Send an email to the user when they change email address

This PR changes the flow to change an email address.
Once the user enter their password, they are told "Check your email".
An email has been sent to them containing a link to notify which contains an encrypted token.
The encrypted token contains the user id and new email address. Once the link is clicked the user's email address is updated to the new email address.
They are redirected to the /user-profile page.

Also in this commit is an update from flask.ext.login to flask_login.

app/main/views/index.py

@@ -1,12 +1,8 @@
-import markdown
-import os
-from flask import (render_template, url_for, redirect, Markup, request, abort)
+from flask import (render_template, url_for, redirect, request, abort)
 from app.main import main
 from app import convert_to_boolean
-from flask_login import login_required
+from flask_login import (login_required, current_user)
 
-from flask.ext.login import current_user
-from mdx_gfm import GithubFlavoredMarkdownExtension
 
 from notifications_utils.renderers import HTMLEmail
 

app/main/views/register.py

@@ -8,11 +8,10 @@ from flask import (
     redirect,
     session,
     abort,
-    url_for,
-    flash
+    url_for
 )
 
-from flask.ext.login import current_user
+from flask_login import current_user
 
 from app.main import main
 

app/main/views/sign_in.py

@@ -9,7 +9,7 @@ from flask import (
     Markup
 )
 
-from flask.ext.login import (
+from flask_login import (
     current_user,
     login_fresh,
     confirm_login

app/main/views/sign_out.py

@@ -4,7 +4,7 @@ from flask import (
     session
 )
 
-from flask.ext.login import logout_user
+from flask_login import logout_user
 
 from app.main import main
 

app/main/views/user_profile.py

@@ -1,19 +1,21 @@
+import json
+
 from flask import (
     render_template,
     redirect,
     url_for,
-    session
-)
+    session,
+    current_app)
+
+from flask_login import login_required, current_user
+from notifications_utils.url_safe_token import check_token
 
-from flask.ext.login import current_user
-from flask_login import login_required
 from app.main import main
 
 from app.main.forms import (
     ChangePasswordForm,
     ChangeNameForm,
     ChangeEmailForm,
-    ConfirmEmailForm,
     ChangeMobileNumberForm,
     ConfirmMobileNumberForm,
     ConfirmPasswordForm
@@ -82,10 +84,9 @@ def user_profile_email_authenticate():
         return redirect('main.user_profile_email')
 
     if form.validate_on_submit():
-        current_user.email_address = session[NEW_EMAIL]
-        del session[NEW_EMAIL]
-        user_api_client.update_user(current_user)
-        return redirect(url_for('.user_profile'))
+        user_api_client.send_change_email_verification(current_user.id, session[NEW_EMAIL])
+        return render_template('views/change-email-continue.html',
+                               new_email=session[NEW_EMAIL])
 
     return render_template(
         'views/user-profile/authenticate.html',
@@ -95,6 +96,26 @@ def user_profile_email_authenticate():
     )
 
 
+@main.route("/user-profile/email/confirm/<token>", methods=['GET'])
+@login_required
+def user_profile_email_confirm(token):
+
+    token_data = check_token(token,
+                             current_app.config['SECRET_KEY'],
+                             current_app.config['DANGEROUS_SALT'],
+                             current_app.config['EMAIL_EXPIRY_SECONDS'])
+    token_data = json.loads(token_data)
+    user_id = token_data['user_id']
+    new_email = token_data['email']
+    user = user_api_client.get_user(user_id)
+    user.email_address = new_email
+    user_api_client.update_user(user)
+    if session.get(NEW_EMAIL, None):
+        del session[NEW_EMAIL]
+
+    return redirect(url_for('.user_profile'))
+
+
 @main.route("/user-profile/mobile-number", methods=['GET', 'POST'])
 @login_required
 def user_profile_mobile_number():

app/notify_client/__init__.py

@@ -1,4 +1,4 @@
-from flask.ext.login import current_user
+from flask_login import current_user
 
 
 def _attach_current_user(data):

app/notify_client/models.py

@@ -1,4 +1,4 @@
-from flask.ext.login import (UserMixin, login_fresh)
+from flask_login import (UserMixin, login_fresh)
 
 
 class User(UserMixin):

app/notify_client/user_api_client.py

@@ -127,3 +127,8 @@ class UserApiClient(BaseAPIClient):
             return self.update_user(user)
         else:
             return user
+
+    def send_change_email_verification(self, user_id, new_email):
+        endpoint = '/user/{}/change-email-verification'.format(user_id)
+        data = {'email': new_email}
+        self.post(endpoint, data)

app/templates/views/change-email-continue.html

@@ -0,0 +1,13 @@
+{% extends "withoutnav_template.html" %}
+
+{% block page_title %}
+  Check your email – GOV.UK Notify
+{% endblock %}
+
+{% block maincolumn_content %}
+
+  <h1 class="heading-large">Check your email​</h1>
+  <p>An email has been sent to {{ new_email }}.</p>
+  <p>Click the link in the email to confirm the change to your email address.</p>
+
+{% endblock %}