def ResetPassword(self, request, context):
"""
If the user does not exist, do nothing.
If the user exists, we send them an email. If they have a password, clicking that email will remove the password.
If they don't have a password, it sends them an email saying someone tried to reset the password but there was none.
Note that as long as emails are send synchronously, this is far from constant time regardless of output.
"""
with session_scope() as session:
user = session.execute(
select(User).where_username_or_email(request.user).where(
~User.is_deleted)).scalar_one_or_none()
if user:
send_password_reset_email(session, user)
notify(
user_id=user.id,
topic="account_recovery",
key="",
action="start",
icon="wrench",
title=f"Password reset initiated",
link=urls.account_settings_link(),
)
else: # user not found
logger.debug(f"Didn't find user")
return empty_pb2.Empty()
def ResetPassword(self, request, context):
"""
If the user does not exist, do nothing.
If the user exists, we send them an email. If they have a password, clicking that email will remove the password.
If they don't have a password, it sends them an email saying someone tried to reset the password but there was none.
Note that as long as emails are send synchronously, this is far from constant time regardless of output.
"""
with session_scope() as session:
user = get_user_by_field(session, request.user)
if user:
password_reset_token, expiry_text = new_password_reset_token(session, user)
send_password_reset_email(user, password_reset_token, expiry_text)
else: # user not found
logger.debug(f"Didn't find user")
return empty_pb2.Empty()
def test_password_reset_email(db):
user, api_token = generate_user()
with session_scope() as session:
with patch("couchers.email.queue_email") as mock:
password_reset_token = send_password_reset_email(session, user)
assert mock.call_count == 1
(sender_name, sender_email, recipient, subject, plain, html), _ = mock.call_args
assert recipient == user.email
assert "reset" in subject.lower()
assert password_reset_token.token in plain
assert password_reset_token.token in html
unique_string = "You asked for your password to be reset on Couchers.org."
assert unique_string in plain
assert unique_string in html
assert f"{config['BASE_URL']}/complete-password-reset?token={password_reset_token.token}" in plain
assert f"{config['BASE_URL']}/complete-password-reset?token={password_reset_token.token}" in html
assert "*****@*****.**" in plain
assert "*****@*****.**" in html