Commit Graph

91 Commits

Author SHA1 Message Date
Chris Hill-Scott
10af2bccf7 Extract user profile route into its own file 2016-01-12 15:30:18 +00:00
Adam Shimali
03c7d7a0ff Merge pull request #63 from alphagov/require_login
Add login_required for all endpoints where it makes sense.
2016-01-12 11:54:33 +00:00
Rebecca Law
3eefce56d4 Add login_required for all endpoints where it makes sense.
https://www.pivotaltracker.com/story/show/111240834
2016-01-12 11:26:28 +00:00
Adam Shimali
886d0c8c95 Added content security policy header.
unsafe-inline exception added to allow inline js scripts
we have in base govuk_template.
2016-01-12 11:08:10 +00:00
Adam Shimali
bfd7291426 resolve merge conflicts 2016-01-12 10:43:23 +00:00
Rebecca Law
05695a1c03 Updated generate_token to use encrypt the entire url.
Created notify_client.sender to hold the methods to send notifications.
2016-01-11 15:18:37 +00:00
Adam Shimali
584533eb11 First slice of csv upload of phone numbers for sending messages.
At the moment the file contents are not persisted by checked in
memory.

The first and last three records are show if all are valid.

If there are invalid rows, they are reported and the user is
prompted to go back and sort out upload file.

The storing of upload result (i.e. validation of file) in session
will be removed in next story which is about persisting of file
for later processing.
2016-01-11 15:00:51 +00:00
Chris Hill-Scott
b303e06ca0 Add a styleguide page
There are now quite a few frontend components in the app.

It’s good to have a reference for them to:
- document for developers what patterns are available and how they are used
- check for regressions
  - when working on one variation of a pattern you can check that your changes
    don’t break other variations of it
  - when changing the arguments to a pattern you can check that this doesn’t
    change the expected arguments already in use

This commit adds a single page (`/_styleguide`) which has examples of all the
patterns.
2016-01-11 14:27:31 +00:00
Rebecca Law
bb1db0c345 When the user request a reset password link, the user.state is set to request_password_reset.
Which means the user will only be able to reset their password, and not sign-in.
Once the user resets the password the user state is set to active once more.
If the link is used a second time they will be redirected to the index page with a message
that the link in the email is not longer valid.
2016-01-11 12:23:08 +00:00
Rebecca Law
f7373ee5fc Fix wording
Changed forgot-password so that it does not expose to the user that the email address does not exist.
2016-01-11 12:23:08 +00:00
Rebecca Law
c858869a52 Removed exceptions, found a better way to handle them.
Refactored the forms so that fields like email_address can be used in multiple forms.
Refactored form validation so that a query function is passed into the form to be run, this
way the form is not exposed to the dao layer and the query is more efficient.

This PR still requires some frontend attention. Will work with Chris to update the templates.
2016-01-11 12:23:08 +00:00
Rebecca Law
ceb78f49b4 Take out the Canadian politeness.
Make the error message more consistent.
Extracted common fields for the forms.
2016-01-11 12:23:08 +00:00
Rebecca Law
f951b364ac Actually use the mock in the test 2016-01-11 12:23:07 +00:00
Rebecca Law
eb78a77808 Added the mock for the admin_api_client 2016-01-11 12:23:07 +00:00
Rebecca Law
35619553c8 Added NoDataFoundException 2016-01-11 12:23:07 +00:00
Rebecca Law
a860f713d2 Implementation of the new_password endpoint.
Found a way to create the token that does not need to persist it to the database.
This requires proper error messages, written by people who speak menglis good.
2016-01-11 12:23:07 +00:00
Rebecca Law
b5901a1ac7 New-password endpoints are implemented.
There should be a better way to validate the token.
2016-01-11 12:23:07 +00:00
Rebecca Law
2cb896fa81 Completion of forgot-password endpoints.
Start implementation for new-password endpoints.
Created PasswordResetToken model
ToDo: create and save token, send valid url to user,
check validity of token, update user's password, redirect to /two-factor.
2016-01-11 12:23:07 +00:00
Rebecca Law
6696426dbc Add endpoints for forgot-password. 2016-01-11 12:22:39 +00:00
Chris Hill-Scott
86db5fa0b9 Make wording on 2nd-level pages match prev. commit 2016-01-08 17:17:34 +00:00
Chris Hill-Scott
0b62d1e755 Add confirm loop
For pages where
- we want you to be sure that you want to do what you’re about to do
- we want to be sure it’s you trying to do the thing

This adds a page that asks the user to confirm their password.
2016-01-08 14:59:30 +00:00
Chris Hill-Scott
3989d1b576 Add pages for ‘service settings’ flow
Adds the pages and wires them together, so that it’s possible to click
through them.

The wording is not quite English, but attempts to be an rough description of
what the consequences are for each of the four actions.
2016-01-08 14:56:14 +00:00
Rebecca Law
afd03ea5bf Merge pull request #46 from alphagov/add-useful-headers
Add some useful owasp suggested headers
2016-01-07 15:39:51 +00:00
Adam Shimali
78b8aed96b Add some useful owasp suggested headers 2016-01-07 13:58:38 +00:00
Nicholas Staples
7001d8261d Fix for security hole with setting session['user_id'] before second factor of authentication has been authorised. 2016-01-07 12:43:10 +00:00
Nicholas Staples
10c2978f85 Merge with master and test fix. 2016-01-06 17:17:02 +00:00
Nicholas Staples
0a4ea6ca2e Merge branch 'master' into provide_logout_link 2016-01-06 17:06:04 +00:00
Nicholas Staples
79c15ec9cf Code checks and all tests passing. 2016-01-06 16:51:35 +00:00
Nicholas Staples
5905229714 Logout functionality and test added. 2016-01-06 16:40:38 +00:00
Nicholas Staples
921c10a1fa Merge with master. 2016-01-06 10:55:45 +00:00
Chris Hill-Scott
ba48707371 Add routing and pages for managing templates
So that users can see what it the flow is like to:
- add new templates
- edit existing templates
2016-01-06 09:39:42 +00:00
Nicholas Staples
0ebacd6929 Refactor for code_not_received, sign_in, two_factor and verify. 2016-01-05 17:08:50 +00:00
Nicholas Staples
1f520116f0 Sign in view, form and template refactored. 2016-01-05 14:30:06 +00:00
Chris Hill-Scott
31e6e53d46 Make data consistent from dashboard -> job
- adds a table of recent activity to the job page, which is shared by the
  dashboard page
- uses the same filename and message template as the first job shown on the
  dashboard
- sets the time of file uploads/message delivery/message sending to always
  match ‘just now’
2016-01-05 13:31:54 +00:00
Chris Hill-Scott
0e6dab3f5c Add unit tests for activity (and SMS) flows
These are basic tests to make sure that the pages stay stitched together.

Added for both the jobs and send SMS flows (because the send SMS flow didn’t
have any before)
2016-01-05 13:31:54 +00:00
Nicholas Staples
7693ba8a18 Update register view form and template. 2016-01-05 12:41:20 +00:00
Rebecca Law
785c413cde Move and rename macro.html
Remove print statements
Fix code style
2016-01-04 15:50:26 +00:00
Rebecca Law
ac05f6931e Refactor add-service form such that the dao is not exposed in the forms. 2016-01-04 15:31:50 +00:00
Rebecca Law
b2f544a165 110880218: Completed implementation of resend the verificaton code 2015-12-31 13:16:59 +00:00
Rebecca Law
fb5e80e0d4 110880218: Implementation to resend the verification code.
Added implementation for GET/POST for the /verification-not-received endpoint.
2015-12-31 11:13:42 +00:00
Rebecca Law
10dd647f2b Merge pull request #35 from alphagov/did-not-receive-code
Implementation for did not receive email or sms code
2015-12-31 10:32:34 +00:00
Rebecca Law
e38df7cda1 109898688: Fix unit test 2015-12-17 16:16:12 +00:00
Rebecca Law
7478f8a0f3 Make Users.email_address unique 2015-12-17 14:57:26 +00:00
Rebecca Law
010be66d31 109898688: Complete the implementation of the did not receive code. 2015-12-17 14:33:20 +00:00
Rebecca Law
64812c1614 109898688: All codes are valid until one code is used, then they are all marked used.
Fixed the is_active() method on the Users model, if the user was pending they would come back as active, allowing a user to sign in before being active.
There is still a problem with the validate_sms_code and validate_email_code method.
2015-12-17 14:33:20 +00:00
Rebecca Law
bd8bb3c926 109898688: Implementation of text-not-received and email-not-received 2015-12-17 14:33:20 +00:00
Rebecca Law
e9383b733e 109898688: Implement get method for email-not-received and text-not-received 2015-12-17 14:33:20 +00:00
Rebecca Law
258ae3674b 110067722: Fix code style 2015-12-15 10:32:26 +00:00
Rebecca Law
eb0cff18c5 110067722: Add form validation for duplicate service name. 2015-12-15 10:32:26 +00:00
Rebecca Law
43f2605ac4 110067722: Post add-service endpoint saves the service and maps it to the user. 2015-12-15 10:32:26 +00:00