Merge pull request #3670 from alphagov/show-broadcast-tour-when-password-reset

Take user to page they are meant to visit in various sign-in flow scenarios

app/main/views/code_not_received.py

@@ -1,4 +1,4 @@
-from flask import redirect, render_template, session, url_for
+from flask import redirect, render_template, request, session, url_for
 
 from app import user_api_client
 from app.main import main
@@ -19,16 +19,17 @@ def resend_email_verification():
 @redirect_to_sign_in
 def check_and_resend_text_code():
     user = User.from_email_address(session['user_details']['email'])
+    redirect_url = request.args.get('next')
 
     if user.state == 'active':
         # this is a verified user and therefore redirect to page to request resend without edit mobile
-        return render_template('views/verification-not-received.html')
+        return render_template('views/verification-not-received.html', redirect_url=redirect_url)
 
     form = TextNotReceivedForm(mobile_number=user.mobile_number)
     if form.validate_on_submit():
         user.send_verify_code(to=form.mobile_number.data)
         user.update(mobile_number=form.mobile_number.data)
-        return redirect(url_for('.verify'))
+        return redirect(url_for('.verify', next=redirect_url))
 
     return render_template('views/text-not-received.html', form=form)
 
@@ -38,16 +39,18 @@ def check_and_resend_text_code():
 def check_and_resend_verification_code():
     user = User.from_email_address(session['user_details']['email'])
     user.send_verify_code()
+    redirect_url = request.args.get('next')
     if user.state == 'pending':
-        return redirect(url_for('main.verify'))
+        return redirect(url_for('main.verify', next=redirect_url))
     else:
-        return redirect(url_for('main.two_factor'))
+        return redirect(url_for('main.two_factor', next=redirect_url))
 
 
 @main.route('/email-not-received', methods=['GET'])
 @redirect_to_sign_in
 def email_not_received():
-    return render_template('views/email-not-received.html')
+    redirect_url = request.args.get('next')
+    return render_template('views/email-not-received.html', redirect_url=redirect_url)
 
 
 @main.route('/send-new-email-token', methods=['GET'])

app/main/views/forgot_password.py

@@ -1,4 +1,4 @@
-from flask import render_template
+from flask import render_template, request
 from notifications_python_client.errors import HTTPError
 
 from app import user_api_client
@@ -11,7 +11,7 @@ def forgot_password():
     form = ForgotPasswordForm()
     if form.validate_on_submit():
         try:
-            user_api_client.send_reset_password_url(form.email_address.data)
+            user_api_client.send_reset_password_url(form.email_address.data, next_string=request.args.get('next'))
         except HTTPError as e:
             if e.status_code == 404:
                 return render_template('views/password-reset-sent.html')

app/main/views/new_password.py

@@ -5,6 +5,7 @@ from flask import (
     flash,
     redirect,
     render_template,
+    request,
     session,
     url_for,
 )
@@ -46,6 +47,6 @@ def new_password(token):
         else:
             # send user a 2fa sms code
             user.send_verify_code()
-            return redirect(url_for('main.two_factor'))
+            return redirect(url_for('main.two_factor', next=request.args.get('next')))
     else:
         return render_template('views/new-password.html', token=token, form=form, user=user)

app/main/views/sign_in.py

@@ -24,6 +24,8 @@ def sign_in():
         return redirect(url_for('main.show_accounts_or_dashboard'))
 
     form = LoginForm()
+    password_reset_url = url_for('.forgot_password', next=request.args.get('next'))
+    redirect_url = request.args.get('next')
 
     if form.validate_on_submit():
 
@@ -32,7 +34,7 @@ def sign_in():
         )
 
         if user and user.state == 'pending':
-            return redirect(url_for('main.resend_email_verification'))
+            return redirect(url_for('main.resend_email_verification', next=redirect_url))
 
         if user and session.get('invited_user'):
             invited_user = InvitedUser.from_session()
@@ -44,24 +46,25 @@ def sign_in():
                 invited_user.accept_invite()
         if user and user.sign_in():
             if user.sms_auth:
-                return redirect(url_for('.two_factor', next=request.args.get('next')))
+                return redirect(url_for('.two_factor', next=redirect_url))
             if user.email_auth:
-                return redirect(url_for('.two_factor_email_sent'))
+                return redirect(url_for('.two_factor_email_sent', next=redirect_url))
 
         # Vague error message for login in case of user not known, locked, inactive or password not verified
         flash(Markup(
             (
-                "The email address or password you entered is incorrect."
-                " <a href={password_reset}>Forgotten your password?</a>"
-            ).format(password_reset=url_for('.forgot_password'))
+                f"The email address or password you entered is incorrect."
+                f" <a href={password_reset_url}>Forgotten your password?</a>"
+            )
         ))
 
     other_device = current_user.logged_in_elsewhere()
     return render_template(
         'views/signin.html',
         form=form,
-        again=bool(request.args.get('next')),
-        other_device=other_device
+        again=bool(redirect_url),
+        other_device=other_device,
+        password_reset_url=password_reset_url
     )
 
 

app/main/views/two_factor.py

@@ -24,7 +24,8 @@ def two_factor_email_sent():
     title = 'Email resent' if request.args.get('email_resent') else 'Check your email'
     return render_template(
         'views/two-factor-email.html',
-        title=title
+        title=title,
+        redirect_url=request.args.get('next')
     )
 
 
@@ -35,6 +36,7 @@ def two_factor_email_interstitial(token):
 
 @main.route('/email-auth/<token>', methods=['POST'])
 def two_factor_email(token):
+    redirect_url = request.args.get('next')
     if current_user.is_authenticated:
         return redirect_when_logged_in(platform_admin=current_user.platform_admin)
 
@@ -47,14 +49,14 @@ def two_factor_email(token):
             current_app.config['EMAIL_2FA_EXPIRY_SECONDS']
         ))
     except SignatureExpired:
-        return render_template('views/email-link-invalid.html')
+        return render_template('views/email-link-invalid.html', redirect_url=redirect_url)
 
     user_id = token_data['user_id']
     # checks if code was already used
     logged_in, msg = user_api_client.check_verify_code(user_id, token_data['secret_code'], "email")
 
     if not logged_in:
-        return render_template('views/email-link-invalid.html')
+        return render_template('views/email-link-invalid.html', redirect_url=redirect_url)
     return log_in_user(user_id)
 
 
@@ -68,21 +70,23 @@ def two_factor():
         return user_api_client.check_verify_code(user_id, code, "sms")
 
     form = TwoFactorForm(_check_code)
+    redirect_url = request.args.get('next')
 
     if form.validate_on_submit():
         if is_less_than_days_ago(user.email_access_validated_at, 90):
             return log_in_user(user_id)
         else:
-            user_api_client.send_verify_code(user.id, 'email', None, request.args.get('next'))
-            return redirect(url_for('.revalidate_email_sent'))
+            user_api_client.send_verify_code(user.id, 'email', None, redirect_url)
+            return redirect(url_for('.revalidate_email_sent', next=redirect_url))
 
-    return render_template('views/two-factor.html', form=form)
+    return render_template('views/two-factor.html', form=form, redirect_url=redirect_url)
 
 
 @main.route('/re-validate-email', methods=['GET'])
 def revalidate_email_sent():
     title = 'Email resent' if request.args.get('email_resent') else 'Check your email'
-    return render_template('views/re-validate-email-sent.html', title=title)
+    redirect_url = request.args.get('next')
+    return render_template('views/re-validate-email-sent.html', title=title, redirect_url=redirect_url)
 
 
 # see http://flask.pocoo.org/snippets/62/