darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-24 00:07:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

109526036: Persist the verify code to the db.

Browse Source 
The codes are hashed and saved to the db.
The code is marked as used once a valid code is submitted.
The code is valid for 1 hour.
The codes are no longer saved to the session.
This commit is contained in:
Rebecca Law
2015-12-10 14:48:01 +00:00
parent 3b327c9986
commit 588730d594
17 changed files with 306 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/main/views/__init__.py
View File

@@ -1,24 +1,27 @@
from random import randint
from app import admin_api_client
from app.main.exceptions import AdminApiClientException
from app.main.dao import verify_codes_dao
def create_verify_code():
return ''.join(["%s" % randint(0, 9) for _ in range(0, 5)])
def send_sms_code(mobile_number):
def send_sms_code(user_id, mobile_number):
sms_code = create_verify_code()
try:
verify_codes_dao.add_code(user_id=user_id, code=sms_code, code_type='sms')
admin_api_client.send_sms(mobile_number, message=sms_code, token=admin_api_client.auth_token)
except:
raise AdminApiClientException('Exception when sending sms.')
return sms_code
def send_email_code(email):
def send_email_code(user_id, email):
email_code = create_verify_code()
try:
verify_codes_dao.add_code(user_id=user_id, code=email_code, code_type='email')
admin_api_client.send_email(email_address=email,
from_str='notify@digital.cabinet-office.gov.uk',
message=email_code,

8
app/main/views/register.py
View File

@@ -29,12 +29,10 @@ def process_register():
created_at=datetime.now(),
role_id=1)
try:
sms_code = send_sms_code(form.mobile_number.data)
email_code = send_email_code(form.email_address.data)
session['sms_code'] = hashpw(sms_code)
session['email_code'] = hashpw(email_code)
session['expiry_date'] = str(datetime.now() + timedelta(hours=1))
users_dao.insert_user(user)
send_sms_code(user_id=user.id, mobile_number=form.mobile_number.data)
send_email_code(user_id=user.id, email=form.email_address.data)
session['expiry_date'] = str(datetime.now() + timedelta(hours=1))
session['user_id'] = user.id
except AdminApiClientException as e:
return jsonify(admin_api_client_error=e.value)

2
app/main/views/sign_in.py
View File

@@ -26,7 +26,7 @@ def process_sign_in():
if not user.is_active():
return jsonify(active_user=False), 401
if checkpw(form.password.data, user.password):
sms_code = send_sms_code(user.mobile_number)
sms_code = send_sms_code(user.id, user.mobile_number)
session['user_id'] = user.id
session['sms_code'] = hashpw(sms_code)
else: