Allow email confirmation without being authenticated. (#79)

* Allow email confirmation without being authenticated.

* PR fixes for: Allow email confirmation without being authenticated.

* PR fixes for: Allow email confirmation without being authenticated.

Author: Kulv3r

genesis_core/elements/dm/models.py

@@ -317,7 +317,7 @@ class Resource(
 
     def get_uri(self):
         parts = self.link.split(".")
-        return f"/{"/".join(parts[1:-1])}/{self.uuid}"
+        return f"/{'/'.join(parts[1:-1])}/{self.uuid}"
 
     def get_parameter_value(self, parameter):
         parts = parameter.split(":")

genesis_core/elements/dm/utils.py

@@ -54,7 +54,7 @@ def get_element_uuid(element_name, element_version):
 def get_project_id():
     # return sys_uuid.UUID(f"{UUID_PREFIX}{str(sys_uuid.uuid4())[8:]}")
     return sys_uuid.UUID(
-        f"{UUID_PREFIX}{str("00000000-0000-0000-0000-000000000000")[8:]}"
+        f"{UUID_PREFIX}{str('00000000-0000-0000-0000-000000000000')[8:]}"
     )
 
 

genesis_core/tests/functional/conftest.py

@@ -36,7 +36,7 @@
 from genesis_core.config import constants as cc
 from genesis_core.secret import constants as sc
 from genesis_core.secret.dm import models as secret_models
-
+from genesis_core.user_api.iam.dm import models as iam_models
 
 FIRST_MIGRATION = "0000-root-d34de1.py"
 
@@ -136,17 +136,21 @@ def auth_test1_user(
 ):
     password = "test1"
     client = user_api_client(auth_user_admin)
-    result = client.create_user(username="test1", password=password)
-    client.confirm_email(result["uuid"])
+    user = client.create_user(username="test1", password=password)
+    user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
+    client.confirm_email(
+        user_uuid=user_obj.uuid,
+        code=str(user_obj.confirmation_code),
+    )
 
     return iam_clients.GenesisCoreAuth(
-        username=result["username"],
+        username=user["username"],
         password=password,
         client_uuid=default_client_uuid,
         client_id=default_client_id,
         client_secret=default_client_secret,
-        uuid=result["uuid"],
-        email=result["email"],
+        uuid=user["uuid"],
+        email=user["email"],
     )
 
 
@@ -160,17 +164,21 @@ def auth_test2_user(
 ):
     password = "test2"
     client = user_api_client(auth_user_admin)
-    result = client.create_user(username="test2", password=password)
-    client.confirm_email(result["uuid"])
+    user = client.create_user(username="test2", password=password)
+    user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
+    client.confirm_email(
+        user_uuid=user_obj.uuid,
+        code=str(user_obj.confirmation_code),
+    )
 
     return iam_clients.GenesisCoreAuth(
-        username=result["username"],
+        username=user["username"],
         password=password,
         client_uuid=default_client_uuid,
         client_id=default_client_id,
         client_secret=default_client_secret,
-        uuid=result["uuid"],
-        email=result["email"],
+        uuid=user["uuid"],
+        email=user["email"],
     )
 
 
@@ -185,7 +193,11 @@ def auth_test1_p1_user(
     password = "test1p1"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test1p1", password=password)
-    client.confirm_email(user_uuid=user["uuid"])
+    user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
+    client.confirm_email(
+        user_uuid=user_obj.uuid,
+        code=str(user_obj.confirmation_code),
+    )
 
     auth = iam_clients.GenesisCoreAuth(
         username=user["username"],
@@ -198,9 +210,7 @@ def auth_test1_p1_user(
         project_id=None,
     )
 
-    client = client = user_api_client(
-        auth,
-    )
+    client = user_api_client(auth)
 
     org = client.create_organization(name="OrganizationU1P1")
     project = client.create_project(
@@ -232,7 +242,11 @@ def auth_test2_p1_user(
     password = "test2p1"
     client = user_api_client(auth_user_admin)
     user = client.create_user(username="test2p1", password=password)
-    client.confirm_email(user_uuid=user["uuid"])
+    user_obj = iam_models.User.objects.get_one(filters={"uuid": user["uuid"]})
+    client.confirm_email(
+        user_uuid=user_obj.uuid,
+        code=str(user_obj.confirmation_code),
+    )
 
     auth = iam_clients.GenesisCoreAuth(
         username=user["username"],
@@ -245,9 +259,7 @@ def auth_test2_p1_user(
         project_id=None,
     )
 
-    client = client = user_api_client(
-        auth,
-    )
+    client = user_api_client(auth)
 
     org = client.create_organization(name="OrganizationU2P1")
     project = client.create_project(

genesis_core/tests/functional/restapi/iam/test_users.py

@@ -13,13 +13,15 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
+import uuid as sys_uuid
 
-from bazooka import exceptions as bazooka_exc
 import pytest
+from bazooka import exceptions as bazooka_exc
 
 from genesis_core.common import constants as common_c
 from genesis_core.tests.functional.restapi.iam import base
 from genesis_core.user_api.iam import constants as c
+from genesis_core.user_api.iam.dm import models as iam_models
 
 
 class TestUsers(base.BaseIamResourceTest):
@@ -231,6 +233,57 @@ def test_update_other_user_change_password_test1_auth_success(
 
         assert result["uuid"] == auth_test2_user.uuid
 
+    def test_confirm_email_no_auth_success(
+        self,
+        user_api_noauth_client,
+        auth_test1_user,
+    ):
+        user = iam_models.User.objects.get_one(
+            filters={"uuid": auth_test1_user.uuid}
+        )
+        user.email_verified = False
+        user.confirmation_code = sys_uuid.uuid4()
+        user.save()
+
+        client = user_api_noauth_client()
+        result = client.confirm_email(
+            user_uuid=auth_test1_user.uuid,
+            code=str(user.confirmation_code),
+        )
+        # Check for success in the API response
+        assert result["uuid"] == str(auth_test1_user.uuid)
+        assert result["email_verified"] is True
+
+        # Check for success in the DB
+        user_updated = iam_models.User.objects.get_one(
+            filters={"uuid": auth_test1_user.uuid}
+        )
+        assert user_updated.email_verified
+
+    def test_confirm_email_invalid_code_400_error(
+        self,
+        user_api_noauth_client,
+        auth_test1_user,
+    ):
+        client = user_api_noauth_client()
+
+        with pytest.raises(bazooka_exc.ForbiddenError):
+            client.confirm_email(
+                user_uuid=auth_test1_user.uuid,
+                code="invalid code",
+            )
+
+    def test_confirm_email_no_code_400_error(
+        self, user_api_noauth_client, auth_test1_user
+    ):
+        client = user_api_noauth_client()
+
+        with pytest.raises(bazooka_exc.ForbiddenError):
+            client.confirm_email(
+                user_uuid=auth_test1_user.uuid,
+                code=None,
+            )
+
     def test_delete_my_user_test1_auth_success(
         self, user_api_client, auth_test1_user
     ):

genesis_core/user_api/api/app.py

@@ -55,6 +55,11 @@
         "/actions/reset_password/invoke",
         methods=[ra_c.POST],
     ),
+    iam_mw.EndpointComparator(
+        f"/v1/iam/users/({ra_types.UUID_RE_TEMPLATE})"
+        "/actions/confirm_email/invoke",
+        methods=[ra_c.POST],
+    ),
 ]
 
 

genesis_core/user_api/iam/api/controllers.py

@@ -212,11 +212,17 @@ def resend_email_confirmation(self, resource):
         resource.resend_confirmation_event(app_endpoint=app_endpoint)
         return resource
 
+    @actions.post
+    def force_confirm_email(self, resource):
+        rule = c.PERMISSION_USER_WRITE_ALL
+        if not self.enforce(rule):
+            raise iam_e.CanNotUpdateUser(uuid=resource.uuid, rule=rule)
+
+        resource.confirm_email()
+        return resource
+
     @actions.post
     def confirm_email(self, resource, code=None):
-        if self.enforce(c.PERMISSION_USER_WRITE_ALL):
-            resource.confirm_email()
-            return resource
         code = code or self._req.params.get("code", "")
         resource.confirm_email_by_code(code)
         return resource

genesis_core/user_api/iam/api/routes.py

@@ -70,6 +70,12 @@ class ConfirmEmailAction(routes.Action):
     __controller__ = controllers.UserController
 
 
+class ForceConfirmEmailAction(routes.Action):
+    """Handler for .../actions/force_confirm_email/invoke endpoint"""
+
+    __controller__ = controllers.UserController
+
+
 class ResetPasswordAction(routes.Action):
     """Handler for .../actions/reset_password/invoke endpoint"""
 
@@ -90,6 +96,7 @@ class UserRoute(routes.Route):
         ResendEmailConfirmationAction, invoke=True
     )
     confirm_email = routes.action(ConfirmEmailAction, invoke=True)
+    force_confirm_email = routes.action(ForceConfirmEmailAction, invoke=True)
     reset_password = routes.action(ResetPasswordAction, invoke=True)