feat(admin): add modal to delete an email address (#18039)

In some cases, removing an email address is desirable, such as when the
user has already added a correct second address to their account, and
editing the existing invalid one would be a duplicate record.

Signed-off-by: Mike Fiedler <[email protected]>

Author: miketheman

tests/unit/admin/test_routes.py

@@ -101,6 +101,13 @@ def test_includeme():
             factory="warehouse.accounts.models:UserFactory",
             traverse="/{username}",
         ),
+        pretend.call(
+            "admin.user.delete_email",
+            "/admin/users/{username}/delete_email/",
+            domain=warehouse,
+            factory="warehouse.accounts.models:UserFactory",
+            traverse="/{username}",
+        ),
         pretend.call(
             "admin.user.delete",
             "/admin/users/{username}/delete/",

tests/unit/admin/views/test_users.py

@@ -1562,3 +1562,41 @@ def test_user_email_domain_check(self, db_request):
         ]
         assert user.primary_email.domain_last_checked is not None
         assert user.primary_email.domain_last_status == ["active"]
+
+
+class TestUserEmailDelete:
+    def test_user_email_delete(self, db_request):
+        user = UserFactory.create(with_verified_primary_email=True)
+        email = EmailFactory.create(user=user, primary=False, verified=False)
+
+        db_request.POST["email_address"] = email.email
+        db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/foobar")
+        db_request.session = pretend.stub(
+            flash=pretend.call_recorder(lambda *a, **kw: None)
+        )
+
+        result = views.user_email_delete(user, db_request)
+
+        assert isinstance(result, HTTPSeeOther)
+        assert result.headers["Location"] == "/foobar"
+        assert db_request.session.flash.calls == [
+            pretend.call(f"Email address '{email.email}' deleted", queue="success")
+        ]
+        assert email.email not in user.emails
+
+    def test_user_email_delete_not_found(self, db_request):
+        user = UserFactory.create(with_verified_primary_email=True)
+
+        db_request.POST["email_address"] = "[email protected]"
+        db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/foobar")
+        db_request.session = pretend.stub(
+            flash=pretend.call_recorder(lambda *a, **kw: None)
+        )
+
+        result = views.user_email_delete(user, db_request)
+
+        assert isinstance(result, HTTPSeeOther)
+        assert result.headers["Location"] == "/foobar"
+        assert db_request.session.flash.calls == [
+            pretend.call("Email not found", queue="error")
+        ]

warehouse/admin/routes.py

@@ -99,6 +99,13 @@ def includeme(config):
         domain=warehouse,
         traverse="/{username}",
     )
+    config.add_route(
+        "admin.user.delete_email",
+        "/admin/users/{username}/delete_email/",
+        domain=warehouse,
+        factory="warehouse.accounts.models:UserFactory",
+        traverse="/{username}",
+    )
     config.add_route(
         "admin.user.delete",
         "/admin/users/{username}/delete/",

warehouse/admin/templates/admin/users/detail.html

@@ -556,6 +556,12 @@ <h3 class="card-title">Emails</h3>
                             <i class="fa fa-times text-red"></i> Unverify Reason: {{ field.unverify_reason.data.value }}
                           </div>
                         {% endif %}
+                        <button type="button"
+                                class="btn btn-sm btn-danger"
+                                data-toggle="modal"
+                                data-target="#deleteEmail-{{ field.email.id }}">
+                          <i class="fa fa-trash"></i>
+                        </button>
                       </div>
                       <div class="row">
                         <div class="col-sm">Domain Status: {{ field.domain_last_status.data }}</div>
@@ -1091,5 +1097,38 @@ <h4 class="modal-title" id="checkDomainStatusModalLabel">Check domain status?</h
         </div>
       </form>
     </div>
+
+    <div class="modal fade"
+         id="deleteEmail-{{ email.id }}-email"
+          tabindex="-1"
+          role="dialog">
+      <form method="POST"
+            action="{{ request.route_path('admin.user.delete_email', username=user.username, email_address=email.email.data) }}">
+        <input name="csrf_token"
+               type="hidden"
+               value="{{ request.session.get_csrf_token() }}">
+        <input name="email_address" type="hidden" value="{{ email.email.data }}">
+        <div class="modal-dialog" role="document">
+          <div class="modal-content">
+            <div class="modal-header">
+              <h4 class="modal-title" id="deleteEmailModalLabel">Delete email?</h4>
+              <button type="button" class="close" data-dismiss="modal">
+                <span>&times;</span>
+              </button>
+            </div>
+            <div class="modal-body">
+              <p>Are you sure you want to delete this email address?</p>
+              <p>Email address:</p>
+              <code>{{ email.email.data }}</code>
+            </div>
+            <div class="modal-footer">
+              <button type="button" class="btn btn-secondary" data-dismiss="modal">Close</button>
+              <button type="submit" class="btn btn-danger">Delete</button>
+            </div>
+          </div>
+        </div>
+      </form>
+    </div>
+
   {% endfor %}
 {% endblock %}

warehouse/admin/views/users.py

@@ -10,8 +10,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from __future__ import annotations
+
 import datetime
 import shlex
+import typing
 
 from collections import defaultdict
 from secrets import token_urlsafe
@@ -49,6 +52,9 @@
 from warehouse.packaging.models import JournalEntry, Project, Release, Role
 from warehouse.utils.paginate import paginate_url_factory
 
+if typing.TYPE_CHECKING:
+    from pyramid.request import Request
+
 
 @view_config(
     route_name="admin.user.list",
@@ -301,6 +307,31 @@ def user_add_email(user, request):
     return HTTPSeeOther(request.route_path("admin.user.detail", username=user.username))
 
 
+@view_config(
+    route_name="admin.user.delete_email",
+    require_methods=["POST"],
+    permission=Permissions.AdminUsersEmailWrite,
+    uses_session=True,
+    require_csrf=True,
+    context=User,
+)
+def user_email_delete(user: User, request: Request) -> HTTPSeeOther:
+    email = request.db.scalar(
+        select(Email).where(
+            Email.email == request.POST.get("email_address"), Email.user == user
+        )
+    )
+    if not email:
+        request.session.flash("Email not found", queue="error")
+        return HTTPSeeOther(
+            request.route_path("admin.user.detail", username=user.username)
+        )
+
+    request.db.delete(email)
+    request.session.flash(f"Email address {email.email!r} deleted", queue="success")
+    return HTTPSeeOther(request.route_path("admin.user.detail", username=user.username))
+
+
 def _nuke_user(user, request):
     # Delete all the user's projects
     projects = request.db.query(Project).filter(