Merge pull request #3371 from alphagov/flask-login-again

Flask login (but backwards compatible)

app/__init__.py

@@ -531,6 +531,12 @@ def make_session_permanent():
     when you first log in/sign up/get invited/etc, but we do it just to be safe. For more reading, check here:
     https://stackoverflow.com/questions/34118093/flask-permanent-session-where-to-define-them
     """
+
+    # TODO: Remove this loop after a weekend, when all cookies have either run through this code or expired
+    for val in ['user_id', 'remember', 'remember_seconds']:
+        if val in session:
+            session[f'_{val}'] = session[val]
+
     session.permanent = True
 
 

app/models/user.py

@@ -139,6 +139,7 @@ class User(JSONModel, UserMixin):
 
     def login(self):
         login_user(self)
+        session['user_id'] = self.id
 
     def sign_in(self):
 

requirements-app.txt

@@ -5,7 +5,7 @@ ago==0.0.93
 humanize==2.2.0
 Flask==1.1.1
 Flask-WTF==0.14.3
-Flask-Login==0.4.1
+Flask-Login==0.5.0
 
 blinker==1.4
 pyexcel==0.5.15

requirements.txt

@@ -7,7 +7,7 @@ ago==0.0.93
 humanize==2.2.0
 Flask==1.1.1
 Flask-WTF==0.14.3
-Flask-Login==0.4.1
+Flask-Login==0.5.0
 
 blinker==1.4
 pyexcel==0.5.15

tests/__init__.py

@@ -4,6 +4,7 @@ from unittest.mock import patch
 from urllib.parse import parse_qs, urlparse
 
 import pytest
+from flask import session as flask_session
 from flask import url_for
 from flask.testing import FlaskClient
 from flask_login import login_user
@@ -27,6 +28,9 @@ class TestClient(FlaskClient):
 
         with patch('app.events_api_client.create_event'):
             login_user(model_user)
+        with self.session_transaction() as test_session:
+            for key, value in flask_session.items():
+                test_session[key] = value
 
     def logout(self, user):
         self.get(url_for("main.sign_out"))

tests/app/main/views/test_api_integration.py

@@ -172,13 +172,13 @@ def test_api_documentation_page_should_redirect(
 
 def test_should_show_empty_api_keys_page(
     client,
-    api_user_pending,
+    api_user_active,
     mock_login,
     mock_get_no_api_keys,
     mock_get_service,
     mock_has_permissions,
 ):
-    client.login(api_user_pending)
+    client.login(api_user_active)
     service_id = str(uuid.uuid4())
     response = client.get(url_for('main.api_keys', service_id=service_id))