peter
ed91c83dd7
"Your account is awaiting admin approval." was true and useless. It never said WHICH mailbox the account was on, and on 2026-09-03 that silence hid a Gmail alias mismatch for a day: a registration as np.temu@gmail.com met a Google claim of nptemu@gmail.com, and every screen in the funnel agreed to say nothing about it. Every refusal password-login can answer with now uses the codebase's structured {code, reason} detail, built in one helper. The three that arrive AFTER the password is proven carry the address on the account plus both gate flags; the two that answer before it (invalid, rate_limited) carry nothing, so a wrong password and an unknown account stay byte-identical. The frontend renders the first three as a named screen in place of the form — there is nothing to retype once the password is correct — with an icon, the two-gate checklist, the address in monospace, and a resend CTA where one helps. Reporting each gate from its own flag is the payoff of S1: approved-but-unverified is a real state now, and a screen that assumed a sequence would send that user off to wait for an admin who has already decided. The Google access-request notice names the address too, and says so when the request was already on file under ANOTHER spelling of the same mailbox — the honest version of "we didn't open a second one", stated only when it applies. It moved from the query string to the fragment: the notice now carries an address, and a query string lands in every reverse-proxy access log. Same reasoning that put the verify/reset tokens there, and the same owner already clears it. urlencode, not an f-string, because URLSearchParams reads a bare + in a fragment as a space and would mangle exactly the +tag addresses this epic exists to protect. upsert_pending_invite returns the row it settled on beside the is-new flag, since the row's stored address is what the notice has to name and what mail will go to. Deviation from the PendingScreen mockup, deliberately: no "Sign out" button and no separate "Not your address?" link. The mockup drew the panel in the app shell; the accepted decision (a) keeps the pending user session-less, so there is no session to end, and the address is named directly above a "Back to sign in" that answers the same question. UAT on localdev, both languages: all three refusals with the typed spelling deliberately differing from the stored one (the panel named the stored one), the resend CTA carrying the typed address into the resend form, and both access-request banners with a +tag address surviving the fragment round trip. Throwaway accounts and the language switch reverted.
108 lines
4.8 KiB
Python
108 lines
4.8 KiB
Python
"""What a refused sign-in SAYS (E9.5 S4), DB-lane.
|
|
|
|
The states behind a 403 were true and useless: "Your account is awaiting admin approval." never
|
|
revealed WHICH mailbox the account was on. On 2026-09-03 a registration as `npeter83.temu@gmail.com`
|
|
met a Google claim of `npeter83temu@gmail.com`, and that missing address hid the mismatch for a day.
|
|
So these pin the DETAIL, not just the status code — the address, and both gates, since E9.5 S1 made
|
|
the two order-independent and the screen must report whichever is actually outstanding.
|
|
|
|
The two refusals that answer BEFORE the password is proven carry nothing, and that is the security
|
|
half of the same contract: `invalid` must stay byte-identical for a real account and an unknown one.
|
|
"""
|
|
|
|
from app.config import settings
|
|
from app.models import Invite
|
|
from app.routes.auth import _access_notice_url, upsert_pending_invite
|
|
|
|
_PW = "correct horse battery"
|
|
|
|
|
|
def _login(client, email, password=_PW):
|
|
return client.post("/auth/password-login", json={"email": email, "password": password})
|
|
|
|
|
|
def test_pending_approval_names_the_address_the_account_is_on(client, make_user):
|
|
# The typed spelling and the stored one are the same mailbox; the screen must show the STORED
|
|
# one, because that is the mismatch a user cannot otherwise see.
|
|
make_user(email="np.temu@gmail.com", password=_PW, is_active=False)
|
|
|
|
detail = _login(client, "nptemu@gmail.com").json()["detail"]
|
|
|
|
assert detail["reason"] == "pending_approval"
|
|
assert detail["email"] == "np.temu@gmail.com"
|
|
assert detail["email_verified"] is True and detail["approved"] is False
|
|
|
|
|
|
def test_an_already_approved_account_still_reports_its_missing_verification(client, make_user):
|
|
# S1 made the gates order-independent, so this really happens: approved, not yet verified. A
|
|
# screen that assumed a sequence would tell this user to wait for an admin who already decided.
|
|
make_user(
|
|
email="approved.first@example.com", password=_PW, email_verified=False, is_active=True
|
|
)
|
|
|
|
detail = _login(client, "approved.first@example.com").json()["detail"]
|
|
|
|
assert detail["reason"] == "email_unverified"
|
|
assert detail["email_verified"] is False and detail["approved"] is True
|
|
|
|
|
|
def test_a_suspended_account_is_told_who_to_contact(client, make_user, monkeypatch):
|
|
monkeypatch.setattr(settings, "admin_emails", "ops@example.com")
|
|
make_user(email="banned@example.com", password=_PW, is_suspended=True)
|
|
|
|
r = _login(client, "banned@example.com")
|
|
|
|
assert r.status_code == 403
|
|
assert r.json()["detail"]["reason"] == "suspended"
|
|
assert r.json()["detail"]["operator"] == "ops@example.com"
|
|
|
|
|
|
def test_a_refusal_before_the_password_is_proven_carries_no_account_detail(client, make_user):
|
|
make_user(email="real@example.com", password=_PW, is_active=False)
|
|
|
|
wrong_pw = _login(client, "real@example.com", "not the password").json()["detail"]
|
|
unknown = _login(client, "nobody@example.com").json()["detail"]
|
|
|
|
# No address, no flags — the pending state above must not leak through the wrong-password door.
|
|
assert wrong_pw == unknown == {"code": "login", "reason": "invalid"}
|
|
|
|
|
|
# --- the access-request notice -------------------------------------------------------------------
|
|
|
|
|
|
def test_the_access_notice_names_the_address_and_rides_the_fragment():
|
|
url = _access_notice_url("requested", "someone@example.com")
|
|
|
|
# A fragment never reaches a proxy access log or a Referer header — the same reasoning that put
|
|
# the verify/reset tokens there (SB3), applied to an address.
|
|
assert url == "/#access=requested&email=someone%40example.com"
|
|
|
|
|
|
def test_a_plus_tagged_address_survives_the_round_trip():
|
|
# URLSearchParams reads a bare `+` in a fragment as a SPACE, so the encoder must emit %2B — or
|
|
# the very address family this epic exists to protect arrives mangled.
|
|
url = _access_notice_url("requested", "me+siftlode@gmail.com")
|
|
|
|
assert "me%2Bsiftlode%40gmail.com" in url and "+siftlode" not in url
|
|
|
|
|
|
def test_a_request_already_on_file_under_another_spelling_says_so(db):
|
|
db.add(Invite(email="hartmann.peter@gmail.com", status="pending"))
|
|
db.commit()
|
|
|
|
req = upsert_pending_invite(db, "hartmannpeter@gmail.com")
|
|
url = _access_notice_url("requested", "hartmannpeter@gmail.com", req.invite)
|
|
|
|
assert req.is_new is False # one mailbox, one request — no second row for the admin queue
|
|
assert "linked=hartmann.peter%40gmail.com" in url
|
|
|
|
|
|
def test_the_same_spelling_twice_is_just_a_repeat_and_says_nothing_extra(db):
|
|
db.add(Invite(email="same@example.com", status="pending"))
|
|
db.commit()
|
|
|
|
req = upsert_pending_invite(db, "same@example.com")
|
|
|
|
# Nothing to explain: telling this user we "linked" their request to itself would be noise.
|
|
assert "linked" not in _access_notice_url("requested", "same@example.com", req.invite)
|