Merge pull request #1011 from alphagov/update-user-profile

Update user profile

app/main/views/user_profile.py

@@ -47,8 +47,8 @@ def user_profile_name():
     form = ChangeNameForm(new_name=current_user.name)
 
     if form.validate_on_submit():
-        current_user.name = form.new_name.data
-        user_api_client.update_user(current_user)
+        user_api_client.update_user_attribute(current_user.id,
+                                              name=form.new_name.data)
         return redirect(url_for('.user_profile'))
 
     return render_template(
@@ -107,7 +107,6 @@ def user_profile_email_authenticate():
 @main.route("/user-profile/email/confirm/<token>", methods=['GET'])
 @login_required
 def user_profile_email_confirm(token):
-
     token_data = check_token(token,
                              current_app.config['SECRET_KEY'],
                              current_app.config['DANGEROUS_SALT'],
@@ -115,9 +114,8 @@ def user_profile_email_confirm(token):
     token_data = json.loads(token_data)
     user_id = token_data['user_id']
     new_email = token_data['email']
-    user = user_api_client.get_user(user_id)
-    user.email_address = new_email
-    user_api_client.update_user(user)
+    user_api_client.update_user_attribute(user_id,
+                                          email_address=new_email)
     session.pop(NEW_EMAIL, None)
 
     return redirect(url_for('.user_profile'))
@@ -179,10 +177,11 @@ def user_profile_mobile_number_confirm():
     form = ConfirmMobileNumberForm(_check_code)
 
     if form.validate_on_submit():
-        current_user.mobile_number = session[NEW_MOBILE]
+        mobile_number = session[NEW_MOBILE]
         del session[NEW_MOBILE]
         del session[NEW_MOBILE_PASSWORD_CONFIRMED]
-        user_api_client.update_user(current_user)
+        user_api_client.update_user_attribute(current_user.id,
+                                              mobile_number=mobile_number)
         return redirect(url_for('.user_profile'))
 
     return render_template(

app/notify_client/user_api_client.py

@@ -3,6 +3,12 @@ from notifications_python_client.errors import HTTPError
 
 from app.notify_client.models import User
 
+ALLOWED_ATTRIBUTES = {
+    'name',
+    'email_address',
+    'mobile_number'
+}
+
 
 class UserApiClient(BaseAPIClient):
     def __init__(self):
@@ -53,6 +59,19 @@ class UserApiClient(BaseAPIClient):
         user_data = self.put(url, data=data)
         return User(user_data['data'], max_failed_login_count=self.max_failed_login_count)
 
+    def update_user_attribute(self, user_id, **kwargs):
+        data = dict(kwargs)
+        disallowed_attributes = set(data.keys()) - ALLOWED_ATTRIBUTES
+        if disallowed_attributes:
+            raise TypeError('Not allowed to update user attributes: {}'.format(
+                ", ".join(disallowed_attributes)
+            ))
+
+        data = dict(**kwargs)
+        url = "/user/{}".format(user_id)
+        user_data = self.post(url, data=data)
+        return User(user_data['data'], max_failed_login_count=self.max_failed_login_count)
+
     def verify_password(self, user_id, password):
         try:
             url = "/user/{}/verify/password".format(user_id)