Merge pull request #984 from alphagov/confirm-email-change

Send an email to the user when they change email address

app/main/views/index.py

@@ -1,12 +1,8 @@
-import markdown
-import os
-from flask import (render_template, url_for, redirect, Markup, request, abort)
+from flask import (render_template, url_for, redirect, request, abort)
 from app.main import main
 from app import convert_to_boolean
-from flask_login import login_required
+from flask_login import (login_required, current_user)
 
-from flask.ext.login import current_user
-from mdx_gfm import GithubFlavoredMarkdownExtension
 
 from notifications_utils.renderers import HTMLEmail
 

app/main/views/register.py

@@ -8,11 +8,10 @@ from flask import (
     redirect,
     session,
     abort,
-    url_for,
-    flash
+    url_for
 )
 
-from flask.ext.login import current_user
+from flask_login import current_user
 
 from app.main import main
 

app/main/views/sign_in.py

@@ -9,7 +9,7 @@ from flask import (
     Markup
 )
 
-from flask.ext.login import (
+from flask_login import (
     current_user,
     login_fresh,
     confirm_login

app/main/views/sign_out.py

@@ -4,7 +4,7 @@ from flask import (
     session
 )
 
-from flask.ext.login import logout_user
+from flask_login import logout_user
 
 from app.main import main
 

app/main/views/user_profile.py

@@ -1,19 +1,21 @@
+import json
+
 from flask import (
     render_template,
     redirect,
     url_for,
-    session
-)
+    session,
+    current_app)
+
+from flask_login import login_required, current_user
+from notifications_utils.url_safe_token import check_token
 
-from flask.ext.login import current_user
-from flask_login import login_required
 from app.main import main
 
 from app.main.forms import (
     ChangePasswordForm,
     ChangeNameForm,
     ChangeEmailForm,
-    ConfirmEmailForm,
     ChangeMobileNumberForm,
     ConfirmMobileNumberForm,
     ConfirmPasswordForm
@@ -23,7 +25,6 @@ from app import user_api_client
 
 NEW_EMAIL = 'new-email'
 NEW_MOBILE = 'new-mob'
-NEW_EMAIL_PASSWORD_CONFIRMED = 'new-email-password-confirmed'
 NEW_MOBILE_PASSWORD_CONFIRMED = 'new-mob-password-confirmed'
 
 
@@ -82,10 +83,9 @@ def user_profile_email_authenticate():
         return redirect('main.user_profile_email')
 
     if form.validate_on_submit():
-        current_user.email_address = session[NEW_EMAIL]
-        del session[NEW_EMAIL]
-        user_api_client.update_user(current_user)
-        return redirect(url_for('.user_profile'))
+        user_api_client.send_change_email_verification(current_user.id, session[NEW_EMAIL])
+        return render_template('views/change-email-continue.html',
+                               new_email=session[NEW_EMAIL])
 
     return render_template(
         'views/user-profile/authenticate.html',
@@ -95,6 +95,25 @@ def user_profile_email_authenticate():
     )
 
 
+@main.route("/user-profile/email/confirm/<token>", methods=['GET'])
+@login_required
+def user_profile_email_confirm(token):
+
+    token_data = check_token(token,
+                             current_app.config['SECRET_KEY'],
+                             current_app.config['DANGEROUS_SALT'],
+                             current_app.config['EMAIL_EXPIRY_SECONDS'])
+    token_data = json.loads(token_data)
+    user_id = token_data['user_id']
+    new_email = token_data['email']
+    user = user_api_client.get_user(user_id)
+    user.email_address = new_email
+    user_api_client.update_user(user)
+    session.pop(NEW_EMAIL, None)
+
+    return redirect(url_for('.user_profile'))
+
+
 @main.route("/user-profile/mobile-number", methods=['GET', 'POST'])
 @login_required
 def user_profile_mobile_number():