Merge pull request #2700 from alphagov/re-validate-user-email

Add email_access_valdiated_at field to user table, populate it

app/dao/users_dao.py

@@ -28,15 +28,17 @@ def save_user_attribute(usr, update_dict={}):
     db.session.commit()
 
 
-def save_model_user(usr, update_dict={}, pwd=None):
-    if pwd:
-        usr.password = pwd
-        usr.password_changed_at = datetime.utcnow()
+def save_model_user(user, update_dict={}, password=None, validated_email_access=False):
+    if password:
+        user.password = password
+        user.password_changed_at = datetime.utcnow()
+    if validated_email_access:
+        user.email_access_validated_at = datetime.utcnow()
     if update_dict:
         _remove_values_for_keys_if_present(update_dict, ['id', 'password_changed_at'])
-        db.session.query(User).filter_by(id=usr.id).update(update_dict)
+        db.session.query(User).filter_by(id=user.id).update(update_dict)
     else:
-        db.session.add(usr)
+        db.session.add(user)
     db.session.commit()
 
 
@@ -121,10 +123,12 @@ def reset_failed_login_count(user):
         db.session.commit()
 
 
-def update_user_password(user, password):
+def update_user_password(user, password, validated_email_access=False):
     # reset failed login count - they've just reset their password so should be fine
     user.password = password
     user.password_changed_at = datetime.utcnow()
+    if validated_email_access:
+        user.email_access_validated_at = datetime.utcnow()
     db.session.add(user)
     db.session.commit()
 

app/models.py

@@ -114,6 +114,7 @@ class User(db.Model):
     platform_admin = db.Column(db.Boolean, nullable=False, default=False)
     current_session_id = db.Column(UUID(as_uuid=True), nullable=True)
     auth_type = db.Column(db.String, db.ForeignKey('auth_type.name'), index=True, nullable=False, default=SMS_AUTH_TYPE)
+    email_access_validated_at = db.Column(db.DateTime, index=False, unique=False, nullable=False)
 
     # either email auth or a mobile number must be provided
     CheckConstraint("auth_type = 'email_auth' or mobile_number is not null")
@@ -162,6 +163,7 @@ class User(db.Model):
             'auth_type': self.auth_type,
             'current_session_id': self.current_session_id,
             'failed_login_count': self.failed_login_count,
+            'email_access_validated_at': self.email_access_validated_at,
             'logged_in_at': self.logged_in_at.strftime(DATETIME_FORMAT) if self.logged_in_at else None,
             'mobile_number': self.mobile_number,
             'organisations': [x.id for x in self.organisations if x.active],

app/schemas.py

@@ -101,6 +101,7 @@ class UserSchema(BaseSchema):
         model = models.User
         exclude = (
             "updated_at",
+            "email_access_validated_at",
             "created_at",
             "user_to_service",
             "user_to_organisation",

app/user/rest.py

@@ -78,7 +78,7 @@ def create_user():
     if not req_json.get('password', None):
         errors.update({'password': ['Missing data for required field.']})
         raise InvalidRequest(errors, status_code=400)
-    save_model_user(user_to_create, pwd=req_json.get('password'))
+    save_model_user(user_to_create, password=req_json.get('password'), validated_email_access=True)
     result = user_to_create.serialize()
     return jsonify(data=result), 201
 
@@ -197,6 +197,8 @@ def verify_user_code(user_id):
 
     user_to_verify.current_session_id = str(uuid.uuid4())
     user_to_verify.logged_in_at = datetime.utcnow()
+    if user_to_verify.auth_type == 'email_auth':
+        user_to_verify.email_access_validated_at = datetime.utcnow()
     user_to_verify.failed_login_count = 0
     save_model_user(user_to_verify)
 
@@ -459,11 +461,12 @@ def send_user_reset_password():
 def update_password(user_id):
     user = get_user_by_id(user_id=user_id)
     req_json = request.get_json()
-    pwd = req_json.get('_password')
+    password = req_json.get('_password')
+    validated_email_access = req_json.get('validated_email_access')
     update_dct, errors = user_update_password_schema_load_json.load(req_json)
     if errors:
         raise InvalidRequest(errors, status_code=400)
-    update_user_password(user, pwd)
+    update_user_password(user, password, validated_email_access=validated_email_access)
     return jsonify(data=user.serialize()), 200