Changeset 76ebb1b in OpenWorkouts-current

Timestamp:

Feb 18, 2019, 12:54:45 PM (5 years ago)

Author:

Borja Lopez <borja@…>

Branches:

current, feature/docs, master

Children:

4af38e8

Parents:

d6da99e

Message:

(#29) Add user verification by email on signup.

From now on, when a new user signs up, we set the account into an "unverified"
state. In order to complete the signup procedure, the user has to click on a
link we send by email to the email address provided on signup.

IMPORTANT: A new dependency has been added, pyramid_mailer, so remember to
install it in any existing openworkouts environment (this is done automatically
if you use the ./bin/start script):

pip install pyramid_mailer

Files:

• development.ini (modified) (1 diff)
• ow/__init__.py (modified) (1 diff)
• ow/mail.py (added)
• ow/migrations/1.py (added)
• ow/models/user.py (modified) (1 diff)
• ow/templates/mail_verify_account.pt (added)
• ow/templates/verify.pt (added)
• ow/tests/test_mail.py (added)
• ow/tests/views/test_user.py (modified) (6 diffs)
• ow/utilities.py (modified) (2 diffs)
• ow/views/user.py (modified) (4 diffs)
• setup.py (modified) (2 diffs)

development.ini

@@ -30 +30 @@
 {BT]KrSx`b3pmRj<Z&e3QP|fgPGEZT@\#
 auth.secret = l9|^@~wQoVKPQoI`GHK5M9ps@S7L:QNU?pF}.jI(9RWZVc<EM)aQv/j~l\#xC++;5
+
+# pyramid_mailer configuration
+mail.default_sender = noreply@openworkouts.org
+mail.queue_path = %(here)s/var/spool/mqueue
+mail.queue_processor_lock = %(here)s/var/run/mail-queue-processor.lock
+mail.host = mail.openworkouts.org
+mail.tls = True
+mail.username = noreply@openworkouts.org
+mail.password = PASSWORD
 
 

ow/__init__.py

@@ -37 +37 @@
     config.include('pyramid_retry')
     config.include('pyramid_zodbconn')
+    config.include('pyramid_mailer')
     config.add_static_view('static', 'static', cache_max_age=3600)
     config.add_translation_dirs(

ow/models/user.py

@@ -39 +39 @@
         self.__password = None
         self.last_workout_id = 0
+        # has this user verified his account?
+        self.verified = False
+        self.verification_token = None
         super(User, self).__init__()
 

ow/tests/views/test_user.py

@@ -6 +6 @@
 from unittest.mock import Mock, patch
 from io import BytesIO
+from uuid import UUID
 
 import pytest
@@ -112 +113 @@
             })
         return request
+
+    @patch('ow.views.user.remember')
+    def test_verify_already_verified(self, remember, dummy_request, john):
+        john.verified = True
+        response = user_views.verify(john, dummy_request)
+        assert isinstance(response, HTTPFound)
+        assert response.location == dummy_request.resource_url(john)
+        # user was not authenticated
+        assert not remember.called
+        # verified status did not change
+        assert john.verified
+
+    @patch('ow.views.user.remember')
+    def test_verify_no_subpath(self, remember, dummy_request, john):
+        response = user_views.verify(john, dummy_request)
+        # the verify info page is rendered, we don't pass anything to the
+        # rendering context
+        assert response == {}
+        # user was not authenticated
+        assert not remember.called
+        # verified status did not change
+        assert not john.verified
+
+    def test_verify_subpath_not_verified(self, dummy_request, john):
+        dummy_request.subpath = ['not_the_token']
+        response = user_views.verify(john, dummy_request)
+        # the verify info page is rendered, we don't pass anything to the
+        # rendering context
+        assert response == {}
+
+    @patch('ow.views.user.remember')
+    def test_verify_wrong_token(self, remember, dummy_request, john):
+        token = 'some-uuid4'
+        john.verification_token = 'some-other-uuid4'
+        dummy_request.subpath = [token]
+        response = user_views.verify(john, dummy_request)
+        # the verify info page is rendered, we don't pass anything to the
+        # rendering context
+        assert response == {}
+        # user was not authenticated
+        assert not remember.called
+        # verified status did not change, neither did the token
+        assert not john.verified
+        assert john.verification_token == 'some-other-uuid4'
+
+    @patch('ow.views.user.remember')
+    def test_verify_verifying(self, remember, dummy_request, john):
+        token = 'some-uuid4'
+        john.verification_token = token
+        dummy_request.subpath = [token]
+        response = user_views.verify(john, dummy_request)
+        # redirect to user page
+        assert isinstance(response, HTTPFound)
+        assert response.location == dummy_request.resource_url(john)
+        # user was authenticated after verified
+        remember.assert_called_with(dummy_request, str(john.uid))
+        # user has been verified
+        assert john.verified
 
     def test_dashboard_redirect_unauthenticated(self, root):
@@ -369 +428 @@
         request.POST['email'] = 'john.doe@example.net'
         request.POST['password'] = 'badpassword'
+        # verify the user first
+        request.root.users[0].verified = True
         response = user_views.login(request.root, request)
         assert response['message'] == u'Wrong password'
 
     @patch('ow.views.user.remember')
-    def test_login_post_ok(self, rem, dummy_request, john):
+    def test_login_post_unverified(self, rem, dummy_request, john):
         request = dummy_request
         request.method = 'POST'
@@ -379 +440 @@
         request.POST['email'] = 'john.doe@example.net'
         request.POST['password'] = 's3cr3t'
+        response = user_views.login(request.root, request)
+        assert response['message'] == u'You have to verify your account first'
+
+    @patch('ow.views.user.remember')
+    def test_login_post_ok(self, rem, dummy_request, john):
+        request = dummy_request
+        request.method = 'POST'
+        request.POST['submit'] = True
+        request.POST['email'] = 'john.doe@example.net'
+        request.POST['password'] = 's3cr3t'
+        # verify the user first
+        john.verified = True
         response = user_views.login(request.root, request)
         assert isinstance(response, HTTPFound)
@@ -620 +693 @@
         assert response['form'].errorlist() == ''
 
-    def test_signup_post_ok(self, signup_post_request):
+    @patch('ow.views.user.send_verification_email')
+    def test_signup_post_ok(self, sve, signup_post_request):
         request = signup_post_request
         assert 'jack.black@example.net' not in request.root.emails
@@ -629 +703 @@
         assert 'jack.black@example.net' in request.root.emails
         assert 'JackBlack' in request.root.all_nicknames
+        # user is in "unverified" state
+        user = request.root.get_user_by_email('jack.black@example.net')
+        assert not user.verified
+        assert isinstance(user.verification_token, UUID)
+        # also, we sent an email to that user
+        sve.assert_called_once_with(request, user)
 
     def test_signup_missing_required(self, signup_post_request):

ow/utilities.py

@@ -8 +8 @@
 from decimal import Decimal
 from shutil import copyfileobj
+from uuid import uuid4
 
 from unidecode import unidecode
@@ -20 +21 @@
 
 log = logging.getLogger(__name__)
+
+
+def get_verification_token():
+    """
+    Generate a new uuid4 verification token we can give a user for
+    verification purposes.
+    uuid4 is a standard that generates a randomly generated token,
+    optimized for a very low chance of collisions. But even if
+    we had a collision, it wouldn't matter - it's simple some users
+    getting the same token in their verification mail.
+    """
+    return uuid4()
 
 

ow/views/user.py

@@ -22 +22 @@
 from ..models.root import OpenWorkouts
 from ..views.renderers import OWFormRenderer
-from ..utilities import timedelta_to_hms
+from ..utilities import timedelta_to_hms, get_verification_token
+from ..mail import send_verification_email
 
 _ = TranslationStringFactory('OpenWorkouts')
@@ -59 +60 @@
         user = context.get_user_by_email(email)
         if user:
-            password = request.POST.get('password', None)
-            if password is not None and user.check_password(password):
-                headers = remember(request, str(user.uid))
-                redirect_url = return_to or request.resource_url(user)
-                return HTTPFound(location=redirect_url, headers=headers)
+            if user.verified:
+                password = request.POST.get('password', None)
+                if password is not None and user.check_password(password):
+                    headers = remember(request, str(user.uid))
+                    redirect_url = return_to or request.resource_url(user)
+                    return HTTPFound(location=redirect_url, headers=headers)
+                else:
+                    message = _('Wrong password')
             else:
-                message = _('Wrong password')
+                message = _('You have to verify your account first')
         else:
             message = _('Wrong email address')
@@ -94 +98 @@
     if 'submit' in request.POST and form.validate():
         user = form.bind(User(), exclude=['password_confirm'])
+        user.verified = False
+        user.verification_token = get_verification_token()
         context.add_user(user)
+        # send a verification link to the user email address
+        send_verification_email(request, user)
         # Send to login
         return HTTPFound(location=request.resource_url(context))
@@ -101 +109 @@
         'form': OWFormRenderer(form)
     }
+
+
+@view_config(
+    context=User,
+    name="verify",
+    renderer='ow:templates/verify.pt')
+def verify(context, request):
+    redirect_url = request.resource_url(context)
+
+    # user has been verified already, send to dashboard
+    if getattr(context, 'verified', False):
+        return HTTPFound(location=redirect_url)
+
+    # Look for a verification token, then check if we can verify the user with
+    # that token
+    verified = len(request.subpath) > 0
+    token = getattr(context, 'verification_token', False)
+    verified = verified and token and str(token) == request.subpath[0]
+    if verified:
+        # verified, log in automatically and send to the dashboard
+        context.verified = True
+        headers = remember(request, str(context.uid))
+        return HTTPFound(location=redirect_url, headers=headers)
+
+    # if we can not verify the user, show a page with some info about it
+    return {}
 
 

setup.py

@@ -17 +17 @@
     'pyramid_tm',
     'pyramid_zodbconn',
+    'pyramid_simpleform==0.7dev0',  # version needed for python3
+    'pyramid_mailer',
     'transaction',
     'ZODB3',
@@ -25 +27 @@
     'bcrypt',
     'FormEncode',
-    'pyramid_simpleform==0.7dev0',  # version needed for python3
     'unidecode',
     'gpxpy',