add permission check for form productor and product

.gitea/workflows/deploy.yaml

@@ -11,6 +11,14 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+      - name: Test backend
+        uses: actions/setup-python@v6
+        with: 
+          python-version: "3.12"
+      - run: |
+          python -m pip install --upgrade pip
+          pip install -r backend/requirements.txt
+          pytest -sv
       - name: Build & deploy
         run: |
           docker compose -f docker-compose.yaml up -d --build

README.md

@@ -4,23 +4,12 @@
 
 - Extract recap
 
-## Payment method max cheque number
-
 ## Link products to a form
 
 ## Wording
 
 - all translations
 
-## Draft / Publish form
-
-- By default form is in draft mode
-- Validate a form (button)
-  - check if productor
-  - check if shipments
-  - check products
-- Publish
-
 ## Footer
 
 ### Legal
@@ -29,4 +18,9 @@
 
 ### Contact
 
+## Pagination
+
+## Confirmation modal on suppression
+### Show on cascade deletion
+
 ## Update contract after (without registration)

backend/.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+default_language_version:
+  python: python3.13
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: trailing-whitespace
+      - id: check-ast
+      - id: check-builtin-literals
+      - id: check-docstring-first
+      - id: check-yaml
+      - id: check-toml
+      - id: mixed-line-ending
+      - id: end-of-file-fixer
+  - repo: local
+    hooks:
+      - id: check-pylint
+        name: check-pylint
+        entry: pylint -d R0801,R0903,W0511,W0603,C0103,R0902
+        language: system
+        types: [python]
+        pass_filenames: false
+        args:
+          - backend

backend/README.md

@@ -29,6 +29,17 @@ alembic revision --autogenerate -m "message"
 ```console
 alembic upgrade head
 ```
+## Tests
+```
+hatch run pytest
+hatch run pytest --cov=src -vv
+```
+
+## Autoformat
+```console
+find -type f -name '*.py' ! -path 'alembic/*'  -exec autopep8 --in-place --aggressive --aggressive '{}' \;
+pylint -d R0801,R0903,W0511,W0603,C0103,R0902 .
+```
 
 ## License
 

backend/alembic/env.py

@@ -25,7 +25,8 @@ target_metadata = SQLModel.metadata
 
 # other values from the config, defined by the needs of env.py,
 # can be acquired:
-config.set_main_option("sqlalchemy.url", f'postgresql://{settings.db_user}:{settings.db_pass}@{settings.db_host}:5432/{settings.db_name}')
+config.set_main_option(
+    "sqlalchemy.url", f'postgresql://{settings.db_user}:{settings.db_pass}@{settings.db_host}:5432/{settings.db_name}')
 # ... etc.
 
 

backend/alembic/versions/7854064278ce_message.py

@@ -22,7 +22,12 @@ depends_on: Union[str, Sequence[str], None] = None
 def upgrade() -> None:
     """Upgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column('paymentmethod', sa.Column('max', sa.Integer(), nullable=True))
+    op.add_column(
+        'paymentmethod',
+        sa.Column(
+            'max',
+            sa.Integer(),
+            nullable=True))
     # ### end Alembic commands ###
 
 

backend/alembic/versions/c0b1073a8394_initial_repository.py

@@ -22,117 +22,121 @@ depends_on: Union[str, Sequence[str], None] = None
 def upgrade() -> None:
     """Upgrade schema."""
     # ### commands auto generated by Alembic - please adjust! ###
-    op.create_table('contracttype',
+    op.create_table(
-    sa.Column('id', sa.Integer(), nullable=False),
+        'contracttype',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+        sa.Column(
-    sa.PrimaryKeyConstraint('id')
+            'id',
-    )
+            sa.Integer(),
-    op.create_table('productor',
+            nullable=False),
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+        sa.Column(
-    sa.Column('address', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+            'name',
-    sa.Column('type', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+            sqlmodel.sql.sqltypes.AutoString(),
-    sa.Column('id', sa.Integer(), nullable=False),
+            nullable=False),
-    sa.PrimaryKeyConstraint('id')
+        sa.PrimaryKeyConstraint('id'))
-    )
+    op.create_table(
+        'productor', sa.Column(
+            'name', sqlmodel.sql.sqltypes.AutoString(), nullable=False), sa.Column(
+            'address', sqlmodel.sql.sqltypes.AutoString(), nullable=False), sa.Column(
+                'type', sqlmodel.sql.sqltypes.AutoString(), nullable=False), sa.Column(
+                    'id', sa.Integer(), nullable=False), sa.PrimaryKeyConstraint('id'))
     op.create_table('template',
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
-    op.create_table('user',
+    op.create_table(
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+        'user', sa.Column(
-    sa.Column('email', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+            'name', sqlmodel.sql.sqltypes.AutoString(), nullable=False), sa.Column(
-    sa.Column('id', sa.Integer(), nullable=False),
+            'email', sqlmodel.sql.sqltypes.AutoString(), nullable=False), sa.Column(
-    sa.PrimaryKeyConstraint('id')
+                'id', sa.Integer(), nullable=False), sa.PrimaryKeyConstraint('id'))
-    )
     op.create_table('form',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('productor_id', sa.Integer(), nullable=True),
+                    sa.Column('productor_id', sa.Integer(), nullable=True),
-    sa.Column('referer_id', sa.Integer(), nullable=True),
+                    sa.Column('referer_id', sa.Integer(), nullable=True),
-    sa.Column('season', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('season', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('start', sa.Date(), nullable=False),
+                    sa.Column('start', sa.Date(), nullable=False),
-    sa.Column('end', sa.Date(), nullable=False),
+                    sa.Column('end', sa.Date(), nullable=False),
-    sa.Column('minimum_shipment_value', sa.Float(), nullable=True),
+                    sa.Column('minimum_shipment_value', sa.Float(), nullable=True),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ),
+                    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ),
-    sa.ForeignKeyConstraint(['referer_id'], ['user.id'], ),
+                    sa.ForeignKeyConstraint(['referer_id'], ['user.id'], ),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('paymentmethod',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('details', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('details', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.Column('productor_id', sa.Integer(), nullable=False),
+                    sa.Column('productor_id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ondelete='CASCADE'),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('product',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('unit', sa.Enum('GRAMS', 'KILO', 'PIECE', name='unit'), nullable=False),
+                    sa.Column('unit', sa.Enum('GRAMS', 'KILO', 'PIECE', name='unit'), nullable=False),
-    sa.Column('price', sa.Float(), nullable=True),
+                    sa.Column('price', sa.Float(), nullable=True),
-    sa.Column('price_kg', sa.Float(), nullable=True),
+                    sa.Column('price_kg', sa.Float(), nullable=True),
-    sa.Column('quantity', sa.Float(), nullable=True),
+                    sa.Column('quantity', sa.Float(), nullable=True),
-    sa.Column('quantity_unit', sqlmodel.sql.sqltypes.AutoString(), nullable=True),
+                    sa.Column('quantity_unit', sqlmodel.sql.sqltypes.AutoString(), nullable=True),
-    sa.Column('type', sa.Enum('OCCASIONAL', 'RECCURENT', name='producttype'), nullable=False),
+                    sa.Column('type', sa.Enum('OCCASIONAL', 'RECCURENT', name='producttype'), nullable=False),
-    sa.Column('productor_id', sa.Integer(), nullable=True),
+                    sa.Column('productor_id', sa.Integer(), nullable=True),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ),
+                    sa.ForeignKeyConstraint(['productor_id'], ['productor.id'], ),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
-    op.create_table('usercontracttypelink',
+    op.create_table(
-    sa.Column('user_id', sa.Integer(), nullable=False),
+        'usercontracttypelink', sa.Column(
-    sa.Column('contract_type_id', sa.Integer(), nullable=False),
+            'user_id', sa.Integer(), nullable=False), sa.Column(
-    sa.ForeignKeyConstraint(['contract_type_id'], ['contracttype.id'], ),
+            'contract_type_id', sa.Integer(), nullable=False), sa.ForeignKeyConstraint(
-    sa.ForeignKeyConstraint(['user_id'], ['user.id'], ),
+                ['contract_type_id'], ['contracttype.id'], ), sa.ForeignKeyConstraint(
-    sa.PrimaryKeyConstraint('user_id', 'contract_type_id')
+                    ['user_id'], ['user.id'], ), sa.PrimaryKeyConstraint(
-    )
+                        'user_id', 'contract_type_id'))
     op.create_table('contract',
-    sa.Column('firstname', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('firstname', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('lastname', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('lastname', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('email', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('email', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('phone', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('phone', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('payment_method', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('payment_method', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('cheque_quantity', sa.Integer(), nullable=False),
+                    sa.Column('cheque_quantity', sa.Integer(), nullable=False),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.Column('form_id', sa.Integer(), nullable=False),
+                    sa.Column('form_id', sa.Integer(), nullable=False),
-    sa.Column('file', sa.LargeBinary(), nullable=True),
+                    sa.Column('file', sa.LargeBinary(), nullable=True),
-    sa.Column('total_price', sa.Float(), nullable=True),
+                    sa.Column('total_price', sa.Float(), nullable=True),
-    sa.ForeignKeyConstraint(['form_id'], ['form.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['form_id'], ['form.id'], ondelete='CASCADE'),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('shipment',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('date', sa.Date(), nullable=False),
+                    sa.Column('date', sa.Date(), nullable=False),
-    sa.Column('form_id', sa.Integer(), nullable=True),
+                    sa.Column('form_id', sa.Integer(), nullable=True),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['form_id'], ['form.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['form_id'], ['form.id'], ondelete='CASCADE'),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('cheque',
-    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('name', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('value', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
+                    sa.Column('value', sqlmodel.sql.sqltypes.AutoString(), nullable=False),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.Column('contract_id', sa.Integer(), nullable=False),
+                    sa.Column('contract_id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['contract_id'], ['contract.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['contract_id'], ['contract.id'], ondelete='CASCADE'),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('contractproduct',
-    sa.Column('product_id', sa.Integer(), nullable=False),
+                    sa.Column('product_id', sa.Integer(), nullable=False),
-    sa.Column('shipment_id', sa.Integer(), nullable=True),
+                    sa.Column('shipment_id', sa.Integer(), nullable=True),
-    sa.Column('quantity', sa.Float(), nullable=False),
+                    sa.Column('quantity', sa.Float(), nullable=False),
-    sa.Column('id', sa.Integer(), nullable=False),
+                    sa.Column('id', sa.Integer(), nullable=False),
-    sa.Column('contract_id', sa.Integer(), nullable=False),
+                    sa.Column('contract_id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['contract_id'], ['contract.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['contract_id'], ['contract.id'], ondelete='CASCADE'),
-    sa.ForeignKeyConstraint(['product_id'], ['product.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['product_id'], ['product.id'], ondelete='CASCADE'),
-    sa.ForeignKeyConstraint(['shipment_id'], ['shipment.id'], ondelete='CASCADE'),
+                    sa.ForeignKeyConstraint(['shipment_id'], ['shipment.id'], ondelete='CASCADE'),
-    sa.PrimaryKeyConstraint('id')
+                    sa.PrimaryKeyConstraint('id')
-    )
+                    )
     op.create_table('shipmentproductlink',
-    sa.Column('shipment_id', sa.Integer(), nullable=False),
+                    sa.Column('shipment_id', sa.Integer(), nullable=False),
-    sa.Column('product_id', sa.Integer(), nullable=False),
+                    sa.Column('product_id', sa.Integer(), nullable=False),
-    sa.ForeignKeyConstraint(['product_id'], ['product.id'], ),
+                    sa.ForeignKeyConstraint(['product_id'], ['product.id'], ),
-    sa.ForeignKeyConstraint(['shipment_id'], ['shipment.id'], ),
+                    sa.ForeignKeyConstraint(['shipment_id'], ['shipment.id'], ),
-    sa.PrimaryKeyConstraint('shipment_id', 'product_id')
+                    sa.PrimaryKeyConstraint('shipment_id', 'product_id')
-    )
+                    )
     # ### end Alembic commands ###
 
 

backend/alembic/versions/e777ed5729ce_message.py

@@ -0,0 +1,40 @@
+"""message
+
+Revision ID: e777ed5729ce
+Revises: 7854064278ce
+Create Date: 2026-02-23 13:53:09.999893
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+import sqlmodel.sql.sqltypes
+
+# revision identifiers, used by Alembic.
+revision: str = 'e777ed5729ce'
+down_revision: Union[str, Sequence[str], None] = '7854064278ce'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        'form',
+        sa.Column(
+            'visible',
+            sa.Boolean(),
+            nullable=False,
+            default=False,
+            server_default="False"))
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('form', 'visible')
+    # ### end Alembic commands ###

backend/pyproject.toml

@@ -30,7 +30,13 @@ dependencies = [
   "requests",
   "weasyprint",
   "odfdo",
-  "alembic"
+  "alembic",
+  "pytest",
+  "pytest-cov",
+  "pytest-mock",
+  "autopep8",
+  "prek",
+  "pylint",
 ]
 
 [project.urls]

backend/requirements.txt

@@ -1,34 +1,48 @@
+alembic==1.18.4
 annotated-doc==0.0.4
 annotated-types==0.7.0
 anyio==4.12.1
+astroid==4.0.4
+autopep8==2.3.2
 brotli==1.2.0
-certifi==2026.1.4
+certifi==2026.2.25
 cffi==2.0.0
 charset-normalizer==3.4.4
 click==8.3.1
+coverage==7.13.4
 cryptography==46.0.5
 cssselect2==0.9.0
+dill==0.4.1
 dnspython==2.8.0
 email-validator==2.3.0
-fastapi==0.129.0
+fastapi==0.135.1
-fastapi-cli==0.0.23
+fastapi-cli==0.0.24
-fastapi-cloud-cli==0.13.0
+fastapi-cloud-cli==0.14.0
 fastar==0.8.0
 fonttools==4.61.1
-greenlet==3.3.1
+greenlet==3.3.2
 h11==0.16.0
 httpcore==1.0.9
 httptools==0.7.1
 httpx==0.28.1
 idna==3.11
+iniconfig==2.3.0
+isort==8.0.1
 Jinja2==3.1.6
 lxml==6.0.2
+Mako==1.3.10
 markdown-it-py==4.0.0
 MarkupSafe==3.0.3
+mccabe==0.7.0
 mdurl==0.1.2
-odfdo==3.20.2
+odfdo==3.21.0
+packaging==26.0
 pillow==12.1.1
+platformdirs==4.9.2
+pluggy==1.6.0
+prek==0.3.4
 psycopg2-binary==2.9.11
+pycodestyle==2.14.0
 pycparser==3.0
 pydantic==2.12.5
 pydantic-extra-types==2.11.0
@@ -37,22 +51,27 @@ pydantic_core==2.41.5
 pydyf==0.12.1
 Pygments==2.19.2
 PyJWT==2.11.0
+pylint==4.0.5
 pyphen==0.17.2
-python-dotenv==1.2.1
+pytest==9.0.2
+pytest-cov==7.0.0
+pytest-mock==3.15.1
+python-dotenv==1.2.2
 python-multipart==0.0.22
 PyYAML==6.0.3
 requests==2.32.5
-rich==14.3.2
+rich==14.3.3
-rich-toolkit==0.19.4
+rich-toolkit==0.19.7
 rignore==0.7.6
 sentry-sdk==2.53.0
 shellingham==1.5.4
-SQLAlchemy==2.0.46
+SQLAlchemy==2.0.47
-sqlmodel==0.0.34
+sqlmodel==0.0.37
 starlette==0.52.1
 tinycss2==1.5.1
 tinyhtml5==2.0.0
-typer==0.24.0
+tomlkit==0.14.0
+typer==0.24.1
 typing-inspection==0.4.2
 typing_extensions==4.15.0
 urllib3==2.6.3
@@ -63,4 +82,3 @@ weasyprint==68.1
 webencodings==0.5.1
 websockets==16.0
 zopfli==0.4.1
-alembic==1.18.4

backend/src/auth/auth.py

@@ -1,26 +1,28 @@
-from typing import Annotated
-from fastapi import APIRouter, Security, HTTPException, Depends, Request, Cookie
-from fastapi.responses import RedirectResponse, Response
-from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
-from sqlmodel import Session, select
-import jwt
-from jwt import PyJWKClient
-
-from src.settings import AUTH_URL, TOKEN_URL, JWKS_URL, ISSUER, LOGOUT_URL, settings
-import src.users.service as service
-from src.database import get_session
-from src.models import UserCreate, User, UserPublic
-
 import secrets
-import requests
+from typing import Annotated
 from urllib.parse import urlencode
+
+import jwt
+import requests
 import src.messages as messages
+import src.users.service as service
+from fastapi import (APIRouter, Cookie, Depends, HTTPException, Request,
+                     Security)
+from fastapi.responses import RedirectResponse, Response
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jwt import PyJWKClient
+from sqlmodel import Session, select
+from src.database import get_session
+from src.models import User, UserCreate, UserPublic
+from src.settings import (AUTH_URL, ISSUER, JWKS_URL, LOGOUT_URL, TOKEN_URL,
+                          settings)
 
 router = APIRouter(prefix='/auth')
 
 jwk_client = PyJWKClient(JWKS_URL)
 security = HTTPBearer()
 
+
 @router.get('/logout')
 def logout():
     params = {
@@ -59,9 +61,11 @@ def login():
         'redirect_uri': settings.keycloak_redirect_uri,
         'state': state,
     }
-    request_url = requests.Request('GET', AUTH_URL, params=params).prepare().url
+    request_url = requests.Request(
+        'GET', AUTH_URL, params=params).prepare().url
     return RedirectResponse(request_url)
 
+
 @router.get('/callback')
 def callback(code: str, session: Session = Depends(get_session)):
     data = {
@@ -77,15 +81,17 @@ def callback(code: str, session: Session = Depends(get_session)):
     response = requests.post(TOKEN_URL, data=data, headers=headers)
     if response.status_code != 200:
         raise HTTPException(
-            status_code=400,
+            status_code=404,
-            detail=messages.failtogettoken
+            detail=messages.Messages.not_found('token')
         )
 
     token_data = response.json()
 
     id_token = token_data['id_token']
     decoded_token = jwt.decode(id_token, options={'verify_signature': False})
-    decoded_access_token = jwt.decode(token_data['access_token'], options={'verify_signature': False})
+    decoded_access_token = jwt.decode(
+        token_data['access_token'], options={
+            'verify_signature': False})
     resource_access = decoded_access_token.get('resource_access')
     if not resource_access:
         data = {
@@ -93,7 +99,7 @@ def callback(code: str, session: Session = Depends(get_session)):
             'client_secret': settings.keycloak_client_secret,
             'refresh_token': token_data['refresh_token'],
         }
-        res = requests.post(LOGOUT_URL, data=data)
+        requests.post(LOGOUT_URL, data=data)
         resp = RedirectResponse(f'{settings.origins}?userNotAllowed=true')
         return resp
     roles = resource_access.get(settings.keycloak_client_id)
@@ -103,7 +109,7 @@ def callback(code: str, session: Session = Depends(get_session)):
             'client_secret': settings.keycloak_client_secret,
             'refresh_token': token_data['refresh_token'],
         }
-        res = requests.post(LOGOUT_URL, data=data)
+        requests.post(LOGOUT_URL, data=data)
         resp = RedirectResponse(f'{settings.origins}?userNotAllowed=true')
         return resp
 
@@ -141,6 +147,7 @@ def callback(code: str, session: Session = Depends(get_session)):
 
     return response
 
+
 def verify_token(token: str):
     try:
         signing_key = jwk_client.get_signing_key_from_jwt(token)
@@ -154,28 +161,49 @@ def verify_token(token: str):
         )
         return decoded
     except jwt.ExpiredSignatureError:
-        raise HTTPException(status_code=401, detail=messages.tokenexipired)
+        raise HTTPException(
+            status_code=401,
+            detail=messages.Messages.tokenexipired
+        )
     except jwt.InvalidTokenError:
-        raise HTTPException(status_code=401, detail=messages.invalidtoken)
+        raise HTTPException(
+            status_code=401,
+            detail=messages.Messages.invalidtoken
+        )
 
 
-def get_current_user(request: Request, session: Session = Depends(get_session)):
+def get_current_user(
+        request: Request,
+        session: Session = Depends(get_session)):
     access_token = request.cookies.get('access_token')
     if not access_token:
-        raise HTTPException(status_code=401, detail=messages.notauthenticated)
+        raise HTTPException(
+            status_code=401,
+            detail=messages.Messages.notauthenticated
+        )
     payload = verify_token(access_token)
     if not payload:
-        raise HTTPException(status_code=401, detail='aze')
+        raise HTTPException(
+            status_code=401, 
+            detail='aze'
+        )
     email = payload.get('email')
 
     if not email:
-        raise HTTPException(status_code=401, detail=messages.notauthenticated)
+        raise HTTPException(
+            status_code=401,
+            detail=messages.Messages.notauthenticated
+        )
 
     user = session.exec(select(User).where(User.email == email)).first()
     if not user:
-        raise HTTPException(status_code=401, detail=messages.usernotfound)
+        raise HTTPException(
+            status_code=401,
+            detail=messages.Messages.not_found('user')
+        )
     return user
 
+
 @router.post('/refresh')
 def refresh_token(refresh_token: Annotated[str | None, Cookie()] = None):
     refresh = refresh_token
@@ -191,8 +219,8 @@ def refresh_token(refresh_token: Annotated[str | None, Cookie()] = None):
     result = requests.post(TOKEN_URL, data=data, headers=headers)
     if result.status_code != 200:
         raise HTTPException(
-            status_code=400,
+            status_code=404,
-            detail=messages.failtogettoken
+            detail=messages.Messages.not_found('token')
         )
 
     token_data = result.json()
@@ -223,6 +251,7 @@ def refresh_token(refresh_token: Annotated[str | None, Cookie()] = None):
     )
     return response
 
+
 @router.get('/user/me')
 def me(user: UserPublic = Depends(get_current_user)):
     if not user:
@@ -233,6 +262,6 @@ def me(user: UserPublic = Depends(get_current_user)):
             'name': user.name,
             'email': user.email,
             'id': user.id,
-            'roles': [role.name for role in user.roles]
+            'roles': user.roles
         }
     }

backend/src/contracts/contracts.py

@@ -1,18 +1,27 @@
-from fastapi import APIRouter, Depends, HTTPException, Query
+"""Router for contract resource"""
-from fastapi.responses import StreamingResponse
-from src.database import get_session
-from sqlmodel import Session
-from src.contracts.generate_contract import generate_html_contract, generate_recap
-from src.auth.auth import get_current_user
-import src.models as models
-import src.messages as messages
-import src.contracts.service as service
-import src.forms.service as form_service
 import io
 import zipfile
+
+import src.contracts.service as service
+import src.forms.service as form_service
+import src.messages as messages
+from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi.responses import StreamingResponse
+from sqlmodel import Session
+from src import models
+from src.auth.auth import get_current_user
+from src.contracts.generate_contract import (generate_html_contract,
+                                             generate_recap)
+from src.database import get_session
+
 router = APIRouter(prefix='/contracts')
 
-def compute_recurrent_prices(products_quantities: list[dict], nb_shipment: int):
+
+def compute_recurrent_prices(
+    products_quantities: list[dict],
+    nb_shipment: int
+):
+    """Compute price for recurrent products"""
     result = 0
     for product_quantity in products_quantities:
         product = product_quantity['product']
@@ -20,25 +29,45 @@ def compute_recurrent_prices(products_quantities: list[dict], nb_shipment: int):
         result += compute_product_price(product, quantity, nb_shipment)
     return result
 
+
 def compute_occasional_prices(occasionals: list[dict]):
+    """Compute prices for occassional products"""
     result = 0
     for occasional in occasionals:
         result += occasional['price']
     return result
 
-def compute_product_price(product: models.Product, quantity: int, nb_shipment: int = 1):
+
-    product_quantity_unit = 1 if product.unit == models.Unit.KILO else 1000
+def compute_product_price(
-    final_quantity = quantity if product.price else quantity / product_quantity_unit
+    product: models.Product,
-    final_price = product.price if product.price else product.price_kg
+    quantity: int,
+    nb_shipment: int = 1
+):
+    """Compute price for a product"""
+    product_quantity_unit = (
+        1 if product.unit == models.Unit.KILO else 1000
+    )
+    final_quantity = (
+        quantity if product.price else quantity / product_quantity_unit
+    )
+    final_price = (
+        product.price if product.price else product.price_kg
+    )
     return final_price * final_quantity * nb_shipment
 
+
 def find_dict_in_list(lst, key, value):
+    """Find the index of a dictionnary in a list of dictionnaries given a key
+    and a value.
+    """
     for i, dic in enumerate(lst):
         if dic[key].id == value:
             return i
     return -1
 
+
 def create_occasional_dict(contract_products: list[models.ContractProduct]):
+    """Create a dictionnary of occasional products"""
     result = []
     for contract_product in contract_products:
         existing_id = find_dict_in_list(
@@ -69,20 +98,46 @@ def create_occasional_dict(contract_products: list[models.ContractProduct]):
             )
     return result
 
+
 @router.post('')
 async def create_contract(
     contract: models.ContractCreate,
     session: Session = Depends(get_session),
 ):
+    """Create contract route"""
     new_contract = service.create_one(session, contract)
-    occasional_contract_products = list(filter(lambda contract_product: contract_product.product.type == models.ProductType.OCCASIONAL, new_contract.products))
+    occasional_contract_products = list(
+        filter(
+            lambda contract_product: (
+                contract_product.product.type == models.ProductType.OCCASIONAL
+            ),
+            new_contract.products
+        )
+    )
     occasionals = create_occasional_dict(occasional_contract_products)
-    recurrents = list(map(lambda x: {"product": x.product, "quantity": x.quantity}, filter(lambda contract_product: contract_product.product.type == models.ProductType.RECCURENT, new_contract.products)))
+    recurrents = list(
-    recurrent_price = compute_recurrent_prices(recurrents, len(new_contract.form.shipments))
+        map(
+            lambda x: {'product': x.product, 'quantity': x.quantity},
+            filter(
+                lambda contract_product: (
+                    contract_product.product.type ==
+                    models.ProductType.RECCURENT
+                ),
+                new_contract.products
+            )
+        )
+    )
+    recurrent_price = compute_recurrent_prices(
+        recurrents,
+        len(new_contract.form.shipments)
+    )
     price = recurrent_price + compute_occasional_prices(occasionals)
-    cheques = list(map(lambda x: {"name": x.name, "value": x.value}, new_contract.cheques))
+    cheques = list(
-    # TODO: send contract to referer
+        map(
-
+            lambda x: {'name': x.name, 'value': x.value},
+            new_contract.cheques
+        )
+    )
     try:
         pdf_bytes = generate_html_contract(
             new_contract,
@@ -93,43 +148,63 @@ async def create_contract(
             '{:10.2f}'.format(price)
         )
         pdf_file = io.BytesIO(pdf_bytes)
-        contract_id = f'{new_contract.firstname}_{new_contract.lastname}_{new_contract.form.productor.type}_{new_contract.form.season}'
+        contract_id = (
+            f'{new_contract.firstname}_'
+            f'{new_contract.lastname}_'
+            f'{new_contract.form.productor.type}_'
+            f'{new_contract.form.season}'
+        )
         service.add_contract_file(session, new_contract.id, pdf_bytes, price)
-    except Exception:
+    except Exception as error:
-        raise HTTPException(status_code=400, detail=messages.pdferror)
+        raise HTTPException(
+            status_code=400,
+            detail=messages.pdferror
+        ) from error
     return StreamingResponse(
         pdf_file,
         media_type='application/pdf',
         headers={
-            'Content-Disposition': f'attachment; filename=contract_{contract_id}.pdf'
+            'Content-Disposition': (
+                f'attachment; filename=contract_{contract_id}.pdf'
+            )
         }
     )
 
+
 @router.get('/{form_id}/base')
 async def get_base_contract_template(
     form_id: int,
     session: Session = Depends(get_session),
 ):
+    """Get contract template route"""
     form = form_service.get_one(session, form_id)
-    recurrents = list(map(lambda x: {"product": x, "quantity": None}, filter(lambda product: product.type == models.ProductType.RECCURENT, form.productor.products)))
+    recurrents = [
+        {'product': product, 'quantity': None}
+        for product in form.productor.products
+        if product.type == models.ProductType.RECCURENT
+    ]
     occasionals = [{
         'shipment': sh,
         'price': None,
         'products': [{'product': pr, 'quantity': None} for pr in sh.products]
     } for sh in form.shipments]
     empty_contract = models.ContractPublic(
-        firstname="",
+        firstname='',
         form=form,
-        lastname="",
+        lastname='',
-        email="",
+        email='',
-        phone="",
+        phone='',
         products=[],
-        payment_method="cheque",
+        payment_method='cheque',
         cheque_quantity=3,
         total_price=0,
         id=1
     )
-    cheques = [{"name": None, "value": None}, {"name": None, "value": None}, {"name": None, "value": None}]
+    cheques = [
+        {'name': None, 'value': None},
+        {'name': None, 'value': None},
+        {'name': None, 'value': None}
+    ]
     try:
         pdf_bytes = generate_html_contract(
             empty_contract,
@@ -138,38 +213,60 @@ async def get_base_contract_template(
             recurrents,
         )
         pdf_file = io.BytesIO(pdf_bytes)
-        contract_id = f'{empty_contract.form.productor.type}_{empty_contract.form.season}'
+        contract_id = (
-    except Exception as e:
+            f'{empty_contract.form.productor.type}_'
-        print(e)
+            f'{empty_contract.form.season}'
-        raise HTTPException(status_code=400, detail=messages.pdferror)
+        )
+    except Exception as error:
+        raise HTTPException(
+            status_code=400,
+            detail=messages.pdferror
+        ) from error
     return StreamingResponse(
         pdf_file,
         media_type='application/pdf',
         headers={
-            'Content-Disposition': f'attachment; filename=contract_{contract_id}.pdf'
+            'Content-Disposition': (
+                f'attachment; filename=contract_{contract_id}.pdf'
+            )
         }
     )
 
+
 @router.get('', response_model=list[models.ContractPublic])
 def get_contracts(
     forms: list[str] = Query([]),
     session: Session = Depends(get_session),
     user: models.User = Depends(get_current_user)
 ):
+    """Get all contracts route"""
     return service.get_all(session, user, forms)
 
-@router.get('/{id}/file')
+
+@router.get('/{_id}/file')
 def get_contract_file(
-    id: int, 
+    _id: int,
     session: Session = Depends(get_session),
     user: models.User = Depends(get_current_user)
 ):
-    if not service.is_allowed(session, user, id):
+    """Get a contract file (in pdf) route"""
-        raise HTTPException(status_code=403, detail=messages.notallowed)
+    if not service.is_allowed(session, user, _id):
-    contract = service.get_one(session, id)
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('contract', 'get')
+        )
+    contract = service.get_one(session, _id)
     if contract is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
-    filename = f'{contract.form.name.replace(' ', '_')}_{contract.form.season}_{contract.firstname}-{contract.lastname}'
+            status_code=404,
+            detail=messages.Messages.not_found('contract')
+        )
+    filename = (
+        f'{contract.form.name.replace(' ', '_')}_'
+        f'{contract.form.season}_'
+        f'{contract.firstname}_'
+        f'{contract.lastname}'
+    )
     return StreamingResponse(
         io.BytesIO(contract.file),
         media_type='application/pdf',
@@ -178,23 +275,37 @@ def get_contract_file(
         }
     )
 
+
 @router.get('/{form_id}/files')
 def get_contract_files(
     form_id: int,
     session: Session = Depends(get_session),
     user: models.User = Depends(get_current_user)
 ):
+    """Get all contract files for a given form"""
     if not form_service.is_allowed(session, user, form_id):
-        raise HTTPException(status_code=403, detail=messages.notallowed)
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('contracts', 'get')
+        )
     form = form_service.get_one(session, form_id=form_id)
     contracts = service.get_all(session, user, forms=[form.name])
     zipped_contracts = io.BytesIO()
-    with zipfile.ZipFile(zipped_contracts, "a", zipfile.ZIP_DEFLATED, False) as zip_file:
+    with zipfile.ZipFile(
+        zipped_contracts,
+        'a',
+        zipfile.ZIP_DEFLATED,
+        False
+    ) as zip_file:
         for contract in contracts:
-            contract_filename = f'{contract.form.name.replace(' ', '_')}_{contract.form.season}_{contract.firstname}-{contract.lastname}.pdf'
+            contract_filename = (
+                f'{contract.form.name.replace(' ', '_')}_'
+                f'{contract.form.season}_'
+                f'{contract.firstname}_'
+                f'{contract.lastname}'
+            )
             zip_file.writestr(contract_filename, contract.file)
-    
+    filename = f'{form.name.replace(' ', '_')}_{form.season}'
-    filename = f'{form.name.replace(" ", "_")}_{form.season}'
     return StreamingResponse(
         io.BytesIO(zipped_contracts.getvalue()),
         media_type='application/zip',
@@ -203,39 +314,69 @@ def get_contract_files(
         }
     )
 
+
 @router.get('/{form_id}/recap')
 def get_contract_recap(
     form_id: int,
     session: Session = Depends(get_session),
     user: models.User = Depends(get_current_user)
 ):
+    """Get a contract recap for a given form"""
     if not form_service.is_allowed(session, user, form_id):
-        raise HTTPException(status_code=403, detail=messages.notallowed)
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('contract recap', 'get')
+        )
     form = form_service.get_one(session, form_id=form_id)
     contracts = service.get_all(session, user, forms=[form.name])
-    
     return StreamingResponse(
         io.BytesIO(generate_recap(contracts, form)),
         media_type='application/zip',
         headers={
-            'Content-Disposition': f'attachment; filename=filename.ods'
+            'Content-Disposition': (
+                'attachment; filename=filename.ods'
+            )
         }
     )
 
-@router.get('/{id}', response_model=models.ContractPublic)
+
-def get_contract(id: int, session: Session = Depends(get_session), user: models.User = Depends(get_current_user)):
+@router.get('/{_id}', response_model=models.ContractPublic)
-    if not service.is_allowed(session, user, id):
+def get_contract(
-        raise HTTPException(status_code=403, detail=messages.notallowed)
+    _id: int,
-    result = service.get_one(session, id)
+    session: Session = Depends(get_session),
+    user: models.User = Depends(get_current_user)
+):
+    """Get a contract route"""
+    if not service.is_allowed(session, user, _id):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('contract', 'get')
+        )
+    result = service.get_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('contract')
+        )
     return result
 
-@router.delete('/{id}', response_model=models.ContractPublic)
+
-def delete_contract(id: int, session: Session = Depends(get_session), user: models.User = Depends(get_current_user)):
+@router.delete('/{_id}', response_model=models.ContractPublic)
-    if not service.is_allowed(session, user, id):
+def delete_contract(
-        raise HTTPException(status_code=403, detail=messages.notallowed)
+    _id: int,
-    result = service.delete_one(session, id)
+    session: Session = Depends(get_session),
+    user: models.User = Depends(get_current_user)
+):
+    """Delete contract route"""
+    if not service.is_allowed(session, user, _id):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('contract', 'delete')
+        )
+    result = service.delete_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('contract')
+        )
     return result

backend/src/contracts/generate_contract.py

@@ -1,11 +1,13 @@
 
+import html
+import io
+import pathlib
+
 import jinja2
-import src.models as models
+from odfdo import Cell, Document, Row, Table
-import html
+from src import models
 from weasyprint import HTML
-import io
 
-import pathlib
 
 def generate_html_contract(
     contract: models.Contract,
@@ -17,7 +19,8 @@ def generate_html_contract(
 ):
     template_dir = pathlib.Path("./src/contracts/templates").resolve()
     template_loader = jinja2.FileSystemLoader(searchpath=template_dir)
-    template_env = jinja2.Environment(loader=template_loader, autoescape=jinja2.select_autoescape(["html", "xml"]))
+    template_env = jinja2.Environment(
+        loader=template_loader, autoescape=jinja2.select_autoescape(["html", "xml"]))
     template_file = "layout.html"
     template = template_env.get_template(template_file)
     output_text = template.render(
@@ -28,41 +31,36 @@ def generate_html_contract(
         referer_email=contract.form.referer.email,
         productor_name=contract.form.productor.name,
         productor_address=contract.form.productor.address,
-        payment_methods_map={"cheque": "Ordre du chèque", "transfer": "virements"},
+        payment_methods_map={
+            "cheque": "Ordre du chèque",
+            "transfer": "virements"},
         productor_payment_methods=contract.form.productor.payment_methods,
-        member_name=f'{html.escape(contract.firstname)} {html.escape(contract.lastname)}',
+        member_name=f'{
-        member_email=html.escape(contract.email),
+            html.escape(
-        member_phone=html.escape(contract.phone),
+                contract.firstname)} {
+                    html.escape(
+                        contract.lastname)}',
+        member_email=html.escape(
+            contract.email),
+        member_phone=html.escape(
+            contract.phone),
         contract_start_date=contract.form.start,
         contract_end_date=contract.form.end,
         occasionals=occasionals,
         recurrents=reccurents,
         recurrent_price=recurrent_price,
         total_price=total_price,
-        contract_payment_method={"cheque": "chèque", "transfer": "virements"}[contract.payment_method],
+        contract_payment_method={
-        cheques=cheques
+            "cheque": "chèque",
-    )
+            "transfer": "virements"}[
-    # options = {
+            contract.payment_method],
-    #     'page-size': 'Letter',
+        cheques=cheques)
-    #     'margin-top': '0.5in',
-    #     'margin-right': '0.5in',
-    #     'margin-bottom': '0.5in',
-    #     'margin-left': '0.5in',
-    #     'encoding': "UTF-8",
-    #     'print-media-type': True,
-    #     "disable-javascript": True,
-    #     "disable-external-links": True,
-    #     'enable-local-file-access': False,
-    #     "disable-local-file-access": True,
-    #     "no-images": True,
-    # }
 
     return HTML(
         string=output_text,
         base_url=template_dir,
     ).write_pdf()
 
-from odfdo import Document, Table, Row, Cell
 
 def generate_recap(
     contracts: list[models.Contract],
@@ -81,4 +79,3 @@ def generate_recap(
     doc.save(buffer)
 
     return buffer.getvalue()
-

backend/src/contracts/service.py

@@ -1,28 +1,57 @@
+"""Contract service responsible for read, create, update and delete contracts"""
+from sqlalchemy.orm import selectinload
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(
     session: Session,
     user: models.User,
-    forms: list[str] = [],
+    forms: list[str] | None = None,
     form_id: int | None = None,
 ) -> list[models.ContractPublic]:
-    statement = select(models.Contract)\
+    """Get all contracts"""
-        .join(models.Form, models.Contract.form_id == models.Form.id)\
+    statement = (
-        .join(models.Productor, models.Form.productor_id == models.Productor.id)\
+        select(models.Contract)
-        .where(models.Productor.type.in_([r.name for r in user.roles]))\
+        .join(
+            models.Form,
+            models.Contract.form_id == models.Form.id
+        )
+        .join(
+            models.Productor,
+            models.Form.productor_id == models.Productor.id
+        )
+        .where(
+            models.Productor.type.in_(
+                [r.name for r in user.roles]
+            )
+        )
         .distinct()
-    if len(forms) > 0:
+    )
+    if forms:
         statement = statement.where(models.Form.name.in_(forms))
     if form_id:
         statement = statement.where(models.Form.id == form_id)
     return session.exec(statement.order_by(models.Contract.id)).all()
 
-def get_one(session: Session, contract_id: int) -> models.ContractPublic:
+
+def get_one(
+    session: Session,
+    contract_id: int
+) -> models.ContractPublic:
+    """Get one contract"""
     return session.get(models.Contract, contract_id)
 
-def create_one(session: Session, contract: models.ContractCreate) -> models.ContractPublic:
+
-    contract_create = contract.model_dump(exclude_unset=True, exclude=["products", "cheques"])
+def create_one(
+    session: Session,
+    contract: models.ContractCreate
+) -> models.ContractPublic:
+    """Create one contract"""
+    contract_create = contract.model_dump(
+        exclude_unset=True,
+        exclude=["products", "cheques"]
+    )
     new_contract = models.Contract(**contract_create)
 
     new_contract.cheques = [
@@ -45,10 +74,27 @@ def create_one(session: Session, contract: models.ContractCreate) -> models.Cont
     session.add(new_contract)
     session.commit()
     session.refresh(new_contract)
-    return new_contract
 
-def add_contract_file(session: Session, id: int, file: bytes, price: float):
+    statement = (
-    statement = select(models.Contract).where(models.Contract.id == id)
+        select(models.Contract)
+        .where(models.Contract.id == new_contract.id)
+        .options(
+            selectinload(models.Contract.form)
+            .selectinload(models.Form.productor)
+        )
+    )
+
+    return session.exec(statement).one()
+
+
+def add_contract_file(
+    session: Session,
+    _id: int,
+    file: bytes,
+    price: float
+):
+    """Add a file to an existing contract"""
+    statement = select(models.Contract).where(models.Contract.id == _id)
     result = session.exec(statement)
     contract = result.first()
     contract.total_price = price
@@ -58,8 +104,14 @@ def add_contract_file(session: Session, id: int, file: bytes, price: float):
     session.refresh(contract)
     return contract
 
-def update_one(session: Session, id: int, contract: models.ContractUpdate) -> models.ContractPublic:
+
-    statement = select(models.Contract).where(models.Contract.id == id)
+def update_one(
+    session: Session,
+    _id: int,
+    contract: models.ContractUpdate
+) -> models.ContractPublic:
+    """Update one contract"""
+    statement = select(models.Contract).where(models.Contract.id == _id)
     result = session.exec(statement)
     new_contract = result.first()
     if not new_contract:
@@ -72,8 +124,13 @@ def update_one(session: Session, id: int, contract: models.ContractUpdate) -> mo
     session.refresh(new_contract)
     return new_contract
 
-def delete_one(session: Session, id: int) -> models.ContractPublic:
+
-    statement = select(models.Contract).where(models.Contract.id == id)
+def delete_one(
+    session: Session,
+    _id: int
+) -> models.ContractPublic:
+    """Delete one contract"""
+    statement = select(models.Contract).where(models.Contract.id == _id)
     result = session.exec(statement)
     contract = result.first()
     if not contract:
@@ -83,11 +140,29 @@ def delete_one(session: Session, id: int) -> models.ContractPublic:
     session.commit()
     return result
 
-def is_allowed(session: Session, user: models.User, id: int) -> bool:
+
-    statement = select(models.Contract)\
+def is_allowed(
-        .join(models.Form, models.Contract.form_id == models.Form.id)\
+    session: Session,
-        .join(models.Productor, models.Form.productor_id == models.Productor.id)\
+    user: models.User,
-        .where(models.Contract.id == id)\
+    _id: int
-        .where(models.Productor.type.in_([r.name for r in user.roles]))\
+) -> bool:
+    """Determine if a user is allowed to access a contract by id"""
+    statement = (
+        select(models.Contract)
+        .join(
+            models.Form,
+            models.Contract.form_id == models.Form.id
+        )
+        .join(
+            models.Productor,
+            models.Form.productor_id == models.Productor.id
+        )
+        .where(models.Contract.id == _id)
+        .where(
+            models.Productor.type.in_(
+                [r.name for r in user.roles]
+            )
+        )
         .distinct()
+    )
     return len(session.exec(statement).all()) > 0

backend/src/contracts/templates/layout.html

@@ -274,7 +274,7 @@
                 else ""}}
               </td>
               <td>
-                {{rec.product.quantity if rec.product.quantity != None else ""}}{{"g" if rec.product.unit == "1" else "kg" if
+                {{rec.quantity if rec.quantity != None else ""}}{{"g" if rec.product.unit == "1" else "kg" if
                 rec.product.unit == "2" else "p" }}
               </td>
             </tr>
@@ -317,7 +317,7 @@
                 product.product.quantity_unit != None else ""}}
               </td>
               <td>
-                {{product.product.quantity if product.product.quantity != None
+                {{product.quantity if product.quantity != None
                 else ""}}{{"g" if product.product.unit == "1" else
                 "kg" if product.product.unit == "2" else "p" }}
               </td>

backend/src/database.py

@@ -1,11 +1,14 @@
-from sqlmodel import create_engine, SQLModel, Session
+from sqlmodel import Session, SQLModel, create_engine
 from src.settings import settings
 
-engine = create_engine(f'postgresql://{settings.db_user}:{settings.db_pass}@{settings.db_host}:5432/{settings.db_name}')
+engine = create_engine(
+    f'postgresql://{settings.db_user}:{settings.db_pass}@{settings.db_host}:5432/{settings.db_name}')
+
 
 def get_session():
     with Session(engine) as session:
         yield session
 
+
 def create_all_tables():
     SQLModel.metadata.create_all(engine)

backend/src/forms/exceptions.py

@@ -0,0 +1,26 @@
+"""Forms module exceptions"""
+import logging
+
+class FormServiceError(Exception):
+    """Form service exception"""
+    def __init__(self, message: str):
+        super().__init__(message)
+        logging.error('FormService : %s', message)
+
+
+class UserNotFoundError(FormServiceError):
+    pass
+
+
+class ProductorNotFoundError(FormServiceError):
+    pass
+
+
+class FormNotFoundError(FormServiceError):
+    pass
+
+
+class FormCreateError(FormServiceError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field

backend/src/forms/forms.py

@@ -1,55 +1,108 @@
-from fastapi import APIRouter, HTTPException, Depends, Query
+import src.forms.exceptions as exceptions
-import src.messages as messages
-import src.models as models
-from src.database import get_session
-from sqlmodel import Session
 import src.forms.service as service
+import src.messages as messages
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
 
 router = APIRouter(prefix='/forms')
 
+
 @router.get('', response_model=list[models.FormPublic])
 async def get_forms(
     seasons: list[str] = Query([]),
     productors: list[str] = Query([]),
     current_season: bool = False,
-    session: Session = Depends(get_session)
+    session: Session = Depends(get_session),
 ):
     return service.get_all(session, seasons, productors, current_season)
 
-@router.get('/{id}', response_model=models.FormPublic)
+
-async def get_form(id: int, session: Session = Depends(get_session)):
+@router.get('/referents', response_model=list[models.FormPublic])
-    result = service.get_one(session, id)
+async def get_forms_filtered(
+    seasons: list[str] = Query([]),
+    productors: list[str] = Query([]),
+    current_season: bool = False,
+    session: Session = Depends(get_session),
+    user: models.User = Depends(get_current_user)
+):
+    return service.get_all(session, seasons, productors, current_season, user)
+
+
+@router.get('/{_id}', response_model=models.FormPublic)
+async def get_form(
+    _id: int, 
+    session: Session = Depends(get_session)
+):
+    result = service.get_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('form')
+        )
     return result
 
+
 @router.post('', response_model=models.FormPublic)
 async def create_form(
     form: models.FormCreate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.create_one(session, form)
+    if not service.is_allowed(session, user, form=form):
+        raise HTTPException(
+            status_code=403,
+            detail=messages.Messages.not_allowed('forms', 'update')
+        )
+    try:
+        form = service.create_one(session, form)
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
+    except exceptions.UserNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
+    except exceptions.FormCreateError as error:
+        raise HTTPException(status_code=400, detail=str(error)) from error
+    return form
 
-@router.put('/{id}', response_model=models.FormPublic)
+
+@router.put('/{_id}', response_model=models.FormPublic)
 async def update_form(
-    id: int, form: models.FormUpdate, 
+    _id: int, 
+    form: models.FormUpdate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.update_one(session, id, form)
+    if not service.is_allowed(session, user, _id=_id):
-    if result is None:
+        raise HTTPException(
-        raise HTTPException(status_code=404, detail=messages.notfound)
+            status_code=403,
+            detail=messages.Messages.not_allowed('forms', 'update')
+        )
+    try:
+        result = service.update_one(session, _id, form)
+    except exceptions.FormNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
+    except exceptions.UserNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result
 
-@router.delete('/{id}', response_model=models.FormPublic)
+
+@router.delete('/{_id}', response_model=models.FormPublic)
 async def delete_form(
-    id: int, 
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.delete_one(session, id)
+    if not service.is_allowed(session, user, _id=_id):
-    if result is None:
+        raise HTTPException(
-        raise HTTPException(status_code=404, detail=messages.notfound)
+            status_code=403,
+            detail=messages.Messages.not_allowed('forms', 'delete')
+        )
+    try:
+        result = service.delete_one(session, _id)
+    except exceptions.FormNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result

backend/src/forms/service.py

@@ -1,41 +1,69 @@
-from sqlmodel import Session, select
+import src.forms.exceptions as exceptions
-import src.models as models
+import src.messages as messages
 from sqlalchemy import func
+from sqlmodel import Session, select
+from src import models
+
 
 def get_all(
     session: Session,
     seasons: list[str],
     productors: list[str],
     current_season: bool,
+    user: models.User = None
 ) -> list[models.FormPublic]:
     statement = select(models.Form)
+    if user:
+        statement = statement .join(
+            models.Productor,
+            models.Form.productor_id == models.Productor.id) .where(
+            models.Productor.type.in_(
+                [
+                    r.name for r in user.roles])) .distinct()
     if len(seasons) > 0:
         statement = statement.where(models.Form.season.in_(seasons))
     if len(productors) > 0:
-        statement = statement.join(models.Productor).where(models.Productor.name.in_(productors))
+        statement = statement.join(
+            models.Productor).where(
+            models.Productor.name.in_(productors))
+    if not user:
+        statement = statement.where(models.Form.visible)
     if current_season:
         subquery = (
             select(
                 models.Productor.type,
                 func.max(models.Form.start).label("max_start")
             )
-            .join(models.Form)\
+            .join(models.Form)
-            .group_by(models.Productor.type)\
+            .group_by(models.Productor.type)
             .subquery()
         )
         statement = select(models.Form)\
             .join(models.Productor)\
             .join(subquery,
-                (models.Productor.type == subquery.c.type) & 
+                  (models.Productor.type == subquery.c.type) &
-                (models.Form.start == subquery.c.max_start)
+                  (models.Form.start == subquery.c.max_start)
-            )
+                  )
+        if not user:
+            statement = statement.where(models.Form.visible)
         return session.exec(statement.order_by(models.Form.name)).all()
     return session.exec(statement.order_by(models.Form.name)).all()
 
+
 def get_one(session: Session, form_id: int) -> models.FormPublic:
     return session.get(models.Form, form_id)
 
+
 def create_one(session: Session, form: models.FormCreate) -> models.FormPublic:
+    if not form:
+        raise exceptions.FormCreateError(
+            messages.Messages.invalid_input(
+                'form', 'input cannot be None'))
+    if not session.get(models.Productor, form.productor_id):
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
+    if not session.get(models.User, form.referer_id):
+        raise exceptions.UserNotFoundError(messages.Messages.not_found('user'))
     form_create = form.model_dump(exclude_unset=True)
     new_form = models.Form(**form_create)
     session.add(new_form)
@@ -43,12 +71,22 @@ def create_one(session: Session, form: models.FormCreate) -> models.FormPublic:
     session.refresh(new_form)
     return new_form
 
-def update_one(session: Session, id: int, form: models.FormUpdate) -> models.FormPublic:
+
-    statement = select(models.Form).where(models.Form.id == id)
+def update_one(
+        session: Session,
+        _id: int,
+        form: models.FormUpdate) -> models.FormPublic:
+    statement = select(models.Form).where(models.Form.id == _id)
     result = session.exec(statement)
     new_form = result.first()
     if not new_form:
-        return None
+        raise exceptions.FormNotFoundError(messages.Messages.not_found('form'))
+    if form.productor_id and not session.get(
+            models.Productor, form.productor_id):
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
+    if form.referer_id and not session.get(models.User, form.referer_id):
+        raise exceptions.UserNotFoundError(messages.Messages.not_found('user'))
     form_updates = form.model_dump(exclude_unset=True)
     for key, value in form_updates.items():
         setattr(new_form, key, value)
@@ -57,21 +95,44 @@ def update_one(session: Session, id: int, form: models.FormUpdate) -> models.For
     session.refresh(new_form)
     return new_form
 
-def delete_one(session: Session, id: int) -> models.FormPublic:
+
-    statement = select(models.Form).where(models.Form.id == id)
+def delete_one(session: Session, _id: int) -> models.FormPublic:
+    statement = select(models.Form).where(models.Form.id == _id)
     result = session.exec(statement)
     form = result.first()
     if not form:
-        return None
+        raise exceptions.FormNotFoundError(messages.Messages.not_found('form'))
     result = models.FormPublic.model_validate(form)
     session.delete(form)
     session.commit()
     return result
 
-def is_allowed(session: Session, user: models.User, id: int) -> bool:
+
-    statement = select(models.Form)\
+def is_allowed(
-        .join(models.Productor, models.Form.productor_id == models.Productor.id)\
+    session: Session, 
-        .where(models.Form.id == id)\
+    user: models.User, 
-        .where(models.Productor.type.in_([r.name for r in user.roles]))\
+    _id: int = None, 
+    form: models.FormCreate = None
+) -> bool:
+    if not _id:
+        statement = (
+            select(models.Productor)
+            .where(models.Productor.id == form.productor_id)
+        )
+        productor = session.exec(statement).first()
+        return productor.type in [r.name for r in user.roles]
+    statement = (
+        select(models.Form)
+        .join(
+            models.Productor,
+            models.Form.productor_id == models.Productor.id
+        )
+        .where(models.Form.id == _id)
+        .where(
+            models.Productor.type.in_(
+                [r.name for r in user.roles]
+            )
+        )
         .distinct()
+    )
     return len(session.exec(statement).all()) > 0

backend/src/main.py

@@ -1,18 +1,15 @@
-from sqlmodel import SQLModel
-
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
-
+from src.auth.auth import router as auth_router
-from src.templates.templates import router as template_router
 from src.contracts.contracts import router as contracts_router
 from src.forms.forms import router as forms_router
 from src.productors.productors import router as productors_router
 from src.products.products import router as products_router
-from src.users.users import router as users_router
-from src.auth.auth import router as auth_router
-from src.shipments.shipments import router as shipment_router
 from src.settings import settings
-from src.database import engine, create_all_tables
+from src.shipments.shipments import router as shipment_router
+from src.templates.templates import router as template_router
+from src.users.users import router as users_router
+
 app = FastAPI()
 
 

backend/src/messages.py

@@ -1,10 +1,20 @@
-notfound = "Resource was not found."
+pdferror = 'An error occured during PDF generation please contact administrator'
-pdferror = "An error occured during PDF generation please contact administrator"
+
-tokenexipired = "Token expired"
+
-invalidtoken = "Invalid token"
+class Messages:
-notauthenticated = "Not authenticated"
+    unauthorized = 'User is Unauthorized'
-usernotfound = "User not found"
+    notauthenticated = 'User is not authenticated'
-userloggedout = "User logged out"
+    tokenexipired = 'Token has expired'
-failtogettoken = "Failed to get token"
+    invalidtoken = 'Token is invalid'
-unauthorized = "Unauthorized"
+
-notallowed = "Not Allowed"
+    @staticmethod
+    def not_found(resource: str) -> str:
+        return f'{resource.capitalize()} not found'
+
+    @staticmethod
+    def invalid_input(resource: str, reason: str = "") -> str:
+        return f'Invalid {resource} input {':' if reason else ""} {reason}'
+
+    @staticmethod
+    def not_allowed(resource: str, action: str) -> str:
+        return f'User is not allowed to {action} this {resource}'

backend/src/models.py

@@ -1,99 +1,136 @@
-from sqlmodel import Field, SQLModel, Relationship, Column, LargeBinary
+import datetime
 from enum import StrEnum
 from typing import Optional
-import datetime
+
+from sqlmodel import Column, Field, LargeBinary, Relationship, SQLModel
+
 
 class ContractType(SQLModel, table=True):
-    id: int | None = Field(default=None, primary_key=True)
+    id: int | None = Field(
+        default=None,
+        primary_key=True
+    )
     name: str
 
+
 class UserContractTypeLink(SQLModel, table=True):
-    user_id: int = Field(foreign_key="user.id", primary_key=True)
+    user_id: int = Field(
-    contract_type_id: int = Field(foreign_key="contracttype.id", primary_key=True)
+        foreign_key='user.id',
+        primary_key=True
+    )
+    contract_type_id: int = Field(
+        foreign_key='contracttype.id',
+        primary_key=True
+    )
+
 
 class UserBase(SQLModel):
     name: str
     email: str
 
+
 class UserPublic(UserBase):
     id: int
     roles: list[ContractType]
 
+
 class User(UserBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
     roles: list[ContractType] = Relationship(
         link_model=UserContractTypeLink
     )
 
+
 class UserUpdate(SQLModel):
     name: str | None
     email: str | None
     role_names: list[str] | None
 
+
 class UserCreate(UserBase):
     role_names: list[str] | None
 
+
 class PaymentMethodBase(SQLModel):
     name: str
     details: str
     max: int | None
 
+
 class PaymentMethod(PaymentMethodBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
-    productor_id: int = Field(foreign_key="productor.id", ondelete="CASCADE")
+    productor_id: int = Field(foreign_key='productor.id', ondelete='CASCADE')
-    productor: Optional["Productor"] = Relationship(
+    productor: Optional['Productor'] = Relationship(
-        back_populates="payment_methods",
+        back_populates='payment_methods',
     )
 
+
 class PaymentMethodPublic(PaymentMethodBase):
     id: int
-    productor: Optional["Productor"]
+    productor: Optional['Productor']
+
 
 class ProductorBase(SQLModel):
     name: str
     address: str
     type: str
 
+
 class ProductorPublic(ProductorBase):
     id: int
-    products: list["Product"] = []
+    products: list['Product'] = Field(default_factory=list)
-    payment_methods: list["PaymentMethod"] = []
+    payment_methods: list['PaymentMethod'] = Field(default_factory=list)
+
 
 class Productor(ProductorBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
 
-    products: list["Product"] = Relationship(
+    products: list['Product'] = Relationship(
         back_populates='productor',
         sa_relationship_kwargs={
-            "order_by": "Product.name"
+            'order_by': 'Product.name'
         },
     )
-    payment_methods: list["PaymentMethod"] = Relationship(
+    payment_methods: list['PaymentMethod'] = Relationship(
-        back_populates="productor",
+        back_populates='productor',
         cascade_delete=True
     )
 
+
 class ProductorUpdate(SQLModel):
     name: str | None
     address: str | None
-    payment_methods: list["PaymentMethod"] = []
+    payment_methods: list['PaymentMethod'] = Field(default_factory=list)
     type: str | None
 
+
 class ProductorCreate(ProductorBase):
-    payment_methods: list["PaymentMethod"] = []
+    payment_methods: list['PaymentMethod'] = Field(default_factory=list)
+
 
 class Unit(StrEnum):
-    GRAMS = "1"
+    GRAMS = '1'
-    KILO = "2"
+    KILO = '2'
-    PIECE = "3"
+    PIECE = '3'
+
 
 class ProductType(StrEnum):
-    OCCASIONAL = "1"
+    OCCASIONAL = '1'
-    RECCURENT = "2"
+    RECCURENT = '2'
+
 
 class ShipmentProductLink(SQLModel, table=True):
-    shipment_id: Optional[int] = Field(default=None, foreign_key="shipment.id", primary_key=True)
+    shipment_id: Optional[int] = Field(
-    product_id: Optional[int] = Field(default=None, foreign_key="product.id", primary_key=True)
+        default=None,
+        foreign_key='shipment.id',
+        primary_key=True
+    )
+    product_id: Optional[int] = Field(
+        default=None,
+        foreign_key='product.id',
+        primary_key=True
+    )
+
 
 class ProductBase(SQLModel):
     name: str
@@ -103,17 +140,31 @@ class ProductBase(SQLModel):
     quantity: float | None
     quantity_unit: str | None
     type: ProductType
-    productor_id: int | None = Field(default=None, foreign_key="productor.id")
+    productor_id: int | None = Field(
+        default=None,
+        foreign_key='productor.id'
+    )
+
 
 class ProductPublic(ProductBase):
     id: int
     productor: Productor | None
-    shipments: list["Shipment"] | None
+    shipments: list['Shipment'] | None
+
 
 class Product(ProductBase, table=True):
-    id: int | None = Field(default=None, primary_key=True)
+    id: int | None = Field(
-    shipments: list["Shipment"] = Relationship(back_populates="products", link_model=ShipmentProductLink)
+        default=None,
-    productor: Optional[Productor] = Relationship(back_populates="products")
+        primary_key=True
+    )
+    shipments: list['Shipment'] = Relationship(
+        back_populates='products',
+        link_model=ShipmentProductLink
+    )
+    productor: Optional[Productor] = Relationship(
+        back_populates='products'
+    )
+
 
 class ProductUpdate(SQLModel):
     name: str | None
@@ -125,40 +176,46 @@ class ProductUpdate(SQLModel):
     productor_id: int | None
     type: ProductType | None
 
+
 class ProductCreate(ProductBase):
     pass
 
+
 class FormBase(SQLModel):
     name: str
-    productor_id: int | None = Field(default=None, foreign_key="productor.id")
+    productor_id: int | None = Field(default=None, foreign_key='productor.id')
-    referer_id: int | None = Field(default=None, foreign_key="user.id")
+    referer_id: int | None = Field(default=None, foreign_key='user.id')
     season: str
     start: datetime.date
     end: datetime.date
     minimum_shipment_value: float | None
+    visible: bool
+
 
 class FormPublic(FormBase):
     id: int
     productor: ProductorPublic | None
     referer: User | None
-    shipments: list["ShipmentPublic"] = []
+    shipments: list['ShipmentPublic'] = Field(default_factory=list)
+
 
 class Form(FormBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
     productor: Optional['Productor'] = Relationship()
     referer: Optional['User'] = Relationship()
-    shipments: list["Shipment"] = Relationship(
+    shipments: list['Shipment'] = Relationship(
-        back_populates="form", 
+        back_populates='form',
         cascade_delete=True,
         sa_relationship_kwargs={
-            "order_by": "Shipment.name"
+            'order_by': 'Shipment.name'
         },
     )
-    contracts: list["Contract"] = Relationship(
+    contracts: list['Contract'] = Relationship(
-        back_populates="form",
+        back_populates='form',
         cascade_delete=True
     )
 
+
 class FormUpdate(SQLModel):
     name: str | None
     productor_id: int | None
@@ -167,36 +224,46 @@ class FormUpdate(SQLModel):
     start: datetime.date | None
     end: datetime.date | None
     minimum_shipment_value: float | None
+    visible: bool | None
+
 
 class FormCreate(FormBase):
     pass
 
+
 class TemplateBase(SQLModel):
     pass
 
+
 class TemplatePublic(TemplateBase):
     id: int
 
+
 class Template(TemplateBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
 
+
 class TemplateUpdate(SQLModel):
     pass
 
+
 class TemplateCreate(TemplateBase):
     pass
 
+
 class ChequeBase(SQLModel):
     name: str
     value: str
 
+
 class Cheque(ChequeBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
-    contract_id: int = Field(foreign_key="contract.id", ondelete="CASCADE")
+    contract_id: int = Field(foreign_key='contract.id', ondelete='CASCADE')
-    contract: Optional["Contract"] = Relationship(
+    contract: Optional['Contract'] = Relationship(
-        back_populates="cheques",
+        back_populates='cheques',
     )
 
+
 class ContractBase(SQLModel):
     firstname: str
     lastname: str
@@ -205,105 +272,122 @@ class ContractBase(SQLModel):
     payment_method: str
     cheque_quantity: int
 
+
 class Contract(ContractBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
 
     form_id: int = Field(
-        foreign_key="form.id",
+        foreign_key='form.id',
         nullable=False,
-        ondelete="CASCADE"
+        ondelete='CASCADE'
     )
-    products: list["ContractProduct"] = Relationship(
+    products: list['ContractProduct'] = Relationship(
-        back_populates="contract",
+        back_populates='contract',
         cascade_delete=True
     )
-    form: Optional[Form] = Relationship(back_populates="contracts")
+    form: Form = Relationship(back_populates='contracts')
     cheques: list[Cheque] = Relationship(
-        back_populates="contract",
+        back_populates='contract',
         cascade_delete=True
     )
     file: bytes = Field(sa_column=Column(LargeBinary))
     total_price: float | None
 
+
 class ContractCreate(ContractBase):
-    products: list["ContractProductCreate"] = []
+    products: list['ContractProductCreate'] = Field(default_factory=list)
-    cheques: list["Cheque"] = []
+    cheques: list['Cheque'] = Field(default_factory=list)
     form_id: int
 
+
 class ContractUpdate(SQLModel):
     file: bytes
 
+
 class ContractPublic(ContractBase):
     id: int
-    products: list["ContractProduct"] = []
+    products: list['ContractProduct'] = Field(default_factory=list)
     form: Form
     total_price: float | None
     # file: bytes
 
+
 class ContractProductBase(SQLModel):
     product_id: int = Field(
-        foreign_key="product.id",
+        foreign_key='product.id',
         nullable=False,
-        ondelete="CASCADE"
+        ondelete='CASCADE'
     )
     shipment_id: int | None = Field(
         default=None,
-        foreign_key="shipment.id",
+        foreign_key='shipment.id',
         nullable=True,
-        ondelete="CASCADE"
+        ondelete='CASCADE'
     )
     quantity: float
 
+
 class ContractProduct(ContractProductBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
     contract_id: int = Field(
-        foreign_key="contract.id",
+        foreign_key='contract.id',
         nullable=False,
-        ondelete="CASCADE"
+        ondelete='CASCADE'
     )
-    contract: Optional["Contract"] = Relationship(back_populates="products")
+    contract: Optional['Contract'] = Relationship(back_populates='products')
-    product: Optional["Product"] = Relationship()
+    product: Optional['Product'] = Relationship()
-    shipment: Optional["Shipment"] = Relationship()
+    shipment: Optional['Shipment'] = Relationship()
+
 
 class ContractProductPublic(ContractProductBase):
     id: int
     quantity: float
     contract: Contract
     product: Product
-    shipment: Optional["Shipment"]
+    shipment: Optional['Shipment']
+
 
 class ContractProductCreate(ContractProductBase):
     pass
 
+
 class ContractProductUpdate(ContractProductBase):
     pass
 
+
 class ShipmentBase(SQLModel):
     name: str
     date: datetime.date
-    form_id: int | None = Field(default=None, foreign_key="form.id", ondelete="CASCADE")
+    form_id: int | None = Field(
+        default=None,
+        foreign_key='form.id',
+        ondelete='CASCADE')
+
 
 class ShipmentPublic(ShipmentBase):
     id: int
-    products: list[Product] = []
+    products: list[Product] = Field(default_factory=list)
     form: Form | None
 
+
 class Shipment(ShipmentBase, table=True):
     id: int | None = Field(default=None, primary_key=True)
     products: list[Product] = Relationship(
-        back_populates="shipments", 
+        back_populates='shipments',
         link_model=ShipmentProductLink,
         sa_relationship_kwargs={
-            "order_by": "Product.name"
+            'order_by': 'Product.name'
         },
     )
-    form: Optional[Form] = Relationship(back_populates="shipments")
+    form: Optional[Form] = Relationship(back_populates='shipments')
+
 
 class ShipmentUpdate(SQLModel):
     name: str | None
-    date: str | None
+    date: datetime.date | None
-    product_ids: list[int] | None = []
+    product_ids: list[int] | None = Field(default_factory=list)
+
 
 class ShipmentCreate(ShipmentBase):
-    product_ids: list[int] = []
+    product_ids: list[int] = Field(default_factory=list)
     form_id: int

backend/src/productors/exceptions.py

@@ -0,0 +1,17 @@
+import logging
+
+
+class ProductorServiceError(Exception):
+    def __init__(self, message: str):
+        super().__init__(message)
+        logging.error('ProductorService : %s', message)
+
+
+class ProductorNotFoundError(ProductorServiceError):
+    pass
+
+
+class ProductorCreateError(ProductorServiceError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field

backend/src/productors/productors.py

@@ -1,13 +1,15 @@
-from fastapi import APIRouter, HTTPException, Depends, Query
 import src.messages as messages
-import src.models as models
+import src.productors.exceptions as exceptions
-from src.database import get_session
-from sqlmodel import Session
 import src.productors.service as service
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
 
 router = APIRouter(prefix='/productors')
 
+
 @router.get('', response_model=list[models.ProductorPublic])
 def get_productors(
     names: list[str] = Query([]),
@@ -15,45 +17,58 @@ def get_productors(
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.get_all(session, names, types)
+    return service.get_all(session, user, names, types)
 
-@router.get('/{id}', response_model=models.ProductorPublic)
+
+@router.get('/{_id}', response_model=models.ProductorPublic)
 def get_productor(
-    id: int, 
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.get_one(session, id)
+    result = service.get_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('productor')
+        )
     return result
 
+
 @router.post('', response_model=models.ProductorPublic)
 def create_productor(
     productor: models.ProductorCreate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.create_one(session, productor)
+    try:
+        result = service.create_one(session, productor)
+    except exceptions.ProductorCreateError as error:
+        raise HTTPException(status_code=400, detail=str(error)) from error
+    return result
 
-@router.put('/{id}', response_model=models.ProductorPublic)
+
+@router.put('/{_id}', response_model=models.ProductorPublic)
 def update_productor(
-    id: int, productor: models.ProductorUpdate, 
+    _id: int, productor: models.ProductorUpdate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.update_one(session, id, productor)
+    try:
-    if result is None:
+        result = service.update_one(session, _id, productor)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result
 
-@router.delete('/{id}', response_model=models.ProductorPublic)
+
+@router.delete('/{_id}', response_model=models.ProductorPublic)
 def delete_productor(
-    id: int, 
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.delete_one(session, id)
+    try:
-    if result is None:
+        result = service.delete_one(session, _id)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result

backend/src/productors/service.py

@@ -1,23 +1,38 @@
+import src.messages as messages
+import src.productors.exceptions as exceptions
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(
     session: Session,
+    user: models.User,
     names: list[str],
     types: list[str]
 ) -> list[models.ProductorPublic]:
-    statement = select(models.Productor)
+    statement = select(models.Productor)\
+        .where(models.Productor.type.in_([r.name for r in user.roles]))\
+        .distinct()
     if len(names) > 0:
         statement = statement.where(models.Productor.name.in_(names))
     if len(types) > 0:
         statement = statement.where(models.Productor.type.in_(types))
     return session.exec(statement.order_by(models.Productor.name)).all()
 
+
 def get_one(session: Session, productor_id: int) -> models.ProductorPublic:
     return session.get(models.Productor, productor_id)
 
-def create_one(session: Session, productor: models.ProductorCreate) -> models.ProductorPublic:
+
-    productor_create = productor.model_dump(exclude_unset=True, exclude="payment_methods")
+def create_one(
+        session: Session,
+        productor: models.ProductorCreate) -> models.ProductorPublic:
+    if not productor:
+        raise exceptions.ProductorCreateError(
+            messages.Messages.invalid_input(
+                'productor', 'input cannot be None'))
+    productor_create = productor.model_dump(
+        exclude_unset=True, exclude='payment_methods')
     new_productor = models.Productor(**productor_create)
 
     new_productor.payment_methods = [
@@ -32,26 +47,31 @@ def create_one(session: Session, productor: models.ProductorCreate) -> models.Pr
     session.refresh(new_productor)
     return new_productor
 
-def update_one(session: Session, id: int, productor: models.ProductorUpdate) -> models.ProductorPublic:
+
+def update_one(
+        session: Session,
+        id: int,
+        productor: models.ProductorUpdate) -> models.ProductorPublic:
     statement = select(models.Productor).where(models.Productor.id == id)
     result = session.exec(statement)
     new_productor = result.first()
     if not new_productor:
-        return None
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
 
     productor_updates = productor.model_dump(exclude_unset=True)
-    if "payment_methods" in productor_updates:
+    if 'payment_methods' in productor_updates:
         new_productor.payment_methods.clear()
-        for pm in productor_updates["payment_methods"]:
+        for pm in productor_updates['payment_methods']:
             new_productor.payment_methods.append(
                 models.PaymentMethod(
-                    name=pm["name"],
+                    name=pm['name'],
-                    details=pm["details"],
+                    details=pm['details'],
                     productor_id=id,
-                    max=pm["max"]
+                    max=pm['max']
                 )
             )
-        del productor_updates["payment_methods"]
+        del productor_updates['payment_methods']
 
     for key, value in productor_updates.items():
         setattr(new_productor, key, value)
@@ -60,13 +80,31 @@ def update_one(session: Session, id: int, productor: models.ProductorUpdate) ->
     session.refresh(new_productor)
     return new_productor
 
+
 def delete_one(session: Session, id: int) -> models.ProductorPublic:
     statement = select(models.Productor).where(models.Productor.id == id)
     result = session.exec(statement)
     productor = result.first()
     if not productor:
-        return None
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
     result = models.ProductorPublic.model_validate(productor)
     session.delete(productor)
     session.commit()
     return result
+
+def is_allowed(
+    session: Session, 
+    user: models.User, 
+    _id: int, 
+    productor: models.ProductorCreate
+) -> bool:
+    if not _id:
+        return productor.type in [r.name for r in user.roles]
+    statement = (
+        select(models.Productor)
+        .where(models.Productor.id == _id)
+        .where(models.Productor.type.in_([r.name for r in user.roles]))
+        .distinct()
+    )
+    return len(session.exec(statement).all()) > 0

backend/src/products/exceptions.py

@@ -0,0 +1,17 @@
+class ProductServiceError(Exception):
+    def __init__(self, message: str):
+        super().__init__(message)
+
+
+class ProductorNotFoundError(ProductServiceError):
+    pass
+
+
+class ProductNotFoundError(ProductServiceError):
+    pass
+
+
+class ProductCreateError(ProductServiceError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field

backend/src/products/products.py

@@ -1,12 +1,15 @@
-from fastapi import APIRouter, HTTPException, Depends, Query
 import src.messages as messages
-import src.models as models
+import src.products.exceptions as exceptions
-from src.database import get_session
-from sqlmodel import Session
 import src.products.service as service
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
+
 router = APIRouter(prefix='/products')
 
+
 @router.get('', response_model=list[models.ProductPublic], )
 def get_products(
     user: models.User = Depends(get_current_user),
@@ -17,11 +20,13 @@ def get_products(
 ):
     return service.get_all(
         session,
+        user,
         names,
         productors,
         types,
     )
 
+
 @router.get('/{id}', response_model=models.ProductPublic)
 def get_product(
     id: int,
@@ -30,16 +35,25 @@ def get_product(
 ):
     result = service.get_one(session, id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(status_code=404,
+                            detail=messages.Messages.not_found('product'))
     return result
 
+
 @router.post('', response_model=models.ProductPublic)
 def create_product(
     product: models.ProductCreate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.create_one(session, product)
+    try:
+        result = service.create_one(session, product)
+    except exceptions.ProductCreateError as error:
+        raise HTTPException(status_code=400, detail=str(error))
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error))
+    return result
+
 
 @router.put('/{id}', response_model=models.ProductPublic)
 def update_product(
@@ -47,18 +61,23 @@ def update_product(
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.update_one(session, id, product)
+    try:
-    if result is None:
+        result = service.update_one(session, id, product)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ProductNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error))
+    except exceptions.ProductorNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error))
     return result
 
+
 @router.delete('/{id}', response_model=models.ProductPublic)
 def delete_product(
     id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.delete_one(session, id)
+    try:
-    if result is None:
+        result = service.delete_one(session, id)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ProductNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error))
     return result

backend/src/products/service.py

@@ -1,25 +1,46 @@
+import src.messages as messages
+import src.products.exceptions as exceptions
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(
     session: Session,
+    user: models.User,
     names: list[str],
     productors: list[str],
     types: list[str],
 ) -> list[models.ProductPublic]:
-    statement = select(models.Product)
+    statement = select(
+        models.Product) .join(
+        models.Productor,
+        models.Product.productor_id == models.Productor.id) .where(
+            models.Productor.type.in_(
+                [
+                    r.name for r in user.roles])) .distinct()
     if len(names) > 0:
         statement = statement.where(models.Product.name.in_(names))
     if len(productors) > 0:
-        statement = statement.join(models.Productor).where(models.Productor.name.in_(productors))
+        statement = statement.where(models.Productor.name.in_(productors))
     if len(types) > 0:
         statement = statement.where(models.Product.type.in_(types))
     return session.exec(statement.order_by(models.Product.name)).all()
 
+
 def get_one(session: Session, product_id: int) -> models.ProductPublic:
     return session.get(models.Product, product_id)
 
-def create_one(session: Session, product: models.ProductCreate) -> models.ProductPublic:
+
+def create_one(
+        session: Session,
+        product: models.ProductCreate) -> models.ProductPublic:
+    if not product:
+        raise exceptions.ProductCreateError(
+            messages.Messages.invalid_input(
+                'product', 'input cannot be None'))
+    if not session.get(models.Productor, product.productor_id):
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
     product_create = product.model_dump(exclude_unset=True)
     new_product = models.Product(**product_create)
     session.add(new_product)
@@ -27,12 +48,22 @@ def create_one(session: Session, product: models.ProductCreate) -> models.Produc
     session.refresh(new_product)
     return new_product
 
-def update_one(session: Session, id: int, product: models.ProductUpdate) -> models.ProductPublic:
+
+def update_one(
+        session: Session,
+        id: int,
+        product: models.ProductUpdate) -> models.ProductPublic:
     statement = select(models.Product).where(models.Product.id == id)
     result = session.exec(statement)
     new_product = result.first()
     if not new_product:
-        return None
+        raise exceptions.ProductNotFoundError(
+            messages.Messages.not_found('product'))
+    if product.productor_id and not session.get(
+            models.Productor, product.productor_id):
+        raise exceptions.ProductorNotFoundError(
+            messages.Messages.not_found('productor'))
+
     product_updates = product.model_dump(exclude_unset=True)
     for key, value in product_updates.items():
         setattr(new_product, key, value)
@@ -42,13 +73,44 @@ def update_one(session: Session, id: int, product: models.ProductUpdate) -> mode
     session.refresh(new_product)
     return new_product
 
+
 def delete_one(session: Session, id: int) -> models.ProductPublic:
     statement = select(models.Product).where(models.Product.id == id)
     result = session.exec(statement)
     product = result.first()
     if not product:
-        return None
+        raise exceptions.ProductNotFoundError(
+            messages.Messages.not_found('product'))
     result = models.ProductPublic.model_validate(product)
     session.delete(product)
     session.commit()
     return result
+
+def is_allowed(
+    session: Session, 
+    user: models.User, 
+    _id: int, 
+    product: models.ProductCreate
+) -> bool:
+    if not _id:
+        statement = (
+            select(models.Product)
+            .join(
+                models.Productor,
+                models.Product.productor_id == models.Productor.id
+            )
+            .where(models.Product.id == product.productor_id)
+        )
+        productor = session.exec(statement).first()
+        return productor.type in [r.name for r in user.roles]
+    statement = (
+        select(models.Product)
+        .join(
+            models.Productor,
+            models.Product.productor_id == models.Productor.id
+        )
+        .where(models.Product.id == _id)
+        .where(models.Productor.type.in_([r.name for r in user.roles]))
+        .distinct()
+    )
+    return len(session.exec(statement).all()) > 0

backend/src/settings.py

@@ -1,4 +1,5 @@
-from pydantic_settings import BaseSettings
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
 
 class Settings(BaseSettings):
     origins: str
@@ -16,13 +17,25 @@ class Settings(BaseSettings):
     max_age: int
     debug: bool
 
-    class Config:
+    model_config = SettingsConfigDict(
-        env_file = "../.env"
+        env_file='../.env'
+    )
+
 
 settings = Settings()
 
-AUTH_URL = f"{settings.keycloak_server}/realms/{settings.keycloak_realm}/protocol/openid-connect/auth"
+AUTH_URL = (
-TOKEN_URL = f"{settings.keycloak_server}/realms/{settings.keycloak_realm}/protocol/openid-connect/token"
+    f'{settings.keycloak_server}/realms/'
-ISSUER = f"{settings.keycloak_server}/realms/{settings.keycloak_realm}"
+    f'{settings.keycloak_realm}/protocol/openid-connect/auth'
-JWKS_URL = f"{ISSUER}/protocol/openid-connect/certs"
+)
-LOGOUT_URL = f'{settings.keycloak_server}/realms/{settings.keycloak_realm}/protocol/openid-connect/logout'
+TOKEN_URL = (
+    f'{settings.keycloak_server}/realms/'
+    f'{settings.keycloak_realm}/protocol/openid-connect/token'
+)
+
+ISSUER = f'{settings.keycloak_server}/realms/{settings.keycloak_realm}'
+JWKS_URL = f'{ISSUER}/protocol/openid-connect/certs'
+LOGOUT_URL = (
+    f'{settings.keycloak_server}/realms/'
+    f'{settings.keycloak_realm}/protocol/openid-connect/logout'
+)

backend/src/shipments/exceptions.py

@@ -0,0 +1,17 @@
+import logging
+
+
+class ShipmentServiceError(Exception):
+    def __init__(self, message: str):
+        super().__init__(message)
+        logging.error('ShipmentService : %s', message)
+
+
+class ShipmentNotFoundError(ShipmentServiceError):
+    pass
+
+
+class ShipmentCreateError(ShipmentServiceError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field

backend/src/shipments/service.py

@@ -1,46 +1,111 @@
+# pylint: disable=E1101
+import datetime
+
+import src.messages as messages
+import src.shipments.exceptions as exceptions
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(
     session: Session,
-    names: list[str],
+    user: models.User,
-    dates: list[str],
+    names: list[str] = None,
-    forms: list[int]
+    dates: list[str] = None,
+    forms: list[str] = None
 ) -> list[models.ShipmentPublic]:
-    statement = select(models.Shipment)
+    statement = (
-    if len(names) > 0:
+        select(models.Shipment)
+        .join(
+            models.Form,
+            models.Shipment.form_id == models.Form.id)
+        .join(
+            models.Productor,
+            models.Form.productor_id == models.Productor.id)
+        .where(
+            models.Productor.type.in_(
+                [r.name for r in user.roles]
+            )
+        )
+        .distinct()
+    )
+    if names and len(names) > 0:
         statement = statement.where(models.Shipment.name.in_(names))
-    if len(dates) > 0:
+    if dates and len(dates) > 0:
-        statement = statement.where(models.Shipment.date.in_(list(map(lambda x: datetime.strptime(x, '%Y-%m-%d'), dates))))
+        statement = statement.where(
-    if len(forms) > 0:
+            models.Shipment.date.in_(
-        statement = statement.join(models.Form).where(models.Form.name.in_(forms))
+                list(map(
+                    lambda x: datetime.datetime.strptime(
+                        x, '%Y-%m-%d').date(),
+                    dates
+                ))
+            )
+        )
+    if forms and len(forms) > 0:
+        statement = statement.where(models.Form.name.in_(forms))
     return session.exec(statement.order_by(models.Shipment.name)).all()
 
+
 def get_one(session: Session, shipment_id: int) -> models.ShipmentPublic:
     return session.get(models.Shipment, shipment_id)
 
-def create_one(session: Session, shipment: models.ShipmentCreate) -> models.ShipmentPublic:
+
-    products = session.exec(select(models.Product).where(models.Product.id.in_(shipment.product_ids))).all()
+def create_one(
-    shipment_create = shipment.model_dump(exclude_unset=True, exclude={'product_ids'})
+        session: Session,
+        shipment: models.ShipmentCreate) -> models.ShipmentPublic:
+    if shipment is None:
+        raise exceptions.ShipmentCreateError(
+            messages.Messages.invalid_input(
+                'shipment', 'input cannot be None'))
+    products = session.exec(
+        select(models.Product)
+        .where(
+            models.Product.id.in_(
+                shipment.product_ids
+            )
+        )
+    ).all()
+    shipment_create = shipment.model_dump(
+        exclude_unset=True, exclude={'product_ids'}
+    )
     new_shipment = models.Shipment(**shipment_create, products=products)
     session.add(new_shipment)
     session.commit()
     session.refresh(new_shipment)
     return new_shipment
 
-def update_one(session: Session, id: int, shipment: models.ShipmentUpdate) -> models.ShipmentPublic:
+
-    statement = select(models.Shipment).where(models.Shipment.id == id)
+def update_one(
+        session: Session,
+        _id: int,
+        shipment: models.ShipmentUpdate) -> models.ShipmentPublic:
+    if shipment is None:
+        raise exceptions.ShipmentCreateError(
+            messages.Messages.invalid_input(
+                'shipment', 'input cannot be None'))
+    statement = select(models.Shipment).where(models.Shipment.id == _id)
     result = session.exec(statement)
     new_shipment = result.first()
     if not new_shipment:
-        return None
+        raise exceptions.ShipmentNotFoundError(
+            messages.Messages.not_found('shipment'))
 
-    products_to_add = session.exec(select(models.Product).where(models.Product.id.in_(shipment.product_ids))).all()
+    products_to_add = session.exec(
+        select(
+            models.Product
+        ).where(
+            models.Product.id.in_(
+                shipment.product_ids
+            )
+        )
+    ).all()
     new_shipment.products.clear()
     for add in products_to_add:
         new_shipment.products.append(add)
 
-    shipment_updates = shipment.model_dump(exclude_unset=True, exclude={"product_ids"})
+    shipment_updates = shipment.model_dump(
+        exclude_unset=True, exclude={"product_ids"}
+    )
     for key, value in shipment_updates.items():
         setattr(new_shipment, key, value)
 
@@ -49,12 +114,15 @@ def update_one(session: Session, id: int, shipment: models.ShipmentUpdate) -> mo
     session.refresh(new_shipment)
     return new_shipment
 
-def delete_one(session: Session, id: int) -> models.ShipmentPublic:
+
-    statement = select(models.Shipment).where(models.Shipment.id == id)
+def delete_one(session: Session, _id: int) -> models.ShipmentPublic:
+    statement = select(models.Shipment).where(models.Shipment.id == _id)
     result = session.exec(statement)
     shipment = result.first()
     if not shipment:
-        return None
+        raise exceptions.ShipmentNotFoundError(
+            messages.Messages.not_found('shipment'))
+
     result = models.ShipmentPublic.model_validate(shipment)
     session.delete(shipment)
     session.commit()

backend/src/shipments/shipments.py

@@ -1,64 +1,82 @@
-from fastapi import APIRouter, HTTPException, Depends, Query
 import src.messages as messages
-import src.models as models
+import src.shipments.exceptions as exceptions
-from src.database import get_session
-from sqlmodel import Session
 import src.shipments.service as service
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
 
 router = APIRouter(prefix='/shipments')
 
+
 @router.get('', response_model=list[models.ShipmentPublic], )
 def get_shipments(
     session: Session = Depends(get_session),
+    user: models.User = Depends(get_current_user),
     names: list[str] = Query([]),
     dates: list[str] = Query([]),
     forms: list[str] = Query([]),
 ):
     return service.get_all(
         session,
+        user,
         names,
         dates,
         forms,
     )
 
-@router.get('/{id}', response_model=models.ShipmentPublic)
+
+@router.get('/{_id}', response_model=models.ShipmentPublic)
 def get_shipment(
-    id: int,
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.get_one(session, id)
+    result = service.get_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('shipment')
+        )
     return result
 
+
 @router.post('', response_model=models.ShipmentPublic)
 def create_shipment(
     shipment: models.ShipmentCreate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.create_one(session, shipment)
+    try:
+        result = service.create_one(session, shipment)
+    except exceptions.ShipmentCreateError as error:
+        raise HTTPException(status_code=400, detail=str(error)) from error
+    return result
 
-@router.put('/{id}', response_model=models.ShipmentPublic)
+
+@router.put('/{_id}', response_model=models.ShipmentPublic)
 def update_shipment(
-    id: int, shipment: models.ShipmentUpdate,
+    _id: int,
+    shipment: models.ShipmentUpdate,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.update_one(session, id, shipment)
+    try:
-    if result is None:
+        result = service.update_one(session, _id, shipment)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ShipmentNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result
 
-@router.delete('/{id}', response_model=models.ShipmentPublic)
+
+@router.delete('/{_id}', response_model=models.ShipmentPublic)
 def delete_shipment(
-    id: int,
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.delete_one(session, id)
+    try:
-    if result is None:
+        result = service.delete_one(session, _id)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.ShipmentNotFoundError as error:
+        raise HTTPException(status_code=404, detail=str(error)) from error
     return result

backend/src/templates/service.py

@@ -1,14 +1,19 @@
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(session: Session) -> list[models.TemplatePublic]:
     statement = select(models.Template)
     return session.exec(statement.order_by(models.Template.name)).all()
 
+
 def get_one(session: Session, template_id: int) -> models.TemplatePublic:
     return session.get(models.Template, template_id)
 
-def create_one(session: Session, template: models.TemplateCreate) -> models.TemplatePublic:
+
+def create_one(
+        session: Session,
+        template: models.TemplateCreate) -> models.TemplatePublic:
     template_create = template.model_dump(exclude_unset=True)
     new_template = models.Template(**template_create)
     session.add(new_template)
@@ -16,7 +21,11 @@ def create_one(session: Session, template: models.TemplateCreate) -> models.Temp
     session.refresh(new_template)
     return new_template
 
-def update_one(session: Session, id: int, template: models.TemplateUpdate) -> models.TemplatePublic:
+
+def update_one(
+        session: Session,
+        id: int,
+        template: models.TemplateUpdate) -> models.TemplatePublic:
     statement = select(models.Template).where(models.Template.id == id)
     result = session.exec(statement)
     new_template = result.first()
@@ -30,6 +39,7 @@ def update_one(session: Session, id: int, template: models.TemplateUpdate) -> mo
     session.refresh(new_template)
     return new_template
 
+
 def delete_one(session: Session, id: int) -> models.TemplatePublic:
     statement = select(models.Template).where(models.Template.id == id)
     result = session.exec(statement)

backend/src/templates/templates.py

@@ -1,13 +1,14 @@
-from fastapi import APIRouter, HTTPException, Depends
 import src.messages as messages
-import src.models as models
-from src.database import get_session
-from sqlmodel import Session
 import src.templates.service as service
+from fastapi import APIRouter, Depends, HTTPException
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
 
 router = APIRouter(prefix='/templates')
 
+
 @router.get('', response_model=list[models.TemplatePublic])
 def get_templates(
     user: models.User = Depends(get_current_user),
@@ -15,6 +16,7 @@ def get_templates(
 ):
     return service.get_all(session)
 
+
 @router.get('/{id}', response_model=models.TemplatePublic)
 def get_template(
     id: int,
@@ -23,9 +25,11 @@ def get_template(
 ):
     result = service.get_one(session, id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(status_code=404,
+                            detail=messages.Messages.not_found('template'))
     return result
 
+
 @router.post('', response_model=models.TemplatePublic)
 def create_template(
     template: models.TemplateCreate,
@@ -34,6 +38,7 @@ def create_template(
 ):
     return service.create_one(session, template)
 
+
 @router.put('/{id}', response_model=models.TemplatePublic)
 def update_template(
     id: int, template: models.TemplateUpdate,
@@ -42,9 +47,11 @@ def update_template(
 ):
     result = service.update_one(session, id, template)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(status_code=404,
+                            detail=messages.Messages.not_found('template'))
     return result
 
+
 @router.delete('/{id}', response_model=models.TemplatePublic)
 def delete_template(
     id: int,
@@ -53,5 +60,6 @@ def delete_template(
 ):
     result = service.delete_one(session, id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(status_code=404,
+                            detail=messages.Messages.not_found('template'))
     return result

backend/src/users/exceptions.py

@@ -0,0 +1,17 @@
+import logging
+
+
+class UserServiceError(Exception):
+    def __init__(self, message: str):
+        super().__init__(message)
+        logging.error('UserService : %s', message)
+
+
+class UserNotFoundError(UserServiceError):
+    pass
+
+
+class UserCreateError(UserServiceError):
+    def __init__(self, message: str, field: str | None = None):
+        super().__init__(message)
+        self.field = field

backend/src/users/service.py

@@ -1,5 +1,8 @@
+import src.messages as messages
+import src.users.exceptions as exceptions
 from sqlmodel import Session, select
-import src.models as models
+from src import models
+
 
 def get_all(
     session: Session,
@@ -13,11 +16,15 @@ def get_all(
         statement = statement.where(models.User.email.in_(emails))
     return session.exec(statement.order_by(models.User.name)).all()
 
+
 def get_one(session: Session, user_id: int) -> models.UserPublic:
     return session.get(models.User, user_id)
 
-def get_or_create_roles(session: Session, role_names: list[str]) -> list[models.ContractType]:
+
-    statement = select(models.ContractType).where(models.ContractType.name.in_(role_names))
+def get_or_create_roles(session: Session,
+                        role_names: list[str]) -> list[models.ContractType]:
+    statement = select(models.ContractType).where(
+        models.ContractType.name.in_(role_names))
     existing = session.exec(statement).all()
     existing_roles = {role.name for role in existing}
     missing_role = set(role_names) - existing_roles
@@ -33,8 +40,11 @@ def get_or_create_roles(session: Session, role_names: list[str]) -> list[models.
         session.refresh(role)
     return existing + new_roles
 
+
 def get_or_create_user(session: Session, user_create: models.UserCreate):
-    statement = select(models.User).where(models.User.email == user_create.email)
+    statement = select(
+        models.User).where(
+        models.User.email == user_create.email)
     user = session.exec(statement).first()
     if user:
         user_role_names = [r.name for r in user.roles]
@@ -44,11 +54,21 @@ def get_or_create_user(session: Session, user_create: models.UserCreate):
     user = create_one(session, user_create)
     return user
 
+
 def get_roles(session: Session):
-    statement = select(models.ContractType)
+    statement = (
+        select(models.ContractType)
+    )
     return session.exec(statement.order_by(models.ContractType.name)).all()
 
+
 def create_one(session: Session, user: models.UserCreate) -> models.UserPublic:
+    if user is None:
+        raise exceptions.UserCreateError(
+            messages.Messages.invalid_input(
+                'user', 'input cannot be None'
+            )
+        )
     new_user = models.User(
         name=user.name,
         email=user.email
@@ -62,13 +82,22 @@ def create_one(session: Session, user: models.UserCreate) -> models.UserPublic:
     session.refresh(new_user)
     return new_user
 
-def update_one(session: Session, id: int, user: models.UserCreate) -> models.UserPublic:
+
-    statement = select(models.User).where(models.User.id == id)
+def update_one(
+        session: Session,
+        _id: int,
+        user: models.UserCreate) -> models.UserPublic:
+    if user is None:
+        raise exceptions.UserCreateError(
+            messages.Messages.invalid_input(
+                'user', 'input cannot be None'
+            )
+        )
+    statement = select(models.User).where(models.User.id == _id)
     result = session.exec(statement)
     new_user = result.first()
     if not new_user:
-        return None
+        raise exceptions.UserNotFoundError(f'User {_id} not found')
-
     new_user.email = user.email
     new_user.name = user.name
 
@@ -79,12 +108,13 @@ def update_one(session: Session, id: int, user: models.UserCreate) -> models.Use
     session.refresh(new_user)
     return new_user
 
-def delete_one(session: Session, id: int) -> models.UserPublic:
+
-    statement = select(models.User).where(models.User.id == id)
+def delete_one(session: Session, _id: int) -> models.UserPublic:
+    statement = select(models.User).where(models.User.id == _id)
     result = session.exec(statement)
     user = result.first()
     if not user:
-        return None
+        raise exceptions.UserNotFoundError(f'User {_id} not found')
     result = models.UserPublic.model_validate(user)
     session.delete(user)
     session.commit()

backend/src/users/users.py

@@ -1,13 +1,15 @@
-from fastapi import APIRouter, HTTPException, Depends, Query
 import src.messages as messages
-import src.models as models
+import src.users.exceptions as exceptions
-from src.database import get_session
-from sqlmodel import Session
 import src.users.service as service
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlmodel import Session
+from src import models
 from src.auth.auth import get_current_user
+from src.database import get_session
 
 router = APIRouter(prefix='/users')
 
+
 @router.get('', response_model=list[models.UserPublic])
 def get_users(
     session: Session = Depends(get_session),
@@ -21,6 +23,7 @@ def get_users(
         emails,
     )
 
+
 @router.get('/roles', response_model=list[models.ContractType])
 def get_roles(
     user: models.User = Depends(get_current_user),
@@ -28,44 +31,66 @@ def get_roles(
 ):
     return service.get_roles(session)
 
-@router.get('/{id}', response_model=models.UserPublic)
+
-def get_users(
+@router.get('/{_id}', response_model=models.UserPublic)
-    id: int, 
+def get_user(
+    _id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.get_one(session, id)
+    result = service.get_one(session, _id)
     if result is None:
-        raise HTTPException(status_code=404, detail=messages.notfound)
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('user')
+        )
     return result
 
+
 @router.post('', response_model=models.UserPublic)
 def create_user(
     user: models.UserCreate,
     logged_user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    return service.create_one(session, user)
+    try:
+        user = service.create_one(session, user)
+    except exceptions.UserCreateError as error:
+        raise HTTPException(
+            status_code=400, 
+            detail=str(error)
+        ) from error
+    return user
 
-@router.put('/{id}', response_model=models.UserPublic)
+
+@router.put('/{_id}', response_model=models.UserPublic)
 def update_user(
-    id: int, 
+    _id: int,
     user: models.UserUpdate,
     logged_user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.update_one(session, id, user)
+    try:
-    if result is None:
+        result = service.update_one(session, _id, user)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.UserNotFoundError as error:
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('user')
+        ) from error
     return result
 
+
 @router.delete('/{id}', response_model=models.UserPublic)
 def delete_user(
     id: int,
     user: models.User = Depends(get_current_user),
     session: Session = Depends(get_session)
 ):
-    result = service.delete_one(session, id)
+    try:
-    if result is None:
+        result = service.delete_one(session, id)
-        raise HTTPException(status_code=404, detail=messages.notfound)
+    except exceptions.UserNotFoundError as error:
+        raise HTTPException(
+            status_code=404,
+            detail=messages.Messages.not_found('user')
+        ) from error
     return result

backend/tests/conftest.py

@@ -0,0 +1,62 @@
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.pool import StaticPool
+from sqlmodel import Session, SQLModel, create_engine
+from src import models
+from src.auth.auth import get_current_user
+from src.database import get_session
+from src.main import app
+
+from .fixtures import *
+
+
+@pytest.fixture
+def mock_session(mocker):
+    session = mocker.Mock()
+
+    def override():
+        return session
+
+    app.dependency_overrides[get_session] = override
+    yield session
+    app.dependency_overrides.clear()
+
+
+@pytest.fixture
+def mock_user():
+    user = models.User(id=1, name='test user', email='test@user.com')
+
+    def override():
+        return user
+
+    app.dependency_overrides[get_current_user] = override
+    yield user
+    app.dependency_overrides.clear()
+
+
+@pytest.fixture
+def client():
+    return TestClient(app)
+
+
+@pytest.fixture(name='session')
+def session_fixture():
+    engine = create_engine(
+        "sqlite://",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+
+    SQLModel.metadata.create_all(engine)
+
+    connection = engine.connect()
+    transaction = connection.begin()
+    session = Session(bind=connection)
+
+    try:
+        yield session
+    finally:
+        transaction.rollback()
+        session.close()
+        connection.close()
+        engine.dispose()

backend/tests/factories/contract_products.py

@@ -0,0 +1,65 @@
+import tests.factories.contracts as contract_factory
+import tests.factories.products as product_factory
+from src import models
+
+
+def contract_product_factory(**kwargs):
+    contract = contract_factory.contract_factory(id=1)
+    product = product_factory.product_public_factory(
+        id=1, type=models.ProductType.RECCURENT)
+    data = dict(
+        product_id=1,
+        shipment_id=1,
+        quantity=1,
+        contract_id=1,
+        product=product,
+        contract=contract
+    )
+    data.update(kwargs)
+    return models.ContractProduct(**data)
+
+
+def contract_product_public_factory(**kwargs):
+    contract = contract_factory.contract_factory(id=1)
+    product = product_factory.product_public_factory(id=1)
+    data = dict(
+        id=1,
+        product_id=1,
+        shipment_id=None,
+        contract=contract,
+        product=product,
+        shipment=None,
+        quantity=1
+    )
+    data.update(kwargs)
+    return models.ContractProductPublic(**data)
+
+
+def contract_product_create_factory(**kwargs):
+    data = dict(
+        product_id=1,
+        shipment_id=1,
+        quantity=1,
+    )
+    data.update(kwargs)
+    return models.ContractProductCreate(**data)
+
+
+def contract_product_update_factory(**kwargs):
+    data = dict(
+        product_id=1,
+        shipment_id=1,
+        quantity=1,
+    )
+    data.update(kwargs)
+    return models.ContractProductUpdate(**data)
+
+
+def contract_product_body_factory(**kwargs):
+    data = dict(
+        product_id=1,
+        shipment_id=1,
+        quantity=1,
+    )
+    data.update(kwargs)
+    return data

backend/tests/factories/contracts.py

@@ -0,0 +1,82 @@
+from src import models
+
+from .forms import form_factory
+
+
+def contract_factory(**kwargs):
+    data = dict(
+        id=1,
+        firstname="test",
+        lastname="test",
+        email="test@test.test",
+        phone="00000000",
+        payment_method="cheque",
+        cheque_quantity=1,
+        form_id=1,
+        products=[],
+        cheques=[],
+    )
+    data.update(kwargs)
+    return models.Contract(**data)
+
+
+def contract_public_factory(**kwargs):
+    data = dict(
+        id=1,
+        firstname="test",
+        lastname="test",
+        email="test@test.test",
+        phone="00000000",
+        payment_method="cheque",
+        cheque_quantity=1,
+        total_price=10,
+        products=[],
+        form=form_factory()
+    )
+    data.update(kwargs)
+    return models.ContractPublic(**data)
+
+
+def contract_create_factory(**kwargs):
+    data = dict(
+        firstname="test",
+        lastname="test",
+        email="test@test.test",
+        phone="00000000",
+        payment_method="cheque",
+        cheque_quantity=1,
+        products=[],
+        cheques=[],
+        form_id=1,
+    )
+    data.update(kwargs)
+    return models.ContractCreate(**data)
+
+
+def contract_update_factory(**kwargs):
+    data = dict(
+        firstname="test",
+        lastname="test",
+        email="test@test.test",
+        phone="00000000",
+        payment_method="cheque",
+        cheque_quantity=1,
+    )
+    data.update(kwargs)
+    return models.ContractUpdate(**data)
+
+
+def contract_body_factory(**kwargs):
+    data = dict(
+        firstname="test",
+        lastname="test",
+        email="test@test.test",
+        phone="00000000",
+        payment_method="cheque",
+        cheque_quantity=1,
+        products=[],
+        cheques=[],
+        form_id=1
+    )
+    data.update(kwargs)
+    return data

backend/tests/factories/forms.py

@@ -0,0 +1,89 @@
+import datetime
+
+from src import models
+
+from .productors import productor_public_factory
+from .users import user_factory
+
+
+def form_factory(**kwargs):
+    data = dict(
+        id=1,
+        name='form 1',
+        productor_id=1,
+        referer_id=1,
+        season='hiver-2026',
+        start=datetime.date(2025, 10, 10),
+        end=datetime.date(2025, 10, 10),
+        minimum_shipment_value=0,
+        visible=True,
+        referer=user_factory(),
+        shipments=[],
+        productor=productor_public_factory(),
+    )
+    data.update(kwargs)
+    return models.Form(**data)
+
+
+def form_body_factory(**kwargs):
+    data = dict(
+        name='form 1',
+        productor_id=1,
+        referer_id=1,
+        season='hiver-2026',
+        start='2025-10-10',
+        end='2025-10-10',
+        minimum_shipment_value=0,
+        visible=True
+    )
+    data.update(kwargs)
+    return data
+
+
+def form_create_factory(**kwargs):
+    data = dict(
+        name='form 1',
+        productor_id=1,
+        referer_id=1,
+        season='hiver-2026',
+        start=datetime.date(2025, 10, 10),
+        end=datetime.date(2025, 10, 10),
+        minimum_shipment_value=0,
+        visible=True
+    )
+    data.update(kwargs)
+    return models.FormCreate(**data)
+
+
+def form_update_factory(**kwargs):
+    data = dict(
+        name='form 1',
+        productor_id=1,
+        referer_id=1,
+        season='hiver-2026',
+        start=datetime.date(2025, 10, 10),
+        end=datetime.date(2025, 10, 10),
+        minimum_shipment_value=0,
+        visible=True
+    )
+    data.update(kwargs)
+    return models.FormUpdate(**data)
+
+
+def form_public_factory(form=None, shipments=[], **kwargs):
+    data = dict(
+        id=1,
+        name='form 1',
+        productor_id=1,
+        referer_id=1,
+        season='hiver-2026',
+        start=datetime.date(2025, 10, 10),
+        end=datetime.date(2025, 10, 10),
+        minimum_shipment_value=0,
+        visible=True,
+        referer=user_factory(),
+        shipments=[],
+        productor=productor_public_factory(),
+    )
+    data.update(kwargs)
+    return models.FormPublic(**data)

backend/tests/factories/productors.py

@@ -0,0 +1,64 @@
+from src import models
+
+
+def productor_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test productor",
+        address="test address",
+        type="test type"
+    )
+    data.update(kwargs)
+    return models.Productor(**data)
+
+
+def productor_public_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test productor",
+        address="test address",
+        type="test type",
+        products=[],
+        payment_methods=[],
+    )
+    data.update(kwargs)
+    return models.ProductorPublic(**data)
+
+
+def productor_create_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test productor",
+        address="test address",
+        type="test type",
+        products=[],
+        payment_methods=[],
+    )
+    data.update(kwargs)
+    return models.ProductorCreate(**data)
+
+
+def productor_update_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test productor",
+        address="test address",
+        type="test type",
+        products=[],
+        payment_methods=[],
+    )
+    data.update(kwargs)
+    return models.ProductorUpdate(**data)
+
+
+def productor_body_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test productor",
+        address="test address",
+        type="test type",
+        products=[],
+        payment_methods=[],
+    )
+    data.update(kwargs)
+    return data

backend/tests/factories/products.py

@@ -0,0 +1,68 @@
+from src import models
+
+from .productors import productor_factory
+
+
+def product_body_factory(**kwargs):
+    data = dict(
+        name='product test 1',
+        unit=models.Unit.PIECE,
+        price=10.2,
+        price_kg=20.4,
+        quantity=500,
+        quantity_unit='g',
+        type=models.ProductType.OCCASIONAL,
+        productor_id=1,
+    )
+    data.update(kwargs)
+    return data
+
+
+def product_create_factory(**kwargs):
+    data = dict(
+        name='product test 1',
+        unit=models.Unit.PIECE,
+        price=10.2,
+        price_kg=20.4,
+        quantity=500,
+        quantity_unit='g',
+        type=models.ProductType.OCCASIONAL,
+        productor_id=1,
+    )
+    data.update(kwargs)
+    return models.ProductCreate(**data)
+
+
+def product_update_factory(**kwargs):
+    data = dict(
+        name='product test 1',
+        unit=models.Unit.PIECE,
+        price=10.2,
+        price_kg=20.4,
+        quantity=500,
+        quantity_unit='g',
+        type=models.ProductType.OCCASIONAL,
+        productor_id=1,
+    )
+    data.update(kwargs)
+    return models.ProductUpdate(**data)
+
+
+def product_public_factory(productor=None, shipments=[], **kwargs):
+    if productor is None:
+        productor = productor_factory()
+    data = dict(
+        id=1,
+        name='product test 1',
+        unit=models.Unit.PIECE,
+        price=10.2,
+        price_kg=20.4,
+        quantity=500,
+        quantity_unit='g',
+        type=models.ProductType.OCCASIONAL,
+        productor_id=1,
+        productor=productor,
+        shipments=shipments,
+    )
+    data.update(kwargs)
+    return models.ProductPublic(**data)

backend/tests/factories/shipments.py

@@ -0,0 +1,59 @@
+import datetime
+
+from src import models
+
+
+def shipment_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test shipment",
+        date=datetime.date(2025, 10, 10),
+        form_id=1,
+    )
+    data.update(kwargs)
+    return models.Shipment(**data)
+
+
+def shipment_public_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test shipment",
+        date=datetime.date(2025, 10, 10),
+        form_id=1,
+        products=[],
+        form=models.Form(id=1, name="test")
+    )
+    data.update(kwargs)
+    return models.ShipmentPublic(**data)
+
+
+def shipment_create_factory(**kwargs):
+    data = dict(
+        name="test shipment",
+        form_id=1,
+        date='2025-10-10',
+        product_ids=[],
+    )
+    data.update(kwargs)
+    return models.ShipmentCreate(**data)
+
+
+def shipment_update_factory(**kwargs):
+    data = dict(
+        name="test shipment",
+        form_id=1,
+        date='2025-10-10',
+        product_ids=[],
+    )
+    data.update(kwargs)
+    return models.ShipmentUpdate(**data)
+
+
+def shipment_body_factory(**kwargs):
+    data = dict(
+        name="test shipment",
+        form_id=1,
+        date="2025-10-10",
+    )
+    data.update(kwargs)
+    return data

backend/tests/factories/users.py

@@ -0,0 +1,53 @@
+from src import models
+
+
+def user_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test user",
+        email="test.test@test.test",
+        roles=[]
+    )
+    data.update(kwargs)
+    return models.User(**data)
+
+
+def user_public_factory(**kwargs):
+    data = dict(
+        id=1,
+        name="test user",
+        email="test.test@test.test",
+        roles=[]
+    )
+    data.update(kwargs)
+    return models.UserPublic(**data)
+
+
+def user_create_factory(**kwargs):
+    data = dict(
+        name="test user",
+        email="test.test@test.test",
+        role_names=[],
+    )
+    data.update(kwargs)
+    return models.UserCreate(**data)
+
+
+def user_update_factory(**kwargs):
+    data = dict(
+        name="test user",
+        email="test.test@test.test",
+        role_names=[],
+    )
+    data.update(kwargs)
+    return models.UserUpdate(**data)
+
+
+def user_body_factory(**kwargs):
+    data = dict(
+        name="test user",
+        email="test.test@test.test",
+        role_names=[],
+    )
+    data.update(kwargs)
+    return data

backend/tests/fixtures.py

@@ -0,0 +1,184 @@
+import datetime
+
+import pytest
+import src.forms.service as forms_service
+import src.productors.service as productors_service
+import src.products.service as products_service
+import src.shipments.service as shipments_service
+import src.users.service as users_service
+import tests.factories.forms as forms_factory
+import tests.factories.productors as productors_factory
+import tests.factories.products as products_factory
+import tests.factories.shipments as shipments_factory
+import tests.factories.users as users_factory
+from sqlmodel import Session
+from src import models
+
+
+@pytest.fixture
+def productor(session: Session) -> models.ProductorPublic:
+    productor = productors_service.create_one(
+        session,
+        productors_factory.productor_create_factory(
+            name='test productor',
+            type='Légumineuses',
+        )
+    )
+    return productor
+
+
+@pytest.fixture
+def productors(session: Session) -> models.ProductorPublic:
+    productors = [
+        productors_service.create_one(
+            session,
+            productors_factory.productor_create_factory(
+                name='test productor 1',
+                type='Légumineuses',
+            )
+        ),
+        productors_service.create_one(
+            session,
+            productors_factory.productor_create_factory(
+                name='test productor 2',
+                type='Légumes',
+            )
+        )
+    ]
+    return productors
+
+
+@pytest.fixture
+def products(session: Session,
+             productor: models.ProductorPublic) -> list[models.ProductPublic]:
+    products = [
+        products_service.create_one(
+            session,
+            products_factory.product_create_factory(
+                name='product 1 occasionnal',
+                type=models.ProductType.OCCASIONAL,
+                productor_id=productor.id
+            )
+        ),
+        products_service.create_one(
+            session,
+            products_factory.product_create_factory(
+                name='product 2 recurrent',
+                type=models.ProductType.RECCURENT,
+                productor_id=productor.id
+            )
+        ),
+    ]
+    return products
+
+
+@pytest.fixture
+def user(session: Session) -> models.UserPublic:
+    user = users_service.create_one(
+        session,
+        users_factory.user_create_factory(
+            name='test user',
+            email='test@test.com',
+            role_names=['Légumineuses']
+        )
+    )
+    return user
+
+
+@pytest.fixture
+def users(session: Session) -> list[models.UserPublic]:
+    users = [
+        users_service.create_one(
+            session,
+            users_factory.user_create_factory(
+                name='test user 1 (admin)',
+                email='test1@test.com',
+                role_names=[
+                    'Légumineuses',
+                    'Légumes',
+                    'Oeufs',
+                    'Porc-Agneau',
+                    'Vin',
+                    'Fruits'])),
+        users_service.create_one(
+            session,
+            users_factory.user_create_factory(
+                name='test user 2',
+                email='test2@test.com',
+                role_names=['Légumineuses'])),
+        users_service.create_one(
+            session,
+            users_factory.user_create_factory(
+                name='test user 3',
+                email='test3@test.com',
+                role_names=['Porc-Agneau']))]
+    return users
+
+
+@pytest.fixture
+def referer(session: Session) -> models.UserPublic:
+    referer = users_service.create_one(
+        session,
+        users_factory.user_create_factory(
+            name='test referer',
+            email='test@test.com',
+            role_names=['Légumineuses'],
+        )
+    )
+    return referer
+
+
+@pytest.fixture
+def shipments(session: Session,
+              forms: list[models.FormPublic],
+              products: list[models.ProductPublic]):
+    shipments = [
+        shipments_service.create_one(
+            session,
+            shipments_factory.shipment_create_factory(
+                name='test shipment 1',
+                date=datetime.date(2025, 10, 10),
+                form_id=forms[0].id,
+                product_ids=[p.id for p in products]
+            )
+        ),
+        shipments_service.create_one(
+            session,
+            shipments_factory.shipment_create_factory(
+                name='test shipment 2',
+                date=datetime.date(2025, 11, 10),
+                form_id=forms[0].id,
+                product_ids=[p.id for p in products]
+            )
+        ),
+    ]
+    return shipments
+
+
+@pytest.fixture
+def forms(
+    session: Session,
+    productor: models.ProductorPublic,
+    referer: models.UserPublic
+) -> list[models.FormPublic]:
+    forms = [
+        forms_service.create_one(
+            session,
+            forms_factory.form_create_factory(
+                name='test form 1',
+                productor_id=productor.id,
+                referer_id=referer.id,
+                season='test season 1',
+            )
+        ),
+        forms_service.create_one(
+            session,
+            forms_factory.form_create_factory(
+                name='test form 2',
+                productor_id=productor.id,
+                referer_id=referer.id,
+                season='test season 2',
+            )
+        )
+    ]
+    return forms

backend/tests/routers/test_contracts.py

@@ -0,0 +1,207 @@
+import src.contracts.service as service
+import tests.factories.contract_products as contract_products_factory
+import tests.factories.contracts as contract_factory
+import tests.factories.forms as form_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestContracts:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            contract_factory.contract_public_factory(id=1),
+            contract_factory.contract_public_factory(id=2),
+            contract_factory.contract_public_factory(id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/contracts')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            [],
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            contract_factory.contract_public_factory(id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/contracts?forms=form test')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            ['form test'],
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.contracts.service.get_all')
+        response = client.get('/api/contracts')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = contract_factory.contract_public_factory(id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        mocker.patch.object(
+            service,
+            'is_allowed',
+            return_value=True
+        )
+        response = client.get('/api/contracts/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        mocker.patch.object(
+            service,
+            'is_allowed',
+            return_value=True
+        )
+        response = client.get('/api/contracts/2')
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.contracts.service.get_one')
+        response = client.get('/api/contracts/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        contract_result = contract_factory.contract_public_factory()
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=contract_result
+        )
+
+        mocker.patch.object(
+            service,
+            'is_allowed',
+            return_value=True
+        )
+
+        response = client.delete('/api/contracts/2')
+
+        assert response.status_code == 200
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user
+    ):
+        contract_result = None
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=contract_result
+        )
+
+        mocker.patch.object(
+            service,
+            'is_allowed',
+            return_value=True
+        )
+
+        response = client.delete('/api/contracts/2')
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user
+    ):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.contracts.service.delete_one')
+        response = client.delete('/api/contracts/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/routers/test_forms.py

@@ -0,0 +1,355 @@
+import src.forms.exceptions as forms_exceptions
+import src.forms.service as service
+import src.messages as messages
+import tests.factories.forms as form_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestForms:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            form_factory.form_public_factory(name="test 1", id=1),
+            form_factory.form_public_factory(name="test 2", id=2),
+            form_factory.form_public_factory(name="test 3", id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/forms/referents')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            [],
+            [],
+            False,
+            mock_user,
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            form_factory.form_public_factory(name="test 2", id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get(
+            '/api/forms/referents?current_season=true&seasons=hiver-2025&productors=test productor')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            ['hiver-2025'],
+            ['test productor'],
+            True,
+            mock_user,
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.forms.service.get_all')
+        response = client.get('/api/forms/referents')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = form_factory.form_public_factory(name="test 2", id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        response = client.get('/api/forms/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        response = client.get('/api/forms/2')
+        response_data = response.json()
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_create_one(self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(name='test form create')
+        form_create = form_factory.form_create_factory(name='test form create')
+        form_result = form_factory.form_public_factory(name='test form create')
+
+        mock = mocker.patch.object(
+            service,
+            'create_one',
+            return_value=form_result
+        )
+
+        response = client.post('/api/forms', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test form create'
+        mock.assert_called_once_with(
+            mock_session,
+            form_create
+        )
+
+    def test_create_one_referer_notfound(
+            self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(
+            name='test form create', referer_id=12312)
+        form_create = form_factory.form_create_factory(
+            name='test form create', referer_id=12312)
+
+        mock = mocker.patch.object(
+            service, 'create_one', side_effect=forms_exceptions.UserNotFoundError(
+                messages.Messages.not_found('referer')))
+
+        response = client.post('/api/forms', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            form_create
+        )
+
+    def test_create_one_productor_notfound(
+            self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(
+            name='test form create', productor_id=1231)
+        form_create = form_factory.form_create_factory(
+            name='test form create', productor_id=1231)
+
+        mock = mocker.patch.object(
+            service, 'create_one', side_effect=forms_exceptions.ProductorNotFoundError(
+                messages.Messages.not_found('productor')))
+
+        response = client.post('/api/forms', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            form_create
+        )
+
+    def test_create_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        form_body = form_factory.form_body_factory(name='test form create')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.forms.service.create_one')
+        response = client.post('/api/forms', json=form_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_update_one(self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(name='test form update')
+        form_update = form_factory.form_update_factory(name='test form update')
+        form_result = form_factory.form_public_factory(name='test form update')
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            return_value=form_result
+        )
+
+        response = client.put('/api/forms/2', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test form update'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            form_update
+        )
+
+    def test_update_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        form_body = form_factory.form_body_factory(name='test form update')
+        form_update = form_factory.form_update_factory(name='test form update')
+
+        mock = mocker.patch.object(
+            service, 'update_one', side_effect=forms_exceptions.FormNotFoundError(
+                messages.Messages.not_found('form')))
+
+        response = client.put('/api/forms/2', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            form_update
+        )
+
+    def test_update_one_referer_notfound(
+            self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(name='test form update')
+        form_update = form_factory.form_update_factory(name='test form update')
+
+        mock = mocker.patch.object(
+            service, 'update_one', side_effect=forms_exceptions.UserNotFoundError(
+                messages.Messages.not_found('referer')))
+
+        response = client.put('/api/forms/2', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            form_update
+        )
+
+    def test_update_one_productor_notfound(
+            self, client, mocker, mock_session, mock_user):
+        form_body = form_factory.form_body_factory(name='test form update')
+        form_update = form_factory.form_update_factory(name='test form update')
+
+        mock = mocker.patch.object(
+            service, 'update_one', side_effect=forms_exceptions.ProductorNotFoundError(
+                messages.Messages.not_found('productor')))
+
+        response = client.put('/api/forms/2', json=form_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            form_update
+        )
+
+    def test_update_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        form_body = form_factory.form_body_factory(name='test form update')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.forms.service.update_one')
+        response = client.put('/api/forms/2', json=form_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        form_result = form_factory.form_public_factory(name='test form delete')
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=form_result
+        )
+
+        response = client.delete('/api/forms/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test form delete'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        form_result = None
+
+        mock = mocker.patch.object(
+            service, 'delete_one', side_effect=forms_exceptions.FormNotFoundError(
+                messages.Messages.not_found('form')))
+
+        response = client.delete('/api/forms/2')
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.forms.service.delete_one')
+        response = client.delete('/api/forms/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/routers/test_productors.py

@@ -0,0 +1,309 @@
+import src.messages as messages
+import src.productors.exceptions as exceptions
+import src.productors.service as service
+import tests.factories.productors as productor_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestProductors:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            productor_factory.productor_public_factory(name="test 1", id=1),
+            productor_factory.productor_public_factory(name="test 2", id=2),
+            productor_factory.productor_public_factory(name="test 3", id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/productors')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            [],
+            [],
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            productor_factory.productor_public_factory(name="test 2", id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get(
+            '/api/productors?types=Légumineuses&names=test 2')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            ['test 2'],
+            ['Légumineuses'],
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.productors.service.get_all')
+        response = client.get('/api/productors')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = productor_factory.productor_public_factory(
+            name="test 2", id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        response = client.get('/api/productors/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        response = client.get('/api/productors/2')
+        response_data = response.json()
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.productors.service.get_one')
+        response = client.get('/api/productors/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_create_one(self, client, mocker, mock_session, mock_user):
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor create')
+        productor_create = productor_factory.productor_create_factory(
+            name='test productor create')
+        productor_result = productor_factory.productor_public_factory(
+            name='test productor create')
+
+        mock = mocker.patch.object(
+            service,
+            'create_one',
+            return_value=productor_result
+        )
+
+        response = client.post('/api/productors', json=productor_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test productor create'
+        mock.assert_called_once_with(
+            mock_session,
+            productor_create
+        )
+
+    def test_create_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor create')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.productors.service.create_one')
+        response = client.post('/api/productors', json=productor_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_update_one(self, client, mocker, mock_session, mock_user):
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor update')
+        productor_update = productor_factory.productor_update_factory(
+            name='test productor update')
+        productor_result = productor_factory.productor_public_factory(
+            name='test productor update')
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            return_value=productor_result
+        )
+
+        response = client.put('/api/productors/2', json=productor_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test productor update'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            productor_update
+        )
+
+    def test_update_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor update')
+        productor_update = productor_factory.productor_update_factory(
+            name='test productor update')
+        productor_result = None
+
+        mock = mocker.patch.object(
+            service, 'update_one', side_effect=exceptions.ProductorNotFoundError(
+                messages.Messages.not_found('productor')))
+
+        response = client.put('/api/productors/2', json=productor_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            productor_update
+        )
+
+    def test_update_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor update')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.productors.service.update_one')
+        response = client.put('/api/productors/2', json=productor_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        productor_result = productor_factory.productor_public_factory(
+            name='test productor delete')
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=productor_result
+        )
+
+        response = client.delete('/api/productors/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test productor delete'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        productor_result = None
+
+        mock = mocker.patch.object(
+            service, 'delete_one', side_effect=exceptions.ProductorNotFoundError(
+                messages.Messages.not_found('productor')))
+
+        response = client.delete('/api/productors/2')
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        productor_body = productor_factory.productor_body_factory(
+            name='test productor delete')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.productors.service.delete_one')
+        response = client.delete('/api/productors/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/routers/test_products.py

@@ -0,0 +1,313 @@
+import src.products.exceptions as exceptions
+import src.products.service as service
+import tests.factories.products as product_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestProducts:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            product_factory.product_public_factory(name="test 1", id=1),
+            product_factory.product_public_factory(name="test 2", id=2),
+            product_factory.product_public_factory(name="test 3", id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/products')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            [],
+            [],
+            []
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            product_factory.product_public_factory(name="test 2", id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/products?types=1&names=test 2')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            ['test 2'],
+            [],
+            ['1'],
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.products.service.get_all')
+        response = client.get('/api/products')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = product_factory.product_public_factory(
+            name="test 2", id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        response = client.get('/api/products/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        response = client.get('/api/products/2')
+        response_data = response.json()
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.products.service.get_one')
+        response = client.get('/api/products/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_create_one(self, client, mocker, mock_session, mock_user):
+        product_body = product_factory.product_body_factory(
+            name='test product create')
+        product_create = product_factory.product_create_factory(
+            name='test product create')
+        product_result = product_factory.product_public_factory(
+            name='test product create')
+
+        mock = mocker.patch.object(
+            service,
+            'create_one',
+            return_value=product_result
+        )
+
+        response = client.post('/api/products', json=product_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test product create'
+        mock.assert_called_once_with(
+            mock_session,
+            product_create
+        )
+
+    def test_create_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        product_body = product_factory.product_body_factory(
+            name='test product create')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.products.service.create_one')
+        response = client.post('/api/products', json=product_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_update_one(self, client, mocker, mock_session, mock_user):
+        product_body = product_factory.product_body_factory(
+            name='test product update')
+        product_update = product_factory.product_update_factory(
+            name='test product update')
+        product_result = product_factory.product_public_factory(
+            name='test product update')
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            return_value=product_result
+        )
+
+        response = client.put('/api/products/2', json=product_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test product update'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            product_update
+        )
+
+    def test_update_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        product_body = product_factory.product_body_factory(
+            name='test product update')
+        product_update = product_factory.product_update_factory(
+            name='test product update')
+        product_result = None
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            side_effect=exceptions.ProductNotFoundError('Product not found')
+        )
+
+        response = client.put('/api/products/2', json=product_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            product_update
+        )
+
+    def test_update_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        product_body = product_factory.product_body_factory(
+            name='test product update')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.products.service.update_one')
+        response = client.put('/api/products/2', json=product_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        product_result = product_factory.product_public_factory(
+            name='test product delete')
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=product_result
+        )
+
+        response = client.delete('/api/products/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test product delete'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        product_result = None
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            side_effect=exceptions.ProductNotFoundError('Product not found')
+        )
+
+        response = client.delete('/api/products/2')
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        product_body = product_factory.product_body_factory(
+            name='test product delete')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.products.service.delete_one')
+        response = client.delete('/api/products/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/routers/test_shipments.py

@@ -0,0 +1,310 @@
+import src.messages as messages
+import src.shipments.exceptions as exceptions
+import src.shipments.service as service
+import tests.factories.shipments as shipment_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestShipments:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            shipment_factory.shipment_public_factory(name="test 1", id=1),
+            shipment_factory.shipment_public_factory(name="test 2", id=2),
+            shipment_factory.shipment_public_factory(name="test 3", id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/shipments')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            [],
+            [],
+            [],
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            shipment_factory.shipment_public_factory(name="test 2", id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get(
+            '/api/shipments?dates=2025-10-10&names=test 2&forms=contract form 1')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            mock_user,
+            ['test 2'],
+            ['2025-10-10'],
+            ['contract form 1'],
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.shipments.service.get_all')
+        response = client.get('/api/shipments')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = shipment_factory.shipment_public_factory(
+            name="test 2", id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        response = client.get('/api/shipments/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        response = client.get('/api/shipments/2')
+        response_data = response.json()
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.shipments.service.get_one')
+        response = client.get('/api/shipments/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_create_one(self, client, mocker, mock_session, mock_user):
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment create')
+        shipment_create = shipment_factory.shipment_create_factory(
+            name='test shipment create')
+        shipment_result = shipment_factory.shipment_public_factory(
+            name='test shipment create')
+
+        mock = mocker.patch.object(
+            service,
+            'create_one',
+            return_value=shipment_result
+        )
+
+        response = client.post('/api/shipments', json=shipment_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test shipment create'
+        mock.assert_called_once_with(
+            mock_session,
+            shipment_create
+        )
+
+    def test_create_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment create')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.shipments.service.create_one')
+        response = client.post('/api/shipments', json=shipment_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_update_one(self, client, mocker, mock_session, mock_user):
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment update')
+        shipment_update = shipment_factory.shipment_update_factory(
+            name='test shipment update')
+        shipment_result = shipment_factory.shipment_public_factory(
+            name='test shipment update')
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            return_value=shipment_result
+        )
+
+        response = client.put('/api/shipments/2', json=shipment_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test shipment update'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            shipment_update
+        )
+
+    def test_update_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment update')
+        shipment_update = shipment_factory.shipment_update_factory(
+            name='test shipment update')
+
+        mock = mocker.patch.object(
+            service, 'update_one', side_effect=exceptions.ShipmentNotFoundError(
+                messages.Messages.not_found('shipment')))
+
+        response = client.put('/api/shipments/2', json=shipment_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            shipment_update
+        )
+
+    def test_update_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment update')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.shipments.service.update_one')
+        response = client.put('/api/shipments/2', json=shipment_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        shipment_result = shipment_factory.shipment_public_factory(
+            name='test shipment delete')
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=shipment_result
+        )
+
+        response = client.delete('/api/shipments/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test shipment delete'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        shipment_result = None
+
+        mock = mocker.patch.object(
+            service, 'delete_one', side_effect=exceptions.ShipmentNotFoundError(
+                messages.Messages.not_found('shipment')))
+
+        response = client.delete('/api/shipments/2')
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        shipment_body = shipment_factory.shipment_body_factory(
+            name='test shipment delete')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.shipments.service.delete_one')
+        response = client.delete('/api/shipments/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/routers/test_users.py

@@ -0,0 +1,296 @@
+import src.users.exceptions as exceptions
+import src.users.service as service
+import tests.factories.users as user_factory
+from fastapi.exceptions import HTTPException
+from src import models
+from src.auth.auth import get_current_user
+from src.main import app
+
+
+class TestUsers:
+    def test_get_all(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            user_factory.user_public_factory(name="test 1", id=1),
+            user_factory.user_public_factory(name="test 2", id=2),
+            user_factory.user_public_factory(name="test 3", id=3),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/users')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 1
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            [],
+            [],
+        )
+
+    def test_get_all_filters(self, client, mocker, mock_session, mock_user):
+        mock_results = [
+            user_factory.user_public_factory(name="test 2", id=2),
+        ]
+        mock = mocker.patch.object(
+            service,
+            'get_all',
+            return_value=mock_results
+        )
+
+        response = client.get('/api/users?emails=test@test.test&names=test 2')
+        response_data = response.json()
+        assert response.status_code == 200
+        assert response_data[0]['id'] == 2
+        assert len(response_data) == len(mock_results)
+        mock.assert_called_once_with(
+            mock_session,
+            ['test 2'],
+            ['test@test.test'],
+        )
+
+    def test_get_all_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.users.service.get_all')
+        response = client.get('/api/users')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_get_one(self, client, mocker, mock_session, mock_user):
+        mock_result = user_factory.user_public_factory(name="test 2", id=2)
+
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+
+        response = client.get('/api/users/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['id'] == 2
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_notfound(self, client, mocker, mock_session, mock_user):
+        mock_result = None
+        mock = mocker.patch.object(
+            service,
+            'get_one',
+            return_value=mock_result
+        )
+        response = client.get('/api/users/2')
+        response_data = response.json()
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2
+        )
+
+    def test_get_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.users.service.get_one')
+        response = client.get('/api/users/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_create_one(self, client, mocker, mock_session, mock_user):
+        user_body = user_factory.user_body_factory(name='test user create')
+        user_create = user_factory.user_create_factory(name='test user create')
+        user_result = user_factory.user_public_factory(name='test user create')
+
+        mock = mocker.patch.object(
+            service,
+            'create_one',
+            return_value=user_result
+        )
+
+        response = client.post('/api/users', json=user_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test user create'
+        mock.assert_called_once_with(
+            mock_session,
+            user_create
+        )
+
+    def test_create_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        user_body = user_factory.user_body_factory(name='test user create')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.users.service.create_one')
+        response = client.post('/api/users', json=user_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_update_one(self, client, mocker, mock_session, mock_user):
+        user_body = user_factory.user_body_factory(name='test user update')
+        user_update = user_factory.user_update_factory(name='test user update')
+        user_result = user_factory.user_public_factory(name='test user update')
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            return_value=user_result
+        )
+
+        response = client.put('/api/users/2', json=user_body)
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test user update'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            user_update
+        )
+
+    def test_update_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        user_body = user_factory.user_body_factory(name='test user update')
+        user_update = user_factory.user_update_factory(name='test user update')
+        user_result = None
+
+        mock = mocker.patch.object(
+            service,
+            'update_one',
+            side_effect=exceptions.UserNotFoundError('User 2 not found')
+        )
+
+        response = client.put('/api/users/2', json=user_body)
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+            user_update
+        )
+
+    def test_update_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        user_body = user_factory.user_body_factory(name='test user update')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.users.service.update_one')
+        response = client.put('/api/users/2', json=user_body)
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()
+
+    def test_delete_one(self, client, mocker, mock_session, mock_user):
+        user_result = user_factory.user_public_factory(name='test user delete')
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            return_value=user_result
+        )
+
+        response = client.delete('/api/users/2')
+        response_data = response.json()
+
+        assert response.status_code == 200
+        assert response_data['name'] == 'test user delete'
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_notfound(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        user_result = None
+
+        mock = mocker.patch.object(
+            service,
+            'delete_one',
+            side_effect=exceptions.UserNotFoundError('User 2 not found')
+        )
+
+        response = client.delete('/api/users/2')
+        response_data = response.json()
+
+        assert response.status_code == 404
+        mock.assert_called_once_with(
+            mock_session,
+            2,
+        )
+
+    def test_delete_one_unauthorized(
+            self,
+            client,
+            mocker,
+            mock_session,
+            mock_user):
+        def unauthorized():
+            raise HTTPException(status_code=401)
+        user_body = user_factory.user_body_factory(name='test user delete')
+
+        app.dependency_overrides[get_current_user] = unauthorized
+
+        mock = mocker.patch('src.users.service.delete_one')
+        response = client.delete('/api/users/2')
+
+        assert response.status_code == 401
+        mock.assert_not_called()
+
+        app.dependency_overrides.clear()

backend/tests/services/test_forms_service.py

@@ -0,0 +1,158 @@
+import pytest
+import src.forms.exceptions as forms_exceptions
+import src.forms.service as forms_service
+import tests.factories.forms as forms_factory
+from sqlmodel import Session
+from src import models
+
+
+class TestFormsService:
+    def test_get_all_forms(self, session: Session,
+                           forms: list[models.FormPublic]):
+        result = forms_service.get_all(session, [], [], False)
+
+        assert len(result) == 2
+        assert result == forms
+
+    def test_get_all_forms_filter_productors(
+            self, session: Session, forms: list[models.FormPublic]):
+        result = forms_service.get_all(session, [], ['test productor'], False)
+
+        assert len(result) == 2
+        assert result == forms
+
+    def test_get_all_forms_filter_season(
+            self, session: Session, forms: list[models.FormPublic]):
+        result = forms_service.get_all(session, ['test season 1'], [], False)
+
+        assert len(result) == 1
+
+    def test_get_all_forms_all_filters(
+            self, session: Session, forms: list[models.FormPublic]):
+        result = forms_service.get_all(
+            session, ['test season 1'], ['test productor'], True)
+
+        assert result == forms
+
+    def test_get_one_form(self, session: Session,
+                          forms: list[models.FormPublic]):
+        result = forms_service.get_one(session, forms[0].id)
+
+        assert result == forms[0]
+
+    def test_get_one_form_notfound(self, session: Session):
+        result = forms_service.get_one(session, 122)
+
+        assert result is None
+
+    def test_create_form(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic
+    ):
+        form_create = forms_factory.form_create_factory(
+            name="new test form",
+            productor_id=productor.id,
+            referer=referer.id,
+            season="new test season",
+        )
+        result = forms_service.create_one(session, form_create)
+
+        assert result.id is not None
+        assert result.name == "new test form"
+        assert result.productor.name == "test productor"
+
+    def test_create_form_invalidinput(
+        self,
+        session: Session,
+        productor: models.Productor
+    ):
+        form_create = None
+        with pytest.raises(forms_exceptions.FormCreateError):
+            result = forms_service.create_one(session, form_create)
+
+        form_create = forms_factory.form_create_factory(productor_id=123)
+        with pytest.raises(forms_exceptions.ProductorNotFoundError):
+            result = forms_service.create_one(session, form_create)
+
+        form_create = forms_factory.form_create_factory(
+            productor_id=productor.id,
+            referer_id=123
+        )
+        with pytest.raises(forms_exceptions.UserNotFoundError):
+            result = forms_service.create_one(session, form_create)
+
+    def test_update_form(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic,
+        forms: list[models.FormPublic]
+    ):
+        form_update = forms_factory.form_update_factory(
+            name='updated test form',
+            productor_id=productor.id,
+            referer_id=referer.id,
+            season='updated test season'
+        )
+        form_id = forms[0].id
+        result = forms_service.update_one(session, form_id, form_update)
+
+        assert result.id == form_id
+        assert result.name == 'updated test form'
+        assert result.season == 'updated test season'
+
+    def test_update_form_notfound(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic,
+    ):
+        form_update = forms_factory.form_update_factory(
+            name='updated test form',
+            productor_id=productor.id,
+            referer_id=referer.id,
+            season='updated test season'
+        )
+        form_id = 123
+        with pytest.raises(forms_exceptions.FormNotFoundError):
+            result = forms_service.update_one(session, form_id, form_update)
+
+    def test_update_form_invalidinput(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        forms: list[models.FormPublic]
+    ):
+        form_id = forms[0].id
+        form_update = forms_factory.form_update_factory(productor_id=123)
+        with pytest.raises(forms_exceptions.ProductorNotFoundError):
+            result = forms_service.update_one(session, form_id, form_update)
+
+        form_update = forms_factory.form_update_factory(
+            productor_id=productor.id,
+            referer_id=123
+        )
+        with pytest.raises(forms_exceptions.UserNotFoundError):
+            result = forms_service.update_one(session, form_id, form_update)
+
+    def test_delete_form(
+        self,
+        session: Session,
+        forms: list[models.FormPublic]
+    ):
+        form_id = forms[0].id
+        result = forms_service.delete_one(session, form_id)
+
+        check = forms_service.get_one(session, form_id)
+        assert check is None
+
+    def test_delete_form_notfound(
+        self,
+        session: Session,
+        forms: list[models.FormPublic]
+    ):
+        form_id = 123
+        with pytest.raises(forms_exceptions.FormNotFoundError):
+            result = forms_service.delete_one(session, form_id)

backend/tests/services/test_productors_service.py

@@ -0,0 +1,146 @@
+import pytest
+import src.productors.exceptions as productors_exceptions
+import src.productors.service as productors_service
+import tests.factories.productors as productors_factory
+from sqlmodel import Session
+from src import models
+
+
+class TestProductorsService:
+    def test_get_all_productors(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic],
+        user: models.UserPublic
+    ):
+        result = productors_service.get_all(session, user, [], [])
+
+        assert len(result) == 1
+        assert result == [productors[0]]
+
+    def test_get_all_productors_filter_names(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic],
+        user: models.UserPublic
+    ):
+        result = productors_service.get_all(
+            session,
+            user,
+            ['test productor 1'],
+            []
+        )
+
+        assert len(result) == 1
+
+    def test_get_all_productors_filter_types(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic],
+        user: models.UserPublic
+    ):
+        result = productors_service.get_all(
+            session,
+            user,
+            [],
+            ['Légumineuses'],
+        )
+
+        assert len(result) == 1
+
+    def test_get_all_productors_all_filters(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic],
+        user: models.UserPublic
+    ):
+        result = productors_service.get_all(
+            session,
+            user,
+            ['test productor 1'],
+            ['Légumineuses'],
+        )
+
+        assert len(result) == 1
+
+    def test_get_one_productor(self,
+                               session: Session,
+                               productors: list[models.ProductorPublic]):
+        result = productors_service.get_one(session, productors[0].id)
+
+        assert result == productors[0]
+
+    def test_get_one_productor_notfound(self, session: Session):
+        result = productors_service.get_one(session, 122)
+
+        assert result is None
+
+    def test_create_productor(
+        self,
+        session: Session,
+        referer: models.ProductorPublic
+    ):
+        productor_create = productors_factory.productor_create_factory(
+            name="new test productor",
+        )
+        result = productors_service.create_one(session, productor_create)
+
+        assert result.id is not None
+        assert result.name == "new test productor"
+
+    def test_create_productor_invalidinput(
+        self,
+        session: Session,
+    ):
+        productor_create = None
+        with pytest.raises(productors_exceptions.ProductorCreateError):
+            result = productors_service.create_one(session, productor_create)
+
+    def test_update_productor(
+        self,
+        session: Session,
+        referer: models.ProductorPublic,
+        productors: list[models.ProductorPublic]
+    ):
+        productor_update = productors_factory.productor_update_factory(
+            name='updated test productor',
+        )
+        productor_id = productors[0].id
+        result = productors_service.update_one(
+            session, productor_id, productor_update)
+
+        assert result.id == productor_id
+        assert result.name == 'updated test productor'
+
+    def test_update_productor_notfound(
+        self,
+        session: Session,
+        referer: models.ProductorPublic,
+    ):
+        productor_update = productors_factory.productor_update_factory(
+            name='updated test productor',
+        )
+        productor_id = 123
+        with pytest.raises(productors_exceptions.ProductorNotFoundError):
+            result = productors_service.update_one(
+                session, productor_id, productor_update)
+
+    def test_delete_productor(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic]
+    ):
+        productor_id = productors[0].id
+        result = productors_service.delete_one(session, productor_id)
+
+        check = productors_service.get_one(session, productor_id)
+        assert check is None
+
+    def test_delete_productor_notfound(
+        self,
+        session: Session,
+        productors: list[models.ProductorPublic]
+    ):
+        productor_id = 123
+        with pytest.raises(productors_exceptions.ProductorNotFoundError):
+            result = productors_service.delete_one(session, productor_id)

backend/tests/services/test_products_service.py

@@ -0,0 +1,196 @@
+import pytest
+import src.products.exceptions as products_exceptions
+import src.products.service as products_service
+import tests.factories.products as products_factory
+from sqlmodel import Session
+from src import models
+
+
+class TestProductsService:
+    def test_get_all_products(
+        self,
+        session: Session,
+        products: list[models.ProductPublic],
+        user: models.UserPublic
+    ):
+        result = products_service.get_all(session, user, [], [], [])
+
+        assert len(result) == 2
+        assert result == products
+
+    def test_get_all_products_filter_productors(
+        self,
+        session: Session,
+        products: list[models.ProductPublic],
+        user: models.UserPublic
+    ):
+        result = products_service.get_all(
+            session,
+            user,
+            [],
+            ['test productor'],
+            []
+        )
+
+        assert len(result) == 2
+        assert result == products
+
+    def test_get_all_products_filter_names(
+        self,
+        session: Session,
+        products: list[models.ProductPublic],
+        user: models.UserPublic
+    ):
+        result = products_service.get_all(
+            session,
+            user,
+            ['product 1 occasionnal'],
+            [],
+            []
+        )
+
+        assert len(result) == 1
+
+    def test_get_all_products_filter_types(
+        self,
+        session: Session,
+        products: list[models.ProductPublic],
+        user: models.UserPublic
+    ):
+        result = products_service.get_all(
+            session,
+            user,
+            [],
+            [],
+            ['1']
+        )
+
+        assert len(result) == 1
+
+    def test_get_all_products_all_filters(
+        self,
+        session: Session,
+        products: list[models.ProductPublic],
+        user: models.UserPublic
+    ):
+        result = products_service.get_all(
+            session,
+            user,
+            ['product 1 occasionnal'],
+            ['test productor'],
+            ['1']
+        )
+
+        assert len(result) == 1
+
+    def test_get_one_product(self, session: Session,
+                             products: list[models.ProductPublic]):
+        result = products_service.get_one(session, products[0].id)
+
+        assert result == products[0]
+
+    def test_get_one_product_notfound(self, session: Session):
+        result = products_service.get_one(session, 122)
+
+        assert result is None
+
+    def test_create_product(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic
+    ):
+        product_create = products_factory.product_create_factory(
+            name="new test product",
+            productor_id=productor.id,
+        )
+        result = products_service.create_one(session, product_create)
+
+        assert result.id is not None
+        assert result.name == "new test product"
+        assert result.productor.name == "test productor"
+
+    def test_create_product_invalidinput(
+        self,
+        session: Session,
+        productor: models.Productor
+    ):
+        product_create = None
+        with pytest.raises(products_exceptions.ProductCreateError):
+            result = products_service.create_one(session, product_create)
+
+        product_create = products_factory.product_create_factory(
+            productor_id=123)
+        with pytest.raises(products_exceptions.ProductorNotFoundError):
+            result = products_service.create_one(session, product_create)
+
+    def test_update_product(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic,
+        products: list[models.ProductPublic]
+    ):
+        product_update = products_factory.product_update_factory(
+            name='updated test product',
+            productor_id=productor.id,
+        )
+        product_id = products[0].id
+        result = products_service.update_one(
+            session, product_id, product_update)
+
+        assert result.id == product_id
+        assert result.name == 'updated test product'
+
+    def test_update_product_notfound(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        referer: models.ProductorPublic,
+    ):
+        product_update = products_factory.product_update_factory(
+            name='updated test product',
+            productor_id=productor.id,
+        )
+        product_id = 123
+        with pytest.raises(products_exceptions.ProductNotFoundError):
+            result = products_service.update_one(
+                session, product_id, product_update)
+
+    def test_update_product_invalidinput(
+        self,
+        session: Session,
+        productor: models.ProductorPublic,
+        products: list[models.ProductPublic]
+    ):
+        product_id = products[0].id
+        product_update = products_factory.product_update_factory(
+            productor_id=123)
+        with pytest.raises(products_exceptions.ProductorNotFoundError):
+            result = products_service.update_one(
+                session, product_id, product_update)
+
+        product_update = products_factory.product_update_factory(
+            productor_id=productor.id,
+            referer_id=123
+        )
+
+    def test_delete_product(
+        self,
+        session: Session,
+        products: list[models.ProductPublic]
+    ):
+        product_id = products[0].id
+        result = products_service.delete_one(session, product_id)
+
+        check = products_service.get_one(session, product_id)
+        assert check is None
+
+    def test_delete_product_notfound(
+        self,
+        session: Session,
+        products: list[models.ProductPublic]
+    ):
+        product_id = 123
+        with pytest.raises(products_exceptions.ProductNotFoundError):
+            result = products_service.delete_one(session, product_id)

backend/tests/services/test_shipments_service.py

@@ -0,0 +1,150 @@
+import datetime
+
+import pytest
+import src.shipments.exceptions as shipments_exceptions
+import src.shipments.service as shipments_service
+import tests.factories.shipments as shipments_factory
+from sqlmodel import Session
+from src import models
+
+
+class TestShipmentsService:
+    def test_get_all_shipments(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic],
+        user: models.UserPublic,
+    ):
+        result = shipments_service.get_all(session, user, [], [], [])
+
+        assert len(result) == 2
+        assert result == shipments
+
+    def test_get_all_shipments_filter_names(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic],
+        user: models.UserPublic,
+    ):
+        result = shipments_service.get_all(
+            session, user, ['test shipment 1'], [], [])
+
+        assert len(result) == 1
+        assert result == [shipments[0]]
+
+    def test_get_all_shipments_filter_dates(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic],
+        user: models.UserPublic,
+    ):
+        result = shipments_service.get_all(
+            session, user, [], ['2025-10-10'], [])
+
+        assert len(result) == 1
+
+    def test_get_all_shipments_filter_forms(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic],
+        forms: list[models.FormPublic],
+        user: models.UserPublic,
+    ):
+        result = shipments_service.get_all(
+            session, user, [], [], [forms[0].name])
+
+        assert len(result) == 2
+
+    def test_get_all_shipments_all_filters(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic],
+        forms: list[models.FormPublic],
+        user: models.UserPublic,
+    ):
+        result = shipments_service.get_all(session, user, ['test shipment 1'], [
+                                           '2025-10-10'], [forms[0].name])
+
+        assert len(result) == 1
+
+    def test_get_one_shipment(self, session: Session,
+                              shipments: list[models.ShipmentPublic]):
+        result = shipments_service.get_one(session, shipments[0].id)
+
+        assert result == shipments[0]
+
+    def test_get_one_shipment_notfound(self, session: Session):
+        result = shipments_service.get_one(session, 122)
+
+        assert result is None
+
+    def test_create_shipment(
+        self,
+        session: Session,
+    ):
+        shipment_create = shipments_factory.shipment_create_factory(
+            name='new test shipment',
+            date='2025-10-10',
+        )
+        result = shipments_service.create_one(session, shipment_create)
+
+        assert result.id is not None
+        assert result.name == "new test shipment"
+
+    def test_create_shipment_invalidinput(
+        self,
+        session: Session,
+    ):
+        shipment_create = None
+        with pytest.raises(shipments_exceptions.ShipmentCreateError):
+            result = shipments_service.create_one(session, shipment_create)
+
+    def test_update_shipment(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic]
+    ):
+        shipment_update = shipments_factory.shipment_update_factory(
+            name='updated shipment 1',
+            date='2025-12-10',
+        )
+        shipment_id = shipments[0].id
+        result = shipments_service.update_one(
+            session, shipment_id, shipment_update)
+
+        assert result.id == shipment_id
+        assert result.name == 'updated shipment 1'
+        assert result.date == datetime.date(2025, 12, 10)
+
+    def test_update_shipment_notfound(
+        self,
+        session: Session,
+    ):
+        shipment_update = shipments_factory.shipment_update_factory(
+            name='updated shipment 1',
+            date=datetime.date(2025, 10, 10),
+        )
+        shipment_id = 123
+        with pytest.raises(shipments_exceptions.ShipmentNotFoundError):
+            result = shipments_service.update_one(
+                session, shipment_id, shipment_update)
+
+    def test_delete_shipment(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic]
+    ):
+        shipment_id = shipments[0].id
+        result = shipments_service.delete_one(session, shipment_id)
+
+        check = shipments_service.get_one(session, shipment_id)
+        assert check is None
+
+    def test_delete_shipment_notfound(
+        self,
+        session: Session,
+        shipments: list[models.ShipmentPublic]
+    ):
+        shipment_id = 123
+        with pytest.raises(shipments_exceptions.ShipmentNotFoundError):
+            result = shipments_service.delete_one(session, shipment_id)

backend/tests/services/test_users_service.py

@@ -0,0 +1,120 @@
+import pytest
+import src.users.exceptions as users_exceptions
+import src.users.service as users_service
+import tests.factories.users as users_factory
+from sqlmodel import Session
+from src import models
+
+
+class TestUsersService:
+    def test_get_all_users(self, session: Session,
+                           users: list[models.UserPublic]):
+        result = users_service.get_all(session, [], [])
+
+        assert len(result) == 3
+        assert result == users
+
+    def test_get_all_users_filter_names(
+            self, session: Session, users: list[models.UserPublic]):
+        result = users_service.get_all(session, ['test user 1 (admin)'], [])
+
+        assert len(result) == 1
+        assert result == [users[0]]
+
+    def test_get_all_users_filter_emails(
+            self, session: Session, users: list[models.UserPublic]):
+        result = users_service.get_all(session, [], ['test1@test.com'])
+
+        assert len(result) == 1
+
+    def test_get_all_users_all_filters(
+            self, session: Session, users: list[models.UserPublic]):
+        result = users_service.get_all(
+            session, ['test user 1 (admin)'], ['test1@test.com'])
+
+        assert len(result) == 1
+
+    def test_get_one_user(self, session: Session,
+                          users: list[models.UserPublic]):
+        result = users_service.get_one(session, users[0].id)
+
+        assert result == users[0]
+
+    def test_get_one_user_notfound(self, session: Session):
+        result = users_service.get_one(session, 122)
+
+        assert result is None
+
+    def test_create_user(
+        self,
+        session: Session,
+    ):
+        user_create = users_factory.user_create_factory(
+            name="new test user",
+            email='test@test.fr',
+            role_names=['test role']
+        )
+        result = users_service.create_one(session, user_create)
+
+        assert result.id is not None
+        assert result.name == "new test user"
+        assert result.email == "test@test.fr"
+        assert len(result.roles) == 1
+
+    def test_create_user_invalidinput(
+        self,
+        session: Session,
+    ):
+        user_create = None
+        with pytest.raises(users_exceptions.UserCreateError):
+            result = users_service.create_one(session, user_create)
+
+    def test_update_user(
+        self,
+        session: Session,
+        users: list[models.UserPublic]
+    ):
+        user_update = users_factory.user_update_factory(
+            name="updated test user",
+            email='test@testttt.fr',
+            role_names=['test role']
+        )
+        user_id = users[0].id
+        result = users_service.update_one(session, user_id, user_update)
+
+        assert result.id == user_id
+        assert result.name == 'updated test user'
+        assert result.email == 'test@testttt.fr'
+
+    def test_update_user_notfound(
+        self,
+        session: Session,
+    ):
+        user_update = users_factory.user_update_factory(
+            name="updated test user",
+            email='test@testttt.fr',
+            role_names=['test role']
+        )
+        user_id = 123
+        with pytest.raises(users_exceptions.UserNotFoundError):
+            result = users_service.update_one(session, user_id, user_update)
+
+    def test_delete_user(
+        self,
+        session: Session,
+        users: list[models.UserPublic]
+    ):
+        user_id = users[0].id
+        result = users_service.delete_one(session, user_id)
+
+        check = users_service.get_one(session, user_id)
+        assert check is None
+
+    def test_delete_user_notfound(
+        self,
+        session: Session,
+        users: list[models.UserPublic]
+    ):
+        user_id = 123
+        with pytest.raises(users_exceptions.UserNotFoundError):
+            result = users_service.delete_one(session, user_id)

frontend/locales/en.json

@@ -82,7 +82,10 @@
     "you can download all contracts for your form using the export all": "you can download all contracts for your form using the export all",
     "in the same corner you can download a recap by clicking on the button": "in the same corner you can download a recap by clicking on the",
     "once all contracts downloaded, you can delete the form (to avoid new submissions) and hide it from the home page": "once all contracts downloaded, you can delete the form (to avoid new submissions) and hide it from the home page",
+    "by checking this option the form will be accessible publicly on the home page, only check it if everything is fine with your form": "by checking this option the form will be accessible publicly on the home page, only check it if everything is fine with your form",
     "contracts": "contracts",
+    "hidden": "hidden",
+    "visible": "visible",
     "minimum price for this shipment should be at least": "minimum price for this shipment should be at least",
     "there is": "there is",
     "for this contract": "for this contract.",

frontend/locales/fr.json

@@ -73,7 +73,10 @@
     "shipment products is necessary only for occasional products (if all products are recurrent leave empty)": "il est nécessaire de configurer les produits pour la livraison uniquement si il y a des produits occasionnels (laisser vide si tous les produits sont récurents).",
     "recurrent product is for all shipments, occasional product is for a specific shipment (see shipment form)": "les produits récurrents sont pour toutes les livraisons, les produits occasionnels sont pour une livraison particulière (voir formulaire de création de livraison).",
     "some contracts require a minimum value per shipment, ignore this field if it's not the case": "certains contrats nécessitent une valeur minimum par livraison. Ce champ peut être ignoré s’il ne s’applique pas à votre contrat.",
+    "by checking this option the form will be accessible publicly on the home page, only check it if everything is fine with your form": "en cochant cette option le formulaire sera accessible publiquement sur la page d'accueil, cochez cette option uniquement si tout est prêt avec votre formulaire.",
     "contracts": "contrats",
+    "hidden": "caché",
+    "visible": "visible",
     "minimum price for this shipment should be at least": "le prix minimum d'une livraison doit être au moins de",
     "there is": "il y a",
     "for this contract": "pour ce contrat.",
@@ -166,7 +169,7 @@
     "with cheque and transfer": "avec chèques et virements configuré pour le producteur",
     "mililiter": "mililitres (ml)",
     "this field is optionnal a product can have a quantity if configured inside the product it will be shown inside the form": "ce champ est optionnel dans la configuration d'un produit, il représente la quantité d'un produit (poids d'une tranche de foie, poids d'un panier, taille d'un bocal...). Si ce champs est renseigné il sera affiché dans le formulaire à destination des amapiens.",
-    "this field is also optionnal if a product have a quantity you can select the correct unit (metric system). It will be shown next to product quantity inside the form": "ce champs est optionnel dans la configuation d'un produit, il représente l'unité de mesure associé à la quantité d'un produit (g, kg, ml, L). Si ce champs est renseigné il sera affiché dans le formulaire à destination des amapiens à coté de la quantité du produit.",
+    "this field is also optionnal if a product have a quantity you can select the correct unit (metric system). It will be shown next to product quantity inside the form": "ce champs est optionnel dans la configuation d'un produit, il représente l'unité de mesure associée à la quantité d'un produit (g, kg, ml, L). Si ce champs est renseigné il sera affiché dans le formulaire à destination des amapiens à coté de la quantité du produit.",
     "with 150 set as quantity and g as quantity unit in product": "avec \"150\" en quantité de produit et \"grammes\" selectionné dans l'unité de quantité du produit",
     "all shipments should be recreated for each form creation": "les livraisons étant liées à un formulaire elles doivent être recréés pour chaque nouveau formulaire.",
     "a productor can be edited if its informations change, it should not be recreated for each contracts": "un(e) producteur·trice peut être édité si ses informations changent, il/elle ne doit pas être recréé pour chaque nouveau contrat.",

frontend/src/components/Forms/Modal/index.tsx

@@ -1,5 +1,6 @@
 import {
     Button,
+    Checkbox,
     Group,
     Modal,
     NumberInput,
@@ -33,6 +34,7 @@ export default function FormModal({ opened, onClose, currentForm, handleSubmit }
             productor_id: currentForm?.productor?.id.toString() ?? "",
             referer_id: currentForm?.referer?.id.toString() ?? "",
             minimum_shipment_value: currentForm?.minimum_shipment_value ?? null,
+            visible: currentForm?.visible ?? false
         },
         validate: {
             name: (value) =>
@@ -136,6 +138,11 @@ export default function FormModal({ opened, onClose, currentForm, handleSubmit }
                 radius="sm"
                 {...form.getInputProps("minimum_shipment_value")}
             />
+            <Checkbox mt="lg"
+                label={t("visible", {capfirst: true})}
+                description={t("by checking this option the form will be accessible publicly on the home page, only check it if everything is fine with your form", {capfirst: true})}
+                {...form.getInputProps("visible", {type: "checkbox"})}
+            />
             <Group mt="sm" justify="space-between">
                 <Button
                     variant="filled"

frontend/src/components/Forms/Row/index.tsx

@@ -1,4 +1,4 @@
-import { ActionIcon, Table, Tooltip } from "@mantine/core";
+import { ActionIcon, Badge, Table, Tooltip } from "@mantine/core";
 import { useNavigate, useSearchParams } from "react-router";
 import { useDeleteForm } from "@/services/api";
 import { IconEdit, IconX } from "@tabler/icons-react";
@@ -16,6 +16,12 @@ export default function FormRow({ form }: FormRowProps) {
 
     return (
         <Table.Tr key={form.id}>
+            <Table.Td>
+                {form.visible ? 
+                    <Badge color="green">{t("visible", {capfirst: true})}</Badge> : 
+                    <Badge color="red">{t("hidden", {capfirst: true})}</Badge>
+                }
+            </Table.Td>
             <Table.Td>{form.name}</Table.Td>
             <Table.Td>{form.season}</Table.Td>
             <Table.Td>{form.start}</Table.Td>

frontend/src/components/Productors/Modal/index.tsx

@@ -19,7 +19,7 @@ import {
     type ProductorInputs,
 } from "@/services/resources/productors";
 import { useMemo } from "react";
-import { useGetRoles } from "@/services/api";
+import { useAuth } from "@/services/auth/AuthProvider";
 
 export type ProductorModalProps = ModalBaseProps & {
     currentProductor?: Productor;
@@ -32,7 +32,7 @@ export function ProductorModal({
     currentProductor,
     handleSubmit,
 }: ProductorModalProps) {
-    const { data: allRoles } = useGetRoles();
+    const { loggedUser } = useAuth();
 
     const form = useForm<ProductorInputs>({
         initialValues: {
@@ -58,8 +58,8 @@ export function ProductorModal({
     });
 
     const roleSelect = useMemo(() => {
-        return allRoles?.map((role) => ({ value: String(role.name), label: role.name }));
+        return loggedUser?.user?.roles?.map((role) => ({ value: String(role.name), label: role.name }));
-    }, [allRoles]);
+    }, [loggedUser?.user?.roles]);
 
     return (
         <Modal opened={opened} onClose={onClose} title={t("create productor", { capfirst: true })}>

frontend/src/components/Shipments/Modal/index.tsx

@@ -13,7 +13,7 @@ import { IconCancel, IconEdit, IconPlus } from "@tabler/icons-react";
 import { useForm } from "@mantine/form";
 import { useMemo } from "react";
 import { type Shipment, type ShipmentInputs } from "@/services/resources/shipments";
-import { useGetForms, useGetProductors, useGetProducts } from "@/services/api";
+import { useGetReferentForms, useGetProductors, useGetProducts } from "@/services/api";
 
 export type ShipmentModalProps = ModalBaseProps & {
     currentShipment?: Shipment;
@@ -43,7 +43,7 @@ export default function ShipmentModal({
         },
     });
 
-    const { data: allForms } = useGetForms();
+    const { data: allForms } = useGetReferentForms();
     const { data: allProducts } = useGetProducts(new URLSearchParams("types=1"));
     const { data: allProductors } = useGetProductors();
 

frontend/src/pages/Forms/index.tsx

@@ -1,5 +1,5 @@
 import { Stack, Loader, Title, Group, ActionIcon, Tooltip, Table, ScrollArea } from "@mantine/core";
-import { useCreateForm, useEditForm, useGetForm, useGetForms } from "@/services/api";
+import { useCreateForm, useEditForm, useGetForm, useGetReferentForms } from "@/services/api";
 import { t } from "@/config/i18n";
 import { useLocation, useNavigate, useSearchParams } from "react-router";
 import { IconPlus } from "@tabler/icons-react";
@@ -28,12 +28,12 @@ export function Forms() {
         navigate(`/dashboard/forms${searchParams ? `?${searchParams.toString()}` : ""}`);
     }, [navigate, searchParams]);
 
-    const { isPending, data } = useGetForms(searchParams);
+    const { isPending, data } = useGetReferentForms(searchParams);
     const { data: currentForm } = useGetForm(Number(editId), {
         enabled: !!editId,
     });
 
-    const { data: allForms } = useGetForms();
+    const { data: allForms } = useGetReferentForms();
 
     const seasons = useMemo(() => {
         return allForms
@@ -148,6 +148,7 @@ export function Forms() {
                 <Table striped>
                     <Table.Thead>
                         <Table.Tr>
+                            <Table.Th>{t("visible", { capfirst: true })}</Table.Th>
                             <Table.Th>{t("name", { capfirst: true })}</Table.Th>
                             <Table.Th>{t("type", { capfirst: true })}</Table.Th>
                             <Table.Th>{t("start", { capfirst: true })}</Table.Th>

frontend/src/services/api.ts

@@ -330,6 +330,15 @@ export function useGetForms(filters?: URLSearchParams): UseQueryResult<Form[], E
     });
 }
 
+export function useGetReferentForms(filters?: URLSearchParams): UseQueryResult<Form[], Error> {
+    const queryString = filters?.toString();
+    return useQuery<Form[]>({
+        queryKey: ["forms", queryString],
+        queryFn: () =>
+            fetchWithAuth(`${Config.backend_uri}/forms/referents${filters ? `?${queryString}` : ""}`).then((res) => res.json()),
+    });
+}
+
 export function useCreateForm() {
     const queryClient = useQueryClient();
 
@@ -711,7 +720,6 @@ export function useGetContractFile() {
     });
 }
 
-
 export function useGetContractFileTemplate() {
     return useMutation({
         mutationFn: async (form_id: number) => {

frontend/src/services/resources/forms.ts

@@ -12,6 +12,7 @@ export type Form = {
     referer: User;
     shipments: Shipment[];
     minimum_shipment_value: number | null;
+    visible: boolean;
 };
 
 export type FormCreate = {
@@ -22,6 +23,7 @@ export type FormCreate = {
     productor_id: number;
     referer_id: number;
     minimum_shipment_value: number | null;
+    visible: boolean;
 };
 
 export type FormEdit = {
@@ -32,6 +34,7 @@ export type FormEdit = {
     productor_id?: number | null;
     referer_id?: number | null;
     minimum_shipment_value: number | null;
+    visible: boolean;
 };
 
 export type FormEditPayload = {
@@ -47,4 +50,5 @@ export type FormInputs = {
     productor_id: string;
     referer_id: string;
     minimum_shipment_value: number | string | null;
+    visible: boolean;
 };