ugh

.ds.baseline

@@ -527,7 +527,7 @@
         "filename": "tests/app/main/views/organizations/test_organization_invites.py",
         "hashed_secret": "bdbb156d25d02fd7792865824201dda1c60f4473",
         "is_verified": false,
-        "line_number": 265,
+        "line_number": 274,
         "is_secret": false
       },
       {
@@ -535,7 +535,7 @@
         "filename": "tests/app/main/views/organizations/test_organization_invites.py",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 273,
+        "line_number": 282,
         "is_secret": false
       }
     ],
@@ -545,7 +545,7 @@
         "filename": "tests/app/main/views/test_accept_invite.py",
         "hashed_secret": "07f0a6c13923fc3b5f0c57ffa2d29b715eb80d71",
         "is_verified": false,
-        "line_number": 607,
+        "line_number": 626,
         "is_secret": false
       }
     ],
@@ -565,7 +565,7 @@
         "filename": "tests/app/main/views/test_register.py",
         "hashed_secret": "bdbb156d25d02fd7792865824201dda1c60f4473",
         "is_verified": false,
-        "line_number": 116,
+        "line_number": 122,
         "is_secret": false
       },
       {
@@ -573,7 +573,7 @@
         "filename": "tests/app/main/views/test_register.py",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 192,
+        "line_number": 201,
         "is_secret": false
       },
       {
@@ -581,7 +581,7 @@
         "filename": "tests/app/main/views/test_register.py",
         "hashed_secret": "bb5b7caa27d005d38039e3797c3ddb9bcd22c3c8",
         "is_verified": false,
-        "line_number": 260,
+        "line_number": 274,
         "is_secret": false
       }
     ],
@@ -591,7 +591,7 @@
         "filename": "tests/app/main/views/test_sign_in.py",
         "hashed_secret": "8b8b69116ee882b5e987e330f55db81aba0636f9",
         "is_verified": false,
-        "line_number": 90,
+        "line_number": 97,
         "is_secret": false
       }
     ],
@@ -601,7 +601,7 @@
         "filename": "tests/app/main/views/test_two_factor.py",
         "hashed_secret": "dc66ad927c29e31c6c374231f57a4684b0687bfe",
         "is_verified": false,
-        "line_number": 267,
+        "line_number": 290,
         "is_secret": false
       }
     ],
@@ -702,5 +702,5 @@
       }
     ]
   },
-  "generated_at": "2024-06-11T22:26:18Z"
+  "generated_at": "2024-07-11T16:37:23Z"
 }

app/main/views/dashboard.py

@@ -36,7 +36,7 @@ from notifications_utils.recipients import format_phone_number_human_readable
 
 @socketio.on("fetch_daily_stats")
 def handle_fetch_daily_stats():
-    service_id = session.get('service_id')
+    service_id = session.get("service_id")
     if service_id:
         date_range = get_stats_date_range()
         daily_stats = service_api_client.get_service_notification_statistics_by_day(

app/main/views/sign_out.py

@@ -1,7 +1,7 @@
 import os
 
 import requests
-from flask import current_app, redirect, url_for
+from flask import current_app, redirect, session, url_for
 from flask_login import current_user
 
 from app.main import main
@@ -26,11 +26,19 @@ def _sign_out_at_login_dot_gov():
 @main.route("/sign-out", methods=(["GET", "POST"]))
 def sign_out():
     # An AnonymousUser does not have an id
-    current_app.logger.info("HIT THE REGULAR SIGN OUT")
+
     if current_user.is_authenticated:
         # TODO This doesn't work yet, due to problems above.
+        current_user.deactivate()
+
+        session.clear()
+
         current_user.sign_out()
+
+        session.permanent = False
+
         login_dot_gov_logout_url = os.getenv("LOGIN_DOT_GOV_LOGOUT_URL")
         if login_dot_gov_logout_url:
+            current_app.config["SESSION_PERMANENT"] = False
             return redirect(login_dot_gov_logout_url)
     return redirect(url_for("main.index"))

app/models/user.py

@@ -147,6 +147,13 @@ class User(JSONModel, UserMixin):
         else:
             return self
 
+    def deactivate(self):
+        if self.is_active:
+            user_data = user_api_client.deactivate_user(self.id)
+            return self.__class__(user_data["data"])
+        else:
+            return self
+
     def login(self):
         login_user(self)
         session["user_id"] = self.id

app/notify_client/__init__.py

@@ -54,16 +54,23 @@ class NotifyAdminAPIClient(BaseAPIClient):
         ):
             abort(403)
 
+    def check_inactive_user(self):
+        if not current_user or not current_user.is_active:
+            abort(403)
+
     def post(self, *args, **kwargs):
         self.check_inactive_service()
+        self.check_inactive_user()
         return super().post(*args, **kwargs)
 
     def put(self, *args, **kwargs):
         self.check_inactive_service()
+        self.check_inactive_user()
         return super().put(*args, **kwargs)
 
     def delete(self, *args, **kwargs):
         self.check_inactive_service()
+        self.check_inactive_user()
         return super().delete(*args, **kwargs)
 
 

app/notify_client/user_api_client.py

@@ -217,6 +217,10 @@ class UserApiClient(NotifyAdminAPIClient):
     def activate_user(self, user_id):
         return self.post("/user/{}/activate".format(user_id), data=None)
 
+    @cache.delete("user-{user_id}")
+    def deactivate_user(self, user_id):
+        return self.post("/user/{}/deactivate".format(user_id), data=None)
+
     def send_change_email_verification(self, user_id, new_email):
         endpoint = "/user/{}/change-email-verification".format(user_id)
         data = {"email": new_email}

tests/app/main/test_errorhandlers.py

@@ -68,6 +68,7 @@ def test_csrf_redirects_to_sign_in_page_if_not_signed_in(client_request, mocker)
     csrf_err = CSRFError("400 Bad Request: The CSRF tokens do not match.")
     mocker.patch("app.main.views.index.render_template", side_effect=csrf_err)
 
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get_url(
         "/privacy",

tests/app/main/views/accounts/test_choose_accounts.py

@@ -289,9 +289,10 @@ def test_choose_account_should_not_show_back_to_service_link_if_no_service_in_se
 
 
 def test_choose_account_should_not_show_back_to_service_link_if_not_signed_in(
-    client_request,
-    mock_get_service,
+    client_request, mock_get_service, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:

tests/app/main/views/accounts/test_show_accounts_or_dashboard.py

@@ -107,9 +107,10 @@ def test_show_accounts_or_dashboard_doesnt_redirect_to_org_dashboard_if_user_not
 
 
 def test_show_accounts_or_dashboard_redirects_if_not_logged_in(
-    client_request,
-    notify_admin,
+    client_request, notify_admin, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         "main.show_accounts_or_dashboard",

tests/app/main/views/organizations/test_organization_invites.py

@@ -116,6 +116,7 @@ def test_cancelled_invite_opened_by_user(
     mock_get_organization,
     fake_uuid,
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mock_get_user = mocker.patch(
         "app.user_api_client.get_user", return_value=api_user_active
@@ -145,8 +146,9 @@ def test_cancelled_invite_opened_by_user(
 
 
 def test_user_invite_already_accepted(
-    client_request, mock_check_org_accepted_invite_token
+    client_request, mock_check_org_accepted_invite_token, mocker
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         "main.accept_org_invite",
@@ -169,7 +171,9 @@ def test_existing_user_invite_already_is_member_of_organization(
     mock_accept_org_invite,
     mock_add_user_to_organization,
     mock_update_user_attribute,
+    mocker,
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mock_update_user_attribute.reset_mock()
     client_request.get(
@@ -201,7 +205,9 @@ def test_existing_user_invite_not_a_member_of_organization(
     mock_accept_org_invite,
     mock_add_user_to_organization,
     mock_update_user_attribute,
+    mocker,
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mock_update_user_attribute.reset_mock()
     client_request.get(
@@ -232,7 +238,9 @@ def test_user_accepts_invite(
     mock_check_org_invite_token,
     mock_dont_get_user_by_email,
     mock_get_users_for_organization,
+    mocker,
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         "main.accept_org_invite",
@@ -246,8 +254,9 @@ def test_user_accepts_invite(
 
 
 def test_registration_from_org_invite_404s_if_user_not_in_session(
-    client_request,
+    client_request, mocker
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         "main.register_from_org_invite",
@@ -262,7 +271,7 @@ def test_registration_from_org_invite_404s_if_user_not_in_session(
             {
                 "name": "Bad Mobile",
                 "mobile_number": "not good",
-                "password": "validPassword!",
+                "password": "validPassword!",  # noqa
             },
             "The string supplied did not seem to be a phone number",
         ),
@@ -270,7 +279,7 @@ def test_registration_from_org_invite_404s_if_user_not_in_session(
             {
                 "name": "Bad Password",
                 "mobile_number": "+12021234123",
-                "password": "password",
+                "password": "password",  # noqa
             },
             "Choose a password that’s harder to guess",
         ),
@@ -282,7 +291,9 @@ def test_registration_from_org_invite_has_bad_data(
     data,
     error,
     mock_get_invited_org_user_by_id,
+    mocker,
 ):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:

tests/app/main/views/test_accept_invite.py

@@ -133,6 +133,8 @@ def test_existing_user_accept_invite_calls_api_and_redirects_to_dashboard(
     mock_get_user,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     expected_service = service_one["id"]
     expected_permissions = {
@@ -176,6 +178,8 @@ def test_existing_user_with_no_permissions_or_folder_permissions_accept_invite(
     mock_get_user,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     expected_service = service_one["id"]
@@ -205,6 +209,8 @@ def test_if_existing_user_accepts_twice_they_redirect_to_sign_in(
     mock_get_service,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     # Logging out updates the current session ID to `None`
     mock_update_user_attribute.reset_mock()
@@ -321,6 +327,8 @@ def test_existing_user_of_service_get_redirected_to_signin(
     mock_accept_invite,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     sample_invite["email_address"] = api_user_active["email_address"]
     mocker.patch("app.models.user.Users.client_method", return_value=[api_user_active])
@@ -355,6 +363,8 @@ def test_accept_invite_redirects_if_api_raises_an_error_that_they_are_already_pa
     mock_get_user,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     mocker.patch(
@@ -397,6 +407,8 @@ def test_existing_signed_out_user_accept_invite_redirects_to_sign_in(
     mock_get_user,
     mock_update_user_attribute,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     expected_service = service_one["id"]
     expected_permissions = {
@@ -438,7 +450,10 @@ def test_cancelled_invited_user_accepts_invited_redirect_to_cancelled_invitation
     sample_invite,
     mock_check_invite_token,
     mock_update_user_attribute,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mock_update_user_attribute.reset_mock()
     sample_invite["status"] = "cancelled"
@@ -466,6 +481,8 @@ def test_new_user_accept_invite_with_malformed_token(
     service_one,
     mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mocker.patch(
         api_endpoint,
@@ -585,6 +602,8 @@ def test_new_invited_user_verifies_and_added_to_service(
         "app.main.views.verify.service_api_client.retrieve_service_invite_data",
         return_value={},
     )
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     # visit accept token page
@@ -604,7 +623,7 @@ def test_new_invited_user_verifies_and_added_to_service(
         "service": sample_invite["service"],
         "email_address": sample_invite["email_address"],
         "from_user": sample_invite["from_user"],
-        "password": "longpassword",
+        "password": "longpassword",  # noqa
         "mobile_number": "+12027890123",
         "name": "Invited User",
         "auth_type": "sms_auth",
@@ -673,6 +692,8 @@ def test_new_invited_user_is_redirected_to_correct_place(
         "app.main.views.verify.service_api_client.retrieve_service_invite_data",
         return_value={},
     )
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mocker.patch(
         "app.service_api_client.get_service",

tests/app/main/views/test_dashboard.py

@@ -1931,14 +1931,14 @@ def test_fetch_daily_stats(
     )
     with app.test_client() as client:
         with client.session_transaction() as sess:
-            sess['service_id'] = service_id
+            sess["service_id"] = service_id
 
         socketio_client = SocketIOTestClient(app, socketio, flask_test_client=client)
 
         connected = socketio_client.is_connected()
         assert connected, "Client should be connected"
 
-        socketio_client.emit('fetch_daily_stats')
+        socketio_client.emit("fetch_daily_stats")
         received = socketio_client.get_received()
 
         mock_service_api.assert_called_once_with(
@@ -1967,8 +1967,13 @@ def test_fetch_daily_stats(
             SERVICE_ONE_ID,
             USER_ONE_ID,
             {"start_date": "2024-01-01", "days": 7},
-            {"service_id": SERVICE_ONE_ID, "user_id": USER_ONE_ID, "start_date": "2024-01-01", "days": 7},
-            {"id": USER_ONE_ID, "name": "Test User"}
+            {
+                "service_id": SERVICE_ONE_ID,
+                "user_id": USER_ONE_ID,
+                "start_date": "2024-01-01",
+                "days": 7,
+            },
+            {"id": USER_ONE_ID, "name": "Test User"},
         ),
     ],
 )
@@ -2001,15 +2006,15 @@ def test_fetch_daily_stats_by_user(
 
     with app.test_client() as client:
         with client.session_transaction() as sess:
-            sess['service_id'] = service_id
-            sess['user_id'] = user_id
+            sess["service_id"] = service_id
+            sess["user_id"] = user_id
 
         socketio_client = SocketIOTestClient(app, socketio, flask_test_client=client)
 
         connected = socketio_client.is_connected()
         assert connected, "Client should be connected"
 
-        socketio_client.emit('fetch_daily_stats_by_user')
+        socketio_client.emit("fetch_daily_stats_by_user")
         received = socketio_client.get_received()
 
         mock_service_api.assert_called_once_with(

tests/app/main/views/test_headers.py

@@ -6,6 +6,8 @@ def test_owasp_useful_headers_set(
     mocker,
     mock_get_service_and_organization_counts,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     response = client_request.get_response(".index")
 

tests/app/main/views/test_index.py

@@ -9,9 +9,10 @@ from tests.conftest import SERVICE_ONE_ID, normalize_spaces
 
 
 def test_non_logged_in_user_can_see_homepage(
-    client_request,
-    mock_get_service_and_organization_counts,
+    client_request, mock_get_service_and_organization_counts, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.get("main.index", _test_page_title=False)
 
@@ -69,11 +70,10 @@ def test_robots(client_request):
 )
 @freeze_time("2012-12-12 12:12")  # So we don’t go out of business hours
 def test_hiding_pages_from_search_engines(
-    client_request,
-    mock_get_service_and_organization_counts,
-    endpoint,
-    kwargs,
+    client_request, mock_get_service_and_organization_counts, endpoint, kwargs, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     response = client_request.get_response(f"main.{endpoint}", **kwargs)
     assert "X-Robots-Tag" in response.headers
@@ -103,11 +103,8 @@ def test_hiding_pages_from_search_engines(
         "billing_details",
     ],
 )
-def test_static_pages(
-    client_request,
-    mock_get_organization_by_domain,
-    view,
-):
+def test_static_pages(client_request, mock_get_organization_by_domain, view, mocker):
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     request = partial(client_request.get, "main.{}".format(view))
 
     # Check the page loads when user is signed in
@@ -130,9 +127,9 @@ def test_static_pages(
     )
 
 
-def test_guidance_pages_link_to_service_pages_when_signed_in(
-    client_request,
-):
+def test_guidance_pages_link_to_service_pages_when_signed_in(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     request = partial(client_request.get, "main.edit_and_format_messages")
     selector = ".list-number li a"
 
@@ -170,7 +167,9 @@ def test_guidance_pages_link_to_service_pages_when_signed_in(
         ("callbacks", "documentation"),
     ],
 )
-def test_old_static_pages_redirect(client_request, view, expected_view):
+def test_old_static_pages_redirect(client_request, view, expected_view, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         "main.{}".format(view),
@@ -243,7 +242,10 @@ def test_sms_price(
     mock_get_service_and_organization_counts,
     current_date,
     expected_rate,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with freeze_time(current_date):

tests/app/main/views/test_platform_admin.py

@@ -27,7 +27,9 @@ from tests.conftest import SERVICE_ONE_ID, SERVICE_TWO_ID, normalize_spaces
         "main.trial_services",
     ],
 )
-def test_should_redirect_if_not_logged_in(client_request, endpoint):
+def test_should_redirect_if_not_logged_in(client_request, endpoint, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.get(
         endpoint,

tests/app/main/views/test_register.py

@@ -10,9 +10,9 @@ from app.models.user import User
 from tests.conftest import normalize_spaces
 
 
-def test_render_register_returns_template_with_form(
-    client_request,
-):
+def test_render_register_returns_template_with_form(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.get_url("/register")
 
@@ -58,7 +58,10 @@ def test_register_creates_new_user_and_redirects_to_continue_page(
     mock_login,
     phone_number_to_register_with,
     password,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     user_data = {
         "name": "Some One Valid",
@@ -89,9 +92,9 @@ def test_register_creates_new_user_and_redirects_to_continue_page(
     # )
 
 
-def test_register_continue_handles_missing_session_sensibly(
-    client_request,
-):
+def test_register_continue_handles_missing_session_sensibly(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     # session is not set
     client_request.get(
@@ -105,7 +108,10 @@ def test_process_register_returns_200_when_mobile_number_is_invalid(
     mock_send_verify_code,
     mock_get_user_by_email_not_found,
     mock_login,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.post(
         "main.register",
@@ -113,7 +119,7 @@ def test_process_register_returns_200_when_mobile_number_is_invalid(
             "name": "Bad Mobile",
             "email_address": "bad_mobile@example.gsa.gov",
             "mobile_number": "not good",
-            "password": "validPassword!",
+            "password": "validPassword!",  # noqa
         },
         _expected_status=200,
     )
@@ -122,9 +128,10 @@ def test_process_register_returns_200_when_mobile_number_is_invalid(
 
 
 def test_should_return_200_when_email_is_not_gov_uk(
-    client_request,
-    mock_get_organizations,
+    client_request, mock_get_organizations, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.post(
         "main.register",
@@ -163,6 +170,8 @@ def test_should_add_user_details_to_session(
     mock_login,
     email_address,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.post(
         "main.register",
@@ -178,10 +187,10 @@ def test_should_add_user_details_to_session(
 
 
 def test_should_return_200_if_password_is_on_list_of_commonly_used_passwords(
-    client_request,
-    mock_get_user_by_email,
-    mock_login,
+    client_request, mock_get_user_by_email, mock_login, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.post(
         "main.register",
@@ -189,7 +198,7 @@ def test_should_return_200_if_password_is_on_list_of_commonly_used_passwords(
             "name": "Bad Mobile",
             "email_address": "bad_mobile@example.gsa.gov",
             "mobile_number": "+12021234123",
-            "password": "password",
+            "password": "password",  # noqa
         },
         _expected_status=200,
     )
@@ -202,7 +211,10 @@ def test_register_with_existing_email_sends_emails(
     api_user_active,
     mock_get_user_by_email,
     mock_send_already_registered_email,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     user_data = {
         "name": "Already Hasaccount",
@@ -244,6 +256,8 @@ def test_register_from_email_auth_invite(
         "app.main.views.verify.service_api_client.retrieve_service_invite_data",
         return_value={},
     )
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mock_login_user = mocker.patch("app.models.user.login_user")
     sample_invite["auth_type"] = "email_auth"
@@ -257,7 +271,7 @@ def test_register_from_email_auth_invite(
         "name": "invited user",
         "email_address": sample_invite["email_address"],
         "mobile_number": "2028675301",
-        "password": "FSLKAJHFNvdzxgfyst",
+        "password": "FSLKAJHFNvdzxgfyst",  # noqa
         "service": sample_invite["service"],
         "auth_type": "email_auth",
     }
@@ -331,6 +345,8 @@ def test_can_register_email_auth_without_phone_number(
         "app.main.views.verify.service_api_client.retrieve_service_invite_data",
         return_value={},
     )
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     sample_invite["auth_type"] = "email_auth"
     with client_request.session_transaction() as session:
@@ -364,7 +380,10 @@ def test_cannot_register_with_sms_auth_and_missing_mobile_number(
     mock_send_verify_code,
     mock_get_user_by_email_not_found,
     mock_login,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.post(
         "main.register",

tests/app/main/views/test_sign_in.py

@@ -7,7 +7,9 @@ from app.models.user import User
 from tests.conftest import SERVICE_ONE_ID, normalize_spaces
 
 
-def test_render_sign_in_template_for_new_user(client_request):
+def test_render_sign_in_template_for_new_user(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.get("main.sign_in")
     assert normalize_spaces(page.select_one("h1").text) == "Sign in"
@@ -25,7 +27,9 @@ def test_render_sign_in_template_for_new_user(client_request):
     assert "Sign in again" not in normalize_spaces(page.text)
 
 
-def test_sign_in_explains_session_timeout(client_request):
+def test_sign_in_explains_session_timeout(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.get("main.sign_in", next="/foo")
     assert (
@@ -81,7 +85,10 @@ def test_should_return_redirect_when_user_is_pending(
     mock_get_user_by_email_pending,
     api_user_pending,
     mock_verify_password,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.post(
         "main.sign_in",
@@ -107,8 +114,14 @@ def test_should_return_redirect_when_user_is_pending(
 )
 @pytest.mark.skip("TODO is this still relevant post login.gov switch?")
 def test_should_attempt_redirect_when_user_is_pending(
-    client_request, mock_get_user_by_email_pending, mock_verify_password, redirect_url
+    client_request,
+    mock_get_user_by_email_pending,
+    mock_verify_password,
+    redirect_url,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     client_request.post(
         "main.sign_in",
@@ -132,6 +145,8 @@ def test_when_signing_in_as_invited_user_you_cannot_accept_an_invite_for_another
     mock_send_verify_code,
     mock_get_invited_user_by_id,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     sample_invite["email_address"] = "some_other_user@user.gsa.gov"
 
     mocker.patch(

tests/app/main/views/test_sign_out.py

@@ -86,12 +86,14 @@ MOCK_JOBS = {
 }
 
 
-def test_render_sign_out_redirects_to_sign_in(client_request):
+def test_render_sign_out_redirects_to_sign_in(client_request, mocker):
     # TODO with the change to using login.gov, we no longer redirect directly to the sign in page.
     # Instead we redirect to login.gov which redirects us to the sign in page.  However, the
     # test for the expected redirect being "/" is buried in conftest and looks fragile.
     # After we move to login.gov officially and get rid of other forms of signing it, it should
     # be refactored.
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     with client_request.session_transaction() as session:
         assert session
     client_request.get(
@@ -99,7 +101,7 @@ def test_render_sign_out_redirects_to_sign_in(client_request):
         _expected_status=302,
     )
     with client_request.session_transaction() as session:
-        assert not session
+        assert session.permanent is False
 
 
 def test_sign_out_user(
@@ -119,6 +121,8 @@ def test_sign_out_user(
     mock_get_free_sms_fragment_limit,
     mock_get_inbound_sms_summary,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     with client_request.session_transaction() as session:
         assert session.get("user_id") is not None
     # Check we are logged in
@@ -141,13 +145,15 @@ def test_sign_out_user(
         assert session.get("user_id") is None
 
 
-def test_sign_out_of_two_sessions(client_request):
+def test_sign_out_of_two_sessions(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.get(
         "main.sign_out",
         _expected_status=302,
     )
     with client_request.session_transaction() as session:
-        assert not session
+        assert session.permanent is False
     client_request.get(
         "main.sign_out",
         _expected_status=302,

tests/app/main/views/test_two_factor.py

@@ -26,8 +26,10 @@ def mock_email_validated_recently(mocker):
     ("email_resent", "page_title"), [(None, "Check your email"), (True, "Email resent")]
 )
 def test_two_factor_email_sent_page(
-    client_request, email_resent, page_title, redirect_url, request_url
+    client_request, email_resent, page_title, redirect_url, request_url, mocker
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     page = client_request.get(
         f"main.{request_url}",
@@ -55,6 +57,8 @@ def test_two_factor_email_sent_page(
 def test_should_render_two_factor_page(
     client_request, api_user_active, mock_get_user_by_email, mocker, redirect_url
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     # TODO this lives here until we work out how to
     # reassign the session after it is lost mid register process
@@ -86,7 +90,10 @@ def test_should_login_user_and_should_redirect_to_next_url(
     mock_check_verify_code,
     mock_create_event,
     mock_email_validated_recently,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -115,6 +122,8 @@ def test_should_send_email_and_redirect_to_info_page_if_user_needs_to_revalidate
     mock_send_verify_code,
     mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     mocker.patch("app.user_api_client.get_user", return_value=api_user_active)
@@ -149,7 +158,10 @@ def test_should_login_user_and_not_redirect_to_external_url(
     mock_get_services_with_one_service,
     mock_create_event,
     mock_email_validated_recently,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -182,7 +194,10 @@ def test_should_login_user_and_redirect_to_show_accounts(
     mock_create_event,
     mock_email_validated_recently,
     platform_admin,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -206,6 +221,8 @@ def test_should_return_200_with_sms_code_error_when_sms_code_is_wrong(
     mock_check_verify_code_code_not_found,
     mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -232,7 +249,10 @@ def test_should_login_user_when_multiple_valid_codes_exist(
     mock_get_services_with_one_service,
     mock_create_event,
     mock_email_validated_recently,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -257,7 +277,10 @@ def test_two_factor_sms_should_set_password_when_new_password_exists_in_session(
     mock_update_user_password,
     mock_create_event,
     mock_email_validated_recently,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -285,7 +308,10 @@ def test_two_factor_sms_returns_error_when_user_is_locked(
     mock_get_locked_user,
     mock_check_verify_code_code_not_found,
     mock_get_services_with_one_service,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with client_request.session_transaction() as session:
@@ -320,6 +346,8 @@ def test_two_factor_sms_should_activate_pending_user(
     mock_activate_user,
     mock_email_validated_recently,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mocker.patch("app.user_api_client.get_user", return_value=api_user_pending)
     mocker.patch("app.service_api_client.get_services", return_value={"data": []})
@@ -344,6 +372,8 @@ def test_valid_two_factor_email_link_shows_interstitial(
     extra_args,
     expected_encoded_next_arg,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     mock_check_code = mocker.patch("app.user_api_client.check_verify_code")
     encoded_token = valid_token.replace("%2E", ".")
     token_url = url_for(
@@ -400,7 +430,10 @@ def test_two_factor_email_link_has_expired(
     mock_send_verify_code,
     fake_uuid,
     redirect_url,
+    mocker,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     with set_config(notify_admin, "EMAIL_EXPIRY_SECONDS", -1):
@@ -419,7 +452,9 @@ def test_two_factor_email_link_has_expired(
     assert mock_send_verify_code.called is False
 
 
-def test_two_factor_email_link_is_invalid(client_request):
+def test_two_factor_email_link_is_invalid(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     token = 12345
     page = client_request.post(
@@ -443,8 +478,14 @@ def test_two_factor_email_link_is_invalid(client_request):
     ],
 )
 def test_two_factor_email_link_is_already_used(
-    client_request, valid_token, mocker, mock_send_verify_code, redirect_url
+    client_request,
+    valid_token,
+    mocker,
+    mock_send_verify_code,
+    redirect_url,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mocker.patch(
         "app.user_api_client.check_verify_code",
@@ -467,8 +508,13 @@ def test_two_factor_email_link_is_already_used(
 
 
 def test_two_factor_email_link_when_user_is_locked_out(
-    client_request, valid_token, mocker, mock_send_verify_code
+    client_request,
+    valid_token,
+    mocker,
+    mock_send_verify_code,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     mocker.patch(
         "app.user_api_client.check_verify_code", return_value=(False, "Code not found")

tests/app/main/views/test_verify.py

@@ -204,6 +204,8 @@ def test_verify_email_redirects_to_sign_in_if_user_active(
     mock_send_verify_code,
     mock_check_verify_code,
 ):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
     token_data = {"user_id": api_user_active["id"], "secret_code": 12345}
     mocker.patch(

tests/app/notify_client/test_service_api_client.py

@@ -529,6 +529,9 @@ def test_deletes_caches_when_modifying_templates(
 def test_deletes_cached_users_when_archiving_service(
     mocker, mock_get_service_templates
 ):
+    mocker.patch(
+        "app.notify_client.service_api_client.ServiceAPIClient.check_inactive_user"
+    )
     mock_redis_delete = mocker.patch("app.extensions.RedisClient.delete")
     mock_redis_delete_by_pattern = mocker.patch(
         "app.extensions.RedisClient.delete_by_pattern"

tests/app/utils/test_user.py

@@ -94,7 +94,9 @@ def test_restrict_admin_usage(
         index()
 
 
-def test_no_user_returns_redirect_to_sign_in(client_request):
+def test_no_user_returns_redirect_to_sign_in(client_request, mocker):
+
+    mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
     client_request.logout()
 
     @user_has_permissions()