store invited org user ids in session

first of a two step process to remove invited user objects from the
session. we're removing them because they're of variable size, and with
a lot of folder permissions they can cause the session to exceed the 4kb
cookie size limit and not save properly.

this commit looks at invited org users only.

in this step, start saving the invited org user's id to the
session alongside the session object. Then, if the invited_org_user_id
is present in the next step of the invite flow, fetch the user object
from the API instead of from the session. If it's not present (due to a
session set by an older instance of the admin app), then just use the
old code to get the entire object out of the session.

For invites where the user is small enough to persist to the cookie,
this will still save both the old and the new way, but will always make
an extra check to the API, I think this minor performance hit is totally
fine. For invites where the user is too big to persist, they'll still
fail for now, and will need to wait until the next PR comes along and
stops saving the large invited user object to the session entirely.

tests/app/main/views/organisations/test_organisation_invites.py

@@ -341,6 +341,48 @@ def test_org_user_registration(
     )
 
 
+def test_org_user_registration_when_org_user_id_in_session(
+    client,
+    sample_org_invite,
+    mock_email_is_not_already_in_use,
+    mock_register_user,
+    mock_send_verify_code,
+    mock_get_user_by_email,
+    mock_send_verify_email,
+    mock_accept_org_invite,
+    mock_add_user_to_organisation,
+    mock_get_invited_org_user_by_id,
+):
+    with client.session_transaction() as session:
+        session['invited_org_user_id'] = sample_org_invite['id']
+
+    response = client.post(url_for('main.register_from_org_invite'), data={
+        'name': 'Test User',
+        'email_address': sample_org_invite['email_address'],
+        'mobile_number': '+4407700900460',
+        'password': 'validPassword!',
+        'organisation': sample_org_invite['organisation']
+    })
+
+    assert response.status_code == 302
+    assert response.location == url_for('main.verify', _external=True)
+
+    assert mock_get_user_by_email.called is False
+    mock_get_invited_org_user_by_id.assert_called_once_with(sample_org_invite['id'])
+    mock_register_user.assert_called_once_with(
+        'Test User',
+        sample_org_invite['email_address'],
+        '+4407700900460',
+        'validPassword!',
+        'sms_auth'
+    )
+    mock_send_verify_code.assert_called_once_with(
+        '6ce466d0-fd6a-11e5-82f5-e0accb9d11a6',
+        'sms',
+        '+4407700900460',
+    )
+
+
 def test_verified_org_user_redirects_to_dashboard(
     client,
     sample_org_invite,

tests/app/models/test_user.py

@@ -1,6 +1,9 @@
+import uuid
+from unittest.mock import Mock
+
 import pytest
 
-from app.models.user import AnonymousUser, User
+from app.models.user import AnonymousUser, InvitedOrgUser, User
 
 
 def test_anonymous_user(app_):
@@ -106,3 +109,42 @@ def test_has_live_services_when_service_is_not_live(
         'id': fake_uuid,
         'platform_admin': False,
     }).live_services == []
+
+
+def test_invited_org_user_from_session_uses_id(client, mocker, mock_get_invited_org_user_by_id, sample_org_invite):
+    session_dict = {'invited_org_user_id': sample_org_invite['id']}
+    mocker.patch.dict('app.models.user.session', values=session_dict, clear=True)
+
+    assert InvitedOrgUser.from_session().id == sample_org_invite['id']
+
+    mock_get_invited_org_user_by_id.assert_called_once_with(sample_org_invite['id'])
+
+
+def test_invited_org_user_from_session_uses_id_even_if_obj_in_session(
+    client,
+    mocker,
+    sample_org_invite,
+    mock_get_invited_org_user_by_id
+):
+    fake_id = str(uuid.uuid4())
+    mock_org_dict = Mock(spec=dict)
+    session_dict = {'invited_org_user_id': fake_id, 'invited_org_user': mock_org_dict}
+    mocker.patch.dict('app.models.user.session', values=session_dict, clear=True)
+
+    assert InvitedOrgUser.from_session().id == sample_org_invite['id']
+
+    # make sure we didn't access invited_org_user (as org_user_id takes precedence)
+    assert mock_org_dict.mock_calls == []
+    mock_get_invited_org_user_by_id.assert_called_once_with(fake_id)
+
+
+def test_invited_org_user_from_session_uses_obj_if_id_not_present(client, mocker, sample_org_invite):
+    session_dict = {'invited_org_user': sample_org_invite}
+    mocker.patch.dict('app.models.user.session', values=session_dict, clear=True)
+
+    assert InvitedOrgUser.from_session().id == sample_org_invite['id']
+
+
+def test_invited_org_user_from_session_returns_none_if_nothing_present(client, mocker):
+    mocker.patch.dict('app.models.user.session', values={}, clear=True)
+    assert InvitedOrgUser.from_session() is None

tests/conftest.py

@@ -4462,3 +4462,16 @@ def mock_update_broadcast_message_status(
         'app.broadcast_message_api_client.update_broadcast_message_status',
         side_effect=_update,
     )
+
+
+@pytest.fixture
+def mock_get_invited_org_user_by_id(mocker, sample_org_invite):
+    def _get(
+        invited_org_user_id
+    ):
+        return sample_org_invite
+
+    return mocker.patch(
+        'app.org_invite_api_client.get_invited_user',
+        side_effect=_get,
+    )