Alternatively, you can paste the following link in your browser's address bar:
{{ url_for('auth.confirm', token=token, _external=True) }}
+If you did not create this account, reach out to {{ help_email }} to disable your account.
Sincerely,
The OpenOversight Team
diff --git a/OpenOversight/app/templates/auth/email/confirm.txt b/OpenOversight/app/templates/auth/email/confirm.txt index 41abe7c57..126cb97cb 100644 --- a/OpenOversight/app/templates/auth/email/confirm.txt +++ b/OpenOversight/app/templates/auth/email/confirm.txt @@ -6,6 +6,8 @@ To confirm your account please click on the following link: {{ url_for('auth.confirm', token=token, _external=True) }} +If you did not create this account, reach out to {{ help_email }} to disable your account. + Sincerely, The OpenOversight Team diff --git a/OpenOversight/app/utils/constants.py b/OpenOversight/app/utils/constants.py index baa60b338..620090674 100644 --- a/OpenOversight/app/utils/constants.py +++ b/OpenOversight/app/utils/constants.py @@ -12,6 +12,7 @@ # Config Key Constants KEY_ALLOWED_EXTENSIONS = "ALLOWED_EXTENSIONS" KEY_APPROVE_REGISTRATIONS = "APPROVE_REGISTRATIONS" +KEY_AUTH_EMAIL_COOLDOWN_HOURS = "AUTH_EMAIL_COOLDOWN_HOURS" KEY_DATABASE_URI = "SQLALCHEMY_DATABASE_URI" KEY_ENV = "ENV" KEY_ENV_DEV = "development" diff --git a/OpenOversight/migrations/versions/2025-04-04-0842_edab445d1714_add_email_last_sent_columns.py b/OpenOversight/migrations/versions/2025-04-04-0842_edab445d1714_add_email_last_sent_columns.py new file mode 100644 index 000000000..99bdd6d4e --- /dev/null +++ b/OpenOversight/migrations/versions/2025-04-04-0842_edab445d1714_add_email_last_sent_columns.py @@ -0,0 +1,32 @@ +"""Add email last sent columns + +Revision ID: edab445d1714 +Revises: 99c50fc8d294 +Create Date: 2025-04-04 08:42:14.823515 + +""" + +import sqlalchemy as sa +from alembic import op + + +revision = "edab445d1714" +down_revision = "99c50fc8d294" + + +def upgrade(): + with op.batch_alter_table("users", schema=None) as batch_op: + batch_op.add_column( + sa.Column( + "last_confirmation_sent_at", sa.DateTime(timezone=True), nullable=True + ) + ) + batch_op.add_column( + sa.Column("last_reset_sent_at", sa.DateTime(timezone=True), nullable=True) + ) + + +def downgrade(): + with op.batch_alter_table("users", schema=None) as batch_op: + batch_op.drop_column("last_reset_sent_at") + batch_op.drop_column("last_confirmation_sent_at") diff --git a/OpenOversight/tests/routes/test_auth.py b/OpenOversight/tests/routes/test_auth.py index ed054353e..5259bf564 100644 --- a/OpenOversight/tests/routes/test_auth.py +++ b/OpenOversight/tests/routes/test_auth.py @@ -1,3 +1,4 @@ +from datetime import datetime, timedelta, timezone from http import HTTPStatus from unittest import TestCase from urllib.parse import urlparse @@ -203,6 +204,49 @@ def test_user_can_get_a_confirmation_token_resent(client, session): ) +@pytest.mark.parametrize( + "last_confirmation_sent_at,is_rate_limited", + [ + (None, False), + (datetime.now(timezone.utc) - timedelta(hours=2), False), + (datetime.now(timezone.utc) - timedelta(minutes=10), True), + ], +) +def test_user_rate_limited_if_resending_confirmation_too_soon( + client, session, last_confirmation_sent_at, is_rate_limited +): + # Should only send email if not rate limited + log_capture = TestCase.assertNoLogs if is_rate_limited else TestCase.assertLogs + + with ( + current_app.test_request_context(), + log_capture(current_app.logger) as log, + ): + _, user = login_user(client) + user.last_confirmation_sent_at = last_confirmation_sent_at + session.commit() + + rv = client.get(url_for("auth.resend_confirmation"), follow_redirects=True) + + if not is_rate_limited: + assert b"A new confirmation email has been sent to you." in rv.data + assert ( + f"{current_app.config[KEY_OO_MAIL_SUBJECT_PREFIX]} Confirm Your Account" + in str(log.output) + ) + + # check that confirmation time was updated + assert user.last_confirmation_sent_at > datetime.now( + timezone.utc + ) - timedelta(seconds=1) + else: + assert ( + b"We already sent a confirmation email to you recently. Please try again later." + in rv.data + ) + assert user.last_confirmation_sent_at == last_confirmation_sent_at + + def test_user_can_get_password_reset_token_sent(client, session): with ( current_app.test_request_context(), @@ -247,6 +291,49 @@ def test_user_can_get_password_reset_token_sent_with_differently_cased_email( ) +@pytest.mark.parametrize( + "last_reset_sent_at,is_rate_limited", + [ + (None, False), + (datetime.now(timezone.utc) - timedelta(hours=2), False), + (datetime.now(timezone.utc) - timedelta(minutes=10), True), + ], +) +def test_user_rate_limited_if_resending_reset_too_soon( + client, session, last_reset_sent_at, is_rate_limited +): + with ( + current_app.test_request_context(), + TestCase.assertLogs(current_app.logger) as log, + ): + user = User.query.filter_by(is_administrator=True).first() + user.last_reset_sent_at = last_reset_sent_at + session.commit() + + form = PasswordResetRequestForm(email=user.email) + rv = client.post( + url_for("auth.password_reset_request"), + data=form.data, + follow_redirects=True, + ) + + assert b"An email with instructions to reset your password" in rv.data + if not is_rate_limited: + assert ( + f"{current_app.config[KEY_OO_MAIL_SUBJECT_PREFIX]} Reset Your Password" + in str(log.output) + ) + assert user.last_reset_sent_at > datetime.now(timezone.utc) - timedelta( + seconds=1 + ) + else: + assert ( + f"{current_app.config[KEY_OO_MAIL_SUBJECT_PREFIX]} Reset Your Password" + not in str(log.output) + ) + assert user.last_reset_sent_at == last_reset_sent_at + + def test_user_can_get_reset_password_with_valid_token(client, session): with current_app.test_request_context(): user = User.query.filter_by(is_administrator=True).first() diff --git a/OpenOversight/tests/test_models.py b/OpenOversight/tests/test_models.py index cce40d878..760ec70b4 100644 --- a/OpenOversight/tests/test_models.py +++ b/OpenOversight/tests/test_models.py @@ -3,6 +3,7 @@ import time from decimal import Decimal from unittest.mock import MagicMock +from zoneinfo import ZoneInfo import pytest from sqlalchemy import and_ @@ -18,6 +19,7 @@ Link, Location, Officer, + TZDateTime, User, ) from OpenOversight.app.utils.choices import STATE_CHOICES @@ -577,4 +579,61 @@ def test_currency_type_decorator(dialect_name, original_value, intermediate_valu assert intermediate_value == value value = currency.process_result_value(value, dialect) + + +@pytest.mark.parametrize( + "by_attr, at_attr", + [ + ("approved_by", "approved_at"), + ("confirmed_by", "confirmed_at"), + ("disabled_by", "disabled_at"), + ], +) +def test_user_constraints(mockdata, session, faker, by_attr, at_attr): + now = datetime.datetime.now(datetime.timezone.utc) + user = User( + email=faker.company_email(), + username=faker.word(), + password=faker.word(), + ) + session.add(user) + session.commit() + + setattr(user, at_attr, now) + setattr(user, by_attr, 1) + session.commit() + + # Both or neither "_at" and "_by" must be set + setattr(user, at_attr, None) + setattr(user, by_attr, 1) + with pytest.raises(IntegrityError): + session.commit() + + +@pytest.mark.parametrize( + "dialect_name,original_value,intermediate_value", + [ + ("sqlite", None, None), + ( + "sqlite", + datetime.datetime(1980, 1, 1, hour=0, tzinfo=ZoneInfo("America/Chicago")), + datetime.datetime(1980, 1, 1, hour=6), + ), + ("postgresql", None, None), + ( + "postgresql", + datetime.datetime(1980, 1, 1, hour=0, tzinfo=ZoneInfo("America/Chicago")), + datetime.datetime(1980, 1, 1, hour=0, tzinfo=ZoneInfo("America/Chicago")), + ), + ], +) +def test_tzdatetime_type_decorator(dialect_name, original_value, intermediate_value): + tzdt = TZDateTime(timezone=True) + dialect = MagicMock() + dialect.name = dialect_name + + value = tzdt.process_bind_param(original_value, dialect) + assert intermediate_value == value + + value = tzdt.process_result_value(value, dialect) assert original_value == value