Send 2fa email and move user to waiting page when they need to re-validate email access

app/main/views/two_factor.py

@@ -1,4 +1,5 @@
 import json
+from datetime import datetime
 
 from flask import (
     current_app,
@@ -57,6 +58,7 @@ def two_factor_email(token):
 @redirect_to_sign_in
 def two_factor():
     user_id = session['user_details']['id']
+    user = User.from_id(user_id)
 
     def _check_code(code):
         return user_api_client.check_verify_code(user_id, code, "sms")
@@ -64,11 +66,23 @@ def two_factor():
     form = TwoFactorForm(_check_code)
 
     if form.validate_on_submit():
-        return log_in_user(user_id)
+        if (datetime.utcnow() - datetime.strptime(
+            user.email_access_validated_at, '%a, %d %b %Y %X %Z'
+        )).days < 90:
+            return log_in_user(user_id)
+        else:
+            user_api_client.send_verify_code(user.id, 'email', None, request.args.get('next'))
+            return redirect(url_for('.revalidate_email_sent'))
 
     return render_template('views/two-factor.html', form=form)
 
 
+@main.route('/re-validate-email', methods=['GET'])
+def revalidate_email_sent():
+    title = 'Email resent' if request.args.get('email_resent') else 'Check your email'
+    return render_template('views/re-validate-email-sent.html', title=title)
+
+
 # see http://flask.pocoo.org/snippets/62/
 def _is_safe_redirect_url(target):
     from urllib.parse import urlparse, urljoin
@@ -85,7 +99,7 @@ def log_in_user(user_id):
         session['current_session_id'] = user.current_session_id
         # Check if coming from new password page
         if 'password' in session.get('user_details', {}):
-            user.update_password(session['user_details']['password'])
+            user.update_password(session['user_details']['password'], from_email=True)
         user.activate()
         user.login()
     finally:

app/models/user.py

@@ -34,6 +34,7 @@ class User(JSONModel, UserMixin):
         'auth_type',
         'current_session_id',
         'failed_login_count',
+        'email_access_validated_at',
         'logged_in_at',
         'mobile_number',
         'password_changed_at',
@@ -105,8 +106,8 @@ class User(JSONModel, UserMixin):
         response = user_api_client.update_user_attribute(self.id, **kwargs)
         self.__init__(response)
 
-    def update_password(self, password):
-        response = user_api_client.update_password(self.id, password)
+    def update_password(self, password, from_email=False):
+        response = user_api_client.update_password(self.id, password, from_email=from_email)
         self.__init__(response)
 
     def password_changed_more_recently_than(self, datetime_string):

app/navigation.py

@@ -112,6 +112,7 @@ class HeaderNavigation(Navigation):
             'view_providers',
         },
         'sign-in': {
+            'revalidate_email_sent',
             'sign_in',
             'two_factor',
             'two_factor_email',
@@ -583,6 +584,7 @@ class MainNavigation(Navigation):
         'returned_letter_summary',
         'returned_letters',
         'returned_letters_report',
+        'revalidate_email_sent',
         'roadmap',
         'robots',
         'security',
@@ -829,6 +831,7 @@ class CaseworkNavigation(Navigation):
         'returned_letter_summary',
         'returned_letters',
         'returned_letters_report',
+        'revalidate_email_sent',
         'revoke_api_key',
         'roadmap',
         'robots',
@@ -1114,6 +1117,7 @@ class OrgNavigation(Navigation):
         'returned_letter_summary',
         'returned_letters',
         'returned_letters_report',
+        'revalidate_email_sent',
         'revoke_api_key',
         'roadmap',
         'robots',

app/notify_client/user_api_client.py

@@ -75,8 +75,10 @@ class UserApiClient(NotifyAdminAPIClient):
         return user_data['data']
 
     @cache.delete('user-{user_id}')
-    def update_password(self, user_id, password):
+    def update_password(self, user_id, password, from_email=False):
         data = {"_password": password}
+        if from_email:
+            data["from_email"] = from_email
         url = "/user/{}/update-password".format(user_id)
         user_data = self.post(url, data=data)
         return user_data['data']

app/templates/views/re-validate-email-sent.html

@@ -0,0 +1,24 @@
+{% extends "withoutnav_template.html" %}
+{% from "components/page-footer.html" import page_footer %}
+
+{% block per_page_title %}
+  {{ title }}
+{% endblock %}
+
+{% block maincolumn_content %}
+
+<div class="grid-row">
+  <div class="column-two-thirds">
+    <h1 class="heading-large">{{ title }}</h1>
+    <p>For security reasons we need to check if you still have access to your email.
+    Hence, we have emailed you a link to sign in to Notify.</p>
+    <p>If your email address has changed, ask a member of your team to update your email address. Then click re-send.</p>
+    <p>Clicking the link will open Notify in a new browser window, so you can close this one.</p>
+    {{ page_footer(
+      secondary_link=url_for('main.email_not_received'),
+      secondary_link_text='Not received an email?'
+    ) }}
+  </div>
+</div>
+
+{% endblock %}