try again

app/main/views/sign_in.py

@@ -5,7 +5,6 @@ import uuid
 import jwt
 import requests
 from flask import (
-    Markup,
     Response,
     abort,
     current_app,
@@ -13,32 +12,28 @@ from flask import (
     redirect,
     render_template,
     request,
-    session,
     url_for,
 )
 from flask_login import current_user
-from notifications_utils.url_safe_token import generate_token
 
 from app import login_manager, user_api_client
 from app.main import main
-from app.main.forms import LoginForm
 from app.main.views.index import error
 from app.main.views.verify import activate_user
-from app.models.user import InvitedUser, User
+from app.models.user import User
 from app.utils import hide_from_search_engines
 from app.utils.login import is_safe_redirect_url
 from app.utils.time import is_less_than_days_ago
+from app.utils.user import is_gov_user
+from notifications_utils.url_safe_token import generate_token
 
 
 def _reformat_keystring(orig):
-    new_keystring = orig.replace("-----BEGIN PRIVATE KEY-----", "")
-    new_keystring = new_keystring.replace("-----END PRIVATE KEY-----", "")
-    new_keystring = new_keystring.strip()
-    new_keystring = new_keystring.replace(" ", "\n")
-    new_keystring = "\n".join(
-        ["-----BEGIN PRIVATE KEY-----", new_keystring, "-----END PRIVATE KEY-----"]
-    )
-    new_keystring = f"{new_keystring}\n"
+    arr = orig.split("-----")
+    begin = arr[1]
+    end = arr[3]
+    middle = arr[2].strip()
+    new_keystring = f"-----{begin}-----\n{middle}\n-----{end}-----\n"
     return new_keystring
 
 
@@ -67,7 +62,9 @@ def _get_access_token(code, state):
     response = requests.post(url, headers=headers)
     if response.json().get("access_token") is None:
         # Capture the response json here so it hopefully shows up in error reports
-        current_app.logger.error(f"Error when getting access token {response.json()}")
+        current_app.logger.error(
+            f"Error when getting access token {response.json()} #notify-admin-1505"
+        )
         raise KeyError(f"'access_token' {response.json()}")
     access_token = response.json()["access_token"]
     return access_token
@@ -92,7 +89,9 @@ def _do_login_dot_gov():
     login_gov_error = request.args.get("error")
 
     if login_gov_error:
-        current_app.logger.error(f"login.gov error: {login_gov_error}")
+        current_app.logger.error(
+            f"login.gov error: {login_gov_error} #notify-admin-1505"
+        )
         raise Exception(f"Could not login with login.gov {login_gov_error}")
     elif code and state:
 
@@ -100,8 +99,17 @@ def _do_login_dot_gov():
         try:
             access_token = _get_access_token(code, state)
             user_email, user_uuid = _get_user_email_and_uuid(access_token)
+            if not is_gov_user(user_email):
+                current_app.logger.error(
+                    "invited user has a non-government email address. #notify-admin-1505"
+                )
+                flash("You must use a government email address.")
+                abort(403)
             redirect_url = request.args.get("next")
             user = user_api_client.get_user_by_uuid_or_email(user_uuid, user_email)
+            current_app.logger.info(
+                f"Retrieved user {user['id']} from db #notify-admin-1505"
+            )
 
             # Check if the email needs to be revalidated
             is_fresh_email = is_less_than_days_ago(
@@ -111,9 +119,10 @@ def _do_login_dot_gov():
                 return verify_email(user, redirect_url)
 
             usr = User.from_email_address(user["email_address"])
+            current_app.logger.info(f"activating user {usr.id} #notify-admin-1505")
             activate_user(usr.id)
         except BaseException as be:  # noqa B036
-            current_app.logger.error(be)
+            current_app.logger.error(f"Error signing in: {be} #notify-admin-1505 ")
             error(401)
         return redirect(url_for("main.show_accounts_or_dashboard", next=redirect_url))
 
@@ -129,6 +138,16 @@ def verify_email(user, redirect_url):
     )
 
 
+def _handle_e2e_tests(redirect_url):
+    current_app.logger.warning("E2E TESTS ARE ENABLED.")
+    current_app.logger.warning(
+        "If you are getting a 404 on signin, comment out E2E vars in .env file!"
+    )
+    user = user_api_client.get_user_by_email(os.getenv("NOTIFY_E2E_TEST_EMAIL"))
+    activate_user(user["id"])
+    return redirect(url_for("main.show_accounts_or_dashboard", next=redirect_url))
+
+
 @main.route("/sign-in", methods=(["GET", "POST"]))
 @hide_from_search_engines
 def sign_in():
@@ -156,63 +175,14 @@ def sign_in():
 
     redirect_url = request.args.get("next")
 
-    current_app.logger.warning("FAILED TO BOUNCE OUT OF SIGN IN")
-    current_app.logger.info(f"current user is {current_user}")
+    if os.getenv("NOTIFY_E2E_TEST_EMAIL"):
+        return _handle_e2e_tests(redirect_url)
+
     if current_user and current_user.is_authenticated:
         if redirect_url and is_safe_redirect_url(redirect_url):
             return redirect(redirect_url)
         return redirect(url_for("main.show_accounts_or_dashboard"))
 
-    form = LoginForm()
-    current_app.logger.info("Got the login form")
-    password_reset_url = url_for(".forgot_password", next=request.args.get("next"))
-
-    if form.validate_on_submit():
-        user = User.from_email_address_and_password_or_none(
-            form.email_address.data, form.password.data
-        )
-
-        if user:
-            # add user to session to mark us as in the process of signing the user in
-            session["user_details"] = {"email": user.email_address, "id": user.id}
-
-            if user.state == "pending":
-                return redirect(
-                    url_for("main.resend_email_verification", next=redirect_url)
-                )
-
-            if user.is_active:
-                if session.get("invited_user_id"):
-                    invited_user = InvitedUser.from_session()
-                    if user.email_address.lower() != invited_user.email_address.lower():
-                        flash("You cannot accept an invite for another person.")
-                        session.pop("invited_user_id", None)
-                        abort(403)
-                    else:
-                        invited_user.accept_invite()
-
-                user.send_login_code()
-
-                if user.sms_auth:
-                    return redirect(url_for(".two_factor_sms", next=redirect_url))
-
-                if user.email_auth:
-                    return redirect(
-                        url_for(".two_factor_email_sent", next=redirect_url)
-                    )
-
-        # Vague error message for login in case of user not known, locked, inactive or password not verified
-        flash(
-            Markup(
-                (
-                    f"The email address or password you entered is incorrect."
-                    f"&ensp;<a href={password_reset_url} class='usa-link'>Forgot your password?</a>"
-                )
-            )
-        )
-
-    other_device = current_user.logged_in_elsewhere()
-
     token = generate_token(
         str(request.remote_addr),
         current_app.config["SECRET_KEY"],
@@ -225,10 +195,7 @@ def sign_in():
         url = url.replace("STATE", token)
     return render_template(
         "views/signin.html",
-        form=form,
         again=bool(redirect_url),
-        other_device=other_device,
-        password_reset_url=password_reset_url,
         initial_signin_url=url,
     )