darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2025-12-21 07:51:13 -05:00
Code Issues Packages Projects Releases Wiki Activity

Don’t update email_access_validated_at on password reset

Browse Source 
As of https://github.com/alphagov/notifications-admin/pull/4000/files
the admin app is doing this, so we don’t need to do it here as well.
This commit is contained in:
Chris Hill-Scott
2021-08-17 16:59:51 +01:00
parent 43f010ea1b
commit 2c7e4657ce
4 changed files with 6 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/dao/users_dao.py
View File

@@ -123,12 +123,10 @@ def reset_failed_login_count(user):
db.session.commit() db.session.commit()
def update_user_password(user, password, validated_email_access=False): def update_user_password(user, password):
# reset failed login count - they've just reset their password so should be fine # reset failed login count - they've just reset their password so should be fine
user.password = password user.password = password
user.password_changed_at = datetime.utcnow() user.password_changed_at = datetime.utcnow()
if validated_email_access:
user.email_access_validated_at = datetime.utcnow()
db.session.add(user) db.session.add(user)
db.session.commit() db.session.commit()

3
app/user/rest.py
View File

@@ -533,11 +533,10 @@ def update_password(user_id):
user = get_user_by_id(user_id=user_id) user = get_user_by_id(user_id=user_id)
req_json = request.get_json() req_json = request.get_json()
password = req_json.get('_password') password = req_json.get('_password')
validated_email_access = req_json.pop('validated_email_access', False)
update_dct, errors = user_update_password_schema_load_json.load(req_json) update_dct, errors = user_update_password_schema_load_json.load(req_json)
if errors: if errors:
raise InvalidRequest(errors, status_code=400) raise InvalidRequest(errors, status_code=400)
update_user_password(user, password, validated_email_access=validated_email_access) update_user_password(user, password)
return jsonify(data=user.serialize()), 200 return jsonify(data=user.serialize()), 200

10
tests/app/dao/test_users_dao.py
View File

@@ -159,19 +159,13 @@ def test_update_user_attribute(client, sample_user, user_attribute, user_value):
@freeze_time('2020-01-24T12:00:00') @freeze_time('2020-01-24T12:00:00')
@pytest.mark.parametrize('from_email', [True, False]) def test_update_user_password(notify_api, notify_db, notify_db_session, sample_user):
def test_update_user_password(notify_api, notify_db, notify_db_session, sample_user, from_email):
sample_user.password_changed_at = datetime.utcnow() - timedelta(days=1) sample_user.password_changed_at = datetime.utcnow() - timedelta(days=1)
sample_user.email_access_validated_at = datetime.utcnow() - timedelta(days=1)
password = 'newpassword' password = 'newpassword'
assert not sample_user.check_password(password) assert not sample_user.check_password(password)
update_user_password(sample_user, password, validated_email_access=from_email) update_user_password(sample_user, password)
assert sample_user.check_password(password) assert sample_user.check_password(password)
assert sample_user.password_changed_at == datetime.utcnow() assert sample_user.password_changed_at == datetime.utcnow()
if from_email:
assert sample_user.email_access_validated_at == datetime.utcnow()
else:
assert sample_user.email_access_validated_at == datetime.utcnow() - timedelta(days=1)
def test_count_user_verify_codes(sample_user): def test_count_user_verify_codes(sample_user):

16
tests/app/user/test_rest.py
View File

@@ -791,30 +791,18 @@ def test_send_user_confirm_new_email_returns_400_when_email_missing(client, samp
mocked.assert_not_called() mocked.assert_not_called()
@pytest.mark.parametrize('data,email_access_validated_at', [
({'_password': '1234567890'}, datetime(2020, 2, 13, 12, 0)),
({
'_password': '1234567890',
'validated_email_access': True,
}, datetime(2020, 2, 14, 12, 0)),
({
'_password': '1234567890',
'validated_email_access': False,
}, datetime(2020, 2, 13, 12, 0))
])
@freeze_time('2020-02-14T12:00:00') @freeze_time('2020-02-14T12:00:00')
def test_update_user_password_saves_correctly(client, sample_service, data, email_access_validated_at): def test_update_user_password_saves_correctly(client, sample_service):
sample_user = sample_service.users[0] sample_user = sample_service.users[0]
sample_user.email_access_validated_at = datetime(2020, 2, 13, 12, 0)
new_password = '1234567890' new_password = '1234567890'
auth_header = create_admin_authorization_header() auth_header = create_admin_authorization_header()
headers = [('Content-Type', 'application/json'), auth_header] headers = [('Content-Type', 'application/json'), auth_header]
data = {'_password': '1234567890'}
resp = client.post( resp = client.post(
url_for('user.update_password', user_id=sample_user.id), url_for('user.update_password', user_id=sample_user.id),
data=json.dumps(data), data=json.dumps(data),
headers=headers) headers=headers)
assert resp.status_code == 200 assert resp.status_code == 200
assert sample_user.email_access_validated_at == email_access_validated_at
json_resp = json.loads(resp.get_data(as_text=True)) json_resp = json.loads(resp.get_data(as_text=True))
assert json_resp['data']['password_changed_at'] is not None assert json_resp['data']['password_changed_at'] is not None