feat: unverify expired domains (#18055)

Author: miketheman

tests/unit/accounts/test_tasks.py

@@ -6,11 +6,12 @@
 import pytest
 
 from warehouse.accounts import tasks
-from warehouse.accounts.models import TermsOfServiceEngagement
+from warehouse.accounts.models import TermsOfServiceEngagement, UnverifyReasons
 from warehouse.accounts.tasks import (
     batch_update_email_domain_status,
     compute_user_metrics,
     notify_users_of_tos_update,
+    unverify_emails_with_expired_domains,
 )
 
 from ...common.db.accounts import EmailFactory, UserFactory
@@ -238,3 +239,34 @@ def test_update_email_domain_status_does_not_update_if_not_needed(
 
     assert fail_check.domain_last_checked is None
     assert fail_check.domain_last_status is None
+
+
+def test_unverify_emails_with_expired_domains(db_request, user_service):
+    """
+    Test that the unverify_emails_with_expired_domains task works as expected.
+    """
+    # ensure an admin user exists
+    admin_user = UserFactory.create(username="admin")
+
+    expired_email = EmailFactory.create(domain_last_status=["undelegated"])
+    non_expired_email = EmailFactory.create(domain_last_status=["active"])
+
+    unverify_emails_with_expired_domains(db_request)
+
+    # Check that the expired email is now unverified and observation added
+    assert expired_email.verified is False
+    assert expired_email.unverify_reason == UnverifyReasons.DomainInvalid
+    assert expired_email.user.observations[-1].kind == "email_unverified"
+
+    # Check that the non-expired email is still verified, and no observation added
+    assert non_expired_email.verified is True
+    assert len(non_expired_email.user.observations) == 0
+
+    # Confirm that the observation was added to the "actor"
+    assert admin_user.observer.observations[-1].kind == "email_unverified"
+
+    assert db_request.metrics.increment.calls == [
+        pretend.call(
+            "warehouse.emails.unverified", value=1, tags=["reason:domain_expired"]
+        )
+    ]

warehouse/accounts/__init__.py

@@ -26,6 +26,7 @@
     batch_update_email_domain_status,
     compute_user_metrics,
     notify_users_of_tos_update,
+    unverify_emails_with_expired_domains,
 )
 from warehouse.accounts.utils import UserContext
 from warehouse.admin.flags import AdminFlagValue
@@ -210,5 +211,8 @@ def includeme(config):
     config.add_periodic_task(crontab(minute="*/20"), compute_user_metrics)
     config.add_periodic_task(crontab(minute="*"), notify_users_of_tos_update)
     config.add_periodic_task(
-        crontab(minute="0", hour=4), batch_update_email_domain_status
+        crontab(minute=0, hour=4), batch_update_email_domain_status
+    )
+    config.add_periodic_task(
+        crontab(minute=15, hour=4), unverify_emails_with_expired_domains
     )

warehouse/accounts/models.py

@@ -391,6 +391,7 @@ class UnverifyReasons(enum.Enum):
     SpamComplaint = "spam complaint"
     HardBounce = "hard bounce"
     SoftBounce = "soft bounce"
+    DomainInvalid = "domain status invalid"
 
 
 class Email(db.ModelBase):

warehouse/accounts/tasks.py

@@ -12,13 +12,15 @@
 from warehouse.accounts.models import (
     Email,
     TermsOfServiceEngagement,
+    UnverifyReasons,
     User,
     UserTermsOfServiceEngagement,
 )
 from warehouse.accounts.services import IUserService
 from warehouse.accounts.utils import update_email_domain_status
 from warehouse.email import send_user_terms_of_service_updated
 from warehouse.metrics import IMetricsService
+from warehouse.observations.models import ObservationKind
 from warehouse.packaging.models import Release
 
 if typing.TYPE_CHECKING:
@@ -160,3 +162,57 @@ def batch_update_email_domain_status(request: Request) -> None:
 
     for email in request.db.scalars(stmt):
         update_email_domain_status(email, request)
+
+
+@tasks.task(ignore_result=True, acks_late=True)
+def unverify_emails_with_expired_domains(request: Request) -> None:
+    """
+    Unverify any emails with domains that have expired.
+    """
+    task_actor = request.find_service(IUserService).get_admin_user()
+
+    stmt = (
+        select(Email)
+        .where(
+            Email.domain_last_status.overlap(
+                [
+                    "undelegated",
+                    "inactive",
+                    "expiring",
+                    "deleting",
+                    "unknown",
+                ]
+            ),
+            Email.verified.is_(True),
+        )
+        .order_by(Email.domain_last_checked)
+        .limit(1_000)
+    )
+
+    results = request.db.scalars(stmt).all()
+
+    for email in results:
+        # Unverify the email
+        email.verified = False
+        email.unverify_reason = UnverifyReasons.DomainInvalid
+        # add an observation to the email parent user
+        email.user.record_observation(
+            request=request,
+            kind=ObservationKind.EmailUnverified,
+            actor=task_actor,
+            summary="Email domain expired",
+            payload={
+                "email": email.email,
+                "domain": email.domain,
+                "domain_last_status": email.domain_last_status,
+                "domain_last_checked": str(email.domain_last_checked),
+            },
+        )
+
+        request.db.add(email)
+
+    request.metrics.increment(
+        "warehouse.emails.unverified",
+        value=len(results),
+        tags=["reason:domain_expired"],
+    )

warehouse/migrations/versions/082def83d89f_add_unverifyreason_domaininvalid.py

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: Apache-2.0
+"""
+Add UnverifyReason.DomainInvalid
+
+Revision ID: 082def83d89f
+Revises: 13c1c0ac92e9
+Create Date: 2025-04-30 20:13:58.084316
+"""
+
+from alembic import op
+from alembic_postgresql_enum import TableReference
+
+revision = "082def83d89f"
+down_revision = "13c1c0ac92e9"
+
+
+def upgrade():
+    op.sync_enum_values(
+        enum_schema="public",
+        enum_name="unverifyreasons",
+        new_values=[
+            "spam complaint",
+            "hard bounce",
+            "soft bounce",
+            "domain status invalid",
+        ],
+        affected_columns=[
+            TableReference(
+                table_schema="public",
+                table_name="user_emails",
+                column_name="unverify_reason",
+            )
+        ],
+        enum_values_to_rename=[],
+    )
+
+
+def downgrade():
+    op.sync_enum_values(
+        enum_schema="public",
+        enum_name="unverifyreasons",
+        new_values=["spam complaint", "hard bounce", "soft bounce"],
+        affected_columns=[
+            TableReference(
+                table_schema="public",
+                table_name="user_emails",
+                column_name="unverify_reason",
+            )
+        ],
+        enum_values_to_rename=[],
+    )

warehouse/observations/models.py

@@ -111,6 +111,7 @@ class ObservationKind(enum.Enum):
         "account_recovery",
         "Account Recovery",
     )
+    EmailUnverified = ("email_unverified", "Email Unverified")
 
     # Organization Applications
     InformationRequest = ("information_request", "Information Request")