redirect on login; flash errors on failure

the js `fetch` function will follow redirects blindly and return you the
final 200 response. when there's an error, we don't want to go anywhere,
and we want to use the flask `flash` functionality to pop up an error
page (the likely reason for seeing this is using a yubikey that isn't
associated with your user). using `flash` and then
`window.location.reload()` handles this fine.

However, when the user does log in succesfully we need to properly log
them in - this includes:

* checking their account isn't over the max login count
* resetting failed login count to 0 if not
* setting a new session id in the database (so other browser windows are
  logged out)
* checking if they need to revalidate their email access (every 90 days)
* clearing old user out of the cache

This code all happens in the ajax function rather than being in a
separate redirect, so that you can't just navigate to the login flow. I
wasn't able to unit test that function due how it uses the session and
other flask globals, so moved the auth into its own function so it's
easy to stub out all that CBOR nonsense.

TODO: We still need to pass any `next` URLs through the chain from login
page all the way through the javascript AJAX calls and redirects to the
log_in_user function

tests/app/notify_client/test_user_client.py

@@ -1,7 +1,8 @@
 import uuid
-from unittest.mock import call
+from unittest.mock import Mock, call
 
 import pytest
+from notifications_python_client.errors import HTTPError
 
 from app import invite_api_client, service_api_client, user_api_client
 from app.models.webauthn_credential import WebAuthnCredential
@@ -191,6 +192,7 @@ def test_returns_value_from_cache(
     (user_api_client, 'update_password', [user_id, 'hunter2'], {}),
     (user_api_client, 'verify_password', [user_id, 'hunter2'], {}),
     (user_api_client, 'check_verify_code', [user_id, '', ''], {}),
+    (user_api_client, 'complete_webauthn_login_attempt', [user_id], {'is_successful': True}),
     (user_api_client, 'add_user_to_service', [SERVICE_ONE_ID, user_id, [], []], {}),
     (user_api_client, 'add_user_to_organisation', [sample_uuid(), user_id], {}),
     (user_api_client, 'set_user_permissions', [user_id, SERVICE_ONE_ID, []], {}),
@@ -263,3 +265,44 @@ def test_create_webauthn_credential_for_user(mocker, webauthn_credential, fake_u
 
     user_api_client.create_webauthn_credential_for_user(fake_uuid, credential)
     mock_post.assert_called_once_with(expected_url, data=credential.serialize())
+
+
+def test_complete_webauthn_login_attempt_returns_true_and_no_message_normally(fake_uuid, mocker):
+    mock_post = mocker.patch('app.notify_client.user_api_client.UserApiClient.post')
+
+    resp = user_api_client.complete_webauthn_login_attempt(fake_uuid, is_successful=True)
+
+    expected_data = {'successful': True}
+    mock_post.assert_called_once_with(f'/user/{fake_uuid}/verify/webauthn-login', data=expected_data)
+    assert resp == (True, '')
+
+
+def test_complete_webauthn_login_attempt_returns_false_and_message_on_403(fake_uuid, mocker):
+    mock_post = mocker.patch(
+        'app.notify_client.user_api_client.UserApiClient.post',
+        side_effect=HTTPError(
+            response=Mock(
+                status_code=403,
+                json=Mock(
+                    return_value={'message': 'forbidden'}
+                )
+            )
+        )
+    )
+
+    resp = user_api_client.complete_webauthn_login_attempt(fake_uuid, is_successful=True)
+
+    expected_data = {'successful': True}
+    mock_post.assert_called_once_with(f'/user/{fake_uuid}/verify/webauthn-login', data=expected_data)
+
+    assert resp == (False, 'forbidden')
+
+
+def test_complete_webauthn_login_attempt_raises_on_api_error(fake_uuid, mocker):
+    mocker.patch(
+        'app.notify_client.user_api_client.UserApiClient.post',
+        side_effect=HTTPError(response=Mock(status_code=503, message='error'))
+    )
+
+    with pytest.raises(HTTPError):
+        user_api_client.complete_webauthn_login_attempt(fake_uuid, is_successful=True)