created_period_yearly(order):  # noqa: ARG001
+    qs = list(Order.objects.count_by_created_period("yearly"))
+    assert len(qs) == 1
+    assert "period" in qs[0]
+
+
+def test_count_by_created_period_monthly(order):  # noqa: ARG001
+    qs = list(Order.objects.count_by_created_period("monthly"))
+    assert len(qs) == 1
+
+
+def test_count_by_created_period_daily(order):  # noqa: ARG001
+    qs = list(Order.objects.count_by_created_period("daily"))
+    assert len(qs) == 1
+
+
+def test_count_by_created_period_hourly(order):  # noqa: ARG001
+    qs = list(Order.objects.count_by_created_period("hourly"))
+    assert len(qs) == 1
+
+
+def test_count_by_created_period_invalid():
+    with pytest.raises(AssertionError):
+        Order.objects.count_by_created_period("weekly")
+
+
+# Order
+# =====
+
+
+def test_order_is_external_true(db):  # noqa: ARG001
+    o = Order.objects.create(order_sum=10)
+    assert o.is_external() is True
+
+
+def test_order_is_external_false(user):
+    o = Order.objects.create(customer=user, order_sum=10)
+    assert o.is_external() is False
+
+
+def test_order_receipt_single_line(order):
+    ol = order.orderlines.first()
+    assert order.reciept() == str(ol)
+
+
+def test_order_receipt_multiple_lines(product):
+    product2 = Product.objects.create(name="cola", sale_price_ext=20, sale_price_int=15)
+    o = Order.objects.create(order_sum=55)
+    OrderLine.objects.create(order=o, product=product, amount=1, unit_price=35)
+    OrderLine.objects.create(order=o, product=product2, amount=1, unit_price=20)
+    receipt = o.reciept()
+    assert "borg" in receipt
+    assert "cola" in receipt
+    assert ", " in receipt
+
+
+def test_order_str_external(db):  # noqa: ARG001
+    o = Order.objects.create(order_sum=Decimal("15.0"))
+    assert EXTERNAL_USER in str(o)
+    assert "15.0" in str(o)
+
+
+def test_order_str_with_customer(user):
+    o = Order.objects.create(customer=user, order_sum=Decimal("20.0"))
+    assert str(user) in str(o)
+
+
+# OrderLine / OrderLineManager
+# ============================
+
+
+def test_orderline_price(order):
+    ol = order.orderlines.first()
+    assert ol.price == ol.amount * ol.unit_price
+
+
+def test_orderline_str(order):
+    ol = order.orderlines.first()
+    assert str(ol) == f"{ol.amount} {ol.product} ({ol.unit_price} kr per)"
+
+
+def test_product_order_stats(order):  # noqa: ARG001
+    qs = list(OrderLine.objects.all().product_order_stats())
+    assert len(qs) == 1
+    assert qs[0]["product_name"] == "borg"
+    assert qs[0]["count"] == 1
+
+
+def test_as_series_single_product(order):  # noqa: ARG001
+    qs = OrderLine.objects.all().product_order_stats()
+    series = qs.as_series()
+    assert len(series) == 1
+    assert series[0]["product_name"] == "borg"
+    assert len(series[0]["data"]) == 1
+    assert "x" in series[0]["data"][0]
+    assert "y" in series[0]["data"][0]
+
+
+def test_as_series_multiple_products(user, product):
+    product2 = Product.objects.create(name="cola", sale_price_ext=20, sale_price_int=15)
+    o = Order.objects.create(customer=user, order_sum=55)
+    OrderLine.objects.create(order=o, product=product, amount=2, unit_price=30)
+    OrderLine.objects.create(order=o, product=product2, amount=1, unit_price=20)
+    qs = OrderLine.objects.all().product_order_stats()
+    series = qs.as_series()
+    assert {s["product_name"] for s in series} == {"borg", "cola"}
+
+
+# Transaction
+# ===========
+
+
+def test_transaction_str(transaction, user):
+    result = str(transaction)
+    assert str(transaction.id) in result
+    assert str(user) in result
+    assert str(transaction.amount) in result
+
+
+# InventoryTransaction
+# ====================
+
+
+def test_inventory_transaction_price(user, product):
+    it = InventoryTransaction.objects.create(user=user, product=product, amount=3, unit_price=Decimal("10.0"))
+    assert it.price == Decimal("30.0")
+
+
+def test_inventory_transaction_str(user, product):
+    it = InventoryTransaction.objects.create(user=user, product=product, amount=3, unit_price=Decimal("10.0"))
+    result = str(it)
+    assert str(it.id) in result
+    assert str(user) in result
+    assert "borg" in result
+
+
+# UserProfile
+# ===========
+
+
+def test_userprofile_str(user):
+    assert str(user.profile) == str(user)
+
+
+def test_last_purchase_none(user):
+    assert user.profile.last_purchase() is None
+
+
+def test_last_purchase_returns_latest(user):
+    Order.objects.create(customer=user, order_sum=10)
+    o2 = Order.objects.create(customer=user, order_sum=20)
+    assert user.profile.last_purchase() == o2
+
+
+def test_last_purchase_date_no_orders(user):
+    assert user.profile.last_purchase_date() == datetime.min.replace(tzinfo=UTC)
+
+
+def test_last_purchase_date_with_orders(user):
+    o = Order.objects.create(customer=user, order_sum=10)
+    assert user.profile.last_purchase_date() == o.created
+
+
+def test_top_months(user):
+    Order.objects.create(customer=user, order_sum=50)
+    Order.objects.create(customer=user, order_sum=30)
+    result = list(user.profile.top_months())
+    assert len(result) == 1
+    assert result[0]["sum"] == Decimal("80.0")
+
+
+def test_order_sum_total_no_orders(user):
+    assert user.profile.order_sum_total() == 0
+
+
+def test_order_sum_total_with_orders(user):
+    Order.objects.create(customer=user, order_sum=Decimal("25.0"))
+    Order.objects.create(customer=user, order_sum=Decimal("15.0"))
+    assert user.profile.order_sum_total() == Decimal("40.0")
+
+
+def test_userprofile_product_order_stats(user, product):
+    o = Order.objects.create(customer=user, order_sum=30)
+    OrderLine.objects.create(order=o, product=product, amount=1, unit_price=30)
+    result = list(user.profile.product_order_stats())
+    assert len(result) == 1
+    assert result[0]["product_name"] == "borg"
+
+
+def test_image_url_with_email(user):
+    expected_hash = hashlib.sha256(user.email.lower().strip().encode()).hexdigest()
+    assert expected_hash in user.profile.image_url()
+
+
+def test_image_url_no_email(db):  # noqa: ARG001
+    u = DjangoUser.objects.create_user(username="noemail", email="")
+    profile = UserProfile.objects.create(user=u, balance=0)
+    assert profile.image_url() == ""
+
+
+def test_save_auto_populates_image(db):  # noqa: ARG001
+    u = DjangoUser.objects.create_user(username="auto@test.com", email="auto@test.com")
+    profile = UserProfile.objects.create(user=u, balance=0)
+    assert profile.image != ""
+    assert "gravatar" in profile.image
+
+
+def test_save_preserves_existing_image(db):  # noqa: ARG001
+    u = DjangoUser.objects.create_user(username="img@test.com", email="img@test.com")
+    profile = UserProfile.objects.create(user=u, balance=0, image="https://example.com/custom.jpg")
+    assert profile.image == "https://example.com/custom.jpg"

bbs/tests/test_mutations.py

@@ -0,0 +1,361 @@
+from django.contrib.auth import get_user_model
+from django.utils import timezone
+
+from bbs.models import InventoryTransaction, Order, OrderLine, Transaction, UserProfile
+
+CREATE_ORDER = """
+mutation CreateOrder($customerId: ID!, $isExternal: Boolean!, $orderLines: [OrderLineInput!]!) {
+  createOrder(customerId: $customerId, isExternal: $isExternal, orderLines: $orderLines) {
+    ... on CreateOrderSuccess {
+      order { id orderSum orderlines { id product { id } } }
+    }
+    ... on InsufficientFunds {
+      amountLacking
+      error
+    }
+    ... on FormErrors {
+      message
+    }
+  }
+}
+"""
+
+CREATE_DEPOSIT = """
+mutation CreateDeposit($userId: ID!, $amount: Int!) {
+  createDeposit(userId: $userId, amount: $amount) {
+    ... on CreateDepositSuccess {
+      transaction { id amount }
+    }
+    ... on AboveMaxSaldo {
+      maxSaldo
+      above
+    }
+    ... on FormErrors {
+      message
+    }
+  }
+}
+"""
+
+CREATE_USER = """
+mutation CreateUser($input: UserInput!) {
+  createUser(input: $input) {
+    id
+    firstName
+    lastName
+  }
+}
+"""
+
+
+def test_user_not_found(db, gql_client):  # noqa: ARG001
+    result = gql_client.query(
+        """
+        query User($userId: ID!) {
+          user(userId: $userId) {
+            id
+          }
+        }
+        """,
+        {"userId": "999"},
+        assert_no_errors=False,
+    )
+
+    assert result.errors
+    error = result.errors[0]
+    assert error["path"] == ["user"]
+    assert error["extensions"]["code"] == "NOT_FOUND"
+    assert error["extensions"]["model"] == "User"
+
+
+def test_create_order(product, gql_client):
+    assert Order.objects.count() == 0
+    variables = {
+        "customerId": "external",
+        "isExternal": True,
+        "orderLines": [{"productId": product.id, "amount": 1}],
+    }
+    query = """
+    mutation CreateOrder($customerId: ID!, $isExternal: Boolean!, $orderLines: [OrderLineInput!]!) {
+      createOrder(customerId: $customerId, isExternal: $isExternal, orderLines: $orderLines) {
+        ... on CreateOrderSuccess {
+          order {
+            id
+            orderSum
+            orderlines {
+              id
+              product {
+                id
+              }
+            }
+          }
+        }
+      }
+    }
+    """
+    res = gql_client.query(query, variables)
+    assert res
+    assert not res.errors
+    assert res.data
+    order_lines = res.data.get("createOrder", {}).get("order", {}).get("orderlines", [])
+    assert order_lines
+    assert order_lines[0]["product"]["id"] == str(product.id)
+    assert Order.objects.count() == 1
+    o = Order.objects.first()
+    assert o.orderlines.first().product.id == product.id
+
+
+def test_create_inventory_transaction_requires_login(product, gql_client):
+    result = gql_client.query(
+        """
+        mutation CreateInventoryTransaction($data: InventoryTransactionInput!) {
+          createInventoryTransaction(data: $data) {
+            ... on FormErrors { message }
+          }
+        }
+        """,
+        variables={"data": {"productId": str(product.id), "amount": 5, "unitPrice": "12.5"}},
+    )
+
+    assert not result.errors
+    assert result.data["createInventoryTransaction"]["message"] == "Logg inn for å registrere varetransaksjoner."
+    product.refresh_from_db()
+    assert product.inventory_amount == 0
+    assert InventoryTransaction.objects.count() == 0
+
+
+def test_create_inventory_transaction_updates_stock(product, gql_client, client):
+    user = get_user_model().objects.create_user(username="stock-manager")
+    client.force_login(user)
+
+    result = gql_client.query(
+        """
+        mutation CreateInventoryTransaction($data: InventoryTransactionInput!) {
+          createInventoryTransaction(data: $data) {
+            ... on CreateInventoryTransactionSuccess {
+              inventoryTransaction {
+                amount
+                unitPrice
+                product { id inventoryAmount }
+                user { id }
+              }
+            }
+          }
+        }
+        """,
+        variables={
+            "data": {
+                "productId": str(product.id),
+                "amount": 5,
+                "unitPrice": "12.5",
+                "comment": "Restock",
+            }
+        },
+    )
+
+    assert not result.errors
+    transaction = result.data["createInventoryTransaction"]["inventoryTransaction"]
+    assert transaction["amount"] == 5
+    assert transaction["unitPrice"] == "12.5"
+    assert transaction["product"]["inventoryAmount"] == 5
+    assert transaction["user"]["id"] == str(user.id)
+    product.refresh_from_db()
+    assert product.inventory_amount == 5
+
+
+def test_inventory_report_aggregates_period_data(product, gql_client):
+    user = get_user_model().objects.create_user(username="report-user")
+    InventoryTransaction.objects.create(user=user, product=product, amount=5, unit_price=10)
+    transaction = Transaction.objects.create(user=user, amount=100)
+    order = Order.objects.create(order_sum=30)
+    OrderLine.objects.create(order=order, product=product, amount=2, unit_price=15)
+    start_time = timezone.make_naive(timezone.now() - timezone.timedelta(days=1))
+    end_time = timezone.make_naive(timezone.now() + timezone.timedelta(days=1))
+
+    result = gql_client.query(
+        """
+        query InventoryReport($startTime: DateTime!, $endTime: DateTime!) {
+          inventoryReport(startTime: $startTime, endTime: $endTime) {
+            products {
+              productId
+              purchaseUnits
+              purchaseValue
+              salesUnits
+              salesValue
+            }
+            inventoryPurchases
+            productSales
+            deposits
+            orderPurchases
+            balanceAtStart
+            balanceAtEnd
+          }
+        }
+        """,
+        variables={"startTime": start_time.isoformat(), "endTime": end_time.isoformat()},
+    )
+
+    assert not result.errors
+    report = result.data["inventoryReport"]
+    assert report["products"] == [
+        {
+            "productId": str(product.id),
+            "purchaseUnits": 5,
+            "purchaseValue": "50",
+            "salesUnits": 2,
+            "salesValue": "30",
+        }
+    ]
+    assert report["inventoryPurchases"] == "50"
+    assert report["productSales"] == "30"
+    assert report["deposits"] == "100"
+    assert report["orderPurchases"] == "30"
+    assert report["balanceAtStart"] == "0"
+    assert report["balanceAtEnd"] == "70"
+    assert transaction.amount == 100
+
+    products_result = gql_client.query(
+        """
+        query InventoryProducts {
+          allProducts {
+            id
+            active
+            inventoryAmount
+            wholesaleUnitPrice
+            wholesaleValue
+          }
+          inventoryTransactionList(ordering: [{created: DESC}], pagination: {limit: 20, offset: 0}) {
+            amount
+            unitPrice
+            product { name }
+            user { firstName lastName }
+          }
+        }
+        """
+    )
+
+    assert not products_result.errors
+    assert products_result.data["allProducts"][0]["active"]
+    assert products_result.data["inventoryTransactionList"][0]["amount"] == 5
+
+
+def test_create_order_no_customer(product, gql_client):
+    res = gql_client.query(
+        CREATE_ORDER,
+        {
+            "customerId": "999",
+            "isExternal": False,
+            "orderLines": [{"productId": product.id, "amount": 1}],
+        },
+    )
+    assert not res.errors
+    assert res.data["createOrder"]["message"]
+
+
+def test_create_order_empty_lines(product, gql_client):  # noqa: ARG001
+    res = gql_client.query(
+        CREATE_ORDER,
+        {
+            "customerId": "external",
+            "isExternal": True,
+            "orderLines": [],
+        },
+    )
+    assert not res.errors
+    assert res.data["createOrder"]["message"]
+
+
+def test_create_order_insufficient_funds(user, product, gql_client):
+    res = gql_client.query(
+        CREATE_ORDER,
+        {
+            "customerId": str(user.id),
+            "isExternal": False,
+            "orderLines": [{"productId": product.id, "amount": 1}],
+        },
+    )
+    assert not res.errors
+    assert res.data["createOrder"]["amountLacking"] == 20
+    assert res.data["createOrder"]["error"] is True
+    assert Order.objects.count() == 0
+    product.refresh_from_db()
+    assert product.inventory_amount == 0
+
+
+def test_create_order_internal_success(user, product, gql_client):
+    user.profile.balance = 100
+    user.profile.save()
+    res = gql_client.query(
+        CREATE_ORDER,
+        {
+            "customerId": str(user.id),
+            "isExternal": False,
+            "orderLines": [{"productId": product.id, "amount": 1}],
+        },
+    )
+    assert not res.errors
+    assert res.data["createOrder"]["order"]
+    user.profile.refresh_from_db()
+    assert user.profile.balance == 70
+    product.refresh_from_db()
+    assert product.inventory_amount == -1
+
+
+def test_create_order_exact_balance(user, product, gql_client):
+    user.profile.balance = 30
+    user.profile.save()
+    res = gql_client.query(
+        CREATE_ORDER,
+        {
+            "customerId": str(user.id),
+            "isExternal": False,
+            "orderLines": [{"productId": product.id, "amount": 1}],
+        },
+    )
+    assert not res.errors
+    assert res.data["createOrder"]["order"]
+    user.profile.refresh_from_db()
+    assert user.profile.balance == 0
+
+
+def test_create_deposit(user, gql_client):
+    res = gql_client.query(CREATE_DEPOSIT, {"userId": str(user.id), "amount": 100})
+    assert not res.errors
+    assert res.data["createDeposit"]["transaction"]
+    assert Transaction.objects.count() == 1
+    user.profile.refresh_from_db()
+    assert user.profile.balance == 110
+
+
+def test_create_deposit_invalid_user(db, gql_client):  # noqa: ARG001
+    res = gql_client.query(CREATE_DEPOSIT, {"userId": "999", "amount": 100})
+    assert not res.errors
+    assert res.data["createDeposit"]["message"]
+
+
+def test_create_deposit_invalid_amount(user, gql_client):
+    res = gql_client.query(CREATE_DEPOSIT, {"userId": str(user.id), "amount": 0})
+    assert not res.errors
+    assert res.data["createDeposit"]["message"]
+
+
+def test_create_deposit_above_max_saldo(user, gql_client):
+    res = gql_client.query(CREATE_DEPOSIT, {"userId": str(user.id), "amount": 1000})
+    assert not res.errors
+    assert res.data["createDeposit"]["maxSaldo"] is not None
+    assert res.data["createDeposit"]["above"] == 10
+    assert Transaction.objects.count() == 0
+
+
+def test_create_deposit_1337(user, gql_client):
+    # balance=10, so amount=1327 makes balance+amount==1337, bypassing max saldo
+    res = gql_client.query(CREATE_DEPOSIT, {"userId": str(user.id), "amount": 1327})
+    assert not res.errors
+    assert res.data["createDeposit"]["transaction"]
+
+
+def test_create_user(db, gql_client):  # noqa: ARG001
+    res = gql_client.query(CREATE_USER, {"input": {"email": "new@example.com", "firstName": "New", "lastName": "User"}})
+    assert not res.errors
+    assert get_user_model().objects.filter(username="new@example.com").exists()
+    assert UserProfile.objects.count() == 1

bbs/tests/test_queries.py

@@ -0,0 +1,63 @@
+ALL_USERS = "query { allUsers { id firstName lastName } }"
+USER = "query User($userId: ID!) { user(userId: $userId) { id firstName lastName } }"
+USER_PROFILE = "query User($userId: ID!) { user(userId: $userId) { profile { balance topMonths { period count sum } productOrderStats { productName data { x y } } } } }"
+ALL_PRODUCTS = "query { allProducts { id name } }"
+ALL_ORDERS = "query { allOrders { id orderSum } }"
+ORDER_LIST = "query { orderList { id orderSum } }"
+ORDER_STATS = "query { orderStats { yearly { period count } monthly { period count } daily { period count } hourly { period count } } }"
+PRODUCT_STATS = "query { productStats { productName data { x y } } }"
+TRANSACTION_LIST = "query { transactionList { id amount } }"
+
+
+def test_user(user, gql_client):
+    res = gql_client.query(USER, {"userId": str(user.id)})
+    assert not res.errors
+    assert res.data["user"]["id"] == str(user.id)
+
+
+def test_all_users(user, gql_client):  # noqa: ARG001
+    res = gql_client.query(ALL_USERS)
+    assert not res.errors
+    assert len(res.data["allUsers"]) == 1
+
+
+def test_all_products(product, gql_client):  # noqa: ARG001
+    res = gql_client.query(ALL_PRODUCTS)
+    assert not res.errors
+    assert len(res.data["allProducts"]) == 1
+
+
+def test_all_orders(order, gql_client):  # noqa: ARG001
+    res = gql_client.query(ALL_ORDERS)
+    assert not res.errors
+    assert len(res.data["allOrders"]) == 1
+
+
+def test_order_list(order, gql_client):  # noqa: ARG001
+    res = gql_client.query(ORDER_LIST)
+    assert not res.errors
+    assert len(res.data["orderList"]) == 1
+
+
+def test_order_stats(db, gql_client):  # noqa: ARG001
+    res = gql_client.query(ORDER_STATS)
+    assert not res.errors
+    assert "daily" in res.data["orderStats"]
+
+
+def test_product_stats(order, gql_client):  # noqa: ARG001
+    res = gql_client.query(PRODUCT_STATS)
+    assert not res.errors
+    assert res.data["productStats"]
+
+
+def test_transaction_list(transaction, gql_client):  # noqa: ARG001
+    res = gql_client.query(TRANSACTION_LIST)
+    assert not res.errors
+    assert len(res.data["transactionList"]) == 1
+
+
+def test_user_profile(user, gql_client):
+    res = gql_client.query(USER_PROFILE, {"userId": str(user.id)})
+    assert not res.errors
+    assert res.data["user"]["profile"]["balance"] is not None

bbs/tests/test_seed_demo_data.py

@@ -0,0 +1,93 @@
+import pytest
+from django.contrib.auth import get_user_model
+from django.core.management import call_command
+from django.test import Client
+from strawberry.django.test import GraphQLTestClient
+
+from bbs.management.commands.seed_demo_data import DEMO_PRODUCTS
+from bbs.models import InventoryTransaction, Order, Product, Transaction, UserProfile
+
+DEMO_PRODUCT_NAMES = [name for name, *_ in DEMO_PRODUCTS]
+
+
+@pytest.mark.django_db
+def test_seed_demo_data_is_repeatable():
+    call_command("seed_demo_data")
+    call_command("seed_demo_data")
+
+    assert get_user_model().objects.filter(username__startswith="demo-").count() == 9
+    assert Product.objects.filter(name__in=DEMO_PRODUCT_NAMES).count() == 6
+    assert Order.objects.count() == 11
+    assert Transaction.objects.count() == 9
+    assert InventoryTransaction.objects.count() == 6
+    assert sum(product.inventory_amount for product in Product.objects.filter(name__in=DEMO_PRODUCT_NAMES)) == 155
+    assert all(profile.balance >= 0 for profile in UserProfile.objects.all())
+    assert all("pravatar.cc" in profile.image for profile in UserProfile.objects.all())
+
+
+@pytest.mark.django_db
+def test_demo_data_is_available_when_an_admin_has_no_profile():
+    user_model = get_user_model()
+    user_model.objects.create_superuser(username="admin", email="admin@example.test", password="password")
+    call_command("seed_demo_data")
+
+    gql_client = GraphQLTestClient(Client())
+    result = gql_client.query(
+        """
+        {
+          allProducts(filters: {active: true}) { name }
+          allUsers { firstName lastName profile { balance } }
+        }
+        """
+    )
+
+    assert not result.errors
+    assert result.data
+    assert len(result.data["allProducts"]) == 6
+    assert len(result.data["allUsers"]) == 9
+
+    ada = user_model.objects.get(username="demo-ada")
+    detail_result = gql_client.query(
+        """
+        query UserDetail($userId: ID!) {
+          user(userId: $userId) {
+            firstName
+            profile {
+              balance
+              lastPurchaseDate
+              orderSumTotal
+              topMonths { period sum count }
+              productOrderStats { productName data { x y } }
+            }
+          }
+        }
+        """,
+        variables={"userId": str(ada.pk)},
+    )
+
+    assert not detail_result.errors
+    assert detail_result.data["user"]["profile"]["topMonths"]
+    assert isinstance(detail_result.data["user"]["profile"]["topMonths"][0]["sum"], float)
+
+
+@pytest.mark.django_db
+def test_seed_demo_data_random_size_adds_consistent_data():
+    call_command("seed_demo_data", size="small", seed=1, users=5, orders=30)
+
+    random_users = get_user_model().objects.exclude(username__startswith="demo-")
+    assert random_users.count() == 5
+    assert Order.objects.count() == 11 + 30
+    for user in random_users:
+        deposits = sum(t.amount for t in Transaction.objects.filter(user=user))
+        purchases = sum(o.order_sum for o in Order.objects.filter(customer=user))
+        assert user.profile.balance == deposits - purchases
+        assert user.profile.balance >= 0
+    assert all(product.inventory_amount >= 0 for product in Product.objects.all())
+
+
+@pytest.mark.django_db
+def test_seed_demo_data_random_size_can_run_twice():
+    call_command("seed_demo_data", size="small", seed=1, users=5, orders=5)
+    call_command("seed_demo_data", size="small", seed=1, users=5, orders=5)
+
+    assert get_user_model().objects.exclude(username__startswith="demo-").count() == 10

bbs/tests/test_spa.py

@@ -0,0 +1,10 @@
+import pytest
+from django.test import Client
+
+
+@pytest.mark.parametrize("path", ["/inventory", "/inventory/add", "/report"])
+def test_inventory_pages_serve_the_spa_entry(client: Client, path: str):
+    response = client.get(path)
+
+    assert response.status_code == 200
+    assert b'<div id="root"></div>' in b"".join(response.streaming_content)

bbs/tests/test_urls.py

@@ -0,0 +1,53 @@
+import importlib
+
+import pytest
+from django.test import Client
+from django.urls import clear_url_caches
+
+import bbs.urls
+
+
+@pytest.fixture
+def prod_urls(settings, tmp_path):
+    """bbs.urls as the image loads it: routes under api/, uploads and frontend routes served."""
+    settings.DEBUG = False
+    settings.BBS_API_PREFIX = "api/"
+    settings.MEDIA_ROOT = str(tmp_path)
+    (tmp_path / "products").mkdir()
+    (tmp_path / "products" / "beer.png").write_bytes(b"png")
+    clear_url_caches()
+    importlib.reload(bbs.urls)
+    yield
+    settings.DEBUG = True
+    settings.BBS_API_PREFIX = ""
+    clear_url_caches()
+    importlib.reload(bbs.urls)
+
+
+def test_graphql_under_api_prefix(prod_urls, client: Client, db):  # noqa: ARG001
+    response = client.post("/api/graphql/", {"query": "{ allUsers { id } }"}, content_type="application/json")
+
+    assert response.status_code == 200
+    assert response.json() == {"data": {"allUsers": []}}
+
+
+def test_login_page_renders(prod_urls, client: Client, db):  # noqa: ARG001
+    response = client.get("/api/accounts/login/")
+
+    assert response.status_code == 200
+    assert b"csrfmiddlewaretoken" in response.content
+
+
+@pytest.mark.parametrize("path", ["/deposit", "/stats/users", "/user/1"])
+def test_frontend_routes_serve_the_spa_entry(prod_urls, client: Client, path: str):  # noqa: ARG001
+    response = client.get(path)
+
+    assert response.status_code == 200
+    assert b'<div id="root"></div>' in b"".join(response.streaming_content)
+
+
+def test_uploads_are_served(prod_urls, client: Client):  # noqa: ARG001
+    response = client.get("/media/products/beer.png")
+
+    assert response.status_code == 200
+    assert b"".join(response.streaming_content) == b"png"

bbs/tests/test_utils.py

@@ -0,0 +1,21 @@
+from bbs.utils import format_username
+
+
+def test_format_username():
+    assert format_username("Ada", "Lovelace") == "adalovela"
+
+
+def test_format_username_truncates_names():
+    assert format_username("Aleksandar", "Vukovic") == "aleksavukovi"
+
+
+def test_format_username_removes_spaces():
+    assert format_username("Mary Jane", "van Dijk") == "maryjavandij"
+
+
+def test_format_username_drops_non_ascii_characters():
+    assert format_username("Ångström", "Ø") == "ngstr"
+
+
+def test_format_username_allows_empty_names():
+    assert format_username("", "") == ""

bbs/urls.py

@@ -0,0 +1,50 @@
+from django.conf import settings
+from django.conf.urls.static import static
+from django.contrib import admin
+from django.contrib.auth.views import LoginView, LogoutView
+from django.urls import include, path, re_path
+from django.views.decorators.csrf import csrf_exempt
+from django.views.static import serve
+from strawberry.django.views import GraphQLView
+
+from bbs.api.schema import schema
+from bbs.views.spa import spa_index
+
+admin.autodiscover()
+
+api_patterns = [
+    # bbs has no login template of its own; the admin's works for any user
+    path(
+        "accounts/login/",
+        LoginView.as_view(template_name="admin/login.html", extra_context={"site_header": "BBS"}),
+        name="django.contrib.auth.views.login",
+    ),
+    path(
+        "accounts/logout/",
+        LogoutView.as_view(),
+        name="django.contrib.auth.views.logout",
+    ),
+    path("admin/", admin.site.urls),
+    path("graphql/", csrf_exempt(GraphQLView.as_view(schema=schema)), name="graphql"),
+]
+
+urlpatterns = [
+    path("inventory", spa_index, name="inventory"),
+    path("inventory/", spa_index),
+    path("inventory/add", spa_index, name="inventory-add"),
+    path("inventory/add/", spa_index),
+    path("report", spa_index, name="report"),
+    path("report/", spa_index),
+    path(settings.BBS_API_PREFIX, include(api_patterns)),
+]
+
+if settings.DEBUG:
+    urlpatterns += static("/media", document_root=settings.MEDIA_ROOT)
+    urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)
+else:
+    # The container has no web server of its own for uploads, and there are few of them.
+    # Any other path is a frontend route, which index.html renders.
+    urlpatterns += [
+        re_path(r"^media/(?P<path>.*)$", serve, {"document_root": settings.MEDIA_ROOT}),
+        re_path(r"^(?!media/|static/).*$", spa_index),
+    ]

bbs/views/reports.py

@@ -1,21 +1,22 @@
-from datetime import datetime, timedelta
+from datetime import timedelta
 from itertools import groupby
 
 from django.contrib import messages
 from django.shortcuts import redirect, render
+from django.utils import timezone
 
-from main.forms import DateRangeForm, InventoryTransactionForm
-from main.models import InventoryTransaction, Order, Product, Transaction, UserProfile
+from bbs.forms import DateRangeForm, InventoryTransactionForm
+from bbs.models import InventoryTransaction, Order, Product, Transaction, UserProfile
 
 
 def report(request):
     # FIXME: split this up in smaller pieces
-    datetime_now = datetime.now()
-    start_time = datetime.now() - timedelta(days=30)
+    datetime_now = timezone.localtime()
+    start_time = timezone.localtime() - timedelta(days=30)
     # start of day, 1 month
     start_time = start_time.replace(hour=0, minute=0, second=0, microsecond=0)
     # end of day
-    end_time = datetime.now().replace(hour=23, minute=59, second=59, microsecond=999)
+    end_time = timezone.localtime().replace(hour=23, minute=59, second=59, microsecond=999)
 
     if request.GET.get("start_time", False) or request.GET.get("end_time", False):
         form = DateRangeForm(request.GET)
@@ -50,14 +51,14 @@ def report(request):
                 k: {
                     "name": k,
                     "transactions": group,
-                    "transactions_sum": sum(map(lambda x: x["transactions__price"], group)),
-                    "transactions_units": sum(map(lambda x: x["transactions__amount"], group)),
+                    "transactions_sum": sum(x["transactions__price"] for x in group),
+                    "transactions_units": sum(x["transactions__amount"] for x in group),
                 }
             }
         )
 
     itrans = InventoryTransaction.objects.filter(created__range=[start_time, end_time])
-    inv_in = sum(map(lambda x: x[1].get("transactions_sum", 0), inventory_products.items()))
+    inv_in = sum(x[1].get("transactions_sum", 0) for x in inventory_products.items())
 
     # out
     out_products = (
@@ -75,8 +76,8 @@ def report(request):
         product = {
             "name": k,
             "orderlines": group,
-            "orderlines_sum": sum(map(lambda x: x["orderlines__price"], group)),
-            "orderlines_units": sum(map(lambda x: x["orderlines__amount"], group)),
+            "orderlines_sum": sum(x["orderlines__price"] for x in group),
+            "orderlines_units": sum(x["orderlines__amount"] for x in group),
         }
         if k in inventory_products:
             # add diff
@@ -88,7 +89,7 @@ def report(request):
         p[1]["value_diff"] = p[1].get("transactions_sum", 0) - p[1].get("orderlines_sum", 0)
         p[1]["units_diff"] = p[1].get("transactions_units", 0) - p[1].get("orderlines_units", 0)
 
-    inv_out = sum(map(lambda x: x[1].get("orderlines_sum", 0), inventory_products.items()))
+    inv_out = sum(x[1].get("orderlines_sum", 0) for x in inventory_products.items())
 
     inv_diff = inv_in - inv_out
 
@@ -110,7 +111,7 @@ def report(request):
     purchases_diff = purchases_end - purchases_start
     saldo_diff = saldo_end - saldo_start
 
-    return render(request, "report.html", locals())
+    return render(request, "report.html", locals())  # noqa: DJ003
 
 
 def inventory(request):
@@ -120,7 +121,7 @@ def inventory(request):
     wholesale_value = sum([p.wholesale_value for p in products_active])
     num_products = sum(products_active.values_list("inventory_amount", flat=True))
 
-    return render(request, "inventory.html", locals())
+    return render(request, "inventory.html", locals())  # noqa: DJ003
 
 
 def inventory_add(request):
@@ -133,13 +134,12 @@ def inventory_add(request):
             itrans.user = request.user
             itrans.product.save()
             itrans.save()
-            messages.success(request, "Satt inn {0} stk {1}.".format(itrans.amount, itrans.product))
+            messages.success(request, f"Satt inn {itrans.amount} stk {itrans.product}.")
             return redirect("inventory-add")
 
-        else:
         messages.error(request, "Feil med skjemaet, se under.")
         form = InventoryTransactionForm(data=request.POST)
     else:
         form = InventoryTransactionForm()
 
-    return render(request, "inventory_add.html", locals())
+    return render(request, "inventory_add.html", locals())  # noqa: DJ003

bbs/views/spa.py

@@ -0,0 +1,11 @@
+from pathlib import Path
+
+from django.contrib.staticfiles import finders
+from django.http import FileResponse, Http404
+
+
+def spa_index(_request):
+    index_path = finders.find("index.html")
+    if not index_path:
+        raise Http404("The frontend has not been built.")
+    return FileResponse(Path(index_path).open("rb"), content_type="text/html")

bbs/wsgi.py

@@ -2,6 +2,6 @@ import os
 
 from django.core.wsgi import get_wsgi_application
 
-os.environ.setdefault("DJANGO_SETTINGS_MODULE", "bbssite.settings")
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "bbs.settings")
 
 application = get_wsgi_application()

bbssite/urls.py

@@ -1,22 +0,0 @@
-from django.conf import settings
-from django.conf.urls.static import static
-from django.contrib import admin
-from django.contrib.auth.views import LoginView, LogoutView
-from django.urls import include, path, re_path
-from strawberry.django.views import GraphQLView
-
-from main import urls as main_urls
-from main.api.schema import schema
-
-admin.autodiscover()
-
-urlpatterns = [
-    re_path(r"", include(main_urls)),
-    path("accounts/login/", LoginView.as_view(), name="django.contrib.auth.views.login"),
-    path("accounts/logout/", LogoutView.as_view(), name="django.contrib.auth.views.logout"),
-    path("admin/", admin.site.urls),
-    path("graphql/", GraphQLView.as_view(schema=schema), name="graphql"),
-]
-
-urlpatterns += static("/media", document_root=settings.MEDIA_ROOT)
-urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)

bin/build-frontend

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -eu
+cd frontend
+npm i
+npm run build

bin/deploy

@@ -1,14 +1,24 @@
 #!/bin/bash
 set -eu
 
-PROJECT_PATH=/var/www/neuf.no/bbs
-PROCESS_NAME="$PROJECT.neuf.no"
+source "$HOME/.local/bin/env"
 
+export VITE_API_URL="https://bbs.neuf.no/api"
+PROJECT_PATH=/var/www/neuf.no/bbs
+PROCESS_NAME="bbs.neuf.no"
+
+echo "Deploying bbs to ${PROJECT_PATH}"
 cd "$PROJECT_PATH" || exit 1
 git pull
-poetry install
-umask 022; poetry run python manage.py collectstatic --noinput  # Collect static
-poetry run python manage.py migrate  # Run DB migrations
 
-# Reload
+# Backend
+uv sync
+umask 022; uv run manage.py collectstatic --noinput  # Collect static
+uv run manage.py migrate  # Run DB migrations
+
+# Frontend
+bin/build-frontend
+
+# Reload backend
+echo "Reloading supervisor process ${PROCESS_NAME}"
 sudo /usr/bin/supervisorctl pid "$PROCESS_NAME" | xargs kill -HUP

bin/format

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-SRC_DIR="main bbssite"
-
-black $SRC_DIR
-isort $SRC_DIR

bin/generate_schema

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python manage.py export_schema
-cd frontend && npm run generate

bin/lint

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-SRC_DIR="main bbssite"
-
-black --check $SRC_DIR
-isort --diff $SRC_DIR

bin/run

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-python manage.py runserver

bin/run-frontend

@@ -1 +0,0 @@
-cd frontend && npm run start

bin/test

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-pytest -v

frontend/.eslintignore

@@ -1 +0,0 @@
-src/types.ts

frontend/.eslintrc.js

@@ -1,53 +0,0 @@
-module.exports = {
-  env: {
-    browser: true,
-  },
-  parser: "@typescript-eslint/parser",
-  parserOptions: {
-    ecmaVersion: 2020,
-    sourceType: "module",
-  },
-  extends: [
-    "plugin:prettier/recommended",
-    "plugin:react/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript",
-    "plugin:react/recommended",
-    "plugin:@typescript-eslint/recommended",
-  ],
-  rules: {
-    "no-console": "off",
-    "prefer-destructuring": "off",
-    "import/no-extraneous-dependencies": [
-      "error",
-      {
-        devDependencies: ["**/*.test.js", "**/*.spec.js", "**/__tests__/**"],
-      },
-    ],
-    "import/prefer-default-export": "off",
-    "import/order": [
-      "error",
-      {
-        groups: ["builtin", "external", "internal", ["parent", "sibling", "index"]],
-        "newlines-between": "always",
-        alphabetize: { order: "asc" },
-      },
-    ],
-    "react-hooks/exhaustive-deps": "error",
-    "react-hooks/rules-of-hooks": "error",
-    "react/button-has-type": "error",
-    "react/jsx-filename-extension": ["warn", { extensions: [".js", ".jsx", ".ts", ".tsx"] }],
-    "react/jsx-uses-react": "off",
-    "react/prefer-stateless-function": "warn",
-    "react/prop-types": "off",
-    "react/react-in-jsx-scope": "off",
-    "react/sort-comp": "off",
-  },
-  plugins: ["prettier", "react", "react-hooks"],
-  settings: {
-    react: {
-      version: "detect",
-    },
-  },
-};

frontend/.nvmrc

@@ -1 +1 @@
-v16
+v26

frontend/codegen.yml

@@ -3,6 +3,28 @@ documents: ./src/**/*.graphql
 generates:
   ./src/types.ts:
     plugins:
-      - typescript
-      - typescript-operations
+      - typescript:
+          typesPrefix: Schema
+          scalars:
+            DateTime:
+              input: string
+              output: string
+            Decimal:
+              input: string
+              output: string
+            JSON:
+              input: unknown
+              output: "Array<{ name: string; count: number }>"
+      - typescript-operations:
+          nonOptionalTypename: true
+          scalars:
+            DateTime:
+              input: string
+              output: string
+            Decimal:
+              input: string
+              output: string
+            JSON:
+              input: unknown
+              output: "Array<{ name: string; count: number }>"
       - typed-document-node

frontend/eslint.config.js

@@ -0,0 +1,54 @@
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import importPlugin from "eslint-plugin-import-x";
+import prettier from "eslint-plugin-prettier/recommended";
+import { defineConfig, globalIgnores } from "eslint/config";
+
+export default defineConfig([
+  globalIgnores(["dist", "src/types.ts"]),
+  {
+    files: ["**/*.{ts,tsx}"],
+    extends: [
+      js.configs.recommended,
+      tseslint.configs.recommended,
+      reactHooks.configs.flat.recommended,
+      reactRefresh.configs.vite,
+      prettier,
+    ],
+    plugins: {
+      "import-x": importPlugin,
+    },
+    languageOptions: {
+      globals: globals.browser,
+    },
+    settings: {
+      react: {
+        version: "detect",
+      },
+    },
+    rules: {
+      "no-console": "off",
+      "prefer-destructuring": "off",
+      "import-x/no-extraneous-dependencies": [
+        "error",
+        {
+          devDependencies: ["**/*.test.ts", "**/*.spec.ts", "**/__tests__/**"],
+        },
+      ],
+      "import-x/prefer-default-export": "off",
+      "import-x/order": [
+        "error",
+        {
+          groups: ["builtin", "external", "internal", ["parent", "sibling", "index"]],
+          "newlines-between": "always",
+          alphabetize: { order: "asc" },
+        },
+      ],
+      "react-hooks/exhaustive-deps": "error",
+      "react-hooks/rules-of-hooks": "error",
+    },
+  },
+]);

frontend/index.html

@@ -2,7 +2,10 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <link rel="icon" type="image/svg+xml" href="/src/favicon.svg" />
+    <link rel="icon" type="image/svg+xml" href="/src/assets/brick.svg" />
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono&display=swap" rel="stylesheet">
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>BBS</title>
   </head>

frontend/package.json

@@ -3,67 +3,66 @@
   "version": "1.0.0",
   "private": true,
   "scripts": {
-    "build": "tsc && vite build",
-    "check-types": "tsc",
+    "build": "tsc -b && vite build",
+    "check-types": "tsc -b",
     "dev": "vite",
     "format:js": "eslint --fix src",
-    "format:styles": "stylelint --fix src",
-    "generate": "graphql-codegen",
+    "format:styles": "prettier --write \"src/**/*.css\"",
+    "generate": "node scripts/generate-types.mjs",
     "lint:js": "eslint src",
-    "lint:styles": "stylelint src",
+    "lint:styles": "prettier --check \"src/**/*.css\"",
     "preview": "vite preview",
     "start": "vite",
-    "test": "jest"
+    "test": "node --test"
   },
   "dependencies": {
-    "@apollo/client": "^3.5.8",
-    "@nivo/bar": "^0.79.1",
-    "@nivo/line": "^0.79.1",
-    "@nivo/pie": "^0.79.1",
-    "bootstrap": "^5.1.3",
-    "bootstrap-icons": "^1.8.1",
-    "clsx": "^1.1.1",
-    "date-fns": "^2.28.0",
-    "graphql": "^16.3.0",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2",
-    "react-hook-form": "^7.27.1",
-    "react-router-dom": "^6.2.1",
+    "@apollo/client": "^4.2.0",
+    "@nivo/bar": "^0.99.0",
+    "@nivo/line": "^0.99.0",
+    "@nivo/pie": "^0.99.0",
+    "clsx": "^2.1.1",
+    "date-fns": "^4.3.0",
+    "graphql": "^16.14.0",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6",
+    "react-hook-form": "^7.76.1",
+    "react-router-dom": "^7.18.4",
     "use-url-search-params": "^2.5.1"
   },
   "devDependencies": {
-    "@graphql-codegen/cli": "^2.6.1",
-    "@graphql-codegen/typed-document-node": "^2.2.3",
-    "@graphql-codegen/typescript-operations": "^2.3.0",
+    "@babel/core": "^7.29.7",
+    "@eslint/js": "^10.0.1",
+    "@graphql-codegen/core": "^6.2.2",
+    "@graphql-codegen/typed-document-node": "^7.2.0",
+    "@graphql-codegen/typescript": "^6.1.2",
+    "@graphql-codegen/typescript-operations": "^6.1.10",
     "@graphql-typed-document-node/core": "^3.1.1",
-    "@types/bootstrap": "^5.1.9",
-    "@types/react": "^17.0.39",
-    "@types/react-dom": "^17.0.11",
-    "@types/react-router-dom": "^5.3.3",
-    "@typescript-eslint/eslint-plugin": "^5.11.0",
-    "@typescript-eslint/parser": "^5.11.0",
-    "@vitejs/plugin-react": "^1.2.0",
-    "@vitejs/plugin-react-refresh": "^1.3.6",
-    "eslint": "^8.9.0",
-    "eslint-config-prettier": "^8.3.0",
-    "eslint-plugin-import": "^2.25.4",
-    "eslint-plugin-prettier": "^4.0.0",
-    "eslint-plugin-react": "^7.28.0",
-    "eslint-plugin-react-hooks": "^4.3.0",
-    "jest": "^27.5.1",
-    "prettier": "^2.5.1",
-    "stylelint": "^14.5.0",
-    "stylelint-config-idiomatic-order": "^8.1.0",
-    "stylelint-config-prettier": "^9.0.3",
-    "stylelint-config-recommended": "^7.0.0",
-    "stylelint-order": "^5.0.0",
-    "stylelint-prettier": "^2.0.0",
-    "typescript": "^4.5.5",
-    "vite": "^2.8.1",
-    "vite-plugin-svgr": "^1.0.1"
+    "@rolldown/plugin-babel": "^0.2.3",
+    "@types/babel__core": "^7.20.5",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.2.15",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.2",
+    "babel-plugin-react-compiler": "^1.0.0",
+    "eslint": "^10.4.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import-x": "^4.16.2",
+    "eslint-plugin-prettier": "^5.5.7",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.5.2",
+    "globals": "^17.6.0",
+    "prettier": "^3.6.2",
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.60.0",
+    "vite": "^8.0.14",
+    "vite-plugin-svgr": "^5.2.0",
+    "yaml": "^2.8.1"
   },
   "engines": {
-    "node": ">=16",
-    "npm": ">=7"
-  }
+    "node": "26"
+  },
+  "overrides": {
+    "@whatwg-node/promise-helpers": "^1.3.2"
+  },
+  "type": "module"
 }

frontend/scripts/generate-types.mjs

@@ -0,0 +1,66 @@
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { codegen } from "@graphql-codegen/core";
+import { plugin as typedDocumentNodePlugin } from "@graphql-codegen/typed-document-node";
+import { plugin as typescriptOperationsPlugin } from "@graphql-codegen/typescript-operations";
+import { plugin as typescriptPlugin } from "@graphql-codegen/typescript";
+import { buildASTSchema, parse } from "graphql";
+import { parse as parseYaml } from "yaml";
+
+const frontendRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const configPath = path.join(frontendRoot, "codegen.yml");
+const config = parseYaml(await readFile(configPath, "utf8"));
+const schemaDocument = parse(await readFile(path.resolve(frontendRoot, config.schema), "utf8"));
+const outputEntries = Object.entries(config.generates ?? {});
+
+if (outputEntries.length !== 1) {
+  throw new Error(`Expected one GraphQL Codegen output in ${configPath}`);
+}
+
+const [outputName, outputConfig] = outputEntries[0];
+const outputPath = path.resolve(frontendRoot, outputName);
+const sourceRoot = path.join(frontendRoot, "src");
+const plugins = outputConfig.plugins.map((plugin) =>
+  typeof plugin === "string" ? { [plugin]: {} } : plugin,
+);
+
+async function findGraphqlFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const nestedFiles = await Promise.all(
+    entries.map((entry) => {
+      const entryPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) return findGraphqlFiles(entryPath);
+      return entry.isFile() && entry.name.endsWith(".graphql") ? [entryPath] : [];
+    }),
+  );
+  return nestedFiles.flat();
+}
+
+const documents = await Promise.all(
+  (await findGraphqlFiles(sourceRoot))
+    .sort()
+    .map(async (location) => ({
+      location,
+      document: parse(await readFile(location, "utf8")),
+    })),
+);
+
+const pluginMap = {
+  typescript: { plugin: typescriptPlugin },
+  "typescript-operations": { plugin: typescriptOperationsPlugin },
+  "typed-document-node": { plugin: typedDocumentNodePlugin },
+};
+
+const generated = await codegen({
+  filename: outputPath,
+  schema: schemaDocument,
+  schemaAst: buildASTSchema(schemaDocument),
+  documents,
+  config: {},
+  plugins,
+  pluginMap,
+});
+
+await writeFile(outputPath, generated);

frontend/src/App.module.css

@@ -1,3 +1,5 @@
 .app {
-  margin: 16px;
+  flex: 1 0 auto;
+  width: min(100% - 2rem, 1220px);
+  margin: 1rem auto;
 }

frontend/src/App.tsx

@@ -1,23 +1,26 @@
-import { ApolloProvider } from "@apollo/client";
+import { ApolloProvider } from "@apollo/client/react";
 import React from "react";
 import { BrowserRouter as Router } from "react-router-dom";
-import "bootstrap/dist/css/bootstrap.min.css";
 
 import styles from "./App.module.css";
 import { Routes } from "./Routes";
 import client from "./client";
+import { Footer } from "./components/Footer";
 import { Header } from "./components/Header";
 import { Toast } from "./components/Toast";
 import { ToastProvider } from "./components/ToastProvider";
+import { Wireframe } from "./components/Wireframe";
 
-const App: React.FC = () => (
+const App = (): React.JSX.Element => (
   <ApolloProvider client={client}>
     <Router>
       <ToastProvider>
         <Header />
         <div className={styles.app}>
           <Routes />
+          <Wireframe />
         </div>
+        <Footer />
         <Toast />
       </ToastProvider>
     </Router>

frontend/src/Routes.tsx

@@ -1,26 +1,38 @@
 import React from "react";
 import { Route, Routes as ReactRouterRoutes } from "react-router-dom";
 
-import { UserCreate } from "./features/auth/UserCreate";
-import { Deposit } from "./features/deposit/Deposit";
-import { Log } from "./features/log/Log";
-import { Register } from "./features/register/Register";
-import { OrderStats } from "./features/stats/OrderStats";
-import { ProductStats } from "./features/stats/ProductStats";
-import { Stats } from "./features/stats/Stats";
-import { UserDetail } from "./features/users/UserDetail";
-import { UserList } from "./features/users/UserList";
+const Splash = React.lazy(() => import("./components/Splash"));
+const UserCreate = React.lazy(() => import("./features/auth/UserCreate"));
+const Deposit = React.lazy(() => import("./features/deposit/Deposit"));
+const Inventory = React.lazy(() => import("./features/inventory/Inventory"));
+const InventoryAdd = React.lazy(() => import("./features/inventory/InventoryAdd"));
+const InventoryReport = React.lazy(() => import("./features/inventory/InventoryReport"));
+const Log = React.lazy(() => import("./features/log/Log"));
+const Register = React.lazy(() => import("./features/register/Register"));
+const OrderStats = React.lazy(() => import("./features/stats/OrderStats"));
+const ProductStats = React.lazy(() => import("./features/stats/ProductStats"));
+const Stats = React.lazy(() => import("./features/stats/Stats"));
+const UserStats = React.lazy(() => import("./features/stats/UserStats"));
+const UserDetail = React.lazy(() => import("./features/users/UserDetail"));
+const UserList = React.lazy(() => import("./features/users/UserList"));
 
-export const Routes: React.FC = () => (
+export const Routes = (): React.JSX.Element => (
+  <React.Suspense fallback={<div>Loading...</div>}>
     <ReactRouterRoutes>
       <Route path="/deposit" element={<Deposit />} />
+      <Route path="/inventory" element={<Inventory />} />
+      <Route path="/inventory/add" element={<InventoryAdd />} />
+      <Route path="/report" element={<InventoryReport />} />
       <Route path="/log" element={<Log />} />
       <Route path="/stats" element={<Stats />} />
       <Route path="/stats/orders" element={<OrderStats />} />
       <Route path="/stats/products" element={<ProductStats />} />
+      <Route path="/stats/users" element={<UserStats />} />
       <Route path="/users" element={<UserList />} />
       <Route path="/users/create" element={<UserCreate />} />
       <Route path="/user/:userId" element={<UserDetail />} />
       <Route path="/" element={<Register />} />
+      <Route path="*" element={<Splash brandText="404" noOverlay />} />
     </ReactRouterRoutes>
+  </React.Suspense>
 );

frontend/src/client.ts

@@ -1,7 +1,7 @@
-import { ApolloClient, InMemoryCache } from "@apollo/client";
+import { ApolloClient, HttpLink, InMemoryCache } from "@apollo/client";
 
 const client = new ApolloClient({
-  uri: import.meta.env.VITE_API_URL || "http://localhost:8000/graphql/",
+  link: new HttpLink({ uri: import.meta.env.DEV ? "/graphql/" : `${import.meta.env.VITE_API_URL}/graphql/` }),
   cache: new InMemoryCache(),
 });
 

frontend/src/components/Footer.module.css

@@ -0,0 +1,20 @@
+.footer {
+  flex-shrink: 0;
+  padding: 0 0 1rem;
+  height: 20px;
+  color: rgba(255, 255, 255, 0.5);
+  font-size: 0.8rem;
+  text-align: center;
+}
+
+.heart {
+  color: var(--brand);
+}
+
+.brick {
+  position: relative;
+  top: 7px;
+  display: inline-block;
+  width: 20px;
+  height: 20px;
+}

frontend/src/components/Footer.tsx

@@ -0,0 +1,15 @@
+import React from "react";
+
+import styles from "./Footer.module.css";
+import Brick from "../assets/brick.svg?react";
+
+export const Footer = (): React.JSX.Element => {
+  return (
+    <footer className={styles.footer}>
+      Made with <span className={styles.heart}>❤</span> by{" "}
+      <span title="EDB-gjengen">
+        <Brick className={styles.brick} />
+      </span>
+    </footer>
+  );
+};

frontend/src/components/GQLError.module.css

@@ -0,0 +1,11 @@
+.errorMessage {
+  width: 100%;
+  margin-top: 30vh;
+  color: var(--brand);
+  font-family:
+    Rocket Rinder,
+    monospace;
+  font-size: 3rem;
+  font-style: italic;
+  text-align: center;
+}

frontend/src/components/GQLError.tsx

@@ -0,0 +1,23 @@
+import type { ErrorLike } from "@apollo/client";
+import { CombinedGraphQLErrors } from "@apollo/client/errors";
+
+import styles from "./GQLError.module.css";
+
+const formatModel = (text: string) => {
+  const withSpaces = text
+    .replace(/([A-Z])/g, " $1")
+    .toLocaleLowerCase()
+    .trim();
+  return withSpaces.charAt(0).toUpperCase() + withSpaces.slice(1);
+};
+
+export const GQLError = ({ error }: { error: ErrorLike }) => {
+  if (error instanceof CombinedGraphQLErrors && error.errors.length === 1) {
+    const single = error.errors[0];
+    if (single?.extensions?.code === "NOT_FOUND") {
+      const modelPretty = formatModel(single?.extensions?.model as string);
+      return <div className={styles.errorMessage}>{`${modelPretty} not found`}</div>;
+    }
+  }
+  return <div className={styles.errorMessage}>Error...</div>;
+};

frontend/src/components/Header.module.css

@@ -1,13 +1,142 @@
-.logo {
-  position: relative;
-  top: -1px;
-  display: inline-block;
-  width: 24px;
-  height: 24px;
-  margin: 0 8px;
+.header {
+  width: min(100% - 2rem, 1220px);
+  max-width: 1220px;
+  margin: 1rem auto;
 }
 
-.navIcon {
+.nav {
+  display: flex;
+  min-height: 5rem;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.5rem 1rem;
+  text-transform: uppercase;
+}
+
+.navLink:after {
+  position: absolute;
+  right: 12px;
+  left: 14px;
+  display: block;
+  height: 1px;
+  background-color: rgba(243, 33, 61, 0.4);
+  box-shadow:
+    0 0 4px rgba(243, 33, 61, 0.4),
+    0 0 11px rgba(243, 33, 61, 0.4),
+    0 0 19px rgba(243, 33, 61, 0.4);
+  content: "";
+  transform: rotate(-2.5deg);
+}
+
+.navLink:hover:after {
+  background-color: var(--brand);
+  box-shadow:
+    0 0 4px var(--brand),
+    0 0 11px var(--brand),
+    0 0 19px var(--brand),
+    0 0 30px var(--brand);
+}
+
+.logoNav {
+  margin-left: 8px;
+}
+
+.navItems {
+  display: flex;
+  align-items: center;
+  flex: 1;
+  flex-wrap: wrap;
+  padding: 0;
+  margin: 0;
+  list-style: none;
+}
+.navLink {
   position: relative;
-  top: -2px;
+  padding: 0.4rem 0.8rem;
+  border: 1px solid transparent;
+  transition: color 0.1s ease-in-out;
+}
+.navLink:hover {
+  color: white;
+}
+.active.active {
+  color: white;
+}
+
+@media (max-width: 640px) {
+  .nav {
+    align-items: flex-start;
+  }
+
+  .logoNav {
+    margin: 0 auto;
+  }
+
+  .navItems {
+    justify-content: center;
+    gap: 0.25rem;
+  }
+
+  .navLink {
+    display: inline-block;
+    padding: 0.5rem;
+    font-size: 0.8rem;
+  }
+
+  .brand {
+    padding-left: 0;
+    font-size: 2.5rem;
+  }
+}
+
+/* FIXME: Duplicates Splash styles */
+.brand {
+  padding-left: 1rem;
+  color: var(--brand);
+  font-family:
+    Rocket Rinder,
+    monospace;
+  font-size: 3rem;
+  font-style: italic;
+  letter-spacing: 2px;
+  line-height: 1;
+  text-shadow:
+    0 0 4px rgba(243, 33, 61, 0.8),
+    0 0 11px rgba(243, 33, 61, 0.8),
+    0 0 19px rgba(243, 33, 61, 0.8);
+}
+
+.subtitle {
+  position: relative;
+  left: -8px;
+  animation: flicker 1.5s infinite alternate;
+  color: var(--interlace);
+  font-family:
+    Rocket Clouds DEMO,
+    serif;
+  font-size: 10px;
+  font-weight: bold;
+  line-height: 1;
+  transform: rotate(-6deg);
+}
+
+@keyframes flicker {
+  0%,
+  18%,
+  22%,
+  25%,
+  53%,
+  57%,
+  100% {
+    text-shadow:
+      0 0 4px rgba(121, 152, 238, 0.8),
+      0 0 11px rgba(121, 152, 238, 0.8),
+      0 0 19px rgba(121, 152, 238, 0.8);
+  }
+
+  20%,
+  24%,
+  55% {
+    text-shadow: none;
+  }
 }

frontend/src/components/Header.tsx

@@ -1,85 +1,60 @@
-import { ReactComponent as BarChart } from "bootstrap-icons/icons/bar-chart.svg";
-import { ReactComponent as CardList } from "bootstrap-icons/icons/card-list.svg";
-import { ReactComponent as House } from "bootstrap-icons/icons/house.svg";
-import { ReactComponent as PeopleIcon } from "bootstrap-icons/icons/people.svg";
+import clsx from "clsx";
 import React from "react";
 import { NavLink } from "react-router-dom";
 
-import { ReactComponent as Logo } from "../assets/brick.svg";
 import styles from "./Header.module.css";
 
-const ADMIN_URL = import.meta.env.VITE_API_URL
-  ? `${import.meta.env.VITE_API_URL}/admin`
-  : "http://localhost:8000/admin/";
+const ADMIN_URL = `${import.meta.env.VITE_API_URL}/admin/`;
 
-const navLinkStyles = ({ isActive }: { isActive: boolean }) => (isActive ? "nav-link active" : "nav-link");
+const navLinkStyles = ({ isActive }: { isActive: boolean }) => clsx(styles.navLink, { [styles.active]: isActive });
 
-export const Header: React.FC = () => {
+export const Header = (): React.JSX.Element => {
   return (
-    <header>
-      <nav className="navbar navbar-dark bg-dark navbar-expand-md">
-        <NavLink to="/" className="navbar-brand">
-          <span className={styles.logo}>
-            <Logo />
-          </span>
-          Biceps Bar System - BBS
+    <header className={styles.header}>
+      <nav className={styles.nav}>
+        <NavLink to="/" className={styles.logoNav}>
+          <div className={styles.brand}>BBS</div>
+          <div className={styles.subtitle}>Biceps Bar System</div>
         </NavLink>
-        <button
-          className="navbar-toggler"
-          type="button"
-          data-bs-toggle="collapse"
-          data-bs-target="#navbarNav"
-          aria-controls="navbarNav"
-          aria-expanded="false"
-          aria-label="Toggle navigation"
-        >
-          <span className="navbar-toggler-icon" />
-        </button>
-        <div className="collapse navbar-collapse" id="navbarNav">
-          <ul className="navbar-nav">
-            <li className="nav-item">
+        <ul className={styles.navItems}>
+          <li>
             <NavLink to="/" className={navLinkStyles} end>
-                <span className={styles.navIcon}>
-                  <House />
-                </span>{" "}
               Kjøp drikke
             </NavLink>
           </li>
-            <li className="nav-item">
+          <li>
             <NavLink to="/deposit" className={navLinkStyles}>
               Sett inn penger
             </NavLink>
           </li>
-            <li className="nav-item">
+          <li>
             <NavLink to="/log" className={navLinkStyles}>
-                <span className={styles.navIcon}>
-                  <CardList />
-                </span>{" "}
               Logg
             </NavLink>
           </li>
-            <li className="nav-item">
+          <li>
+            <NavLink to="/inventory" className={navLinkStyles}>
+              Varebeholdning
+            </NavLink>
+          </li>
+          <li>
+            <NavLink to="/report" className={navLinkStyles}>
+              Rapport
+            </NavLink>
+          </li>
+          <li>
             <NavLink to="/stats" className={navLinkStyles}>
-                <span className={styles.navIcon}>
-                  <BarChart />
-                </span>{" "}
               Statistikk
             </NavLink>
           </li>
 
-            <li className="nav-item">
+          <li>
             <NavLink to="/users" className={navLinkStyles}>
-                <span className={styles.navIcon}>
-                  <PeopleIcon />
-                </span>{" "}
               Folk
             </NavLink>
           </li>
-          </ul>
-        </div>
-        <ul className="navbar-nav">
-          <li className="nav-item">
-            <a href={ADMIN_URL} className="nav-link">
+          <li>
+            <a href={ADMIN_URL} className={styles.navLink}>
               Admin
             </a>
           </li>

frontend/src/components/ProductCard.module.css

@@ -1,57 +0,0 @@
-.product {
-  display: flex;
-  overflow: hidden;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  border: 4px solid transparent;
-  background: transparent;
-  border-radius: 8px;
-  transition: background-color 0.1s ease-out, border 0.1s ease-out;
-}
-.product:hover {
-  border-color: rgba(25, 135, 84, 0.6);
-  background: rgba(0, 0, 0, 0.1);
-}
-.active {
-  border-color: rgba(25, 135, 84, 0.6);
-  background: rgba(25, 135, 84, 0.2);
-}
-.active:hover {
-  background: rgba(25, 135, 84, 0.2);
-}
-.productText {
-  position: absolute;
-  right: 0;
-  bottom: 0;
-  left: 0;
-  padding: 4px;
-  background: rgba(0, 0, 0, 0.6);
-  border-radius: 8px;
-  color: white;
-  font-weight: bold;
-}
-.productImage {
-  width: 140px;
-  height: 140px;
-  object-fit: contain;
-}
-.noProductImage {
-  width: 140px;
-  height: 140px;
-}
-.amount {
-  position: absolute;
-  top: 0px;
-  left: 0px;
-  padding: 4px;
-  background: rgba(0, 0, 0, 0.6);
-  border-radius: 8px;
-  color: white;
-  font-size: 2rem;
-  font-weight: bold;
-  line-height: 1;
-}
-.wrap {
-  position: relative;
-}

frontend/src/components/ProductCard.tsx

@@ -1,26 +0,0 @@
-import clsx from "clsx";
-import React, { MouseEventHandler } from "react";
-
-import { Product } from "../types";
-import styles from "./ProductCard.module.css";
-
-type ProductCardProps = {
-  product: Omit<Product, "userCounts">;
-  onProduct: MouseEventHandler;
-  active: boolean;
-  amount: number;
-};
-
-export const ProductCard: React.FC<ProductCardProps> = ({ product, onProduct, amount, active = false }) => {
-  const classes = clsx(styles.product, { [styles.active]: active });
-  return (
-    <button className={classes} type="button" onClick={onProduct}>
-      <div className={styles.wrap}>
-        <span className={styles.amount}>{amount}</span>
-        {product.imageUrl && <img src={product.imageUrl} className={styles.productImage} alt={product.name} />}
-        {!product.imageUrl && <div className={styles.noProductImage} />}
-        <span className={styles.productText}>{product.name}</span>
-      </div>
-    </button>
-  );
-};

frontend/src/components/Splash.module.css

@@ -0,0 +1,82 @@
+.splash {
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  display: grid;
+  place-items: center;
+  text-align: center;
+}
+.overlay {
+  position: fixed;
+}
+
+.wrap {
+  position: relative;
+}
+
+.sun {
+  width: clamp(100px, 65vw, 600px);
+  height: clamp(100px, 65vw, 600px);
+  border-radius: 50% 50%;
+  margin: 0 auto;
+  background: linear-gradient(var(--sun) 50%, var(--sun-end) 90%);
+  box-shadow:
+    0 0 4px var(--sun),
+    0 0 11px var(--sun),
+    0 0 19px var(--sun),
+    0 0 30px var(--sun);
+}
+.brand {
+  position: relative;
+  left: -0.6rem;
+  padding-top: 3rem;
+  color: var(--brand);
+  font-family:
+    Rocket Rinder,
+    monospace;
+  font-size: clamp(20px, 20vw, 200px);
+  font-style: italic;
+  letter-spacing: 1rem;
+  line-height: 1;
+  text-shadow:
+    0 0 4px rgba(243, 33, 61, 0.8),
+    0 0 11px rgba(243, 33, 61, 0.8),
+    0 0 19px rgba(243, 33, 61, 0.8);
+}
+
+.subtitle {
+  position: relative;
+  bottom: 0.5rem;
+  left: 0rem;
+  animation: flicker 1.5s infinite alternate;
+  color: var(--interlace);
+  font-family:
+    Rocket Clouds DEMO,
+    serif;
+  font-size: clamp(20px, 5vw, 50px);
+  font-weight: bold;
+  line-height: 1;
+  transform: rotate(-6deg);
+}
+
+@keyframes flicker {
+  0%,
+  18%,
+  22%,
+  25%,
+  53%,
+  57%,
+  100% {
+    text-shadow:
+      0 0 4px rgba(121, 152, 238, 0.8),
+      0 0 11px rgba(121, 152, 238, 0.8),
+      0 0 19px rgba(121, 152, 238, 0.8);
+  }
+
+  20%,
+  24%,
+  55% {
+    text-shadow: none;
+  }
+}

frontend/src/components/Splash.tsx

@@ -0,0 +1,20 @@
+import clsx from "clsx";
+import React from "react";
+
+import styles from "./Splash.module.css";
+
+interface SplashProps {
+  brandText?: string;
+  noOverlay?: boolean;
+}
+
+const Splash = ({ brandText = "BBS", noOverlay = false }: SplashProps): React.JSX.Element => (
+  <div className={clsx(styles.splash, { [styles.overlay]: !noOverlay })}>
+    <div className={styles.wrap}>
+      <div className={styles.sun}></div>
+      <div className={styles.brand}>{brandText}</div>
+      <div className={styles.subtitle}>Biceps Bar System</div>
+    </div>
+  </div>
+);
+export default Splash;

frontend/src/components/Toast.module.css

@@ -2,4 +2,33 @@
   position: absolute;
   bottom: 32px;
   left: 32px;
+  padding: 0.6rem 1.2rem;
+  border-radius: 4px;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.1s ease-in-out;
+}
+
+.visible {
+  opacity: 1;
+  pointer-events: initial;
+}
+
+.primary {
+  background: linear-gradient(var(--sun) 30%, var(--sun-end) 100%);
+  box-shadow:
+    0 0 4px var(--sun),
+    0 0 11px var(--sun),
+    0 0 19px var(--sun);
+}
+.danger {
+  background: var(--brand);
+  box-shadow:
+    0 0 4px rgba(243, 33, 61, 0.8),
+    0 0 11px rgba(243, 33, 61, 0.8),
+    0 0 19px rgba(243, 33, 61, 0.8);
+}
+
+.close {
+  display: none;
 }

frontend/src/components/Toast.tsx

@@ -1,41 +1,18 @@
-import { Toast as BSToast } from "bootstrap";
 import clsx from "clsx";
-import React, { useEffect, useRef } from "react";
+import React from "react";
 
 import styles from "./Toast.module.css";
-import { useToast } from "./ToastProvider";
+import { useToast } from "../hooks/useToast";
 
-export const Toast: React.FC = () => {
-  const ref = useRef<HTMLInputElement>(null);
-  const { visible, showToast, message, background } = useToast();
+export const Toast = (): React.JSX.Element => {
+  const { showToast, message, background, visible } = useToast();
 
-  const backgroundColor = `bg-${background}`;
-  const classes = clsx("toast align-items-center text-white bg-primary border-0", backgroundColor, styles.toast);
-
-  useEffect(() => {
-    if (!ref.current) return;
-    const bsToast = BSToast.getInstance(ref.current) || new BSToast(ref.current);
-
-    if (visible) {
-      bsToast?.show();
-    } else if (!visible) {
-      bsToast?.hide();
-    }
-    return () => bsToast?.hide();
-  }, [visible]);
+  const classes = clsx([styles[background], styles.toast], { [styles.visible]: visible });
 
   return (
-    <div ref={ref} className={classes} role="alert" aria-live="assertive" aria-atomic="true">
-      <div className="d-flex">
-        <div className="toast-body">{message}</div>
-        <button
-          type="button"
-          className="btn-close btn-close-white me-2 m-auto"
-          data-bs-dismiss="toast"
-          aria-label="Close"
-          onClick={() => showToast(message)}
-        />
-      </div>
+    <div className={classes} role="alert" aria-live="assertive" aria-atomic="true">
+      <div>{message}</div>
+      <button type="button" aria-label="Close" onClick={() => showToast(message)} className={styles.close} />
     </div>
   );
 };

frontend/src/components/ToastProvider.tsx

@@ -1,41 +1,25 @@
-import React, { ReactNode, useContext, useState } from "react";
+import React, { useState } from "react";
+import type { ReactNode } from "react";
 
-interface ToastProps {
-  visible: boolean;
-  message: string;
-  showToast: (message: string, background?: string) => void;
-  hide: () => void;
-  background: string;
-}
-
-const defaultState = {
-  visible: false,
-  message: "",
-  // eslint-disable-next-line @typescript-eslint/no-empty-function
-  showToast: () => {},
-  // eslint-disable-next-line @typescript-eslint/no-empty-function
-  hide: () => {},
-  background: "primary",
-};
-
-const ToastContext = React.createContext<ToastProps>(defaultState);
+import { ToastContext, defaultToastState } from "../contexts/ToastContext";
+import type { Background } from "../contexts/ToastContext";
 
 type ToastProviderProps = {
   children: ReactNode;
 };
-export const ToastProvider: React.FC<ToastProviderProps> = ({ children }) => {
-  const [visible, setVisible] = useState(defaultState.visible);
-  const [message, setMessage] = useState("");
-  const [background, setBackground] = useState("");
 
-  const showToast = (newMessage: string, background = "primary") => {
+export const ToastProvider = ({ children }: ToastProviderProps): React.JSX.Element => {
+  const [visible, setVisible] = useState(defaultToastState.visible);
+  const [message, setMessage] = useState(defaultToastState.message);
+  const [background, setBackground] = useState(defaultToastState.background);
+
+  const showToast = (newMessage: string, background: Background = "primary") => {
     setMessage(newMessage);
     setBackground(background);
     if (!visible) {
       setVisible(true);
       setTimeout(() => {
         setVisible(false);
-        setMessage("");
       }, 3000);
     }
   };
@@ -47,5 +31,3 @@ export const ToastProvider: React.FC<ToastProviderProps> = ({ children }) => {
     <ToastContext.Provider value={{ visible, showToast, message, hide, background }}>{children}</ToastContext.Provider>
   );
 };
-
-export const useToast = (): ToastProps => useContext(ToastContext);

frontend/src/components/UserCard.module.css

@@ -1,34 +0,0 @@
-.user {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  padding: 4px;
-  border: 3px solid transparent;
-  background: transparent;
-  border-radius: 8px;
-  transition: background-color 0.1s ease-out, border 0.1s ease-out;
-}
-.user:hover {
-  border-color: rgba(25, 135, 84, 0.6);
-  background: rgba(0, 0, 0, 0.1);
-}
-.active {
-  border-color: rgba(25, 135, 84, 0.6);
-  background: rgba(25, 135, 84, 0.2);
-}
-.active:hover {
-  background: rgba(25, 135, 84, 0.2);
-}
-.avatar {
-  width: 50px;
-  height: 50px;
-  border-radius: 50px;
-}
-.avatar svg {
-  width: 50px;
-  height: 50px;
-  color: #ccc;
-}
-.name {
-  font-weight: bold;
-}

frontend/src/components/UserCard.tsx

@@ -1,31 +0,0 @@
-import { ReactComponent as PersonFill } from "bootstrap-icons/icons/person-fill.svg";
-import clsx from "clsx";
-import React, { MouseEventHandler } from "react";
-
-import { AllUsersQuery } from "../types";
-import styles from "./UserCard.module.css";
-
-type UserCardProps = {
-  user: AllUsersQuery["allUsers"][0] | null;
-  onUser: MouseEventHandler;
-  active: boolean;
-};
-
-/** If user is null, then it's the special external user */
-export const UserCard: React.FC<UserCardProps> = ({ user, onUser, active = false }) => {
-  const classes = clsx(styles.user, { [styles.active]: active });
-  return (
-    <button className={classes} onClick={onUser} type="button">
-      {user?.profile?.image && (
-        <img src={user.profile?.image} alt={`Profile for ${user.firstName}`} className={styles.avatar} />
-      )}
-      {!user?.profile?.image && (
-        <span className={styles.avatar}>
-          <PersonFill />
-        </span>
-      )}
-      <span className={styles.name}>{user?.firstName || "Ekstern"}</span>
-      <span className={styles.balance}>{user?.profile?.balance || ""}</span>
-    </button>
-  );
-};

frontend/src/components/Wireframe.module.css

@@ -0,0 +1,52 @@
+.decoration {
+  position: absolute;
+  z-index: -1;
+  top: 0;
+  right: 0;
+  left: 0;
+  height: 100vh;
+  overflow: clip;
+  pointer-events: none;
+}
+
+.wireframe {
+  position: absolute;
+  bottom: calc(22% - 512px);
+  left: calc(50% - 512px);
+  display: grid;
+  width: 1024px;
+  height: 1024px;
+  animation-duration: 10s;
+  animation-iteration-count: infinite;
+  animation-name: isometric-rotate;
+  animation-timing-function: linear;
+  grid-template-columns: repeat(8, 128px);
+}
+
+.cell {
+  border-right: 2px solid var(--sun);
+  border-bottom: 2px solid var(--sun);
+}
+
+.cell:nth-child(8n) {
+  border-right: none;
+}
+
+.cell:nth-child(n + 57) {
+  border-bottom: none;
+}
+
+@media (max-width: 640px) {
+  .decoration {
+    display: none;
+  }
+}
+
+@keyframes isometric-rotate {
+  0% {
+    transform: rotateX(70deg) rotateY(0deg) rotateZ(-45deg);
+  }
+  100% {
+    transform: rotateX(70deg) rotateY(0deg) rotateZ(-405deg);
+  }
+}