Merge pull request #94 from alphagov/verify-user

Verify activate and login user with sms and email code

app/main/dao/users_dao.py

@@ -6,6 +6,8 @@ from app import db, login_manager
 from app.models import User
 from app.main.encryption import hashpw
 
+from app import user_api_client
+
 
 @login_manager.user_loader
 def load_user(user_id):
@@ -21,7 +23,7 @@ def insert_user(user):
 # TODO Would be better to have a generic get and update for user
 # something that replicates the sql functionality.
 def get_user_by_id(id):
-    return User.query.filter_by(id=id).first()
+    return user_api_client.get_user(id)
 
 
 def get_all_users():
@@ -38,11 +40,9 @@ def increment_failed_login_count(id):
     db.session.commit()
 
 
-def activate_user(id):
-    user = get_user_by_id(id)
+def activate_user(user):
     user.state = 'active'
-    db.session.add(user)
-    db.session.commit()
+    return user_api_client.update_user(user)
 
 
 def update_email_address(id, email_address):

app/main/views/register.py

@@ -4,14 +4,12 @@ from flask import (
     render_template,
     redirect,
     session,
-    current_app,
     abort
 )
 
 from client.errors import HTTPError
 
 from app.main import main
-from app.models import User
 from app.main.dao import users_dao
 from app.main.forms import RegisterUserForm
 
@@ -27,7 +25,6 @@ def register():
     form = RegisterUserForm(users_dao.get_user_by_email)
 
     if form.validate_on_submit():
-
         try:
             user = user_api_client.register_user(form.name.data,
                                                  form.email_address.data,

app/main/views/sign_in.py

@@ -16,6 +16,8 @@ def sign_in():
         if form.validate_on_submit():
             user = users_dao.get_user_by_email(form.email_address.data)
             if user:
+                # TODO move to user API in next pr to actually do password check as this
+                # is totally broken now
                 if not user.is_locked() and user.is_active() and check_hash(form.password.data, user.password):
                     send_sms_code(user.id, user.mobile_number)
                     session['user_email'] = user.email_address

app/main/views/verify.py

@@ -1,11 +1,13 @@
 from flask import (
     render_template,
     redirect,
-    jsonify,
     session,
-    url_for
+    url_for,
+    abort
 )
 
+from client.errors import HTTPError
+
 from flask_login import login_user
 
 from app.main import main
@@ -24,9 +26,15 @@ def verify():
         verify_codes_dao.use_code_for_user_and_type(user_id=user_id, code_type='email')
         verify_codes_dao.use_code_for_user_and_type(user_id=user_id, code_type='sms')
 
-        # TODO complete verify and login flow
-        # users_dao.activate_user(user.id)
-        # login_user(user)
+        try:
+            user = users_dao.get_user_by_id(user_id)
+            activated_user = users_dao.activate_user(user)
+            login_user(activated_user)
+            return redirect(url_for('main.add_service', first='first'))
+        except HTTPError as e:
+            if e.status_code == 404:
+                abort(404)
+            else:
+                raise e
 
-        return redirect(url_for('.add_service', first='first'))
     return render_template('views/verify.html', form=form)

app/notify_client/user_api_client.py

@@ -24,6 +24,17 @@ class UserApiClient(BaseAPIClient):
         user_data = self.post("/user", data)
         return User(user_data['data'], max_failed_login_count=self.user_max_failed_login_count)
 
+    def get_user(self, id):
+        url = "{}/user/{}".format(self.base_url, id)
+        user_data = self.get(url)
+        return User(user_data['data'], max_failed_login_count=self.user_max_failed_login_count)
+
+    def update_user(self, user):
+        data = user.serialize()
+        url = "{}/user/{}".format(self.base_url, user.id)
+        user_data = self.put(url, data=data)
+        return User(user_data['data'], max_failed_login_count=self.user_max_failed_login_count)
+
 
 class User(object):
 
@@ -51,24 +62,28 @@ class User(object):
     def password_changed_at(self):
         return self.fields.get('password_changed_at')
 
-    @property
+    def get_id(self):
+        return self.id
+
     def is_authenticated(self):
-        return self.fields.get('is_authenticated')
+        return True
 
-    @property
     def is_active(self):
-        if self.fields.get('state') != 'active':
-            return False
-        else:
-            return True
+        return self.state == 'active'
 
     @property
+    def state(self):
+        return self.fields['state']
+
+    @state.setter
+    def state(self, state):
+        self.fields['state'] = state
+
     def is_anonymous(self):
         return False
 
-    @property
     def is_locked(self):
-        if self.fields.get('failed_login_count') < self.max_failed_login_count:
-            return False
-        else:
-            return True
+        return self.fields.get('failed_login_count') > self.max_failed_login_count
+
+    def serialize(self):
+        return self.fields