Add should_change_password column

Author: Marc-Andrieu

app/core/users/cruds_users.py

@@ -283,6 +283,18 @@ async def update_user_password_by_id(
     await db.flush()
 
 
+async def update_should_user_change_password_by_id(
+    db: AsyncSession,
+    user_id: str,
+    should_change_password: bool = True,
+):
+    await db.execute(
+        update(models_users.CoreUser)
+        .where(models_users.CoreUser.id == user_id)
+        .values(should_change_password=should_change_password),
+    )
+
+
 async def remove_users_from_school(
     db: AsyncSession,
     school_id: UUID,

app/core/users/endpoints_users.py

@@ -406,6 +406,7 @@ async def activate_user(
         school_id=school_id,
         account_type=account_type,
         password_hash=password_hash,
+        should_change_password=False,
         name=user.name,
         firstname=user.firstname,
         nickname=user.nickname,

app/core/users/factory_users.py

@@ -93,6 +93,7 @@ async def create_core_users(cls, db: AsyncSession):
             user = CoreUser(
                 id=cls.other_users_id[i],
                 password_hash=password[i],
+                should_change_password=False,
                 firstname=firstname[i],
                 nickname=nickname[i],
                 name=name[i],
@@ -113,6 +114,7 @@ async def create_core_users(cls, db: AsyncSession):
                 password_hash=security.get_password_hash(
                     user_info.password or faker.password(16, True, True, True, True),
                 ),
+                should_change_password=False,
                 firstname=user_info.firstname,
                 nickname=user_info.nickname,
                 name=user_info.name,

app/core/users/models_users.py

@@ -24,6 +24,7 @@ class CoreUser(Base):
     email: Mapped[str] = mapped_column(unique=True, index=True)
     school_id: Mapped[UUID] = mapped_column(ForeignKey("core_school.id"))
     password_hash: Mapped[str]
+    should_change_password: Mapped[bool]
     # Depending on the account type, the user may have different rights and access to different features
     # External users may exist for:
     # - accounts meant to be used by external services based on Hyperion SSO or Hyperion backend

migrations/versions/43-password_invalidation.py

@@ -0,0 +1,53 @@
+"""password-invalidation
+
+Create Date: 2025-10-03 11:24:35.720759
+"""
+
+from collections.abc import Sequence
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from pytest_alembic import MigrationContext
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "cfba514689ed"
+down_revision: str | None = "c4812e1ab108"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        "core_user",
+        sa.Column(
+            "should_change_password",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.sql.false(),
+        ),
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column("core_user", "should_change_password")
+    # ### end Alembic commands ###
+
+
+def pre_test_upgrade(
+    alembic_runner: "MigrationContext",
+    alembic_connection: sa.Connection,
+) -> None:
+    pass
+
+
+def test_upgrade(
+    alembic_runner: "MigrationContext",
+    alembic_connection: sa.Connection,
+) -> None:
+    pass

tests/commons.py

@@ -193,6 +193,7 @@ async def create_user_with_groups(
         email=email or (get_random_string() + "@etu.ec-lyon.fr"),
         school_id=school_id,
         password_hash=password_hash,
+        should_change_password=False,
         name=name or get_random_string(),
         firstname=firstname or get_random_string(),
         nickname=nickname,