User registration now creates user via api.

Verification flow is still to be completed.

Foreign key constraint on verify codes to user table removed.

app/__init__.py

@@ -8,6 +8,7 @@ from flask_login import LoginManager
 from flask_wtf import CsrfProtect
 from werkzeug.exceptions import abort
 from app.notify_client.api_client import NotificationsAdminAPIClient
+from app.notify_client.user_api_client import UserApiClient
 from app.its_dangerous_session import ItsdangerousSessionInterface
 import app.proxy_fix
 from config import configs
@@ -18,6 +19,7 @@ login_manager = LoginManager()
 csrf = CsrfProtect()
 
 notifications_api_client = NotificationsAdminAPIClient()
+user_api_client = UserApiClient()
 
 
 def create_app(config_name, config_overrides=None):
@@ -31,6 +33,7 @@ def create_app(config_name, config_overrides=None):
     init_csrf(application)
 
     notifications_api_client.init_app(application)
+    user_api_client.init_app(application)
 
     login_manager.init_app(application)
     login_manager.login_view = 'main.sign_in'

app/main/dao/verify_codes_dao.py

@@ -13,7 +13,7 @@ def add_code(user_id, code, code_type):
 
     db.session.add(code)
     db.session.commit()
-    return code.id
+    return code
 
 
 def get_codes(user_id, code_type=None):
@@ -23,7 +23,7 @@ def get_codes(user_id, code_type=None):
 
 
 def get_code_by_code(user_id, code, code_type):
-    return VerifyCodes.query.filter_by(user_id=user_id, code=code, code_type=code_type).first()
+    return VerifyCodes.query.filter_by(user_id=user_id, code=hashpw(code), code_type=code_type).first()
 
 
 def use_code(id):

app/main/views/register.py

@@ -15,7 +15,7 @@ from app.models import User
 from app.main.dao import users_dao
 from app.main.forms import RegisterUserForm
 
-from app.notify_client.user_api_client import UserApiClient
+from app import user_api_client
 
 # TODO how do we handle duplicate unverifed email addresses?
 # malicious or otherwise.
@@ -28,23 +28,11 @@ def register():
 
     if form.validate_on_submit():
 
-        #  TODO remove once all api integrations done
-        user = User(name=form.name.data,
-                    email_address=form.email_address.data,
-                    mobile_number=form.mobile_number.data,
-                    password=form.password.data,
-                    created_at=datetime.now(),
-                    role_id=1)
-        users_dao.insert_user(user)
-
-        user_api_client = UserApiClient(current_app.config['API_HOST_NAME'],
-                                        current_app.config['ADMIN_CLIENT_USER_NAME'],
-                                        current_app.config['ADMIN_CLIENT_SECRET'])
         try:
-            user_api_client.register_user(form.name.data,
-                                          form.email_address.data,
-                                          form.mobile_number.data,
-                                          form.password.data)
+            user = user_api_client.register_user(form.name.data,
+                                                 form.email_address.data,
+                                                 form.mobile_number.data,
+                                                 form.password.data)
         except HTTPError as e:
             if e.status_code == 404:
                 abort(404)
@@ -56,10 +44,10 @@ def register():
         # How do we report to the user there is a problem with
         # sending codes apart from service unavailable?
         # at the moment i believe http 500 is fine.
-        send_sms_code(user_id=user.id, mobile_number=form.mobile_number.data)
-        send_email_code(user_id=user.id, email=form.email_address.data)
+        send_sms_code(user_id=user.id, mobile_number=user.mobile_number)
+        send_email_code(user_id=user.id, email=user.email_address)
         session['expiry_date'] = str(datetime.now() + timedelta(hours=1))
-        session['user_email'] = user.email_address
+        session['user_details'] = {"email": user.email_address, "id": user.id}
         return redirect('/verify')
 
     return render_template('views/register.html', form=form)

app/main/views/verify.py

@@ -1,5 +1,10 @@
 from flask import (
-    render_template, redirect, jsonify, session, url_for)
+    render_template,
+    redirect,
+    jsonify,
+    session,
+    url_for
+)
 
 from flask_login import login_user
 
@@ -12,13 +17,16 @@ from app.main.forms import VerifyForm
 def verify():
     # TODO there needs to be a way to regenerate a session id
     # or handle gracefully.
-    user = users_dao.get_user_by_email(session['user_email'])
-    codes = verify_codes_dao.get_codes(user.id)
+    user_id = session['user_details']['id']
+    codes = verify_codes_dao.get_codes(user_id)
     form = VerifyForm(codes)
     if form.validate_on_submit():
-        verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='email')
-        verify_codes_dao.use_code_for_user_and_type(user_id=user.id, code_type='sms')
-        users_dao.activate_user(user.id)
-        login_user(user)
+        verify_codes_dao.use_code_for_user_and_type(user_id=user_id, code_type='email')
+        verify_codes_dao.use_code_for_user_and_type(user_id=user_id, code_type='sms')
+
+        # TODO complete verify and login flow
+        # users_dao.activate_user(user.id)
+        # login_user(user)
+
         return redirect(url_for('.add_service', first='first'))
     return render_template('views/verify.html', form=form)

app/models.py

@@ -12,7 +12,7 @@ class VerifyCodes(db.Model):
     code_types = ['email', 'sms']
 
     id = db.Column(db.Integer, primary_key=True)
-    user_id = db.Column(db.Integer, db.ForeignKey('users.id'), index=True, unique=False, nullable=False)
+    user_id = db.Column(db.Integer, index=True, unique=False, nullable=False)
     code = db.Column(db.String, nullable=False)
     code_type = db.Column(db.Enum(code_types, name='verify_code_types'), index=False, unique=False, nullable=False)
     expiry_datetime = db.Column(db.DateTime, nullable=False)

app/notify_client/user_api_client.py

@@ -3,16 +3,72 @@ from client.notifications import BaseAPIClient
 
 class UserApiClient(BaseAPIClient):
 
-    def __init__(self, base_url, client_id, secret):
-        super(self.__class__, self).__init__(base_url=base_url,
-                                             client_id=client_id,
-                                             secret=secret)
+    def __init__(self, base_url=None, client_id=None, secret=None):
+        super(self.__class__, self).__init__(base_url=base_url or 'base_url',
+                                             client_id=client_id or 'client_id',
+                                             secret=secret or 'secret')
+
+    def init_app(self, app):
+        self.base_url = app.config['API_HOST_NAME']
+        self.client_id = app.config['ADMIN_CLIENT_USER_NAME']
+        self.secret = app.config['ADMIN_CLIENT_SECRET']
+        self.user_max_failed_login_count = app.config["MAX_FAILED_LOGIN_COUNT"]
 
     def register_user(self, name, email_address,  mobile_number, password):
         data = {
             "name": name,
             "email_address": email_address,
             "mobile_number": mobile_number,
-            "password": password}
+            "password": password
+        }
+        user_data = self.post("/user", data)
+        return User(user_data, max_failed_login_count=self.user_max_failed_login_count)
 
-        return self.post("/user", data)
+
+class User(object):
+
+    def __init__(self, fields, max_failed_login_count=3):
+        self.fields = fields
+        self.max_failed_login_count = max_failed_login_count
+
+    @property
+    def id(self):
+        return self.fields.get('id')
+
+    @property
+    def name(self):
+        return self.fields.get('name')
+
+    @property
+    def email_address(self):
+        return self.fields.get('email_address')
+
+    @property
+    def mobile_number(self):
+        return self.fields.get('mobile_number')
+
+    @property
+    def password_changed_at(self):
+        return self.fields.get('password_changed_at')
+
+    @property
+    def is_authenticated(self):
+        return self.fields.get('is_authenticated')
+
+    @property
+    def is_active(self):
+        if self.fields.get('state') != 'active':
+            return False
+        else:
+            return True
+
+    @property
+    def is_anonymous(self):
+        return False
+
+    @property
+    def is_locked(self):
+        if self.fields.get('failed_login_count') < self.max_failed_login_count:
+            return False
+        else:
+            return True