alter login flow to allow for email auth login

tests/app/main/views/test_sign_in.py

@@ -77,7 +77,7 @@ def test_logged_in_user_redirects_to_choose_service(
     assert response.location == url_for('main.choose_service', _external=True)
 
 
-def test_process_sign_in_return_2fa_template(
+def test_process_sms_auth_sign_in_return_2fa_template(
     client,
     api_user_active,
     mock_send_verify_code,
@@ -94,6 +94,25 @@ def test_process_sign_in_return_2fa_template(
     mock_verify_password.assert_called_with(api_user_active.id, 'val1dPassw0rd!')
 
 
+def test_process_email_auth_sign_in_return_2fa_template(
+    client,
+    api_user_active_email_auth,
+    mock_send_verify_code,
+    mock_verify_password,
+    mocker
+):
+    mocker.patch('app.user_api_client.get_user', return_value=api_user_active_email_auth)
+    mocker.patch('app.user_api_client.get_user_by_email', return_value=api_user_active_email_auth)
+
+    response = client.post(
+        url_for('main.sign_in'), data={
+            'email_address': 'valid@example.gov.uk',
+            'password': 'val1dPassw0rd!'})
+    assert response.status_code == 302
+    assert response.location == url_for('.two_factor_email_sent', _external=True)
+    mock_verify_password.assert_called_with(api_user_active_email_auth.id, 'val1dPassw0rd!')
+
+
 def test_should_return_locked_out_true_when_user_is_locked(
     client,
     mock_get_user_by_email_locked,

tests/app/main/views/test_two_factor.py

@@ -1,8 +1,10 @@
-from flask import url_for
-from tests.conftest import SERVICE_ONE_ID
-
 from unittest.mock import ANY
 
+from flask import url_for
+from bs4 import BeautifulSoup
+
+from tests.conftest import SERVICE_ONE_ID, normalize_spaces, set_config
+
 
 def test_should_render_two_factor_page(
     client,
@@ -213,3 +215,108 @@ def test_two_factor_should_activate_pending_user(
 
     assert mock_activate_user.called
     assert api_user_pending.is_active
+
+
+def test_valid_two_factor_email_link_logs_in_user(
+    client,
+    valid_token,
+    mock_get_user,
+    mock_get_services_with_one_service,
+    mocker
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(True, ''))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+    )
+
+    assert response.status_code == 302
+    assert response.location == url_for('main.service_dashboard', service_id=SERVICE_ONE_ID, _external=True)
+
+
+def test_two_factor_email_link_has_expired(
+    app_,
+    valid_token,
+    client,
+    mock_send_verify_code,
+    fake_uuid
+):
+
+    with set_config(app_, 'EMAIL_2FA_EXPIRY_SECONDS', -1):
+        response = client.get(
+            url_for('main.two_factor_email', token=valid_token),
+            follow_redirects=True,
+        )
+
+    assert response.status_code == 200
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "The link in the email we sent you has expired. We’ve sent you a new one."
+    assert page.h1.text.strip() == 'Email resent'
+    mock_send_verify_code.assert_called_once_with(fake_uuid, 'email', None)
+
+
+def test_two_factor_email_link_is_invalid(
+    client
+):
+    token = 12345
+    response = client.get(
+        url_for('main.two_factor_email', token=token),
+        follow_redirects=True
+    )
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "There’s something wrong with the link you’ve used."
+    assert response.status_code == 404
+
+
+def test_two_factor_email_link_is_already_used(
+    client,
+    valid_token,
+    mocker
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(False, 'Code has expired'))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+        follow_redirects=True
+    )
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "There’s something wrong with the code"
+    assert response.status_code == 200
+
+
+def test_two_factor_email_link_when_user_is_locked_out(
+    client,
+    valid_token,
+    mocker
+):
+    mocker.patch('app.user_api_client.check_verify_code', return_value=(False, 'Code not found'))
+
+    response = client.get(
+        url_for('main.two_factor_email', token=valid_token),
+        follow_redirects=True
+    )
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+    assert normalize_spaces(
+        page.select_one('.banner-dangerous').text
+    ) == "There’s something wrong with the code"
+    assert response.status_code == 200
+
+
+def test_two_factor_email_link_used_when_user_already_logged_in(
+    logged_in_client,
+    valid_token
+):
+    response = logged_in_client.get(
+        url_for('main.two_factor_email', token=valid_token)
+    )
+    assert response.status_code == 302
+    assert response.location == url_for('main.choose_service', _external=True)