feat(app): add a demo mode

README.md

@@ -129,6 +129,7 @@ To create the first user, open the container's console using Unraid's UI, by cli
 | ENABLE_SOFT_DELETE            | true\|false | false                             | Whether to enable transactions soft delete, if enabled, deleted transactions will remain in the database. Useful for imports and avoiding duplicate entries.                                                                             |
 | KEEP_DELETED_TRANSACTIONS_FOR | int         | 365                               | Time in days to keep soft deleted transactions for. If 0, will keep all transactions indefinitely. Only works if ENABLE_SOFT_DELETE is true.                                                                                             |
 | TASK_WORKERS                  | int         | 1                                 | How many workers to have for async tasks. One should be enough for most use cases                                                                                                                                                        |
+| DEMO                          | true\|false         | false                             | If demo mode is enabled.                                                                                                                                                                                                                 |
 | ADMIN_EMAIL                   | string         | None                              | Automatically creates an admin account with this email. Must have `ADMIN_PASSWORD` also set.                                                                                                                                             |
 | ADMIN_PASSWORD                | string         | None                              | Automatically creates an admin account with this password. Must have `ADMIN_EMAIL` also set.                                                                                                                                             |
 

app/WYGIWYH/settings.py

@@ -394,3 +394,4 @@ PWA_SERVICE_WORKER_PATH = BASE_DIR / "templates" / "pwa" / "serviceworker.js"
 ENABLE_SOFT_DELETE = os.getenv("ENABLE_SOFT_DELETE", "false").lower() == "true"
 KEEP_DELETED_TRANSACTIONS_FOR = int(os.getenv("KEEP_DELETED_ENTRIES_FOR", "365"))
 APP_VERSION = os.getenv("APP_VERSION", "unknown")
+DEMO = os.getenv("DEMO_MODE", "false").lower() == "true"

app/apps/common/decorators/demo.py

@@ -0,0 +1,15 @@
+from functools import wraps
+
+from django.conf import settings
+from django.core.exceptions import PermissionDenied
+
+
+def disabled_on_demo(view):
+    @wraps(view)
+    def _view(request, *args, **kwargs):
+        if settings.DEMO and not request.user.is_superuser:
+            raise PermissionDenied
+
+        return view(request, *args, **kwargs)
+
+    return _view

app/apps/common/tasks.py

@@ -1,7 +1,9 @@
 import logging
 
 from asgiref.sync import sync_to_async
+from django.conf import settings
 from django.core import management
+from django.db import DEFAULT_DB_ALIAS
 
 from procrastinate import builtin_tasks
 from procrastinate.contrib.django import app
@@ -40,3 +42,39 @@ async def remove_expired_sessions(timestamp=None):
             "Error while executing 'remove_expired_sessions' task",
             exc_info=True,
         )
+
+
+@app.periodic(cron="0 6 * * *")
+@app.task(name="reset_demo_data")
+def reset_demo_data():
+    """
+    Wipes the database and loads fresh demo data if DEMO mode is active.
+    Runs daily at 6:00 AM.
+    """
+    if not settings.DEMO:
+        return  # Exit if not in demo mode
+
+    logger.info("Demo mode active. Starting daily data reset...")
+
+    try:
+        # 1. Flush the database (wipe all data)
+        logger.info("Flushing the database...")
+        # Using --noinput prevents prompts. Specify database if not default.
+        management.call_command(
+            "flush", "--noinput", database=DEFAULT_DB_ALIAS, verbosity=1
+        )
+        logger.info("Database flushed successfully.")
+
+        # 2. Load data from the fixture
+        fixture_name = "fixtures/demo_data.json"
+        logger.info(f"Loading data from fixture: {fixture_name}...")
+        management.call_command(
+            "loaddata", fixture_name, database=DEFAULT_DB_ALIAS, verbosity=1
+        )
+        logger.info(f"Data loaded successfully from {fixture_name}.")
+
+        logger.info("Daily demo data reset completed.")
+
+    except Exception as e:
+        logger.exception(f"Error during daily demo data reset: {e}")
+        raise

app/apps/currencies/views/exchange_rates_services.py

@@ -11,9 +11,11 @@ from apps.common.decorators.htmx import only_htmx
 from apps.currencies.forms import ExchangeRateForm, ExchangeRateServiceForm
 from apps.currencies.models import ExchangeRate, ExchangeRateService
 from apps.currencies.tasks import manual_fetch_exchange_rates
+from apps.common.decorators.demo import disabled_on_demo
 
 
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def exchange_rates_services_index(request):
     return render(
@@ -24,6 +26,7 @@ def exchange_rates_services_index(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def exchange_rates_services_list(request):
     services = ExchangeRateService.objects.all()
@@ -37,6 +40,7 @@ def exchange_rates_services_list(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def exchange_rate_service_add(request):
     if request.method == "POST":
@@ -63,6 +67,7 @@ def exchange_rate_service_add(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def exchange_rate_service_edit(request, pk):
     service = get_object_or_404(ExchangeRateService, id=pk)
@@ -91,6 +96,7 @@ def exchange_rate_service_edit(request, pk):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def exchange_rate_service_delete(request, pk):
     service = get_object_or_404(ExchangeRateService, id=pk)
@@ -109,6 +115,7 @@ def exchange_rate_service_delete(request, pk):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def exchange_rate_service_force_fetch(request):
     manual_fetch_exchange_rates.defer()

app/apps/export_app/views.py

@@ -41,11 +41,13 @@ from apps.export_app.resources.transactions import (
     RecurringTransactionResource,
 )
 from apps.export_app.resources.users import UserResource
+from apps.common.decorators.demo import disabled_on_demo
 
 logger = logging.getLogger()
 
 
 @login_required
+@disabled_on_demo
 @user_passes_test(lambda u: u.is_superuser)
 @require_http_methods(["GET"])
 def export_index(request):
@@ -53,6 +55,7 @@ def export_index(request):
 
 
 @login_required
+@disabled_on_demo
 @user_passes_test(lambda u: u.is_superuser)
 @require_http_methods(["GET", "POST"])
 def export_form(request):
@@ -182,6 +185,7 @@ def export_form(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @user_passes_test(lambda u: u.is_superuser)
 @require_http_methods(["GET", "POST"])
 def import_form(request):

app/apps/import_app/views.py

@@ -13,9 +13,11 @@ from apps.import_app.forms import ImportRunFileUploadForm, ImportProfileForm
 from apps.import_app.models import ImportRun, ImportProfile
 from apps.import_app.services import PresetService
 from apps.import_app.tasks import process_import
+from apps.common.decorators.demo import disabled_on_demo
 
 
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def import_presets_list(request):
     presets = PresetService.get_all_presets()
@@ -27,6 +29,7 @@ def import_presets_list(request):
 
 
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_profile_index(request):
     return render(
@@ -37,6 +40,7 @@ def import_profile_index(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_profile_list(request):
     profiles = ImportProfile.objects.all()
@@ -50,6 +54,7 @@ def import_profile_list(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_profile_add(request):
     message = request.POST.get("message", None)
@@ -85,6 +90,7 @@ def import_profile_add(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_profile_edit(request, profile_id):
     profile = get_object_or_404(ImportProfile, id=profile_id)
@@ -114,6 +120,7 @@ def import_profile_edit(request, profile_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def import_profile_delete(request, profile_id):
     profile = ImportProfile.objects.get(id=profile_id)
@@ -132,6 +139,7 @@ def import_profile_delete(request, profile_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_runs_list(request, profile_id):
     profile = ImportProfile.objects.get(id=profile_id)
@@ -147,6 +155,7 @@ def import_runs_list(request, profile_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_run_log(request, profile_id, run_id):
     run = ImportRun.objects.get(profile__id=profile_id, id=run_id)
@@ -160,6 +169,7 @@ def import_run_log(request, profile_id, run_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def import_run_add(request, profile_id):
     profile = ImportProfile.objects.get(id=profile_id)
@@ -202,6 +212,7 @@ def import_run_add(request, profile_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def import_run_delete(request, profile_id, run_id):
     run = ImportRun.objects.get(profile__id=profile_id, id=run_id)

app/apps/rules/views.py

@@ -18,9 +18,11 @@ from apps.rules.models import (
 )
 from apps.common.models import SharedObject
 from apps.common.forms import SharedObjectForm
+from apps.common.decorators.demo import disabled_on_demo
 
 
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def rules_index(request):
     return render(
@@ -31,6 +33,7 @@ def rules_index(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def rules_list(request):
     transaction_rules = TransactionRule.objects.all().order_by("id")
@@ -43,6 +46,7 @@ def rules_list(request):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_toggle_activity(request, transaction_rule_id, **kwargs):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -65,6 +69,7 @@ def transaction_rule_toggle_activity(request, transaction_rule_id, **kwargs):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_add(request, **kwargs):
     if request.method == "POST":
@@ -91,6 +96,7 @@ def transaction_rule_add(request, **kwargs):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_edit(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -129,6 +135,7 @@ def transaction_rule_edit(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_view(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -142,6 +149,7 @@ def transaction_rule_view(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def transaction_rule_delete(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -166,6 +174,7 @@ def transaction_rule_delete(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET"])
 def transaction_rule_take_ownership(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -187,6 +196,7 @@ def transaction_rule_take_ownership(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_share(request, pk):
     obj = get_object_or_404(TransactionRule, id=pk)
@@ -225,6 +235,7 @@ def transaction_rule_share(request, pk):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_action_add(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -252,6 +263,7 @@ def transaction_rule_action_add(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def transaction_rule_action_edit(request, transaction_rule_action_id):
     transaction_rule_action = get_object_or_404(
@@ -289,6 +301,7 @@ def transaction_rule_action_edit(request, transaction_rule_action_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def transaction_rule_action_delete(request, transaction_rule_action_id):
     transaction_rule_action = get_object_or_404(
@@ -309,6 +322,7 @@ def transaction_rule_action_delete(request, transaction_rule_action_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def update_or_create_transaction_rule_action_add(request, transaction_rule_id):
     transaction_rule = get_object_or_404(TransactionRule, id=transaction_rule_id)
@@ -340,6 +354,7 @@ def update_or_create_transaction_rule_action_add(request, transaction_rule_id):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["GET", "POST"])
 def update_or_create_transaction_rule_action_edit(request, pk):
     linked_action = get_object_or_404(UpdateOrCreateTransactionRuleAction, id=pk)
@@ -374,6 +389,7 @@ def update_or_create_transaction_rule_action_edit(request, pk):
 
 @only_htmx
 @login_required
+@disabled_on_demo
 @require_http_methods(["DELETE"])
 def update_or_create_transaction_rule_action_delete(request, pk):
     linked_action = get_object_or_404(UpdateOrCreateTransactionRuleAction, id=pk)

app/fixtures/demo_data.json

@@ -0,0 +1,34 @@
+[
+{
+    "model": "users.user",
+    "pk": 1,
+    "fields": {
+        "password": "pbkdf2_sha256$870000$kUmqeqdenjc2yFS8qbniwS$7qOMXzKG+yFmezdjhptkwuMJlqlZnQHXgAnonWurpBk=",
+        "last_login": "2025-03-31T03:22:25Z",
+        "is_superuser": false,
+        "first_name": "Demo",
+        "last_name": "User",
+        "is_staff": false,
+        "is_active": true,
+        "date_joined": "2025-03-31T03:21:04Z",
+        "email": "demo@demo.com",
+        "groups": [],
+        "user_permissions": []
+    }
+},
+{
+    "model": "users.usersettings",
+    "pk": 1,
+    "fields": {
+        "user": 1,
+        "hide_amounts": false,
+        "mute_sounds": false,
+        "date_format": "SHORT_DATE_FORMAT",
+        "datetime_format": "SHORT_DATETIME_FORMAT",
+        "number_format": "AA",
+        "language": "auto",
+        "timezone": "auto",
+        "start_page": "MONTHLY_OVERVIEW"
+    }
+}
+]

app/templates/includes/scripts/hyperscript/htmx_error_handler.html

@@ -2,13 +2,28 @@
 <script type="text/hyperscript">
 behavior htmx_error_handler
   on htmx:responseError or htmx:afterRequest[detail.failed] or htmx:sendError queue none
-      call Swal.fire({title: '{% trans 'Something went wrong loading your data' %}',
-                      text: '{% trans 'Try reloading the page or check the console for more information.' %}',
+    -- Check if the event detail contains the xhr object and the status is 403
+    if event.detail.xhr.status == 403 then
+      call Swal.fire({
+        title: '{% trans "Access Denied" %}',
+        text: '{% trans "You do not have permission to perform this action or access this resource." %}',
+        icon: 'warning',
+        customClass: {
+          confirmButton: 'btn btn-warning' -- Optional: different button style
+        },
+        buttonsStyling: true
+      })
+    else
+      call Swal.fire({
+        title: '{% trans "Something went wrong loading your data" %}',
+        text: '{% trans "Try reloading the page or check the console for more information." %}',
         icon: 'error',
         customClass: {
           confirmButton: 'btn btn-primary'
         },
-                      buttonsStyling: true})
+        buttonsStyling: true
+      })
+    end
     then log event
     then halt the event
 end

app/templates/layouts/base.html

@@ -1,3 +1,4 @@
+{% load settings %}
 {% load pwa %}
 {% load formats %}
 {% load i18n %}
@@ -32,6 +33,16 @@
      hx-headers='{"X-CSRFToken": "{{ csrf_token }}"}'>
   {% include 'includes/navbar.html' %}
 
+  {% settings "DEMO" as demo_mode %}
+  {% if demo_mode %}
+  <div class="px-3 m-0" id="demo-mode-alert" hx-preserve>
+    <div class="alert alert-warning alert-dismissible fade show my-3" role="alert">
+      <strong>{% trans 'This is a demo!' %}</strong> {% trans 'Any data you add here will be wiped in 24hrs or less' %}
+      <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+    </div>
+  </div>
+  {% endif %}
+
   <div id="content">
     {% block content %}{% endblock %}
   </div>

app/templates/users/login.html

@@ -1,4 +1,6 @@
 {% extends "layouts/base_auth.html" %}
+{% load i18n %}
+{% load settings %}
 {% load crispy_forms_tags %}
 
 {% block title %}Login{% endblock %}
@@ -8,9 +10,20 @@
     <div class="container">
       <div class="row vh-100 d-flex justify-content-center align-items-center">
         <div class="col-md-6 col-xl-4 col-12">
+          {% settings "DEMO" as demo_mode %}
+          {% if demo_mode %}
+            <div class="card shadow mb-3">
+              <div class="card-body">
+                <h1 class="h5 card-title text-center mb-4">{% trans "Welcome to WYGIWYH's demo!" %}</h1>
+                <p>{% trans 'Use the credentials below to login' %}:</p>
+                <p>{% trans 'E-mail' %}: <span class="badge text-bg-secondary user-select-all">demo@demo.com</span></p>
+                <p>{% trans 'Password' %}: <span class="badge text-bg-secondary user-select-all">wygiwyhdemo</span></p>
+              </div>
+            </div>
+          {% endif %}
           <div class="card shadow-lg">
             <div class="card-body">
-                          <h2 class="card-title text-center mb-4">Login</h2>
+              <h1 class="h2 card-title text-center mb-4">Login</h1>
               {% crispy form %}
             </div>
           </div>