From d0894245013e9e130542101d4093a396421f795d Mon Sep 17 00:00:00 2001 From: Pea Tyczynska Date: Mon, 5 Oct 2020 15:51:44 +0100 Subject: [PATCH] Forgot password sends redirect link with reset password email. This is so when users reset their password they are still redirected to pages they were meant to visit. This change was done specifically so everyone who is meant to see broadcast tour sees it, but it will improve lives of all users who wanted to visit a page on Notify but then had to reset their password in the process. --- app/main/views/forgot_password.py | 4 ++-- app/notify_client/user_api_client.py | 4 +++- tests/app/main/views/test_forgot_password.py | 22 ++++++++++++++++++-- 3 files changed, 25 insertions(+), 5 deletions(-) diff --git a/app/main/views/forgot_password.py b/app/main/views/forgot_password.py index a16c8a78a..359ad40c9 100644 --- a/app/main/views/forgot_password.py +++ b/app/main/views/forgot_password.py @@ -1,4 +1,4 @@ -from flask import render_template +from flask import render_template, request from notifications_python_client.errors import HTTPError from app import user_api_client @@ -11,7 +11,7 @@ def forgot_password(): form = ForgotPasswordForm() if form.validate_on_submit(): try: - user_api_client.send_reset_password_url(form.email_address.data) + user_api_client.send_reset_password_url(form.email_address.data, next_string=request.args.get('next')) except HTTPError as e: if e.status_code == 404: return render_template('views/password-reset-sent.html') diff --git a/app/notify_client/user_api_client.py b/app/notify_client/user_api_client.py index c97b241be..bafd22284 100644 --- a/app/notify_client/user_api_client.py +++ b/app/notify_client/user_api_client.py @@ -165,9 +165,11 @@ class UserApiClient(NotifyAdminAPIClient): endpoint = '/user/{}/service/{}/permission'.format(user_id, service_id) self.post(endpoint, data=data) - def send_reset_password_url(self, email_address): + def send_reset_password_url(self, email_address, next_string=None): endpoint = '/user/reset-password' data = {'email': email_address} + if next_string: + data['next'] = next_string self.post(endpoint, data=data) def find_users_by_full_or_partial_email(self, email_address): diff --git a/tests/app/main/views/test_forgot_password.py b/tests/app/main/views/test_forgot_password.py index c75f83210..dc7d4fd7e 100644 --- a/tests/app/main/views/test_forgot_password.py +++ b/tests/app/main/views/test_forgot_password.py @@ -31,7 +31,23 @@ def test_should_redirect_to_password_reset_sent_for_valid_email( assert response.status_code == 200 assert 'Click the link in the email to reset your password.' \ in response.get_data(as_text=True) - app.user_api_client.send_reset_password_url.assert_called_once_with(sample_user['email_address']) + app.user_api_client.send_reset_password_url.assert_called_once_with(sample_user['email_address'], next_string=None) + + +def test_forgot_password_sends_next_link_with_reset_password_email_request( + client, + fake_uuid, + mocker, +): + sample_user = user_json(email_address='test@user.gov.uk') + mocker.patch('app.user_api_client.send_reset_password_url', return_value=None) + response = client.post( + url_for('.forgot_password') + "?next=blob", + data={'email_address': sample_user['email_address']}) + assert response.status_code == 200 + app.user_api_client.send_reset_password_url.assert_called_once_with( + sample_user['email_address'], next_string="blob" + ) def test_should_redirect_to_password_reset_sent_for_missing_email( @@ -48,4 +64,6 @@ def test_should_redirect_to_password_reset_sent_for_missing_email( assert response.status_code == 200 assert 'Click the link in the email to reset your password.' \ in response.get_data(as_text=True) - app.user_api_client.send_reset_password_url.assert_called_once_with(api_user_active['email_address']) + app.user_api_client.send_reset_password_url.assert_called_once_with( + api_user_active['email_address'], next_string=None + )